Story Crater Bot
acfc9cfc04
Import all live authentik resources (groups, users, oauth2 providers, applications) into terraform state via authentik-generated.tf. Provider config in authentik-config.tf. Resources are drift-free and match live cluster. Add cilium CNI to bootstrap helm_release.for_each (1.19.5, kube-system). Cilium was unmanaged (helmfile-only); now IaC-owned. Critical path for cluster rebuild recovery. Adds cilium repo to helm-repositories.tf.
68 lines
1.9 KiB
Terraform
68 lines
1.9 KiB
Terraform
locals {
|
|
bootstrap_releases = {
|
|
cert-manager = {
|
|
chart_version = "v1.21.0"
|
|
namespace = "cert-manager"
|
|
repo = "jetstack"
|
|
}
|
|
cilium = {
|
|
chart_version = "1.19.5"
|
|
namespace = "kube-system"
|
|
repo = "cilium"
|
|
}
|
|
reloader = {
|
|
chart_version = "1.3.0"
|
|
namespace = "reloader"
|
|
repo = "stakater"
|
|
}
|
|
ingress-nginx = {
|
|
chart_version = "4.15.1"
|
|
namespace = "ingress-nginx"
|
|
repo = "ingress_nginx"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "bootstrap" {
|
|
for_each = local.bootstrap_releases
|
|
|
|
name = each.key
|
|
repository = local.helm_repos[each.value.repo]
|
|
chart = each.key
|
|
version = each.value.chart_version
|
|
namespace = each.value.namespace
|
|
|
|
dynamic "set" {
|
|
for_each = each.key == "cert-manager" ? {
|
|
"crds.enabled" = "true"
|
|
"prometheus.enabled" = "true"
|
|
"prometheus.servicemonitor.enabled" = "true"
|
|
"prometheus.servicemonitor.interval" = "60s"
|
|
} : (each.key == "ingress-nginx" ? {
|
|
"controller.admissionWebhooks.enabled" = "false"
|
|
"controller.dnsPolicy" = "ClusterFirstWithHostNet"
|
|
"controller.extraArgs.default-ssl-certificate" = "ingress-nginx/homelab-tls"
|
|
"controller.hostPort.enabled" = "true"
|
|
"controller.ingressClassResource.default" = "true"
|
|
"controller.kind" = "DaemonSet"
|
|
"controller.metrics.enabled" = "true"
|
|
"controller.metrics.serviceMonitor.enabled" = "true"
|
|
"controller.metrics.serviceMonitor.interval" = "30s"
|
|
} : {})
|
|
content {
|
|
name = set.key
|
|
value = set.value
|
|
}
|
|
}
|
|
|
|
depends_on = [
|
|
kubernetes_namespace.namespaces
|
|
]
|
|
|
|
lifecycle {
|
|
ignore_changes = [
|
|
values
|
|
]
|
|
}
|
|
}
|