Story Crater Bot
edd4ea7fe4
- privileged level allows hostPort (80/443) required for nginx - Other namespaces remain at baseline for security - Cleaner than exempting namespace entirely
38 lines
1.6 KiB
Terraform
38 lines
1.6 KiB
Terraform
locals {
|
|
namespaces = {
|
|
"cert-manager" = { pod_security = "baseline" }
|
|
"reloader" = { pod_security = "baseline" }
|
|
"ingress-nginx" = { pod_security = "privileged" }
|
|
"ddb" = { pod_security = "baseline" }
|
|
"iam" = { pod_security = "baseline" }
|
|
"storage" = { pod_security = "baseline" }
|
|
"logging" = { pod_security = "baseline" }
|
|
"monitoring" = { pod_security = "baseline" }
|
|
"cicd" = { pod_security = "baseline" }
|
|
"dashboard" = { pod_security = "baseline" }
|
|
"sqs" = { pod_security = "baseline" }
|
|
"temporal" = { pod_security = "baseline" }
|
|
"story-crater-backend" = { pod_security = "baseline" }
|
|
"llm" = { pod_security = "baseline" }
|
|
"dev-tools" = { pod_security = "baseline" }
|
|
"longhorn-system" = { pod_security = "baseline" }
|
|
"cilium-secrets" = { pod_security = "baseline" }
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "namespaces" {
|
|
for_each = local.namespaces
|
|
|
|
metadata {
|
|
name = each.key
|
|
labels = {
|
|
"pod-security.kubernetes.io/enforce" = each.value.pod_security
|
|
"pod-security.kubernetes.io/enforce-version" = "latest"
|
|
"pod-security.kubernetes.io/audit" = "restricted"
|
|
"pod-security.kubernetes.io/audit-version" = "latest"
|
|
"pod-security.kubernetes.io/warn" = "restricted"
|
|
"pod-security.kubernetes.io/warn-version" = "latest"
|
|
}
|
|
}
|
|
}
|