fix camunda vault secrets: restore admin/firstuser/db passwords as explicit values, add identity-password/keycloak-password fields to camunda_postgresql secret

infrastructure-secrets.yaml

@@ -1340,7 +1340,7 @@ environments:
               lifecycle:
                 ignore_changes: false
               data:
-                test-key: ENC[AES256_GCM,data:kuxtOu8Jf+6pIBOFJSDF0w==,iv:X4prcqoF966X+RCetGXd1H5EvjdJmBseiRrP5qZW+Ok=,tag:DuXrYstF2skc6dvP19abNw==,type:str]
+                test-key: ENC[AES256_GCM,data:jBkZ/S+WqKBfegjPaGT3Ig==,iv:rDGhROt0OSy+kGAhqirYyEeOrEyntJz2hzn7KX6ROrw=,tag:rXgn142fiN9ZeQscbfk3Xw==,type:str]
             - name: test-db-k8s
               namespace: contour
               type: database
@@ -1926,17 +1926,17 @@ environments:
                                 password: ENC[AES256_GCM,data:s1Ogbd8a2XWwIRmpwE8/LfCL5nQDx3pJ1Ojl2erkNCE=,iv:W83tq9ErfzBbmbouCNT3gkvhyilSN+KA/3ViMSlMRXU=,tag:vehf//Phf6ijngyUIWqwtQ==,type:str]
                                 topics:
                                     - configs:
-                                        cleanup.policy: ENC[AES256_GCM,data:bci0at7a,iv:4A4fDSiY17839hTiEI4VIg6kFRUV4cs7p50nE/Zqf0k=,tag:IKyGJFmXi7Ihiqfo+51hIQ==,type:str]
+                                        cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
-                                        retention.ms: ENC[AES256_GCM,data:OHpBeqDdg6ZA,iv:wH4ZxKyhj5tcxTCefdVMda2G6LzPJExhnnQFYQmMkOk=,tag:lGhCH2CiYXujdwNwSS4I4w==,type:str]
+                                        retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
                                       name: ENC[AES256_GCM,data:t+M3aITQpWjkV90=,iv:nuCdm9JJeDNQiiiGB0D3y9xsRcmd7pNOfT73azOEufg=,tag:w3GePrjSSHS0DvEQw0qS8Q==,type:str]
-                                      partitions: ENC[AES256_GCM,data:WA==,iv:16BCF08lvhzJmeOtaEeeWHul2ACVyGr6klnnBANyljo=,tag:UH7Td0GRtY3sna+1VGXUaQ==,type:int]
+                                      partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int]
-                                      replication_factor: ENC[AES256_GCM,data:mw==,iv:2p3IeM+gCV2rjRouMsorJmPW32oWWa0YK4bKx3oMHI4=,tag:RvuqtMdYYJvMqvUHeqTrCA==,type:int]
+                                      replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int]
                                     - configs:
-                                        cleanup.policy: ENC[AES256_GCM,data:Prc/53fC,iv:8okyNgdamRmI1R2KvabFPGF7scUSpdI/kU7XUKz0fdg=,tag:51DKWHZ1CwqfyLgqNWeV+w==,type:str]
+                                        cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
-                                        retention.ms: ENC[AES256_GCM,data:FPHsif9etKCT,iv:8moCT36zXh7G80sbIaXi4UwNZBGIS/Zr8nUc2uRe+gg=,tag:5v5wM7baOBIKyVfbts3Iow==,type:str]
+                                        retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
                                       name: ENC[AES256_GCM,data:KnVT/mTcdE+ghdaXD3eeHQ==,iv:r6XURr//smAiOjkENgdGcUXWG1X6lqFxeelEe3Y2I+0=,tag:tz1JSBqg/PAwpy0LNZ0QGQ==,type:str]
-                                      partitions: ENC[AES256_GCM,data:7g==,iv:UNyFsa4tT0Z6t+p/yn8EWYg96Wv+RFXkpPu7coFL+b8=,tag:QBzQRcWtckQPoyIVi9KRuA==,type:int]
+                                      partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int]
-                                      replication_factor: ENC[AES256_GCM,data:Ew==,iv:gEibiPAvcgPgGddC1ETlluNpUMo0Aqb/hbU75jp5DTc=,tag:HsAcaSPS1DcO15Du//JBJg==,type:int]
+                                      replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int]
                                     - configs:
                                         cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
                                         retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
@@ -2255,14 +2255,16 @@ environments:
                                 zeebe-secret: ENC[AES256_GCM,data:VFHr9YgTNqk/Y7rxFAtzzesqTFR1CN5Hs28feTzGprw=,iv:GUcI8kA33x5pk32xtd2hi0pI4OUrUfTw0LqxB+LpaEU=,tag:GIRuB0nVcsm6xrzrzjxzrw==,type:str]
                         identity_firstuser:
                             generate: ENC[AES256_GCM,data:gWbO/m0=,iv:CmmL0AGJRkg8DlSkmqoVQ2fyLHnPFMzmBkybZ9FRm8o=,tag:Urk9ZM8b34SYai+5Qq9gyg==,type:bool]
-                            identity_firstuser_password: ""
+                            identity_firstuser_password: ENC[AES256_GCM,data:cSvwDBwDu3o/pHwczcYdyqCUHQEe66U226ewJ/m55M8=,iv:GNt8A9qRxFD3uy6eKOm7J/yvO4NOcgY/LwVSDJOiDRc=,tag:OclWcsoxq6sWWrFpUsTptg==,type:str]
                         keycloak_admin:
                             generate: ENC[AES256_GCM,data:zYEwUzA=,iv:s1Nwr1dhc/U5NfDQHRKZjoOWAM+ujXSxNzu1HVZTNxE=,tag:0+eo0KzX+PqVapSwpncf3w==,type:bool]
-                            admin_password: ""
+                            admin_password: ENC[AES256_GCM,data:4JZNKfW144z1mSihzVstq0r6FcOOnwktZqLrR0xiGSw=,iv:d65e7Raj0jYe3xRmqIgLAj03l+dk/ZeKnPDxLC6wSSI=,tag:s7Laa3kknsCKXAIVXLQjNg==,type:str]
                         postgresql:
                             generate: ENC[AES256_GCM,data:zWVwwOA=,iv:Jj1eHN8g2SxhZ2fmaPa4nONESE5Dgss1TpRCATBrncQ=,tag:ldOgGZko8qtMIWuGGqjJ7A==,type:bool]
                             password: ""
                             postgres_password: ""
+                            identity_password: ENC[AES256_GCM,data:YSdu6h9QUODVHsGKVn8+7/K/1c/phTyrfptezC+lfyWFFNtqGpGCOUUcd48vmTwJYH8I712QQHfYybmpe+2p3w==,iv:NLW5G79zsvlxMBTEPmswftRf6nyEWbdAbfPLCFa8mKU=,tag:hL0GWlrn9pYOFiiaAqPNzw==,type:str]
+                            keycloak_password: ENC[AES256_GCM,data:w7M/YauGeGzZz/0l9uar83+fjLDZi5fx6oB6GmuOYE6ECd82wixX60VKCwPNv+Y+jEbkLJab8cxnH9gbqDSbvQ==,iv:FLqj9NiIBg2s2RPkZqFynWSJ6kHLdILp8ickZbQeEfM=,tag:QLCNVmuocmECfcjjXRi90Q==,type:str]
         secrets:
             - name: attachments-postgres
               type: database
@@ -2626,8 +2628,8 @@ sops:
             dDV2c1FBTkdLajFtWHdDZjM1NjJQSzgK2ysr++aBuJeW67hdOg5Phqw2Jg6/4PqB
             qWKvglUwZfaMMOqGIMqw++wbgDNHLOl/pkoDb30qcC4NqW2Us7clXg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-07T08:53:29Z"
+    lastmodified: "2026-08-07T11:35:00Z"
-    mac: ENC[AES256_GCM,data:b81s5abLYTZfqCGXnuu0Hi9eYa91X6vzr6Ktzzyyc0k2yjQAlQf8l+rTOiGE/0IfLi6SVBMhUC1fbRsLVp+LTQY65PJRkzQ+wbF9UPEocvFn65ayQ4KblAJskRm1LizD0YUyCR/bmdYgmn/llaOaA6x/rNv6C9jrWB+Brp0eVeQ=,iv:IanfOu4Vs0CcXS85bKeJCDT33Xu+ZZnL0cpINaZSYmA=,tag:GjCRYWcAUC5YZ1y0gS4z+g==,type:str]
+    mac: ENC[AES256_GCM,data:Hhr1B1KVvJgwPrKafRLKhx6fGKpMMFpIToo017/BZ/vggCvTcwdRJgihNoqBErMjYHaDuCaBbtHRUkxdbFVt5hkIbEXae/ftjlT9GCZtvNAU++KZgx6AjMjD+/Yv/HHpXggwY1DvmGZLdLK2G2+QC4pUJmO51muwDjFvwVX3/nI=,iv:Hi8A8nvkIvIxPBU6O1GfpVbBZMWP6CG9AhMnHVvMl5U=,tag:ieaRgmsYg2MbAn5dEM8IZw==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.9.0

modules/vault-platform-secrets/main.tf

@@ -191,6 +191,8 @@ locals {
         generate          = false
         password          = ""
         postgres_password = ""
+        identity_password = ""
+        keycloak_password = ""
       }
       role = {
         enabled                    = true
@@ -504,6 +506,16 @@ locals {
   camunda_pg_postgres_password = trimspace(try(local.camunda_pg_cfg.postgres_password, "")) != "" ? trimspace(local.camunda_pg_cfg.postgres_password) : (
     try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_postgres_password[0].result, "") : ""
   )
+  # identity-password / keycloak-password are the two distinct app-DB user passwords
+  # (users "identity" and "bn_keycloak") that camunda-identity/camunda-keycloak vault-agent
+  # templates actually read from this secret - separate from the generic password/postgres-password
+  # fields above, which no consumer reads.
+  camunda_pg_identity_password = trimspace(try(local.camunda_pg_cfg.identity_password, "")) != "" ? trimspace(local.camunda_pg_cfg.identity_password) : (
+    try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_identity_password[0].result, "") : ""
+  )
+  camunda_pg_keycloak_password = trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) != "" ? trimspace(local.camunda_pg_cfg.keycloak_password) : (
+    try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_keycloak_password[0].result, "") : ""
+  )
 
   keycloak_admin_password = trimspace(try(local.keycloak_admin_cfg.password, "")) != "" ? trimspace(local.keycloak_admin_cfg.password) : (
     try(local.keycloak_admin_cfg.generate, false) ? try(random_password.keycloak_admin_password[0].result, "") : ""
@@ -922,6 +934,20 @@ resource "random_password" "camunda_pg_postgres_password" {
   special = false
 }
 
+resource "random_password" "camunda_pg_identity_password" {
+  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.identity_password, "")) == "" ? 1 : 0
+
+  length  = 32
+  special = false
+}
+
+resource "random_password" "camunda_pg_keycloak_password" {
+  count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) == "" ? 1 : 0
+
+  length  = 32
+  special = false
+}
+
 resource "random_password" "keycloak_admin_password" {
   count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) && try(local.keycloak_admin_cfg.generate, false) && trimspace(try(local.keycloak_admin_cfg.password, "")) == "" ? 1 : 0
 
@@ -1184,6 +1210,8 @@ resource "vault_kv_secret_v2" "camunda_postgresql" {
   data_json = jsonencode({
     password            = local.camunda_pg_password
     "postgres-password" = local.camunda_pg_postgres_password
+    "identity-password" = local.camunda_pg_identity_password
+    "keycloak-password" = local.camunda_pg_keycloak_password
   })
 }