From 28b26e1dad23addfceba2bc48a0da3fac04ef452 Mon Sep 17 00:00:00 2001
From: Work <work@ehs-MacBook-Pro.local>
Date: Wed, 28 Jan 2026 14:27:18 +0300
Subject: [PATCH] fixes

---
 .gitlab-ci.yml               | 2 --
 live/terragrunt.hcl          | 6 +++---
 scripts/generate-pipeline.sh | 7 ++-----
 3 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index babbe84..17b9bd6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -41,8 +41,6 @@ trigger-downstream:
     S3_STATE_BUCKET: ${S3_STATE_BUCKET}
     AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
     AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
-    KUBECONFIG: ${KUBECONFIG}
-    KUBE_CONTEXT: ${KUBE_CONTEXT}
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"'
diff --git a/live/terragrunt.hcl b/live/terragrunt.hcl
index 56aa657..305edea 100644
--- a/live/terragrunt.hcl
+++ b/live/terragrunt.hcl
@@ -52,9 +52,9 @@ provider "yandex" {
 }
 
 provider "kubernetes" {
-  # Если kubeconfig_path не указан, провайдер использует дефолтный путь ~/.kube/config
-  # Если указан, берем только первый путь (KUBECONFIG может содержать несколько путей через :)
-  config_path    = var.kubeconfig_path != "" ? split(":", var.kubeconfig_path)[0] : null
+  # Если kubeconfig_path указан и файл существует - используем его
+  # Иначе провайдер автоматически использует in-cluster config (для runner'а в k8s)
+  config_path    = var.kubeconfig_path != "" ? var.kubeconfig_path : null
   config_context = var.kube_context != "" ? var.kube_context : null
 }
 
diff --git a/scripts/generate-pipeline.sh b/scripts/generate-pipeline.sh
index 002ea8a..b84d5d3 100755
--- a/scripts/generate-pipeline.sh
+++ b/scripts/generate-pipeline.sh
@@ -118,11 +118,8 @@ plan-${job_prefix}:
 
 PLAN_JOB
 
-  if [ "$env" = "prod" ]; then
-    when_clause="manual"
-  else
-    when_clause="on_success"
-  fi
+  # Apply всегда manual
+  when_clause="manual"
   
   apply_needs="plan-${job_prefix}"
   if [ "$component" = "secrets" ]; then