feat(k8s-digester): enable on all namespaces

kubernetes/apps/1password/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: 1password
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/cert-manager/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/audit: restricted
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/cnpg-system/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: cnpg-system
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/database/namespace.yaml

@@ -7,6 +7,7 @@ metadata:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: restricted
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/default/namespace.yaml

@@ -6,6 +6,8 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/democratic-csi/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/external-secrets/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: restricted
     pod-security.kubernetes.io/enforce-version: latest
 ---

kubernetes/apps/flux-system/namespace.yaml

@@ -6,6 +6,8 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/gpu-operator/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/harbor/namespace.yaml

@@ -6,6 +6,8 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/ingress-certificates/namespace.yaml

@@ -5,3 +5,5 @@ metadata:
   name: ingress-certificates
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled

kubernetes/apps/kruise-system/namespace.yaml

@@ -7,6 +7,7 @@ metadata:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
     control-plane: openkruise
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/kube-system/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/kubernetes-dashboard/namespace.yaml

@@ -6,4 +6,4 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
-    pod-security.kubernetes.io/enforce: baseline
+    digest-resolution: enabled

kubernetes/apps/kyverno/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/minio-operator/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: restricted
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/network/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: network
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/observability-agents/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/observability/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: observability
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/omni/namespace.yaml

@@ -5,3 +5,5 @@ metadata:
   name: omni
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled

kubernetes/apps/openebs-system/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/rook-ceph/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/samba-system/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: samba-system
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/storage/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/tailscale/namespace.yaml

@@ -6,6 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/talos-admin/namespace.yaml

@@ -7,6 +7,7 @@ metadata:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
   labels:
+    digest-resolution: enabled
     pod-security.kubernetes.io/enforce: privileged
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json

kubernetes/apps/trivy-system/namespace.yaml

@@ -5,6 +5,8 @@ metadata:
   name: trivy-system
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/volsync-system/namespace.yaml

@@ -6,6 +6,8 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
     volsync.backube/privileged-movers: "true"
+  labels:
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3

kubernetes/apps/yugabyte/namespace.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     kustomize.toolkit.fluxcd.io/prune: disabled
   labels:
-    pod-security.kubernetes.io/enforce: baseline
+    digest-resolution: enabled
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
 apiVersion: notification.toolkit.fluxcd.io/v1beta3