Document addition of namespace labels for pods needing elevated privileges

docs/docs-content/troubleshooting/cluster-deployment.md

@@ -17,7 +17,8 @@ tags: ["troubleshooting", "cluster-deployment"]
 The following steps will help you troubleshoot errors in the event issues arise while deploying a cluster.  
 
 
-## Scenario - Instances Continuously Delete Every 30 Minutes
+## Instances Continuously Delete Every 30 Minutes
+
 
 An instance is launched and terminated every 30 minutes prior to completion of its deployment, and the **Events Tab** lists errors with the following message:
 
@@ -94,6 +95,31 @@ Common reasons for why a service may fail are:
 
 6. Check stdout for errors. You can also open a support ticket. Visit our [support page](http://support.spectrocloud.io/).
 
+## Deployment Violates Pod Security
+In cluster profiles running Kubernetes 1.25 or later, some packs contain Pods that need elevated privileges during Pod creation. 
+When you try to deploy a cluster with such packs, you get an error message that looks like the following:
+
+```
+Error creating: pods <name of pod> is forbidden: violates PodSecurity "baseline:v<k8s version>": non-default capabilities …
+```
+
+### Debug Steps
+
+You can change the Pod Security Standards of the namepace where the Pod is being created to address this issue. 
+
+1. Log in to **Palette** and navigate to the **Profiles** tab. 
+2. Select the profile you are trying to deploy the cluster with and choose the layer that represents your pack. 
+3. In the YAML file for your pack, under the `pack` field, add a subfield `namespaceLabels`.
+4. In the `namespaceLabels` field, add a subfield with the name of your namespace as the key and `pod-security.kubernetes.io/enforce=privileged,pod-security.kubernetes.io/enforce-version=v<k8s_version>` as the value. Replace `<k8s_version>` with the version of Kubernetes that runs on your cluster. 
+   - For example, if you the pack creates a namespace called `monitoring`, add the labels to the `monitoring` namespace:
+   ```yaml
+   pack:
+    namespace: "monitoring"
+
+    namespaceLabels:
+        "monitoring": "org=spectro,team=dev,pod-security.kubernetes.io/enforce=privileged,pod-security.kubernetes.io/enforce-version=v1.28"
+   ```
+
 
 ## Gateway Installer Registration Failures