chore/go api cleanup followup

base-infrastructure/terraform/imports.tf

@@ -1,28 +0,0 @@
-# One-off adoption of resources that predate this configuration.
-#
-# The go-api workload identity was created outside Terraform for the legacy
-# `go-api-<environment>-workload-sa` federation, under the same name
-# module.go_api_resources derives from app_name and environment, so the first
-# apply of that module fails with "resource already exists".
-#
-# The identity holds no role assignments, and the federated credential the legacy
-# deployment uses stays unmanaged: the module adds a second credential rather than
-# replacing it, so both service accounts keep working during the parallel run.
-#
-# NOTE: Terraform owns the identity once this is imported, so destroying
-# module.go_api_resources also removes the legacy credential along with its parent.
-#
-# TODO: Clear this file once staging and production have both been applied.
-
-locals {
-  # Every environment in this configuration lives in the same subscription.
-  subscription_id = "39308fb0-9929-4b29-aafa-b3c78a8b0658"
-
-  # Mirrors azurerm_user_assigned_identity.workload in ./app_resources/iam.tf
-  go_api_workload_identity_name = "${replace(title("go-api"), "-", "")}${title(var.environment)}WorkloadIdentity"
-}
-
-import {
-  to = module.go_api_resources.azurerm_user_assigned_identity.workload
-  id = "/subscriptions/${local.subscription_id}/resourceGroups/${module.resources.resource_group}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${local.go_api_workload_identity_name}"
-}

base-infrastructure/terraform/resources/aks.tf

@@ -58,14 +58,3 @@ resource "azurerm_role_assignment" "storage" {
   role_definition_name = "Storage Account Contributor"
   principal_id         = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id
 }
-
-# Kubernetes provider. No resource in this configuration uses it, and it cannot be deleted
-# while an orphaned kubernetes_* resource is still in state. This block sits inside a child
-# module, so its provider address cannot be implied; destroying such an orphan without it
-# fails with "Provider configuration not present".
-provider "kubernetes" {
-  host                   = azurerm_kubernetes_cluster.ifrcgo.kube_config[0].host
-  client_certificate     = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_certificate)
-  client_key             = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_key)
-  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].cluster_ca_certificate)
-}

base-infrastructure/terraform/resources/bastion.tf

@@ -5,11 +5,6 @@
 # applied via this helm_release (matching how the other cluster components — traefik,
 # argocd, cert-manager, etc. — are deployed).
 #
-# TODO: An older copy of this bastion is still shipped by the go-api Helm chart
-# (deploy/helm/ifrcgo-helm/templates/bastion.yaml) and runs in the `default` namespace.
-# Both run in parallel for now; users should migrate to the new IP exposed by this
-# resource. The go-api copy will be removed in the upcoming go-api updates.
-#
 # NOTE: after editing anything under charts/ssh-bastion, bump the chart `version` in
 # Chart.yaml so the helm provider detects the change and redeploys.
 

base-infrastructure/terraform/resources/providers.tf

@@ -14,10 +14,6 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.17.0"
     }
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "=2.24.0"
-    }
     random = {
       source  = "hashicorp/random"
       version = "~> 3.5.1"