From 086ad9f9a9496e3c0e18743854fe276dbd968479 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:41:36 -0700
Subject: [PATCH] Fix: exempt ingress-nginx from PodSecurity policy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- restricted policy forbids hostPort (80/443) — broke nginx
- Remove pod-security labels from ingress-nginx namespace entirely
- Other namespaces remain at baseline level
---
 terraform/bootstrap-namespaces.tf | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/terraform/bootstrap-namespaces.tf b/terraform/bootstrap-namespaces.tf
index e6359b4..ab799f1 100644
--- a/terraform/bootstrap-namespaces.tf
+++ b/terraform/bootstrap-namespaces.tf
@@ -2,7 +2,7 @@ locals {
   namespaces = {
     "cert-manager"          = {}
     "reloader"              = {}
-    "ingress-nginx"         = { pod_security = "restricted" }
+    "ingress-nginx"         = { exempt_pod_security = true }
     "ddb"                   = {}
     "iam"                   = {}
     "storage"               = {}
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
 
   metadata {
     name = each.key
-    labels = {
-      "pod-security.kubernetes.io/enforce"         = try(each.value.pod_security, "baseline")
+    labels = try(each.value.exempt_pod_security, false) ? {} : {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
       "pod-security.kubernetes.io/enforce-version" = "latest"
       "pod-security.kubernetes.io/audit"           = "restricted"
       "pod-security.kubernetes.io/audit-version"   = "latest"