From edd4ea7fe47b0b50f6a2e0cd146f44c6db04fe4d Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:43:56 -0700
Subject: [PATCH] Fix: set ingress-nginx to privileged PodSecurity level

- privileged level allows hostPort (80/443) required for nginx
- Other namespaces remain at baseline for security
- Cleaner than exempting namespace entirely
---
 terraform/bootstrap-namespaces.tf | 38 +++++++++++++++----------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/terraform/bootstrap-namespaces.tf b/terraform/bootstrap-namespaces.tf
index ab799f1..aba1298 100644
--- a/terraform/bootstrap-namespaces.tf
+++ b/terraform/bootstrap-namespaces.tf
@@ -1,22 +1,22 @@
 locals {
   namespaces = {
-    "cert-manager"          = {}
-    "reloader"              = {}
-    "ingress-nginx"         = { exempt_pod_security = true }
-    "ddb"                   = {}
-    "iam"                   = {}
-    "storage"               = {}
-    "logging"               = {}
-    "monitoring"            = {}
-    "cicd"                  = {}
-    "dashboard"             = {}
-    "sqs"                   = {}
-    "temporal"              = {}
-    "story-crater-backend"  = {}
-    "llm"                   = {}
-    "dev-tools"             = {}
-    "longhorn-system"       = {}
-    "cilium-secrets"        = {}
+    "cert-manager"          = { pod_security = "baseline" }
+    "reloader"              = { pod_security = "baseline" }
+    "ingress-nginx"         = { pod_security = "privileged" }
+    "ddb"                   = { pod_security = "baseline" }
+    "iam"                   = { pod_security = "baseline" }
+    "storage"               = { pod_security = "baseline" }
+    "logging"               = { pod_security = "baseline" }
+    "monitoring"            = { pod_security = "baseline" }
+    "cicd"                  = { pod_security = "baseline" }
+    "dashboard"             = { pod_security = "baseline" }
+    "sqs"                   = { pod_security = "baseline" }
+    "temporal"              = { pod_security = "baseline" }
+    "story-crater-backend"  = { pod_security = "baseline" }
+    "llm"                   = { pod_security = "baseline" }
+    "dev-tools"             = { pod_security = "baseline" }
+    "longhorn-system"       = { pod_security = "baseline" }
+    "cilium-secrets"        = { pod_security = "baseline" }
   }
 }
 
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
 
   metadata {
     name = each.key
-    labels = try(each.value.exempt_pod_security, false) ? {} : {
-      "pod-security.kubernetes.io/enforce"         = "baseline"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = each.value.pod_security
       "pod-security.kubernetes.io/enforce-version" = "latest"
       "pod-security.kubernetes.io/audit"           = "restricted"
       "pod-security.kubernetes.io/audit-version"   = "latest"