rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: exempt ingress-nginx from PodSecurity policy

Browse Source 
- restricted policy forbids hostPort (80/443) — broke nginx
- Remove pod-security labels from ingress-nginx namespace entirely
- Other namespaces remain at baseline level
This commit is contained in:
Story Crater Bot
2026-07-14 13:41:36 -07:00
parent 3eabb847fd
commit 086ad9f9a9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap-namespaces.tf
+3 -3
View File
@@ -2,7 +2,7 @@ locals {
namespaces = { namespaces = {
"cert-manager" = {} "cert-manager" = {}
"reloader" = {} "reloader" = {}
"ingress-nginx" = { pod_security = "restricted" } "ingress-nginx" = { exempt_pod_security = true }
"ddb" = {} "ddb" = {}
"iam" = {} "iam" = {}
"storage" = {} "storage" = {}
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
metadata { metadata {
name = each.key name = each.key
labels = { labels = try(each.value.exempt_pod_security, false) ? {} : {
"pod-security.kubernetes.io/enforce" = try(each.value.pod_security, "baseline") "pod-security.kubernetes.io/enforce" = "baseline"
"pod-security.kubernetes.io/enforce-version" = "latest" "pod-security.kubernetes.io/enforce-version" = "latest"
"pod-security.kubernetes.io/audit" = "restricted" "pod-security.kubernetes.io/audit" = "restricted"
"pod-security.kubernetes.io/audit-version" = "latest" "pod-security.kubernetes.io/audit-version" = "latest"