From 2fb0b416d7f40851faa078b1c57344235ac08109 Mon Sep 17 00:00:00 2001
From: Work <work@ehs-MacBook-Pro.local>
Date: Mon, 26 Jan 2026 15:58:04 +0300
Subject: [PATCH] change pipeline generation + add tf dockerfile

---
 live/stage/secrets/terragrunt.hcl | 42 +++++++++++++------------------
 scripts/generate-pipeline.sh      |  6 ++---
 2 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/live/stage/secrets/terragrunt.hcl b/live/stage/secrets/terragrunt.hcl
index 16a1773..0681a95 100644
--- a/live/stage/secrets/terragrunt.hcl
+++ b/live/stage/secrets/terragrunt.hcl
@@ -1,23 +1,19 @@
-# Включение корневой конфигурации
 include "root" {
   path = find_in_parent_folders()
 }
 
-# Включение конфигурации окружения
 include "env" {
   path           = find_in_parent_folders("env.hcl")
   expose         = true
   merge_strategy = "deep"
 }
 
-# Зависимости от других компонентов
 dependency "namespace" {
   config_path = "../namespace"
   mock_outputs = {
     name = "pulse"
   }
   mock_outputs_allowed_terraform_commands = ["validate", "plan"]
-  # При apply используем реальные outputs, не mock
 }
 
 dependency "s3" {
@@ -28,7 +24,6 @@ dependency "s3" {
     secret_key  = "mock-secret-key"
   }
   mock_outputs_allowed_terraform_commands = ["validate", "plan"]
-  # При apply используем реальные outputs, не mock
 }
 
 dependency "database" {
@@ -40,10 +35,8 @@ dependency "database" {
     password     = "mock-password"
   }
   mock_outputs_allowed_terraform_commands = ["validate", "plan"]
-  # При apply используем реальные outputs, не mock
 }
 
-# Сертификат Yandex Cloud PostgreSQL (константа, не копируется в infrastructure.yaml)
 locals {
   yc_postgresql_ca_cert = <<-EOT
 -----BEGIN CERTIFICATE-----
@@ -112,20 +105,26 @@ EOT
   env_name = basename(dirname(get_terragrunt_dir()))
   env_config   = local.infra_config.environments[local.env_name]
   secrets      = local.env_config.secrets
+  
+  namespace_name = dependency.namespace.outputs.name
+  s3_bucket_name = dependency.s3.outputs.bucket_name
+  s3_access_key  = dependency.s3.outputs.access_key
+  s3_secret_key  = dependency.s3.outputs.secret_key
+  db_host         = dependency.database.outputs.host
+  db_database_name = dependency.database.outputs.database_name
+  db_user_name    = dependency.database.outputs.user_name
+  db_password     = dependency.database.outputs.password
 }
 
-# Путь к модулю
 terraform {
   source = "${get_terragrunt_dir()}/../../../modules//k8s-secret"
 }
 
-# Входные переменные из конфига - модуль сам формирует data из зависимостей
 inputs = {
-  # Передаем секреты как есть из infrastructure.yaml, модуль сам обработает type и dependencies
   secrets = [
     for secret in local.secrets : {
       name          = secret.name
-      namespace     = dependency.namespace.outputs.name
+      namespace     = local.namespace_name
       secret_type   = secret.type
       registry_url  = try(secret.registry_url, "")
       dependencies  = try(secret.dependencies, {})
@@ -137,39 +136,32 @@ inputs = {
     }
   ]
   
-  # Зависимости от других модулей
   s3_outputs = {
-    bucket_name = dependency.s3.outputs.bucket_name
-    access_key  = dependency.s3.outputs.access_key
-    secret_key  = dependency.s3.outputs.secret_key
+    bucket_name = local.s3_bucket_name
+    access_key  = local.s3_access_key
+    secret_key  = local.s3_secret_key
   }
   
-  # Database outputs как map, ключ = "cluster_id:database_name:user_name"
-  # Собираем все базы данных из infrastructure.yaml
   database_outputs_map = {
-    # Текущая база из dependency
     "${local.env_config.databases[0].cluster_id}:${local.env_config.databases[0].database.name}:${local.env_config.databases[0].user.name}" = {
-      host         = dependency.database.outputs.host
-      database_name = dependency.database.outputs.database_name
-      user_name    = dependency.database.outputs.user_name
-      password     = dependency.database.outputs.password
+      host         = local.db_host
+      database_name = local.db_database_name
+      user_name    = local.db_user_name
+      password     = local.db_password
     }
   }
   
-  # Константы
   constants = {
     s3_endpoint   = "https://storage.yandexcloud.net"
     postgres_port = "6432"
     postgres_ca   = local.yc_postgresql_ca_cert
   }
   
-  # Environment variables
   env_vars = {
     DOCKER_REGISTRY_USERNAME = get_env("DOCKER_REGISTRY_USERNAME", "")
     DOCKER_REGISTRY_PASSWORD = get_env("DOCKER_REGISTRY_PASSWORD", "")
   }
   
-  # Провайдеры (передаются в сгенерированный provider.tf)
   yc_token       = get_env("YC_TOKEN", "")
   yc_cloud_id    = get_env("YC_CLOUD_ID", "")
   yc_folder_id   = get_env("YC_STAGE_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
diff --git a/scripts/generate-pipeline.sh b/scripts/generate-pipeline.sh
index 19272b1..a2e1201 100755
--- a/scripts/generate-pipeline.sh
+++ b/scripts/generate-pipeline.sh
@@ -94,7 +94,7 @@ validate-${job_prefix}:
     - export TF_PLUGIN_CACHE_DIR=/root/.terraform.d/plugin-cache
   script:
     - env | grep -E "(S3_|AWS_)" || echo "No S3/AWS vars found"
-    - terragrunt init -reconfigure
+    - terragrunt init -upgrade -reconfigure
     - terragrunt validate
   rules:
     - if: '\$CI_PIPELINE_SOURCE == "merge_request_event"'
@@ -128,7 +128,7 @@ plan-${job_prefix}:
     - ls -la
     - rm -rf .terragrunt-cache
   script:
-    - terragrunt init -reconfigure
+    - terragrunt init -upgrade -reconfigure
     - terragrunt plan -out=tfplan
   rules:
     - if: '\$CI_COMMIT_BRANCH == "master" || \$CI_COMMIT_BRANCH == "main"'
@@ -174,7 +174,7 @@ apply-${job_prefix}:
     - ls -la
     - rm -rf .terragrunt-cache
   script:
-    - terragrunt init -reconfigure || true
+    - terragrunt init -upgrade -reconfigure 
     - terragrunt apply tfplan
   rules:
     - if: '\$CI_COMMIT_BRANCH == "master" || \$CI_COMMIT_BRANCH == "main"'