locals {
  namespaces = {
    "cert-manager"          = { pod_security = "baseline" }
    "reloader"              = { pod_security = "baseline" }
    "ingress-nginx"         = { pod_security = "privileged" }
    "ddb"                   = { pod_security = "baseline" }
    "iam"                   = { pod_security = "baseline" }
    "storage"               = { pod_security = "baseline" }
    "logging"               = { pod_security = "baseline" }
    "monitoring"            = { pod_security = "baseline" }
    "cicd"                  = { pod_security = "baseline" }
    "dashboard"             = { pod_security = "baseline" }
    "sqs"                   = { pod_security = "baseline" }
    "temporal"              = { pod_security = "baseline" }
    "story-crater-backend"  = { pod_security = "baseline" }
    "llm"                   = { pod_security = "baseline" }
    "dev-tools"             = { pod_security = "baseline" }
    "longhorn-system"       = { pod_security = "baseline" }
    "cilium-secrets"        = { pod_security = "baseline" }
  }
}

resource "kubernetes_namespace" "namespaces" {
  for_each = local.namespaces

  metadata {
    name = each.key
    labels = {
      "pod-security.kubernetes.io/enforce"         = each.value.pod_security
      "pod-security.kubernetes.io/enforce-version" = "latest"
      "pod-security.kubernetes.io/audit"           = "restricted"
      "pod-security.kubernetes.io/audit-version"   = "latest"
      "pod-security.kubernetes.io/warn"            = "restricted"
      "pod-security.kubernetes.io/warn-version"    = "latest"
    }
  }
}