# Traefik controller — apply before Helm (omit --create-namespace on install).
# Ingress controller needs capabilities beyond "restricted"; use baseline.
apiVersion: v1
kind: Namespace
metadata:
  name: traefik
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/audit: baseline
    pod-security.kubernetes.io/warn: baseline