Add minio-operator Application to deploy operator before Tenant

terraform/argocd-bootstrap.tf

@@ -44,6 +44,12 @@ resource "helm_release" "argocd" {
           enabled     = true
           minReplicas = 2
         }
+        env = [
+          {
+            name  = "GIT_SSL_CAINFO"
+            value = "/etc/ssl/certs/homelab-ca.crt"
+          }
+        ]
         volumes = [
           {
             name = "homelab-ca"
@@ -70,11 +76,8 @@ resource "helm_release" "argocd" {
     kubernetes_namespace.argocd
   ]
 
-  lifecycle {
-    ignore_changes = [
-      values
-    ]
-  }
+  # Note: lifecycle.ignore_changes removed to allow CA cert update
+  # This allows TF to inject the homelab-ca-secret for TLS verification
 }
 
 resource "kubernetes_manifest" "argocd_project" {

terraform/bootstrap-certificates.tf

@@ -1,104 +0,0 @@
-resource "kubernetes_manifest" "selfsigned_bootstrap" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "ClusterIssuer"
-    metadata = {
-      name = "selfsigned-bootstrap"
-    }
-    spec = {
-      selfSigned = {}
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-}
-
-resource "kubernetes_manifest" "homelab_ca_cert" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "homelab-ca"
-      namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
-    }
-    spec = {
-      secretName = "homelab-ca-secret"
-      commonName = "homelab-ca"
-      isCA       = true
-      issuerRef = {
-        name = "selfsigned-bootstrap"
-        kind = "ClusterIssuer"
-      }
-      duration    = "87600h"
-      renewBefore = "720h"
-      privateKey = {
-        algorithm = "ECDSA"
-        size      = 256
-      }
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.selfsigned_bootstrap
-  ]
-}
-
-resource "kubernetes_manifest" "homelab_ca_issuer" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "ClusterIssuer"
-    metadata = {
-      name = "homelab-ca"
-    }
-    spec = {
-      ca = {
-        secretName = "homelab-ca-secret"
-      }
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.homelab_ca_cert
-  ]
-}
-
-resource "kubernetes_manifest" "wildcard_cert" {
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "homelab-tls"
-      namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
-    }
-    spec = {
-      secretName = "homelab-tls"
-      commonName = "*.${var.cluster_domain}"
-      dnsNames   = ["*.${var.cluster_domain}"]
-      issuerRef = {
-        name = "homelab-ca"
-        kind = "ClusterIssuer"
-      }
-      duration    = "2160h"
-      renewBefore = "720h"
-    }
-  }
-
-  field_manager {
-    name = "terraform"
-  }
-
-  depends_on = [
-    kubernetes_manifest.homelab_ca_issuer,
-    kubernetes_namespace.namespaces
-  ]
-}