From 20c634fd034cb04af2eb69eaff64a074729b0ce6 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:31:16 -0700
Subject: [PATCH] Fix: ingress-nginx PodSecurity policy enforcement level

- ingress-nginx requires hostPort (80/443) which is forbidden at baseline level
- Change to restricted enforcement level to allow hostPort
- Other namespaces remain at baseline for security
---
 terraform/bootstrap-namespaces.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/bootstrap-namespaces.tf b/terraform/bootstrap-namespaces.tf
index 53b4cc5..e6359b4 100644
--- a/terraform/bootstrap-namespaces.tf
+++ b/terraform/bootstrap-namespaces.tf
@@ -2,7 +2,7 @@ locals {
   namespaces = {
     "cert-manager"          = {}
     "reloader"              = {}
-    "ingress-nginx"         = {}
+    "ingress-nginx"         = { pod_security = "restricted" }
     "ddb"                   = {}
     "iam"                   = {}
     "storage"               = {}
@@ -26,7 +26,7 @@ resource "kubernetes_namespace" "namespaces" {
   metadata {
     name = each.key
     labels = {
-      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce"         = try(each.value.pod_security, "baseline")
       "pod-security.kubernetes.io/enforce-version" = "latest"
       "pod-security.kubernetes.io/audit"           = "restricted"
       "pod-security.kubernetes.io/audit-version"   = "latest"