apiVersion: v1
kind: Namespace
metadata:
  name: jarvis
  labels:
    # baseline PSA required — Hermes runs as root due to NFS root_squash
    # preventing UID 10000 from writing to nfs-emporium PVC.
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/warn: baseline