Restructure and variablize config

Makefile

@@ -1,6 +1,6 @@
-.PHONY: init plan apply destroy kubeconfig talosconfig argocd-password bootstrap decrypt post-apply fluentbit-secret
+.PHONY: init plan apply destroy clean kubeconfig talosconfig argocd-password bootstrap decrypt post-apply fluentbit-secret
 
-SECRET=dumpnet
+SECRET ?= dumpnet
 TF_DIR=terraform
 SOPS_FILES=controlplane.yaml worker.yaml talosconfig
 
@@ -12,11 +12,29 @@ plan:
 	cd $(TF_DIR) && terraform plan
 
 apply:
+	cd $(TF_DIR) && terraform apply -target=talos_cluster_kubeconfig.this
 	cd $(TF_DIR) && terraform apply
 
 destroy:
 	cd $(TF_DIR) && terraform destroy
 
+# Full clean slate - run before destroy when recreating from scratch
+# Removes resources that block terraform from recreating cleanly
+clean:
+	@echo "==> Force-deleting Secrets Manager secret..."
+	-aws secretsmanager delete-secret --secret-id $(SECRET) --force-delete-without-recovery 2>/dev/null || true
+	@echo "==> Emptying S3 buckets..."
+	-aws s3 rm s3://dumpnet-logs --recursive 2>/dev/null || true
+	-aws s3 rm s3://dumpnet-athena-results --recursive 2>/dev/null || true
+	@echo "==> Clearing stale kubeconfig contexts..."
+	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
+	-kubectl config delete-cluster dumpnet 2>/dev/null || true
+	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
+	@echo "==> Clearing stale talosctl contexts..."
+	-talosctl config remove dumpnet 2>/dev/null || true
+	-talosctl config remove dumpnet-1 2>/dev/null || true
+	@echo "==> Done. Run 'make destroy' then 'make apply' to rebuild from scratch."
+
 # Bootstrap ArgoCD app of apps (run once after cluster is up)
 bootstrap:
 	kubectl apply -f apps/apps.yaml
@@ -32,6 +50,9 @@ talosconfig:
 	talosctl config context dumpnet
 
 kubeconfig:
+	-kubectl config delete-context admin@dumpnet 2>/dev/null || true
+	-kubectl config delete-cluster dumpnet 2>/dev/null || true
+	-kubectl config delete-user admin@dumpnet 2>/dev/null || true
 	aws secretsmanager get-secret-value --secret-id $(SECRET) \
 	  --query SecretString --output text | python3 -c \
 	  "import sys,json; print(json.load(sys.stdin)['cluster']['kubeconfig'])" \