locals {
  namespaces = {
    "cert-manager"          = {}
    "reloader"              = {}
    "ingress-nginx"         = { pod_security = "restricted" }
    "ddb"                   = {}
    "iam"                   = {}
    "storage"               = {}
    "logging"               = {}
    "monitoring"            = {}
    "cicd"                  = {}
    "dashboard"             = {}
    "sqs"                   = {}
    "temporal"              = {}
    "story-crater-backend"  = {}
    "llm"                   = {}
    "dev-tools"             = {}
    "longhorn-system"       = {}
    "cilium-secrets"        = {}
  }
}

resource "kubernetes_namespace" "namespaces" {
  for_each = local.namespaces

  metadata {
    name = each.key
    labels = {
      "pod-security.kubernetes.io/enforce"         = try(each.value.pod_security, "baseline")
      "pod-security.kubernetes.io/enforce-version" = "latest"
      "pod-security.kubernetes.io/audit"           = "restricted"
      "pod-security.kubernetes.io/audit-version"   = "latest"
      "pod-security.kubernetes.io/warn"            = "restricted"
      "pod-security.kubernetes.io/warn-version"    = "latest"
    }
  }
}