Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"

This reverts commit e7f3409d0f.

terraform/argocd-bootstrap.tf

@@ -13,8 +13,8 @@ resource "kubernetes_namespace" "argocd" {
 resource "null_resource" "copy_ca_secret_to_argocd" {
   provisioner "local-exec" {
     command = <<-EOT
-      kubectl get secret homelab-ca-secret -n cert-manager -o json | \
-        jq 'del(.metadata.namespace, .metadata.resourceVersion, .metadata.uid, .metadata.creationTimestamp, .metadata.selfLink, .metadata.managedFields) | .metadata.namespace = "argocd"' | \
+      kubectl get secret homelab-ca-secret -n cert-manager -o yaml | \
+        sed 's/namespace: cert-manager/namespace: argocd/' | \
         kubectl apply -f -
     EOT
   }

terraform/bootstrap-releases.tf

@@ -20,11 +20,6 @@ locals {
       namespace     = "ingress-nginx"
       repo          = "ingress_nginx"
     }
-    external-secrets = {
-      chart_version = "0.9.9"
-      namespace     = "external-secrets-system"
-      repo          = "external_secrets"
-    }
   }
 }
 

terraform/helm-repositories.tf

@@ -17,6 +17,5 @@ locals {
     strimzi              = "https://strimzi.io/charts/"
     bitnami              = "https://charts.bitnami.com/bitnami"
     temporal             = "https://go.temporal.io/helm-charts"
-    external_secrets     = "https://charts.external-secrets.io"
   }
 }

terraform/longhorn.tf

@@ -1,13 +1,25 @@
-# Longhorn StorageClasses — app-specific variants only.
-#
-# The cluster-wide default `longhorn` SC is intentionally NOT managed here.
-# It is owned by Longhorn's own setting-controller (reconciled from the
-# `longhorn-storageclass` ConfigMap in longhorn-system, stamped with the
-# `longhorn.io/last-applied-configmap` annotation). Managing it in Terraform
-# caused a dual-ownership fight: TF strips the annotation, Longhorn re-adds it
-# and delete+recreates the SC (params are immutable), racing TF's post-apply
-# read ("Root object present, but now absent"). Longhorn recreates it
-# automatically on any cluster, so it needs no TF representation.
+# Longhorn StorageClasses — cluster-wide default + app-specific variants
+# Imported from live cluster state (import-only, no delete)
+
+resource "kubernetes_storage_class" "longhorn" {
+  metadata {
+    name = "longhorn"
+  }
+  storage_provisioner    = "driver.longhorn.io"
+  reclaim_policy         = "Delete"
+  allow_volume_expansion = true
+  volume_binding_mode    = "Immediate"
+
+  parameters = {
+    numberOfReplicas          = "3"
+    staleReplicaTimeout       = "60"
+    fromBackup                = ""
+    fsType                    = "ext4"
+    dataLocality              = "disabled"
+    disableRevisionCounter    = "true"
+    unmapMarkSnapChainRemoved = "ignored"
+  }
+}
 
 resource "kubernetes_storage_class" "longhorn_kafka" {
   metadata {

terraform/minio.tf

@@ -3,11 +3,6 @@
 # Why xfs: default `longhorn` SC uses ext4 whose mkfs on 100Gi (~4.5min)
 # exceeds kubelet mount timeout. xfs mkfs is near-instant. min.io chart has
 # no persistence.fsType, so fsType must be set on the StorageClass.
-#
-# PVC is Terraform-managed directly (import-only, prevent_destroy) and
-# referenced by the chart via persistence.existingClaim, so Helm never
-# templates/reconciles the PVC object itself (previously caused a failed
-# force-replace attempt against the bound, immutable volumeName).
 
 resource "kubernetes_storage_class" "longhorn_xfs" {
   metadata {
@@ -26,22 +21,6 @@ resource "kubernetes_storage_class" "longhorn_xfs" {
   }
 }
 
-resource "kubernetes_persistent_volume_claim" "minio" {
-  metadata {
-    name      = "minio"
-    namespace = "storage"
-  }
-  spec {
-    access_modes       = ["ReadWriteOnce"]
-    storage_class_name = kubernetes_storage_class.longhorn_xfs.metadata[0].name
-    resources {
-      requests = {
-        storage = "100Gi"
-      }
-    }
-  }
-}
-
 resource "helm_release" "minio" {
   name            = "minio"
   repository      = "https://charts.min.io/"
@@ -49,6 +28,7 @@ resource "helm_release" "minio" {
   version         = "5.4.0"
   namespace       = "storage"
   upgrade_install = true
+  force_update    = true
   wait            = true
   timeout         = 600
 
@@ -63,8 +43,10 @@ resource "helm_release" "minio" {
       rootPassword = var.minio_root_password
 
       persistence = {
-        enabled       = true
-        existingClaim = kubernetes_persistent_volume_claim.minio.metadata[0].name
+        enabled      = true
+        size         = "100Gi"
+        storageClass = kubernetes_storage_class.longhorn_xfs.metadata[0].name
+        accessMode   = "ReadWriteOnce"
       }
 
       resources = {

terraform/state.tf

@@ -1,3 +1,4 @@
+# S3 backend (MinIO remote state)
 terraform {
   backend "s3" {
     bucket                      = "terraform-state"