# §4.9 步骤 1：一次性特权 bootstrap，把 PVC 根 world-writable + sticky。
# 必须在启用 PSA restricted 之前跑（此 namespace 不打 restricted 标签）。
apiVersion: batch/v1
kind: Job
metadata:
  name: dsh-users-bootstrap
  namespace: dsh-poc
spec:
  ttlSecondsAfterFinished: 300
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: bootstrap
          image: busybox:1.36
          command: ["sh", "-c", "chmod 1777 /mnt && ls -ld /mnt"]
          securityContext:
            privileged: true
          volumeMounts:
            - name: data
              mountPath: /mnt
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: dsh-users