apiVersion: v1
kind: Namespace
metadata:
  name: tailscale
  labels:
    # The proxy runs unprivileged, so the namespace refuses any pod that isn't.
    pod-security.kubernetes.io/enforce: restricted