Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF
- ArgoCD migrated to argocd namespace - Cert-manager issuers/certs created - 20 namespaces imported with pod-security labels - S3 backend temporarily offline (MinIO), using local backup - Pending: Remove metadata drift from helm releases, re-apply
This commit is contained in:
Story Crater Bot
+81
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
echo "=== Step 1: Apply bootstrap manifests (namespaces, cert-manager issuers/certs) ==="
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
source "$SCRIPT_DIR/../../.env.terraform.sh"
|
||||
kubectl apply -f "$SCRIPT_DIR/../bootstrap-manifests.yaml" --validate=false
|
||||
echo "✓ Bootstrap manifests applied"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 2: Wait for cert-manager to be ready ==="
|
||||
kubectl -n cert-manager rollout status deployment/cert-manager --timeout=5m
|
||||
echo "✓ cert-manager ready"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 3: Wait for homelab-ca certificate to be issued ==="
|
||||
for i in {1..60}; do
|
||||
if kubectl -n cert-manager get secret homelab-ca-secret &>/dev/null; then
|
||||
echo "✓ homelab-ca-secret created"
|
||||
break
|
||||
fi
|
||||
echo "Waiting for homelab-ca-secret... ($i/60)"
|
||||
sleep 2
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "=== Step 4a: Delete old ArgoCD release from cicd namespace ==="
|
||||
if helm list -n cicd | grep -q "^argocd"; then
|
||||
helm delete argocd -n cicd
|
||||
echo "✓ Old ArgoCD removed from cicd"
|
||||
sleep 5
|
||||
else
|
||||
echo "✓ No ArgoCD in cicd to delete"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Step 4a2: Delete orphaned CRDs left behind by helm resource policy ==="
|
||||
kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io --ignore-not-found
|
||||
echo "✓ CRDs deleted"
|
||||
sleep 2
|
||||
|
||||
echo ""
|
||||
echo "=== Step 4b: Install ArgoCD helm release in argocd namespace ==="
|
||||
helm repo add argocd https://argoproj.github.io/argo-helm
|
||||
helm repo update
|
||||
ARGOCD_VALUES="$SCRIPT_DIR/../../k8s/talos-ci-cd/argocd-values.yaml"
|
||||
helm upgrade --install argocd argocd/argo-cd \
|
||||
--namespace argocd \
|
||||
--version 7.3.3 \
|
||||
--values "$ARGOCD_VALUES" \
|
||||
--wait
|
||||
echo "✓ ArgoCD installed in argocd namespace"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 5: Import kubernetes resources into TF state ==="
|
||||
cd "$SCRIPT_DIR/../.."
|
||||
source .env.terraform.sh
|
||||
cd terraform
|
||||
|
||||
# Import namespaces
|
||||
terraform import kubernetes_namespace.argocd argocd
|
||||
terraform import 'kubernetes_namespace.namespaces["dev-tools"]' dev-tools
|
||||
|
||||
# Import cert-manager objects (kubernetes_manifest import syntax uses colons: apiVersion:kind:name or apiVersion:kind:namespace:name)
|
||||
terraform import kubernetes_manifest.selfsigned_bootstrap 'cert-manager.io:v1:ClusterIssuer:selfsigned-bootstrap'
|
||||
terraform import kubernetes_manifest.homelab_ca_issuer 'cert-manager.io:v1:ClusterIssuer:homelab-ca'
|
||||
terraform import kubernetes_manifest.homelab_ca_cert 'cert-manager.io:v1:Certificate:cert-manager:homelab-ca'
|
||||
terraform import kubernetes_manifest.wildcard_cert 'cert-manager.io:v1:Certificate:ingress-nginx:homelab-tls'
|
||||
|
||||
echo "✓ Kubernetes resources imported"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 6: Import ArgoCD helm release ==="
|
||||
terraform import helm_release.argocd argocd/argocd
|
||||
echo "✓ ArgoCD helm release imported"
|
||||
|
||||
echo ""
|
||||
echo "=== Step 7: Verify clean plan ==="
|
||||
terraform plan
|
||||
echo ""
|
||||
echo "✓ All bootstrap resources imported. Plan should show zero changes."
|
||||
Executable
+69
@@ -0,0 +1,69 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
echo "=== Importing Namespaces ==="
|
||||
for ns in cert-manager reloader ingress-nginx ddb iam storage logging monitoring cicd dashboard sqs temporal story-crater-backend llm dev-tools cilium-secrets kube-node-lease kube-public; do
|
||||
if kubectl get ns "$ns" &>/dev/null; then
|
||||
echo "Importing namespace: $ns"
|
||||
terraform import "kubernetes_namespace.namespaces[\"$ns\"]" "$ns" || echo " (already imported or skipped)"
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "\n=== Importing Storage Classes ==="
|
||||
for sc in longhorn longhorn-kafka longhorn-llm longhorn-static; do
|
||||
if kubectl get sc "$sc" &>/dev/null; then
|
||||
echo "Importing storage class: $sc"
|
||||
terraform import "kubernetes_storage_class.$sc" "$sc" || echo " (already imported or skipped)"
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "\n=== Importing Bootstrap Helm Releases (TF-managed) ==="
|
||||
declare -a bootstrap_releases=(
|
||||
"cert-manager/cert-manager"
|
||||
"reloader/reloader"
|
||||
"ingress-nginx/ingress-nginx"
|
||||
)
|
||||
|
||||
for rel_ns in "${bootstrap_releases[@]}"; do
|
||||
rel=$(echo "$rel_ns" | cut -d/ -f1)
|
||||
ns=$(echo "$rel_ns" | cut -d/ -f2)
|
||||
if helm list -n "$ns" --output json 2>/dev/null | grep -q "\"name\":\"$rel\""; then
|
||||
echo "Importing helm release: $rel_ns"
|
||||
terraform import "helm_release.bootstrap[\"$rel\"]" "$rel_ns" || echo " (already imported or skipped)"
|
||||
fi
|
||||
done
|
||||
|
||||
echo -e "\n=== Skipping Workload Helm Releases ==="
|
||||
echo "The following releases will be managed by ArgoCD (not imported to TF):"
|
||||
declare -a workload_releases=(
|
||||
"argocd/cicd"
|
||||
"authentik/iam"
|
||||
"cilium/kube-system"
|
||||
"cloudnative-pg/ddb"
|
||||
"duckdns/kube-system"
|
||||
"forgejo/cicd"
|
||||
"forgejo-runner/cicd"
|
||||
"grafana/logging"
|
||||
"kafka-cluster/sqs"
|
||||
"kmsvc-redis/sqs"
|
||||
"loki/logging"
|
||||
"management-service/sqs"
|
||||
"minio/storage"
|
||||
"ollama/llm"
|
||||
"portainer/dashboard"
|
||||
"prometheus/monitoring"
|
||||
"promtail/logging"
|
||||
"queue-crd/sqs"
|
||||
"strimzi-operator/sqs"
|
||||
"temporal/temporal"
|
||||
"vault/iam"
|
||||
)
|
||||
for rel in "${workload_releases[@]}"; do
|
||||
echo " - $rel"
|
||||
done
|
||||
|
||||
echo -e "\n=== Import Complete ==="
|
||||
echo "Next: review terraform plan and apply"
|
||||
terraform plan
|
||||
Executable
+60
@@ -0,0 +1,60 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
cd "$(dirname "$0")/.."
|
||||
|
||||
echo "=== Terraform Bootstrap Setup ==="
|
||||
|
||||
if [ ! -f "../.env" ]; then
|
||||
echo "ERROR: ../.env not found. Run from terraform/ directory."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Extract MinIO credentials from .env
|
||||
export AWS_ACCESS_KEY_ID=$(grep "^MINIO_ROOT_USER=" ../.env | cut -d= -f2)
|
||||
export AWS_SECRET_ACCESS_KEY=$(grep "^MINIO_ROOT_PASSWORD=" ../.env | cut -d= -f2)
|
||||
export KUBECONFIG=$(pwd)/../cluster-config/kubeconfig
|
||||
|
||||
if [ -z "$AWS_ACCESS_KEY_ID" ] || [ -z "$AWS_SECRET_ACCESS_KEY" ]; then
|
||||
echo "ERROR: MINIO_ROOT_USER or MINIO_ROOT_PASSWORD not found in .env"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "✓ MinIO S3 credentials loaded"
|
||||
|
||||
# Check Vault token
|
||||
if [ -z "$VAULT_TOKEN" ]; then
|
||||
echo "WARNING: VAULT_TOKEN not set. Set it before terraform init:"
|
||||
echo " export VAULT_TOKEN=\$(vault login -method=oidc ...)"
|
||||
fi
|
||||
|
||||
# Generate terraform.tfvars from .env
|
||||
echo "Generating terraform.tfvars from .env..."
|
||||
cat > terraform.tfvars.local << 'EOF'
|
||||
# Auto-generated from .env
|
||||
EOF
|
||||
|
||||
grep -E '^(AUTHENTIK_SECRET_KEY|AUTHENTIK_BOOTSTRAP_PASSWORD|AUTHENTIK_BOOTSTRAP_TOKEN|AUTHENTIK_PG_PASSWORD|POSTGRES_PASSWORD|MINIO_ROOT_|GRAFANA_|FORGEJO_|ARGOCD_)' ../.env | sed 's/_ROOT_USER=/=/' | while read line; do
|
||||
key=$(echo "$line" | cut -d= -f1 | sed 's/_/ /g; s/.*/\L&/; s/ /_/g')
|
||||
val=$(echo "$line" | cut -d= -f2-)
|
||||
if [[ "$key" == *"secret"* ]] || [[ "$key" == *"password"* ]]; then
|
||||
echo "$key = \"$val\"" >> terraform.tfvars.local
|
||||
else
|
||||
echo "$key = \"$val\"" >> terraform.tfvars.local
|
||||
fi
|
||||
done
|
||||
|
||||
echo "✓ terraform.tfvars.local generated"
|
||||
|
||||
# Initialize terraform
|
||||
echo "Initializing terraform with S3 backend..."
|
||||
terraform init \
|
||||
-backend-config="access_key=$AWS_ACCESS_KEY_ID" \
|
||||
-backend-config="secret_key=$AWS_SECRET_ACCESS_KEY"
|
||||
|
||||
echo "✓ Terraform initialized"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Review: terraform plan"
|
||||
echo " 2. Import existing resources: ./scripts/import-existing.sh"
|
||||
echo " 3. Apply: terraform apply"
|
||||
Reference in New Issue
Block a user