rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(terraform): set ingress-nginx PodSecurity to privileged, keep TF-managed

Browse Source
This commit is contained in:
Story Crater Bot
2026-08-18 15:08:01 -07:00
parent f64fda297e
commit da0ec35f6c
1 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap-namespaces.tf
+18 -18
View File
@@ -1,22 +1,22 @@
locals { locals {
namespaces = { namespaces = {
"cert-manager" = {} "cert-manager" = { pod_security = "baseline" }
"reloader" = {} "reloader" = { pod_security = "baseline" }
"ingress-nginx" = {} "ingress-nginx" = { pod_security = "privileged" }
"ddb" = {} "ddb" = { pod_security = "baseline" }
"iam" = {} "iam" = { pod_security = "baseline" }
"storage" = {} "storage" = { pod_security = "baseline" }
"logging" = {} "logging" = { pod_security = "baseline" }
"monitoring" = {} "monitoring" = { pod_security = "baseline" }
"cicd" = {} "cicd" = { pod_security = "baseline" }
"dashboard" = {} "dashboard" = { pod_security = "baseline" }
"sqs" = {} "sqs" = { pod_security = "baseline" }
"temporal" = {} "temporal" = { pod_security = "baseline" }
"story-crater-backend" = {} "story-crater-backend" = { pod_security = "baseline" }
"llm" = {} "llm" = { pod_security = "baseline" }
"dev-tools" = {} "dev-tools" = { pod_security = "baseline" }
"longhorn-system" = {} "longhorn-system" = { pod_security = "baseline" }
"cilium-secrets" = {} "cilium-secrets" = { pod_security = "baseline" }
} }
} }
@@ -26,7 +26,7 @@ resource "kubernetes_namespace" "namespaces" {
metadata { metadata {
name = each.key name = each.key
labels = { labels = {
"pod-security.kubernetes.io/enforce" = "baseline" "pod-security.kubernetes.io/enforce" = each.value.pod_security
"pod-security.kubernetes.io/enforce-version" = "latest" "pod-security.kubernetes.io/enforce-version" = "latest"
"pod-security.kubernetes.io/audit" = "restricted" "pod-security.kubernetes.io/audit" = "restricted"
"pod-security.kubernetes.io/audit-version" = "latest" "pod-security.kubernetes.io/audit-version" = "latest"