Story Crater BotandClaude Haiku 4.5
e7f3409d0f
Phase 0 groundwork for helmfile→ArgoCD migration: 1. Remove 3 bootstrap releases from helmfile (cert-manager, reloader, ingress-nginx) — already managed by terraform/bootstrap-releases.tf; eliminates dual-ownership 2. Bootstrap ESO (External Secrets Operator) as TF-managed release — required for all ExternalSecret resources in phases 1-3 — added to bootstrap-releases.tf + helm-repositories.tf 3. Create ClusterSecretStore connecting ESO to Vault (K8s auth) — enables per-namespace/per-release secret injection — vault config documented in docs/PHASE0-ESO-VAULT-SETUP.md (manual setup) 4. Fix argocd-bootstrap.tf CA cert copy: use jq instead of sed for cleaner metadata handling Changes: - helmfile.yaml.gotmpl: remove cert-manager/reloader/ingress-nginx blocks - terraform/bootstrap-releases.tf: add external-secrets release - terraform/helm-repositories.tf: add external-secrets Helm repo - k8s/external-secrets/clustersecretstore.yaml: ESO→Vault ClusterSecretStore - k8s/argocd/apps/0-wave-0.yaml: stub wave 0 applications (schema fix, rewrite pending Phase 1) - docs/PHASE0-ESO-VAULT-SETUP.md: manual ESO-Vault auth setup procedure Next: Phase 1 will incrementally rewrite ArgoCD Applications + migrate helmfile releases. Co-Authored-By: Claude Haiku 4.5 <[email protected]>
73 lines
2.0 KiB
Terraform
73 lines
2.0 KiB
Terraform
locals {
|
|
bootstrap_releases = {
|
|
cert-manager = {
|
|
chart_version = "v1.21.0"
|
|
namespace = "cert-manager"
|
|
repo = "jetstack"
|
|
}
|
|
cilium = {
|
|
chart_version = "1.19.5"
|
|
namespace = "kube-system"
|
|
repo = "cilium"
|
|
}
|
|
reloader = {
|
|
chart_version = "1.3.0"
|
|
namespace = "reloader"
|
|
repo = "stakater"
|
|
}
|
|
ingress-nginx = {
|
|
chart_version = "4.15.1"
|
|
namespace = "ingress-nginx"
|
|
repo = "ingress_nginx"
|
|
}
|
|
external-secrets = {
|
|
chart_version = "0.9.9"
|
|
namespace = "external-secrets-system"
|
|
repo = "external_secrets"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "bootstrap" {
|
|
for_each = local.bootstrap_releases
|
|
|
|
name = each.key
|
|
repository = local.helm_repos[each.value.repo]
|
|
chart = each.key
|
|
version = each.value.chart_version
|
|
namespace = each.value.namespace
|
|
|
|
dynamic "set" {
|
|
for_each = each.key == "cert-manager" ? {
|
|
"crds.enabled" = "true"
|
|
"prometheus.enabled" = "true"
|
|
"prometheus.servicemonitor.enabled" = "true"
|
|
"prometheus.servicemonitor.interval" = "60s"
|
|
} : (each.key == "ingress-nginx" ? {
|
|
"controller.admissionWebhooks.enabled" = "false"
|
|
"controller.dnsPolicy" = "ClusterFirstWithHostNet"
|
|
"controller.extraArgs.default-ssl-certificate" = "ingress-nginx/homelab-tls"
|
|
"controller.hostPort.enabled" = "true"
|
|
"controller.ingressClassResource.default" = "true"
|
|
"controller.kind" = "DaemonSet"
|
|
"controller.metrics.enabled" = "true"
|
|
"controller.metrics.serviceMonitor.enabled" = "true"
|
|
"controller.metrics.serviceMonitor.interval" = "30s"
|
|
} : {})
|
|
content {
|
|
name = set.key
|
|
value = set.value
|
|
}
|
|
}
|
|
|
|
depends_on = [
|
|
kubernetes_namespace.namespaces
|
|
]
|
|
|
|
lifecycle {
|
|
ignore_changes = [
|
|
values
|
|
]
|
|
}
|
|
}
|