From 285151bd18b8d52fdc9f8a76f0badae3a8dad839 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:08:03 -0700
Subject: [PATCH] feat(bootstrap): add Phase 1c nginx ingress controller

---
 .gitignore                              |  2 +-
 bootstrap.sh                            | 33 +++++++++++++++++++++++--
 k8s/bootstrap/ingress/namespace.yaml    |  8 ++++++
 k8s/bootstrap/ingress/nginx-values.yaml |  3 ++-
 4 files changed, 42 insertions(+), 4 deletions(-)
 create mode 100644 k8s/bootstrap/ingress/namespace.yaml

diff --git a/.gitignore b/.gitignore
index 933383e..6dc7f3d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,4 +56,4 @@ skills-lock.json
 CLAUDE.md
 docs/
 
-k8s/argocd/seed-repo-secret.yaml
\ No newline at end of file
+k8s/argocd/seed-repo-secret.yamlbootstrap-argocd.log
diff --git a/bootstrap.sh b/bootstrap.sh
index f005d60..3c0f7dd 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -81,6 +81,34 @@ p1_longhorn() {
   fi
 }
 
+p1_ingress() {
+  phase "PHASE 1c: INGRESS (Nginx Ingress Controller)"
+  
+  # Install nginx-ingress if not present
+  if kubectl get ingressclass nginx >/dev/null 2>&1; then
+    log "nginx IngressClass present, skip install"
+    return
+  fi
+  
+  # Always ensure namespace with PodSecurity labels (idempotent)
+  kubectl apply -f "$BOOT/ingress/namespace.yaml"
+  
+  ensure_helm_repo ingress-nginx https://kubernetes.github.io/ingress-nginx
+  log "Installing nginx-ingress controller (this may take 2-3 minutes)..."
+  if helm install ingress-nginx ingress-nginx/ingress-nginx -n ingress-nginx \
+    --values "$BOOT/ingress/nginx-values.yaml" --timeout 5m; then
+    log "✅ nginx-ingress installed"
+  else
+    log "❌ nginx-ingress install failed"
+    return 1
+  fi
+  
+  # Apply additional ingress resources (cert, ingress rules)
+  log "Applying ingress manifests (ignoring cert-manager CRD errors)..."
+  kubectl apply -k "$BOOT/ingress/" 2>&1 | grep -v "no matches for kind" || true
+  log "✅ Ingress resources applied (cert-manager resources will be created by ArgoCD)"
+}
+
 p2_cnpg() {
   phase "PHASE 2: CNPG OPERATOR"
   if kubectl get crd clusters.postgresql.cnpg.io >/dev/null 2>&1; then log "cnpg CRD present, skip install"; return; fi
@@ -233,13 +261,14 @@ p5_cutover() {
 }
 
 case "${1:-all}" in
-  all)      preflight; p1_cilium; p1_longhorn; p2_cnpg; p3_forgejo; p4_argocd
+  all)      preflight; p1_cilium; p1_longhorn; p1_ingress; p2_cnpg; p3_forgejo; p4_argocd
             log "Phases 1-4 done. Push repo to Forgejo + set up pull-mirror, then: $0 cutover" ;;
   cilium)   preflight; p1_cilium ;;
   storage)  preflight; p1_longhorn ;;
+  ingress)  preflight; p1_ingress ;;
   cnpg)     preflight; p2_cnpg ;;
   forgejo)  preflight; p3_forgejo ;;
   argocd)   preflight; p4_argocd ;;
   cutover)  preflight; p5_cutover ;;
-  *) echo "usage: $0 {all|cilium|storage|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
+  *) echo "usage: $0 {all|cilium|storage|ingress|cnpg|forgejo|argocd|cutover}"; exit 1 ;;
 esac
diff --git a/k8s/bootstrap/ingress/namespace.yaml b/k8s/bootstrap/ingress/namespace.yaml
new file mode 100644
index 0000000..2e88b39
--- /dev/null
+++ b/k8s/bootstrap/ingress/namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
diff --git a/k8s/bootstrap/ingress/nginx-values.yaml b/k8s/bootstrap/ingress/nginx-values.yaml
index 6f989ab..a507b5d 100644
--- a/k8s/bootstrap/ingress/nginx-values.yaml
+++ b/k8s/bootstrap/ingress/nginx-values.yaml
@@ -79,10 +79,11 @@ controller:
   # every exposed service in the cluster goes through here, so this single block
   # is the cluster-wide "latency and availability" signal. Prometheus auto-discovers
   # the ServiceMonitor (serviceMonitorSelectorNilUsesHelmValues: false in prometheus-values.yaml).
+  # NOTE: ServiceMonitor disabled during bootstrap (Prometheus CRDs not installed yet)
   metrics:
     enabled: true
     serviceMonitor:
-      enabled: true
+      enabled: false  # Will be enabled by ArgoCD after Prometheus CRDs are installed
       namespace: ingress-nginx
       interval: 30s
       scrapeTimeout: 30s