apiVersion: v1
kind: Namespace
metadata:
  name: cosmic-clash
  labels:
    # Agones' Dynamic port policy injects a hostPort into every GameServer
    # Pod. Kubernetes' built-in baseline and restricted policies both forbid
    # host ports, so this workload namespace must enforce privileged while
    # continuing to surface restricted-policy deviations in audit and warnings.
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted