From da0ec35f6cd0826af9284cfed7746ff087bfc04f Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:08:01 -0700
Subject: [PATCH] fix(terraform): set ingress-nginx PodSecurity to privileged,
 keep TF-managed

---
 terraform/bootstrap-namespaces.tf | 36 +++++++++++++++----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/terraform/bootstrap-namespaces.tf b/terraform/bootstrap-namespaces.tf
index 53b4cc5..aba1298 100644
--- a/terraform/bootstrap-namespaces.tf
+++ b/terraform/bootstrap-namespaces.tf
@@ -1,22 +1,22 @@
 locals {
   namespaces = {
-    "cert-manager"          = {}
-    "reloader"              = {}
-    "ingress-nginx"         = {}
-    "ddb"                   = {}
-    "iam"                   = {}
-    "storage"               = {}
-    "logging"               = {}
-    "monitoring"            = {}
-    "cicd"                  = {}
-    "dashboard"             = {}
-    "sqs"                   = {}
-    "temporal"              = {}
-    "story-crater-backend"  = {}
-    "llm"                   = {}
-    "dev-tools"             = {}
-    "longhorn-system"       = {}
-    "cilium-secrets"        = {}
+    "cert-manager"          = { pod_security = "baseline" }
+    "reloader"              = { pod_security = "baseline" }
+    "ingress-nginx"         = { pod_security = "privileged" }
+    "ddb"                   = { pod_security = "baseline" }
+    "iam"                   = { pod_security = "baseline" }
+    "storage"               = { pod_security = "baseline" }
+    "logging"               = { pod_security = "baseline" }
+    "monitoring"            = { pod_security = "baseline" }
+    "cicd"                  = { pod_security = "baseline" }
+    "dashboard"             = { pod_security = "baseline" }
+    "sqs"                   = { pod_security = "baseline" }
+    "temporal"              = { pod_security = "baseline" }
+    "story-crater-backend"  = { pod_security = "baseline" }
+    "llm"                   = { pod_security = "baseline" }
+    "dev-tools"             = { pod_security = "baseline" }
+    "longhorn-system"       = { pod_security = "baseline" }
+    "cilium-secrets"        = { pod_security = "baseline" }
   }
 }
 
@@ -26,7 +26,7 @@ resource "kubernetes_namespace" "namespaces" {
   metadata {
     name = each.key
     labels = {
-      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce"         = each.value.pod_security
       "pod-security.kubernetes.io/enforce-version" = "latest"
       "pod-security.kubernetes.io/audit"           = "restricted"
       "pod-security.kubernetes.io/audit-version"   = "latest"