Opt in proven stateless apps to user namespaces #2568

🤖 Generated by the Daily AI Engineer

Summary

Replace the two per-app hostUsers: false post-render patches with one opt-in Kyverno default, enabled only for the two stateless workloads already proven healthy in production.

Motivation

whoami and homepage have both run successfully with private user namespaces, but the current rollout mechanism duplicates a HelmRelease post-render patch per app. That does not scale to the wider rollout tracked by #1807 and makes the security default easy to apply inconsistently.

The local Docker provider must remain unchanged because Talos runs nested there and user-namespace/idmapped-mount support is not guaranteed. Stateful workloads must also remain excluded until their storage paths are validated.

Proposed Solution

• Add a CREATE-only rule to add-security-context that conditionally anchors spec.hostUsers: false for Pods whose namespace opts in with pod-security.devantler.tech/user-namespaces: enabled.
• Add that label only in the Hetzner app overlay for the already-validated whoami and homepage namespaces.
• Remove the two duplicated HelmRelease post-render patches after the label-gated policy owns the default.
• Keep the mechanism default-off for every other namespace, including all local/CI and stateful workloads.

Acceptance Criteria

• The Kyverno rule is CREATE-only, label-gated, and does not overwrite an explicit workload value.
• Only the Hetzner whoami and homepage namespaces opt in.
• The local overlay remains opted out and contains no hostUsers rollout change.
• The two per-app HelmRelease post-render patches are removed without changing unrelated patches.
• Structural red/green assertions cover the policy, both enabled namespaces, and the disabled local state.
• Local and prod Kustomize renders, embedded-JSON validation, naming validation, and schema-aware KSail validation pass without starting a cluster.

Alternatives Considered

• Keep adding one post-render patch per app: rejected because it duplicates permanent security policy and is easy to drift.
• Apply hostUsers: false cluster-wide: rejected until stateful/idmapped-volume workloads are proven safe.
• Put the label in base namespaces: rejected because that would enable the behavior on the nested Docker provider instead of keeping rollout default-off.

Additional Context

Child of #1807. The existing whoami and homepage production pilots are healthy; this slice changes only how those two proven workloads receive the same setting.