Story Crater Bot
086ad9f9a9
- restricted policy forbids hostPort (80/443) — broke nginx - Remove pod-security labels from ingress-nginx namespace entirely - Other namespaces remain at baseline level
38 lines
1.2 KiB
Terraform
38 lines
1.2 KiB
Terraform
locals {
|
|
namespaces = {
|
|
"cert-manager" = {}
|
|
"reloader" = {}
|
|
"ingress-nginx" = { exempt_pod_security = true }
|
|
"ddb" = {}
|
|
"iam" = {}
|
|
"storage" = {}
|
|
"logging" = {}
|
|
"monitoring" = {}
|
|
"cicd" = {}
|
|
"dashboard" = {}
|
|
"sqs" = {}
|
|
"temporal" = {}
|
|
"story-crater-backend" = {}
|
|
"llm" = {}
|
|
"dev-tools" = {}
|
|
"longhorn-system" = {}
|
|
"cilium-secrets" = {}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "namespaces" {
|
|
for_each = local.namespaces
|
|
|
|
metadata {
|
|
name = each.key
|
|
labels = try(each.value.exempt_pod_security, false) ? {} : {
|
|
"pod-security.kubernetes.io/enforce" = "baseline"
|
|
"pod-security.kubernetes.io/enforce-version" = "latest"
|
|
"pod-security.kubernetes.io/audit" = "restricted"
|
|
"pod-security.kubernetes.io/audit-version" = "latest"
|
|
"pod-security.kubernetes.io/warn" = "restricted"
|
|
"pod-security.kubernetes.io/warn-version" = "latest"
|
|
}
|
|
}
|
|
}
|