rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: set ingress-nginx to privileged PodSecurity level

Browse Source 
- privileged level allows hostPort (80/443) required for nginx
- Other namespaces remain at baseline for security
- Cleaner than exempting namespace entirely
This commit is contained in:
Story Crater Bot
2026-07-14 13:43:56 -07:00
parent 086ad9f9a9
commit edd4ea7fe4
1 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap-namespaces.tf
+19 -19
View File
@@ -1,22 +1,22 @@
locals {
namespaces = {
"cert-manager" = {}
"reloader" = {}
"ingress-nginx" = { exempt_pod_security = true }
"ddb" = {}
"iam" = {}
"storage" = {}
"logging" = {}
"monitoring" = {}
"cicd" = {}
"dashboard" = {}
"sqs" = {}
"temporal" = {}
"story-crater-backend" = {}
"llm" = {}
"dev-tools" = {}
"longhorn-system" = {}
"cilium-secrets" = {}
"cert-manager" = { pod_security = "baseline" }
"reloader" = { pod_security = "baseline" }
"ingress-nginx" = { pod_security = "privileged" }
"ddb" = { pod_security = "baseline" }
"iam" = { pod_security = "baseline" }
"storage" = { pod_security = "baseline" }
"logging" = { pod_security = "baseline" }
"monitoring" = { pod_security = "baseline" }
"cicd" = { pod_security = "baseline" }
"dashboard" = { pod_security = "baseline" }
"sqs" = { pod_security = "baseline" }
"temporal" = { pod_security = "baseline" }
"story-crater-backend" = { pod_security = "baseline" }
"llm" = { pod_security = "baseline" }
"dev-tools" = { pod_security = "baseline" }
"longhorn-system" = { pod_security = "baseline" }
"cilium-secrets" = { pod_security = "baseline" }
}
}
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
metadata {
name = each.key
labels = try(each.value.exempt_pod_security, false) ? {} : {
"pod-security.kubernetes.io/enforce" = "baseline"
labels = {
"pod-security.kubernetes.io/enforce" = each.value.pod_security
"pod-security.kubernetes.io/enforce-version" = "latest"
"pod-security.kubernetes.io/audit" = "restricted"
"pod-security.kubernetes.io/audit-version" = "latest"