There. :D
strategicMergePatches:
    - apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: gotosocial
      spec:
        template:
          spec:
            initContainers:
              - name: block-cloudflare
                image: git.camnet.site/homelab/k3s-config/block-cloudflare:main
                command: [ "block.sh" ]
                securityContext:
                  capabilities:
                    add: [ NET_ADMIN ]