rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: ingress-nginx PodSecurity policy enforcement level

Browse Source 
- ingress-nginx requires hostPort (80/443) which is forbidden at baseline level
- Change to restricted enforcement level to allow hostPort
- Other namespaces remain at baseline for security
This commit is contained in:
Story Crater Bot
2026-07-14 13:31:16 -07:00
parent 074b43e1f2
commit 20c634fd03
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap-namespaces.tf
+2 -2
View File
@@ -2,7 +2,7 @@ locals {
namespaces = { namespaces = {
"cert-manager" = {} "cert-manager" = {}
"reloader" = {} "reloader" = {}
"ingress-nginx" = {} "ingress-nginx" = { pod_security = "restricted" }
"ddb" = {} "ddb" = {}
"iam" = {} "iam" = {}
"storage" = {} "storage" = {}
@@ -26,7 +26,7 @@ resource "kubernetes_namespace" "namespaces" {
metadata { metadata {
name = each.key name = each.key
labels = { labels = {
"pod-security.kubernetes.io/enforce" = "baseline" "pod-security.kubernetes.io/enforce" = try(each.value.pod_security, "baseline")
"pod-security.kubernetes.io/enforce-version" = "latest" "pod-security.kubernetes.io/enforce-version" = "latest"
"pod-security.kubernetes.io/audit" = "restricted" "pod-security.kubernetes.io/audit" = "restricted"
"pod-security.kubernetes.io/audit-version" = "latest" "pod-security.kubernetes.io/audit-version" = "latest"