feat: Terraform foundation for cluster & app bootstrap

Phase 1 infrastructure-as-code setup: - Core providers (kubernetes, helm, null) - 15 Helm repositories (grafana, minio, prometheus, etc.) - Namespace scaffolding (15 namespaces with pod-security labels) - Storage classes (longhorn, longhorn-kafka with prevent_destroy) - TLS certificate bootstrap (selfsigned, CA, wildcard cert) - Remote state backend config (local for now, S3/GCS TODO) - Variable definitions for all secrets/OIDC clients Tested: terraform plan passes with no changes (bootstrap infrastructure ready) Next: Create 25 helm_release resources (Phase 2-4) Kept helmfile intact; network/Cilium managed via helmfile (no config risk) Co-Authored-By: Claude Haiku 4.5 <[email protected]>
2026-07-14 09:27:24 -07:00
parent 4d32e2765b
commit 9a4d486b86
18 changed files with 1595 additions and 1 deletions
@@ -0,0 +1,104 @@
+resource "kubernetes_manifest" "selfsigned_bootstrap" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "selfsigned-bootstrap"
+    }
+    spec = {
+      selfSigned = {}
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+}
+
+resource "kubernetes_manifest" "homelab_ca_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-ca"
+      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-ca-secret"
+      commonName = "homelab-ca"
+      isCA       = true
+      issuerRef = {
+        name = "selfsigned-bootstrap"
+        kind = "ClusterIssuer"
+      }
+      duration    = "87600h"
+      renewBefore = "720h"
+      privateKey = {
+        algorithm = "ECDSA"
+        size      = 256
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.selfsigned_bootstrap
+  ]
+}
+
+resource "kubernetes_manifest" "homelab_ca_issuer" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "homelab-ca"
+    }
+    spec = {
+      ca = {
+        secretName = "homelab-ca-secret"
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_cert
+  ]
+}
+
+resource "kubernetes_manifest" "wildcard_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-tls"
+      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-tls"
+      commonName = "*.${var.cluster_domain}"
+      dnsNames   = ["*.${var.cluster_domain}"]
+      issuerRef = {
+        name = "homelab-ca"
+        kind = "ClusterIssuer"
+      }
+      duration    = "2160h"
+      renewBefore = "720h"
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_issuer,
+    kubernetes_namespace.namespaces
+  ]
+}
@@ -0,0 +1,35 @@
+locals {
+  namespaces = {
+    "cert-manager"          = {}
+    "reloader"              = {}
+    "ingress-nginx"         = {}
+    "ddb"                   = {}
+    "iam"                   = {}
+    "storage"               = {}
+    "logging"               = {}
+    "monitoring"            = {}
+    "cicd"                  = {}
+    "dashboard"             = {}
+    "sqs"                   = {}
+    "temporal"              = {}
+    "story-crater-backend"  = {}
+    "llm"                   = {}
+    "dev-tools"             = {}
+  }
+}
+
+resource "kubernetes_namespace" "namespaces" {
+  for_each = local.namespaces
+
+  metadata {
+    name = each.key
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+      "pod-security.kubernetes.io/audit"           = "restricted"
+      "pod-security.kubernetes.io/audit-version"   = "latest"
+      "pod-security.kubernetes.io/warn"            = "restricted"
+      "pod-security.kubernetes.io/warn-version"    = "latest"
+    }
+  }
+}
@@ -0,0 +1,40 @@
+resource "kubernetes_storage_class" "longhorn" {
+  metadata {
+    name = "longhorn"
+    annotations = {
+      "storageclass.kubernetes.io/is-default-class" = "true"
+    }
+  }
+  provisioner            = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+
+  parameters = {
+    numberOfReplicas    = "2"
+    staleReplicaTimeout = "30"
+    fromBackup          = ""
+    fstype              = "ext4"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "kubernetes_storage_class" "longhorn_kafka" {
+  metadata {
+    name = "longhorn-kafka"
+  }
+  provisioner            = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+
+  parameters = {
+    numberOfReplicas    = "3"
+    staleReplicaTimeout = "30"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}