Story Crater Bot
20c634fd03
- ingress-nginx requires hostPort (80/443) which is forbidden at baseline level - Change to restricted enforcement level to allow hostPort - Other namespaces remain at baseline for security
38 lines
1.1 KiB
Terraform
38 lines
1.1 KiB
Terraform
locals {
|
|
namespaces = {
|
|
"cert-manager" = {}
|
|
"reloader" = {}
|
|
"ingress-nginx" = { pod_security = "restricted" }
|
|
"ddb" = {}
|
|
"iam" = {}
|
|
"storage" = {}
|
|
"logging" = {}
|
|
"monitoring" = {}
|
|
"cicd" = {}
|
|
"dashboard" = {}
|
|
"sqs" = {}
|
|
"temporal" = {}
|
|
"story-crater-backend" = {}
|
|
"llm" = {}
|
|
"dev-tools" = {}
|
|
"longhorn-system" = {}
|
|
"cilium-secrets" = {}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "namespaces" {
|
|
for_each = local.namespaces
|
|
|
|
metadata {
|
|
name = each.key
|
|
labels = {
|
|
"pod-security.kubernetes.io/enforce" = try(each.value.pod_security, "baseline")
|
|
"pod-security.kubernetes.io/enforce-version" = "latest"
|
|
"pod-security.kubernetes.io/audit" = "restricted"
|
|
"pod-security.kubernetes.io/audit-version" = "latest"
|
|
"pod-security.kubernetes.io/warn" = "restricted"
|
|
"pod-security.kubernetes.io/warn-version" = "latest"
|
|
}
|
|
}
|
|
}
|