Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply

terraform/scripts/import-existing.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+echo "=== Importing Namespaces ==="
+for ns in cert-manager reloader ingress-nginx ddb iam storage logging monitoring cicd dashboard sqs temporal story-crater-backend llm dev-tools cilium-secrets kube-node-lease kube-public; do
+  if kubectl get ns "$ns" &>/dev/null; then
+    echo "Importing namespace: $ns"
+    terraform import "kubernetes_namespace.namespaces[\"$ns\"]" "$ns" || echo "  (already imported or skipped)"
+  fi
+done
+
+echo -e "\n=== Importing Storage Classes ==="
+for sc in longhorn longhorn-kafka longhorn-llm longhorn-static; do
+  if kubectl get sc "$sc" &>/dev/null; then
+    echo "Importing storage class: $sc"
+    terraform import "kubernetes_storage_class.$sc" "$sc" || echo "  (already imported or skipped)"
+  fi
+done
+
+echo -e "\n=== Importing Bootstrap Helm Releases (TF-managed) ==="
+declare -a bootstrap_releases=(
+  "cert-manager/cert-manager"
+  "reloader/reloader"
+  "ingress-nginx/ingress-nginx"
+)
+
+for rel_ns in "${bootstrap_releases[@]}"; do
+  rel=$(echo "$rel_ns" | cut -d/ -f1)
+  ns=$(echo "$rel_ns" | cut -d/ -f2)
+  if helm list -n "$ns" --output json 2>/dev/null | grep -q "\"name\":\"$rel\""; then
+    echo "Importing helm release: $rel_ns"
+    terraform import "helm_release.bootstrap[\"$rel\"]" "$rel_ns" || echo "  (already imported or skipped)"
+  fi
+done
+
+echo -e "\n=== Skipping Workload Helm Releases ==="
+echo "The following releases will be managed by ArgoCD (not imported to TF):"
+declare -a workload_releases=(
+  "argocd/cicd"
+  "authentik/iam"
+  "cilium/kube-system"
+  "cloudnative-pg/ddb"
+  "duckdns/kube-system"
+  "forgejo/cicd"
+  "forgejo-runner/cicd"
+  "grafana/logging"
+  "kafka-cluster/sqs"
+  "kmsvc-redis/sqs"
+  "loki/logging"
+  "management-service/sqs"
+  "minio/storage"
+  "ollama/llm"
+  "portainer/dashboard"
+  "prometheus/monitoring"
+  "promtail/logging"
+  "queue-crd/sqs"
+  "strimzi-operator/sqs"
+  "temporal/temporal"
+  "vault/iam"
+)
+for rel in "${workload_releases[@]}"; do
+  echo "  - $rel"
+done
+
+echo -e "\n=== Import Complete ==="
+echo "Next: review terraform plan and apply"
+terraform plan