Fix: exempt ingress-nginx from PodSecurity policy

- restricted policy forbids hostPort (80/443) — broke nginx
- Remove pod-security labels from ingress-nginx namespace entirely
- Other namespaces remain at baseline level

terraform/bootstrap-namespaces.tf

@@ -2,7 +2,7 @@ locals {
   namespaces = {
     "cert-manager"          = {}
     "reloader"              = {}
-    "ingress-nginx"         = { pod_security = "restricted" }
+    "ingress-nginx"         = { exempt_pod_security = true }
     "ddb"                   = {}
     "iam"                   = {}
     "storage"               = {}
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
 
   metadata {
     name = each.key
-    labels = {
-      "pod-security.kubernetes.io/enforce"         = try(each.value.pod_security, "baseline")
+    labels = try(each.value.exempt_pod_security, false) ? {} : {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
       "pod-security.kubernetes.io/enforce-version" = "latest"
       "pod-security.kubernetes.io/audit"           = "restricted"
       "pod-security.kubernetes.io/audit-version"   = "latest"