Merge pull request #1571 from alphagov/import-licensify-namespace-con…

…figuration

Import `licensify` namespace into Terraform

terraform/deployments/cluster-services/argo.tf

@@ -41,6 +41,29 @@ resource "kubernetes_namespace" "apps" {
   }
 }
 
+import {
+  to = kubernetes_namespace.licensify
+  id = "licensify"
+}
+
+resource "kubernetes_namespace" "licensify" {
+  metadata {
+    name = var.licensify_namespace
+    annotations = {
+      "argocd.argoproj.io/sync-options" = "ServerSideApply=true"
+    }
+    labels = {
+      "app.kubernetes.io/managed-by"  = "Terraform"
+      "argocd.argoproj.io/managed-by" = "cluster-services"
+      # https://kubernetes-sigs.github.io/aws-load-balancer-controller/latest/deploy/pod_readiness_gate/
+      "elbv2.k8s.aws/pod-readiness-gate-inject" = "enabled"
+      "pod-security.kubernetes.io/audit"        = "restricted"
+      "pod-security.kubernetes.io/enforce"      = "baseline"
+      "pod-security.kubernetes.io/warn"         = "restricted"
+    }
+  }
+}
+
 resource "helm_release" "argo_cd" {
   chart            = "argo-cd"
   name             = "argo-cd"

terraform/deployments/cluster-services/variables.tf

@@ -4,6 +4,12 @@ variable "apps_namespace" {
   default     = "apps"
 }
 
+variable "licensify_namespace" {
+  type        = string
+  description = "Name of the namespace to create for ArgoCD to deploy licensify apps into by default."
+  default     = "licensify"
+}
+
 variable "argo_workflows_namespaces" {
   type        = list(string)
   description = "Namespaces in which Argo will run workflows."