Story Crater Bot
d2f4b3c7e4
Revert "feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership"
...
This reverts commit e7f3409d0f
2026-07-15 14:59:54 -07:00
Story Crater Bot and Claude Haiku 4.5
e7f3409d0f
feat(phase0): bootstrap External Secrets Operator and fix helmfile dual-ownership
...
Phase 0 groundwork for helmfile→ArgoCD migration:
1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx)
— already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership
2. Bootstrap ESO (External Secrets Operator) as TF-managed release
— required for all ExternalSecret resources in phases 1-3
— added to bootstrap-releases.tf + helm-repositories.tf
3. Create ClusterSecretStore connecting ESO to Vault (K8s auth)
— enables per-namespace/per-release secret injection
— vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup)
4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling
Changes:
- helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks
- terraform/bootstrap-releases.tf: add external-secrets release
- terraform/helm-repositories.tf: add external-secrets Helm repo
- k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore
- k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1)
- docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure
Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases.
Co-Authored-By: Claude Haiku 4.5 <[email protected]
2026-07-15 14:53:16 -07:00
Story Crater Bot
bca247a763
feat(authentik): import 24 resources to TF; chore(bootstrap): add cilium to TF
...
Import all live authentik resources (groups, users, oauth2 providers, applications)
into terraform state via authentik-generated.tf. Provider config in authentik-config.tf.
Resources are drift-free and match live cluster.
Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system).
Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for
cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.
2026-07-14 16:36:12 -07:00
Story Crater Bot
3eabb847fd
Re-add ingress-nginx to TF bootstrap (PodSecurity policy fixed)
...
- ingress-nginx now has restricted policy level (allows hostPort)
- Previous timeout was due to policy blocking pod deployment
- Re-importing helm release to TF management
2026-07-14 13:37:22 -07:00
Story Crater Bot
6109477bf9
Skip TF management of ingress-nginx (helm timeout issues)
...
- ingress-nginx already deployed and working in cluster
- Helm updates timeout repeatedly (5+ min with context deadline exceeded)
- Remove from bootstrap releases; manage separately via helm/kubectl
- cert-manager + reloader continue via TF
2026-07-14 13:32:40 -07:00
Story Crater Bot
074b43e1f2
Temp: disable kubernetes_manifest cert-manager resources (already live)
...
- Will import separately after helm issues resolved
- Avoids re-create conflicts during bootstrap apply
2026-07-14 13:26:26 -07:00
Story Crater Bot
c2e084c7c2
Fix: downgrade ArgoCD to 7.3.3, ignore helm metadata drift
...
- ArgoCD 7.9.1 -> 7.3.3 (match live cluster)
- Ignore helm release metadata in lifecycle rules
- Prevents unnecessary upgrade attempts
2026-07-14 13:16:55 -07:00
Story Crater Bot
dd608d3231
Step 1 complete: Bootstrap layer with ArgoCD, cert-manager, namespaces imported to TF
...
- ArgoCD migrated to argocd namespace
- Cert-manager issuers/certs created
- 20 namespaces imported with pod-security labels
- S3 backend temporarily offline (MinIO), using local backup
- Pending: Remove metadata drift from helm releases, re-apply
2026-07-14 13:14:46 -07:00
Story Crater Bot