rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: set ingress-nginx to privileged PodSecurity level

Browse Source 
- privileged level allows hostPort (80/443) required for nginx
- Other namespaces remain at baseline for security
- Cleaner than exempting namespace entirely
This commit is contained in:
Story Crater Bot
2026-07-14 13:43:56 -07:00
parent 086ad9f9a9
commit edd4ea7fe4
1 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/bootstrap-namespaces.tf
+19 -19
View File
@@ -1,22 +1,22 @@
locals { locals {
namespaces = { namespaces = {
"cert-manager" = {} "cert-manager" = { pod_security = "baseline" }
"reloader" = {} "reloader" = { pod_security = "baseline" }
"ingress-nginx" = { exempt_pod_security = true } "ingress-nginx" = { pod_security = "privileged" }
"ddb" = {} "ddb" = { pod_security = "baseline" }
"iam" = {} "iam" = { pod_security = "baseline" }
"storage" = {} "storage" = { pod_security = "baseline" }
"logging" = {} "logging" = { pod_security = "baseline" }
"monitoring" = {} "monitoring" = { pod_security = "baseline" }
"cicd" = {} "cicd" = { pod_security = "baseline" }
"dashboard" = {} "dashboard" = { pod_security = "baseline" }
"sqs" = {} "sqs" = { pod_security = "baseline" }
"temporal" = {} "temporal" = { pod_security = "baseline" }
"story-crater-backend" = {} "story-crater-backend" = { pod_security = "baseline" }
"llm" = {} "llm" = { pod_security = "baseline" }
"dev-tools" = {} "dev-tools" = { pod_security = "baseline" }
"longhorn-system" = {} "longhorn-system" = { pod_security = "baseline" }
"cilium-secrets" = {} "cilium-secrets" = { pod_security = "baseline" }
} }
} }
@@ -25,8 +25,8 @@ resource "kubernetes_namespace" "namespaces" {
metadata { metadata {
name = each.key name = each.key
labels = try(each.value.exempt_pod_security, false) ? {} : { labels = {
"pod-security.kubernetes.io/enforce" = "baseline" "pod-security.kubernetes.io/enforce" = each.value.pod_security
"pod-security.kubernetes.io/enforce-version" = "latest" "pod-security.kubernetes.io/enforce-version" = "latest"
"pod-security.kubernetes.io/audit" = "restricted" "pod-security.kubernetes.io/audit" = "restricted"
"pod-security.kubernetes.io/audit-version" = "latest" "pod-security.kubernetes.io/audit-version" = "latest"