44713e4ca0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018BAUeCFpDkRD6tU5wGsc1C
31 lines
1.1 KiB
YAML
31 lines
1.1 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: xpeditis-prod
|
|
labels:
|
|
app.kubernetes.io/part-of: xpeditis
|
|
environment: production
|
|
# Pod Security Admission en mode "restricted" : refuse tout pod privilegie,
|
|
# tout conteneur root, toute capability. C'est une barriere du cluster,
|
|
# independante de ce que contiennent les manifests applicatifs.
|
|
pod-security.kubernetes.io/enforce: restricted
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
pod-security.kubernetes.io/audit: restricted
|
|
pod-security.kubernetes.io/warn: restricted
|
|
---
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: monitoring
|
|
labels:
|
|
app.kubernetes.io/part-of: xpeditis
|
|
environment: production
|
|
# "baseline" et non "restricted" : Promtail doit lire les journaux des
|
|
# conteneurs de l'hote (hostPath), ce que "restricted" interdit.
|
|
# Le compromis est assume et confine a ce seul namespace.
|
|
pod-security.kubernetes.io/enforce: baseline
|
|
pod-security.kubernetes.io/enforce-version: latest
|
|
pod-security.kubernetes.io/audit: restricted
|
|
pod-security.kubernetes.io/warn: restricted
|