feat: Terraform foundation for cluster & app bootstrap

Phase 1 infrastructure-as-code setup: - Core providers (kubernetes, helm, null) - 15 Helm repositories (grafana, minio, prometheus, etc.) - Namespace scaffolding (15 namespaces with pod-security labels) - Storage classes (longhorn, longhorn-kafka with prevent_destroy) - TLS certificate bootstrap (selfsigned, CA, wildcard cert) - Remote state backend config (local for now, S3/GCS TODO) - Variable definitions for all secrets/OIDC clients Tested: terraform plan passes with no changes (bootstrap infrastructure ready) Next: Create 25 helm_release resources (Phase 2-4) Kept helmfile intact; network/Cilium managed via helmfile (no config risk) Co-Authored-By: Claude Haiku 4.5 <[email protected]>
2026-07-14 09:27:24 -07:00
parent 4d32e2765b
commit 9a4d486b86
18 changed files with 1595 additions and 1 deletions
@@ -0,0 +1,104 @@
+resource "kubernetes_manifest" "selfsigned_bootstrap" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "selfsigned-bootstrap"
+    }
+    spec = {
+      selfSigned = {}
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+}
+
+resource "kubernetes_manifest" "homelab_ca_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-ca"
+      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-ca-secret"
+      commonName = "homelab-ca"
+      isCA       = true
+      issuerRef = {
+        name = "selfsigned-bootstrap"
+        kind = "ClusterIssuer"
+      }
+      duration    = "87600h"
+      renewBefore = "720h"
+      privateKey = {
+        algorithm = "ECDSA"
+        size      = 256
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.selfsigned_bootstrap
+  ]
+}
+
+resource "kubernetes_manifest" "homelab_ca_issuer" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = "homelab-ca"
+    }
+    spec = {
+      ca = {
+        secretName = "homelab-ca-secret"
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_cert
+  ]
+}
+
+resource "kubernetes_manifest" "wildcard_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "homelab-tls"
+      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
+    }
+    spec = {
+      secretName = "homelab-tls"
+      commonName = "*.${var.cluster_domain}"
+      dnsNames   = ["*.${var.cluster_domain}"]
+      issuerRef = {
+        name = "homelab-ca"
+        kind = "ClusterIssuer"
+      }
+      duration    = "2160h"
+      renewBefore = "720h"
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.homelab_ca_issuer,
+    kubernetes_namespace.namespaces
+  ]
+}