From bad6c8633b0a41a0551e48e8ddd87db7b30415ce Mon Sep 17 00:00:00 2001
From: jenkins <brad@bstein.dev>
Date: Sun, 8 Nov 2026 17:02:15 -0600
Subject: [PATCH] jenkins: scope nested namespace AppArmor exception to probe

---
 services/jenkins/lesavka-userns-probe.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/services/jenkins/lesavka-userns-probe.yaml b/services/jenkins/lesavka-userns-probe.yaml
index 048e7a4a..ed8e78cb 100644
--- a/services/jenkins/lesavka-userns-probe.yaml
+++ b/services/jenkins/lesavka-userns-probe.yaml
@@ -13,7 +13,7 @@ data:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: lesavka-userns-probe-2
+  name: lesavka-userns-probe-3
   namespace: jenkins
 spec:
   backoffLimit: 0
@@ -41,6 +41,9 @@ spec:
         # exception is confined to a hostUsers:false pod with no host mounts.
         seccompProfile:
           type: Unconfined
+        # The CRI default denies userns_create even inside an isolated pod.
+        appArmorProfile:
+          type: Unconfined
       containers:
         - name: probe
           image: registry.bstein.dev/bstein/lesavka-ci@sha256:7d3a2548ef0df8da053a2e2939675f5a3cf23e26517828e5fa9a3185911a8e75