From 6cecb90baf713fc8157902e0b31751e71ddf4994 Mon Sep 17 00:00:00 2001
From: Ian Keane <ian@keane.sh>
Date: Tue, 18 Aug 2026 13:46:49 -0400
Subject: [PATCH] Move namespaces out of terraform

---
 charts/fluent-bit/Chart.yaml                  |  5 ++++
 charts/fluent-bit/templates/namespace.yaml    |  8 +++++++
 charts/ingress-nginx/Chart.yaml               |  5 ++++
 .../{ => templates}/namespace.yaml            |  0
 manifests/cluster/fluent-bit.yaml             | 23 +++++++++++++++++-
 manifests/cluster/ingress-nginx.yaml          | 21 ++++++++++++++++
 terraform/namespaces.tf                       | 24 ++++---------------
 7 files changed, 66 insertions(+), 20 deletions(-)
 create mode 100644 charts/fluent-bit/Chart.yaml
 create mode 100644 charts/fluent-bit/templates/namespace.yaml
 create mode 100644 charts/ingress-nginx/Chart.yaml
 rename charts/ingress-nginx/{ => templates}/namespace.yaml (100%)

diff --git a/charts/fluent-bit/Chart.yaml b/charts/fluent-bit/Chart.yaml
new file mode 100644
index 0000000..97d63be
--- /dev/null
+++ b/charts/fluent-bit/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: fluent-bit-namespace
+description: fluent-bit namespace with privileged PodSecurity
+type: application
+version: 0.1.0
diff --git a/charts/fluent-bit/templates/namespace.yaml b/charts/fluent-bit/templates/namespace.yaml
new file mode 100644
index 0000000..e69bd65
--- /dev/null
+++ b/charts/fluent-bit/templates/namespace.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fluent-bit
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
diff --git a/charts/ingress-nginx/Chart.yaml b/charts/ingress-nginx/Chart.yaml
new file mode 100644
index 0000000..b73197a
--- /dev/null
+++ b/charts/ingress-nginx/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: ingress-nginx-namespace
+description: ingress-nginx namespace with privileged PodSecurity
+type: application
+version: 0.1.0
diff --git a/charts/ingress-nginx/namespace.yaml b/charts/ingress-nginx/templates/namespace.yaml
similarity index 100%
rename from charts/ingress-nginx/namespace.yaml
rename to charts/ingress-nginx/templates/namespace.yaml
diff --git a/manifests/cluster/fluent-bit.yaml b/manifests/cluster/fluent-bit.yaml
index 2867276..705bd0f 100644
--- a/manifests/cluster/fluent-bit.yaml
+++ b/manifests/cluster/fluent-bit.yaml
@@ -1,5 +1,26 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: fluent-bit-namespace
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/fluent-bit
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: fluent-bit
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: fluent-bit
   namespace: argocd
@@ -24,4 +45,4 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
-      - CreateNamespace=true
+      - CreateNamespace=false
diff --git a/manifests/cluster/ingress-nginx.yaml b/manifests/cluster/ingress-nginx.yaml
index 84a567c..1ba6726 100644
--- a/manifests/cluster/ingress-nginx.yaml
+++ b/manifests/cluster/ingress-nginx.yaml
@@ -1,5 +1,26 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
+metadata:
+  name: ingress-nginx-namespace
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://forge.keane.sh/ian/dumpnet-argo.git
+    targetRevision: HEAD
+    path: charts/ingress-nginx
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: ingress-nginx
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
 metadata:
   name: ingress-nginx
   namespace: argocd
diff --git a/terraform/namespaces.tf b/terraform/namespaces.tf
index 8ed4586..40f54f7 100644
--- a/terraform/namespaces.tf
+++ b/terraform/namespaces.tf
@@ -1,19 +1,5 @@
-provider "kubernetes" {
-  host                   = "https://${aws_eip.controlplane.public_ip}:6443"
-  cluster_ca_certificate = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.ca_certificate)
-  client_certificate     = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.client_certificate)
-  client_key             = base64decode(talos_cluster_kubeconfig.this.kubernetes_client_configuration.client_key)
-}
-
-resource "kubernetes_namespace" "ingress_nginx" {
-  metadata {
-    name = "ingress-nginx"
-    labels = {
-      "pod-security.kubernetes.io/enforce" = "privileged"
-      "pod-security.kubernetes.io/audit"   = "privileged"
-      "pod-security.kubernetes.io/warn"    = "privileged"
-    }
-  }
-
-  depends_on = [talos_cluster_kubeconfig.this]
-}
+# Namespaces that need privileged PodSecurity are managed as Helm charts
+# in charts/<name>/templates/namespace.yaml so ArgoCD creates them with
+# the correct labels before deploying workloads into them.
+#
+# This file is intentionally empty.