Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF

- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply
2026-07-14 13:14:46 -07:00
parent 9a4d486b86
commit dd608d3231
34 changed files with 2015 additions and 87 deletions
@@ -0,0 +1,143 @@
+resource "kubernetes_namespace" "argocd" {
+  metadata {
+    name = "argocd"
+    labels = {
+      "pod-security.kubernetes.io/enforce"         = "baseline"
+      "pod-security.kubernetes.io/enforce-version" = "latest"
+    }
+  }
+}
+
+resource "helm_release" "argocd" {
+  name       = "argocd"
+  repository = local.helm_repos["argo"]
+  chart      = "argo-cd"
+  version    = "7.9.1"
+  namespace  = kubernetes_namespace.argocd.metadata[0].name
+
+  values = [
+    yamlencode({
+      global = {
+        domain = "argocd.${var.cluster_domain}"
+      }
+      configs = {
+        params = {
+          "application.instanceLabelKey" = "argocd.argoproj.io/instance"
+        }
+        rbac = {
+          "policy.default" = "role:readonly"
+        }
+      }
+      server = {
+        extraArgs = [
+          "--insecure"
+        ]
+        ingress = {
+          enabled = true
+          hosts = [
+            "argocd.${var.cluster_domain}"
+          ]
+        }
+      }
+      repoServer = {
+        autoscaling = {
+          enabled     = true
+          minReplicas = 2
+        }
+      }
+      controller = {
+        replicas = 2
+      }
+    })
+  ]
+
+  depends_on = [
+    kubernetes_namespace.argocd,
+    kubernetes_manifest.wildcard_cert
+  ]
+
+  lifecycle {
+    ignore_changes = [
+      values
+    ]
+  }
+}
+
+resource "kubernetes_manifest" "argocd_project" {
+  manifest = {
+    apiVersion = "argoproj.io/v1alpha1"
+    kind       = "AppProject"
+    metadata = {
+      name      = "homelab"
+      namespace = kubernetes_namespace.argocd.metadata[0].name
+    }
+    spec = {
+      sourceRepos = [
+        "https://forgejo.forge.riotpiao.homelab.com/rock/*"
+      ]
+      destinations = [
+        {
+          server    = "https://kubernetes.default.svc"
+          namespace = "*"
+        }
+      ]
+      clusterResourceWhitelist = [
+        {
+          group = "*"
+          kind  = "*"
+        }
+      ]
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    helm_release.argocd
+  ]
+}
+
+resource "kubernetes_manifest" "argocd_root_app" {
+  manifest = {
+    apiVersion = "argoproj.io/v1alpha1"
+    kind       = "Application"
+    metadata = {
+      name      = "homelab-root"
+      namespace = kubernetes_namespace.argocd.metadata[0].name
+    }
+    spec = {
+      project = kubernetes_manifest.argocd_project.manifest.metadata.name
+      source = {
+        repoURL        = "https://forgejo.riotpiao.homelab.com/riotpiao.com/homelab.git"
+        targetRevision = "main"
+        path           = "k8s/argocd/apps"
+        directory = {
+          recurse = true
+        }
+      }
+      destination = {
+        server    = "https://kubernetes.default.svc"
+        namespace = kubernetes_namespace.argocd.metadata[0].name
+      }
+      syncPolicy = {
+        automated = {
+          prune    = true
+          selfHeal = true
+        }
+        syncOptions = [
+          "CreateNamespace=true"
+        ]
+      }
+    }
+  }
+
+  field_manager {
+    name = "terraform"
+  }
+
+  depends_on = [
+    kubernetes_manifest.argocd_project
+  ]
+}