homelab/terraform/argocd-bootstrap.tf

resource "kubernetes_namespace" "argocd" {
  metadata {
    name = "argocd"
    labels = {
      "pod-security.kubernetes.io/enforce"         = "baseline"
      "pod-security.kubernetes.io/enforce-version" = "latest"
    }
  }
}

resource "helm_release" "argocd" {
  name       = "argocd"
  repository = local.helm_repos["argo"]
  chart      = "argo-cd"
  version    = "7.3.3"
  namespace  = kubernetes_namespace.argocd.metadata[0].name

  values = [
    yamlencode({
      global = {
        domain = "argocd.${var.cluster_domain}"
      }
      configs = {
        params = {
          "application.instanceLabelKey" = "argocd.argoproj.io/instance"
        }
        rbac = {
          "policy.default" = "role:readonly"
        }
      }
      server = {
        extraArgs = [
          "--insecure"
        ]
        ingress = {
          enabled = true
          hosts = [
            "argocd.${var.cluster_domain}"
          ]
        }
      }
      repoServer = {
        autoscaling = {
          enabled     = true
          minReplicas = 2
        }
      }
      controller = {
        replicas = 2
      }
    })
  ]

  depends_on = [
    kubernetes_namespace.argocd,
    kubernetes_manifest.wildcard_cert
  ]

  lifecycle {
    ignore_changes = [
      values,
      metadata
    ]
  }
}

resource "kubernetes_manifest" "argocd_project" {
  manifest = {
    apiVersion = "argoproj.io/v1alpha1"
    kind       = "AppProject"
    metadata = {
      name      = "homelab"
      namespace = kubernetes_namespace.argocd.metadata[0].name
    }
    spec = {
      sourceRepos = [
        "https://forgejo.forge.riotpiao.homelab.com/rock/*"
      ]
      destinations = [
        {
          server    = "https://kubernetes.default.svc"
          namespace = "*"
        }
      ]
      clusterResourceWhitelist = [
        {
          group = "*"
          kind  = "*"
        }
      ]
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    helm_release.argocd
  ]
}

resource "kubernetes_manifest" "argocd_root_app" {
  manifest = {
    apiVersion = "argoproj.io/v1alpha1"
    kind       = "Application"
    metadata = {
      name      = "homelab-root"
      namespace = kubernetes_namespace.argocd.metadata[0].name
    }
    spec = {
      project = kubernetes_manifest.argocd_project.manifest.metadata.name
      source = {
        repoURL        = "https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git"
        targetRevision = "main"
        path           = "k8s/argocd/apps"
        directory = {
          recurse = true
        }
      }
      destination = {
        server    = "https://kubernetes.default.svc"
        namespace = kubernetes_namespace.argocd.metadata[0].name
      }
      syncPolicy = {
        automated = {
          prune    = true
          selfHeal = true
        }
        syncOptions = [
          "CreateNamespace=true"
        ]
      }
    }
  }

  field_manager {
    name = "terraform"
  }

  depends_on = [
    kubernetes_manifest.argocd_project
  ]
}