feat: manage the UniFi network declaratively via tofu-controller

[devantler]

What & why

Manage the UniFi network declaratively as a platform tenant. The desired
state lives in the public repo
devantler-tech/unifi (plain OpenTofu
using filipowm/unifi);
this PR installs tofu-controller and wires a unifi tenant so the cluster
reconciles that repo against the controller API.

devantler-tech/unifi (public; OpenTofu, filipowm/unifi)
   │  Flux GitRepository (ns: unifi, no auth — public, no secrets)
   ▼
Terraform CR (tofu-controller, infra.contrib.fluxcd.io/v1alpha2)
   │  tf-runner pod runs OpenTofu; state in a Secret in the unifi namespace
   ▼  ↑ unifi-credentials ← ExternalSecret ← OpenBao (openbao ClusterSecretStore)
UniFi Controller API   (reached from Hetzner)

The repo is public and holds no secrets; the only sensitive value (the UniFi
API key) lives in OpenBao and is pulled in via an ExternalSecret — exactly
like external-dns's Cloudflare token. A real-CRD provider-upjet-unifi
(Crossplane) is the tracked steady-state follow-up. See docs/unifi-management.md.

Contents

• infrastructure/controllers/tofu-controller/ — HelmRepository + HelmRelease
  (flux-iac chart 0.16.4, installs the Terraform CRD), registered in the
  controllers kustomization. Prod-only.
• providers/hetzner/unifi/ — namespace (restricted PSS), tf-runner SA +
  namespaced RBAC, CiliumNetworkPolicy, GitRepository (public, no auth),
  Terraform CR, and an ExternalSecret pulling the API creds from OpenBao.
• bases/infrastructure/vault-config/job.yaml — adds the infra-unifi-readonly
  OpenBao policy and attaches it to the external-secrets role.
• clusters/prod/unifi-flux-kustomization.yaml — dedicated, isolated,
  prod-only Flux Kustomization (wait: false, dependsOn: infrastructure) so a
  UniFi stall never blocks app deploys (same rationale as overprovisioning).
• docs/unifi-management.md.

Safety (observe-first)

• Terraform CR ships approvePlan: "" → plan only, never applies. Review
  the plan, import existing objects until it's a no-op, then approve a specific
  plan id (or flip to auto) once trusted.
• destroyResourcesOnDeletion: false — deleting the CR never tears down the network.

Gate (maintainer) — one secret; Kustomization is red by design until done

Generate a Limited Admin, Local Access Only API key (UniFi OS ≥ 9.0.108) and seed
OpenBao:

bao kv put secret/infrastructure/unifi/controller \
  api_url=https://<controller> api_key=<api-key>

(api_url omits the /api path.) GitOps alternative: SOPS-encrypt in
variables-cluster + a PushSecret under providers/hetzner/infrastructure/vault-seed/.

Validate on the live cluster before promoting

• Runner ↔ controller mTLS: SPIRE require-mutual-auth applies to the
  tofu-controller ↔ tf-runner gRPC (:30000). Cilium auto-issues SPIFFE identities,
  so the L3/L4 allow should suffice — confirm the runner connects.
• Runner PSS: namespace enforces restricted; if the tf-runner image can't
  run non-root, rely on Kyverno securityContext mutation or relax to baseline.
• HelmRelease values: confirm chart 0.16.4 value paths and Kyverno fit.
• Egress: networkpolicy.yaml allows world:443,8443; tighten to the
  controller address + OpenTofu registry FQDNs once known.

Validation done

ksail workload validate --config ksail.prod.yaml → 324 files validated, pass
(incl. the Terraform CR and ExternalSecret). kubectl kustomize builds clean.

Companion PRs: scaffold + docs in devantler-tech/unifi
(#1); submodule registration
monorepo#1861;
provider-upjet-unifi tracking issue monorepo#1860.

🤖 Generated with Claude Code

[botantler-1]

🎉 This PR is included in version 1.69.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀