Story Crater Bot
9a4d486b86
Phase 1 infrastructure-as-code setup: - Core providers (kubernetes, helm, null) - 15 Helm repositories (grafana, minio, prometheus, etc.) - Namespace scaffolding (15 namespaces with pod-security labels) - Storage classes (longhorn, longhorn-kafka with prevent_destroy) - TLS certificate bootstrap (selfsigned, CA, wildcard cert) - Remote state backend config (local for now, S3/GCS TODO) - Variable definitions for all secrets/OIDC clients Tested: terraform plan passes with no changes (bootstrap infrastructure ready) Next: Create 25 helm_release resources (Phase 2-4) Kept helmfile intact; network/Cilium managed via helmfile (no config risk) Co-Authored-By: Claude Haiku 4.5 <[email protected]>
105 lines
2.1 KiB
Terraform
105 lines
2.1 KiB
Terraform
resource "kubernetes_manifest" "selfsigned_bootstrap" {
|
|
manifest = {
|
|
apiVersion = "cert-manager.io/v1"
|
|
kind = "ClusterIssuer"
|
|
metadata = {
|
|
name = "selfsigned-bootstrap"
|
|
}
|
|
spec = {
|
|
selfSigned = {}
|
|
}
|
|
}
|
|
|
|
field_manager {
|
|
name = "terraform"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_manifest" "homelab_ca_cert" {
|
|
manifest = {
|
|
apiVersion = "cert-manager.io/v1"
|
|
kind = "Certificate"
|
|
metadata = {
|
|
name = "homelab-ca"
|
|
namespace = kubernetes_namespace.namespaces["cert-manager"].metadata[0].name
|
|
}
|
|
spec = {
|
|
secretName = "homelab-ca-secret"
|
|
commonName = "homelab-ca"
|
|
isCA = true
|
|
issuerRef = {
|
|
name = "selfsigned-bootstrap"
|
|
kind = "ClusterIssuer"
|
|
}
|
|
duration = "87600h"
|
|
renewBefore = "720h"
|
|
privateKey = {
|
|
algorithm = "ECDSA"
|
|
size = 256
|
|
}
|
|
}
|
|
}
|
|
|
|
field_manager {
|
|
name = "terraform"
|
|
}
|
|
|
|
depends_on = [
|
|
kubernetes_manifest.selfsigned_bootstrap
|
|
]
|
|
}
|
|
|
|
resource "kubernetes_manifest" "homelab_ca_issuer" {
|
|
manifest = {
|
|
apiVersion = "cert-manager.io/v1"
|
|
kind = "ClusterIssuer"
|
|
metadata = {
|
|
name = "homelab-ca"
|
|
}
|
|
spec = {
|
|
ca = {
|
|
secretName = "homelab-ca-secret"
|
|
}
|
|
}
|
|
}
|
|
|
|
field_manager {
|
|
name = "terraform"
|
|
}
|
|
|
|
depends_on = [
|
|
kubernetes_manifest.homelab_ca_cert
|
|
]
|
|
}
|
|
|
|
resource "kubernetes_manifest" "wildcard_cert" {
|
|
manifest = {
|
|
apiVersion = "cert-manager.io/v1"
|
|
kind = "Certificate"
|
|
metadata = {
|
|
name = "homelab-tls"
|
|
namespace = kubernetes_namespace.namespaces["ingress-nginx"].metadata[0].name
|
|
}
|
|
spec = {
|
|
secretName = "homelab-tls"
|
|
commonName = "*.${var.cluster_domain}"
|
|
dnsNames = ["*.${var.cluster_domain}"]
|
|
issuerRef = {
|
|
name = "homelab-ca"
|
|
kind = "ClusterIssuer"
|
|
}
|
|
duration = "2160h"
|
|
renewBefore = "720h"
|
|
}
|
|
}
|
|
|
|
field_manager {
|
|
name = "terraform"
|
|
}
|
|
|
|
depends_on = [
|
|
kubernetes_manifest.homelab_ca_issuer,
|
|
kubernetes_namespace.namespaces
|
|
]
|
|
}
|