Namespace Exception admissionControl

[JulesPichon84]

Hello, I tried to add several namespaces to the admissionControl but when I deploy my cluster, the bootstrap don't finish and the workers enter in pending mode.

Here is my config for the admissionControl:

    apiServer:
        image: registry.k8s.io/kube-apiserver:${kubernetes_version}  # The container image used in the API server manifest.
        admissionControl:
            - name: PodSecurity # Name is the name of the admission controller.
              configuration:
                apiVersion: pod-security.admission.config.k8s.io/v1alpha1
                defaults:
                    audit: restricted
                    audit-version: latest
                    enforce: baseline
                    enforce-version: latest
                    warn: restricted
                    warn-version: latest
                exemptions:
                    namespaces:
                        - kube-system
                        - longhorn-system
                        - cilium-spire
                    runtimeClasses: []
                    usernames: []
                kind: PodSecurityConfiguration

Also, on the kubernetes official doc, for version >1.25, the apiVersion for the admissionControl is v1. In the talos doc, they setup the apiVersion on v1alpha1. What is the right apiVersion and have you ever encountered this behavior ?

Thank you for your response !

[smira]

You don't specify any exact errors, so it's not possible to guess what exactly is wrong.

If the above you posted is a config patch, it might have an issue with - kube-system being there twice (another one comes from the default machine config).

Version of the configuration here shouldn't matter.

[JulesPichon84]

Ok, thank you for help, I thought it was mandatory to put the kube-system ns in the config. I thought the config file was going to write over the default config.