Story Crater Bot
7835ac2932
Phase 1 infrastructure-as-code setup: - Core providers (kubernetes, helm, null) - 15 Helm repositories (grafana, minio, prometheus, etc.) - Namespace scaffolding (15 namespaces with pod-security labels) - Storage classes (longhorn, longhorn-kafka with prevent_destroy) - TLS certificate bootstrap (selfsigned, CA, wildcard cert) - Remote state backend config (local for now, S3/GCS TODO) - Variable definitions for all secrets/OIDC clients Tested: terraform plan passes with no changes (bootstrap infrastructure ready) Next: Create 25 helm_release resources (Phase 2-4) Kept helmfile intact; network/Cilium managed via helmfile (no config risk) Co-Authored-By: Claude Haiku 4.5 <[email protected]>
36 lines
1.0 KiB
Terraform
36 lines
1.0 KiB
Terraform
locals {
|
|
namespaces = {
|
|
"cert-manager" = {}
|
|
"reloader" = {}
|
|
"ingress-nginx" = {}
|
|
"ddb" = {}
|
|
"iam" = {}
|
|
"storage" = {}
|
|
"logging" = {}
|
|
"monitoring" = {}
|
|
"cicd" = {}
|
|
"dashboard" = {}
|
|
"sqs" = {}
|
|
"temporal" = {}
|
|
"story-crater-backend" = {}
|
|
"llm" = {}
|
|
"dev-tools" = {}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_namespace" "namespaces" {
|
|
for_each = local.namespaces
|
|
|
|
metadata {
|
|
name = each.key
|
|
labels = {
|
|
"pod-security.kubernetes.io/enforce" = "baseline"
|
|
"pod-security.kubernetes.io/enforce-version" = "latest"
|
|
"pod-security.kubernetes.io/audit" = "restricted"
|
|
"pod-security.kubernetes.io/audit-version" = "latest"
|
|
"pod-security.kubernetes.io/warn" = "restricted"
|
|
"pod-security.kubernetes.io/warn-version" = "latest"
|
|
}
|
|
}
|
|
}
|