Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/scripts/apply-and-import-bootstrap.sh

@@ -0,0 +1,81 @@
+#!/bin/bash
+set -e
+
+echo "=== Step 1: Apply bootstrap manifests (namespaces, cert-manager issuers/certs) ==="
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../../.env.terraform.sh"
+kubectl apply -f "$SCRIPT_DIR/../bootstrap-manifests.yaml" --validate=false
+echo "✓ Bootstrap manifests applied"
+
+echo ""
+echo "=== Step 2: Wait for cert-manager to be ready ==="
+kubectl -n cert-manager rollout status deployment/cert-manager --timeout=5m
+echo "✓ cert-manager ready"
+
+echo ""
+echo "=== Step 3: Wait for homelab-ca certificate to be issued ==="
+for i in {1..60}; do
+  if kubectl -n cert-manager get secret homelab-ca-secret &>/dev/null; then
+    echo "✓ homelab-ca-secret created"
+    break
+  fi
+  echo "Waiting for homelab-ca-secret... ($i/60)"
+  sleep 2
+done
+
+echo ""
+echo "=== Step 4a: Delete old ArgoCD release from cicd namespace ==="
+if helm list -n cicd | grep -q "^argocd"; then
+  helm delete argocd -n cicd
+  echo "✓ Old ArgoCD removed from cicd"
+  sleep 5
+else
+  echo "✓ No ArgoCD in cicd to delete"
+fi
+
+echo ""
+echo "=== Step 4a2: Delete orphaned CRDs left behind by helm resource policy ==="
+kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io --ignore-not-found
+echo "✓ CRDs deleted"
+sleep 2
+
+echo ""
+echo "=== Step 4b: Install ArgoCD helm release in argocd namespace ==="
+helm repo add argocd https://argoproj.github.io/argo-helm
+helm repo update
+ARGOCD_VALUES="$SCRIPT_DIR/../../k8s/talos-ci-cd/argocd-values.yaml"
+helm upgrade --install argocd argocd/argo-cd \
+  --namespace argocd \
+  --version 7.3.3 \
+  --values "$ARGOCD_VALUES" \
+  --wait
+echo "✓ ArgoCD installed in argocd namespace"
+
+echo ""
+echo "=== Step 5: Import kubernetes resources into TF state ==="
+cd "$SCRIPT_DIR/../.."
+source .env.terraform.sh
+cd terraform
+
+# Import namespaces
+terraform import kubernetes_namespace.argocd argocd
+terraform import 'kubernetes_namespace.namespaces["dev-tools"]' dev-tools
+
+# Import cert-manager objects (kubernetes_manifest import syntax uses colons: apiVersion:kind:name or apiVersion:kind:namespace:name)
+terraform import kubernetes_manifest.selfsigned_bootstrap 'cert-manager.io:v1:ClusterIssuer:selfsigned-bootstrap'
+terraform import kubernetes_manifest.homelab_ca_issuer 'cert-manager.io:v1:ClusterIssuer:homelab-ca'
+terraform import kubernetes_manifest.homelab_ca_cert 'cert-manager.io:v1:Certificate:cert-manager:homelab-ca'
+terraform import kubernetes_manifest.wildcard_cert 'cert-manager.io:v1:Certificate:ingress-nginx:homelab-tls'
+
+echo "✓ Kubernetes resources imported"
+
+echo ""
+echo "=== Step 6: Import ArgoCD helm release ==="
+terraform import helm_release.argocd argocd/argocd
+echo "✓ ArgoCD helm release imported"
+
+echo ""
+echo "=== Step 7: Verify clean plan ==="
+terraform plan
+echo ""
+echo "✓ All bootstrap resources imported. Plan should show zero changes."