gitops: Terraform AWS substrate reconcile as a GitOps prerequisite (ordering cross-reference)

[ausbru87]

Goal

Cross-reference and ordering only: the AWS substrate stays Terraform, and the
imperative AWS reconciliation backlog must land before GitOps adoption. This
issue does not add GitOps work; it tracks the dependency. Plan:
docs/plans/gitops-adoption.md (section 6.3). Source backlog:
docs/as-built/80-iac-vs-imperative.md.

Ordering

1. Terraform first. Fold the imperative backlog into Terraform: standard EKS (drop Auto Mode), the mng node group and usgov-coderdemo-mngnode role, the four EKS addons and the EBS CSI IRSA role, the gp3-backing addon, the Route53 alias records, the ECR repos, and the IRSA roles GitOps depends on.
2. Then the GitOps control plane bootstrap (sibling plan).
3. Then per-workload adoption (the other issues in this label).

Tasks (Terraform side)

• Import the ESO IRSA role usgov-coderdemo-external-secrets into Terraform state before apply (it was created via CLI; recreating it breaks ESO auth).
• Adopt the Route53 alias records (dev, auth, gitlab, *) into Terraform without delete/recreate so DNS never drops.
• Ensure the IRSA roles GitOps workloads rely on (ESO, the LB controller, the coder Bedrock role) and the ASM secret containers exist before adoption.
• Keep EKS Secrets envelope encryption (customer-managed KMS) deferred: it is irreversible and gated on a maintenance window (terraform/secrets-hardening.tf); orthogonal to GitOps, does not block adoption.

Note

This is an ordering dependency, not new GitOps work. See docs/as-built/80-iac-vs-imperative.md for the full ledger and the complete reconciliation backlog.

Generated by Coder Agents.