Move namespaces out of terraform

charts/fluent-bit/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: fluent-bit-namespace
+description: fluent-bit namespace with privileged PodSecurity
+type: application
+version: 0.1.0

charts/fluent-bit/templates/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fluent-bit
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

charts/ingress-nginx/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: ingress-nginx-namespace
+description: ingress-nginx namespace with privileged PodSecurity
+type: application
+version: 0.1.0

manifests/cluster/fluent-bit.yaml

@@ -1,5 +1,26 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: fluent-bit-namespace
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/fluent-bit
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: fluent-bit
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: fluent-bit
   namespace: argocd
@@ -24,4 +45,4 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-      - CreateNamespace=true
+      - CreateNamespace=false

manifests/cluster/ingress-nginx.yaml

@@ -1,5 +1,26 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: ingress-nginx-namespace
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/ingress-nginx
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: ingress-nginx
   namespace: argocd

terraform/namespaces.tf

@@ -1,19 +1,5 @@
-provider "kubernetes" {
-  host                   = "https://${aws_eip.controlplane.public_ip}:6443"
-  cluster_ca_certificate = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate)
-  client_certificate     = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.client_certificate)
-  client_key             = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.client_key)
-}
-
-resource "kubernetes_namespace" "ingress_nginx" {
-  metadata {
-    name = "ingress-nginx"
-    labels = {
-      "pod-security.kubernetes.io/enforce" = "privileged"
-      "pod-security.kubernetes.io/audit"   = "privileged"
-      "pod-security.kubernetes.io/warn"    = "privileged"
-    }
-  }
-
-  depends_on = [talos_cluster_kubeconfig.this]
-}
+# Namespaces that need privileged PodSecurity are managed as Helm charts
+# in charts/<name>/templates/namespace.yaml so ArgoCD creates them with
+# the correct labels before deploying workloads into them.
+#
+# This file is intentionally empty.