Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply
2026-08-18 15:08:00 -07:00
parent 7835ac2932
commit 4e473978b5
34 changed files with 2015 additions and 87 deletions
@@ -0,0 +1,62 @@
+locals {
+  bootstrap_releases = {
+    cert-manager = {
+      chart_version = "v1.21.0"
+      namespace     = "cert-manager"
+      repo          = "jetstack"
+    }
+    reloader = {
+      chart_version = "1.3.0"
+      namespace     = "reloader"
+      repo          = "stakater"
+    }
+    ingress-nginx = {
+      chart_version = "4.15.1"
+      namespace     = "ingress-nginx"
+      repo          = "ingress_nginx"
+    }
+  }
+}
+
+resource "helm_release" "bootstrap" {
+  for_each = local.bootstrap_releases
+
+  name       = each.key
+  repository = local.helm_repos[each.value.repo]
+  chart      = each.key
+  version    = each.value.chart_version
+  namespace  = each.value.namespace
+
+  dynamic "set" {
+    for_each = each.key == "cert-manager" ? {
+      "crds.enabled"                       = "true"
+      "prometheus.enabled"                 = "true"
+      "prometheus.servicemonitor.enabled"  = "true"
+      "prometheus.servicemonitor.interval" = "60s"
+      } : (each.key == "ingress-nginx" ? {
+        "controller.admissionWebhooks.enabled"         = "false"
+        "controller.dnsPolicy"                         = "ClusterFirstWithHostNet"
+        "controller.extraArgs.default-ssl-certificate" = "ingress-nginx/homelab-tls"
+        "controller.hostPort.enabled"                  = "true"
+        "controller.ingressClassResource.default"      = "true"
+        "controller.kind"                              = "DaemonSet"
+        "controller.metrics.enabled"                   = "true"
+        "controller.metrics.serviceMonitor.enabled"    = "true"
+        "controller.metrics.serviceMonitor.interval"   = "30s"
+    } : {})
+    content {
+      name  = set.key
+      value = set.value
+    }
+  }
+
+  depends_on = [
+    kubernetes_namespace.namespaces
+  ]
+
+  lifecycle {
+    ignore_changes = [
+      values
+    ]
+  }
+}