++ enforce canonical field set for all v2 schemas, not just rabbitmq.v1

modules/k8s-secret/main.tf

@@ -315,12 +315,75 @@ locals {
     )
   }
 
-  # rabbitmq.v1 differs from the legacy field-set only in "hostname": legacy
-  # ships host:port there, the canonical schema wants host alone.
+  # Canonical field sets per schema (opaque.v1 has no fixed set by design -
+  # "only named fields from allowed sources" - the legacy custom_keys/
+  # constant_keys catch-all already is exactly that, no adjustment needed).
+  canonical_schema_fields = {
+    "postgresql.v1" = ["host", "port", "database", "username", "password", "sslmode", "ca", "url"]
+    "kafka.v1"       = ["bootstrap_servers", "username", "password", "sasl_mechanism", "security_protocol", "ca"]
+    "rabbitmq.v1"    = ["host", "port", "hostname", "username", "password", "vhost", "uri", "management_endpoint"]
+    "s3.v1"          = ["endpoint", "region", "bucket", "access_key_id", "secret_access_key"]
+    "valkey.v1"      = ["host", "port", "username", "password", "tls", "ca", "url"]
+  }
+
+  # Legacy field names/shapes -> canonical ones, computed once per schema on
+  # top of the legacy-computed base data. Only the fields that differ from
+  # legacy (renamed or genuinely new) are listed here; secrets_data_schema_adjusted
+  # below picks out exactly the canonical key set from this, dropping anything
+  # legacy-only (e.g. rabbitmq/kafka's "user" alias, database's "ca.crt").
+  secrets_data_canonical_source = {
+    for name, secret in local.secrets_map : name => (
+      try(secret.schema, "") == "postgresql.v1" && local.database_outputs_by_secret[name] != null ? merge(
+        local.secrets_data_base[name],
+        {
+          ca      = try(local.secrets_data_base[name]["ca.crt"], "")
+          sslmode = try(var.constants.postgres_sslmode, "require")
+          url = format(
+            "postgresql://%s:%s@%s:%s/%s?sslmode=%s",
+            try(local.secrets_data_base[name].username, ""),
+            try(local.secrets_data_base[name].password, ""),
+            try(local.secrets_data_base[name].host, ""),
+            try(local.secrets_data_base[name].port, ""),
+            try(local.secrets_data_base[name].database, ""),
+            try(var.constants.postgres_sslmode, "require"),
+          )
+        }
+      ) :
+      try(secret.schema, "") == "kafka.v1" && local.kafka_outputs_by_secret[name] != null ? merge(
+        local.secrets_data_base[name],
+        { ca = try(var.constants.kafka_ca, "") }
+      ) :
+      try(secret.schema, "") == "rabbitmq.v1" && local.rabbitmq_outputs_by_secret[name] != null ? merge(
+        local.secrets_data_base[name],
+        { hostname = local.rabbitmq_outputs_by_secret[name].host }
+      ) :
+      try(secret.schema, "") == "s3.v1" ? merge(
+        local.secrets_data_base[name],
+        {
+          access_key_id     = try(local.secrets_data_base[name].access_key, "")
+          secret_access_key = try(local.secrets_data_base[name].secret_key, "")
+          region            = try(var.constants.s3_region, "us-east-1")
+        }
+      ) :
+      try(secret.schema, "") == "valkey.v1" && local.valkey_outputs_by_secret[name] != null ? merge(
+        local.secrets_data_base[name],
+        {
+          username = try(local.secrets_data_base[name].login, "")
+          ca       = try(local.secrets_data_base[name].cert, "")
+          tls      = try(local.secrets_data_base[name].cert, "") != "" ? "true" : "false"
+        }
+      ) :
+      local.secrets_data_base[name]
+    )
+  }
+
   secrets_data_schema_adjusted = {
     for name, secret in local.secrets_map : name => (
-      try(secret.schema, "") == "rabbitmq.v1" && local.rabbitmq_outputs_by_secret[name] != null
-      ? merge(local.secrets_data_base[name], { hostname = local.rabbitmq_outputs_by_secret[name].host })
+      contains(keys(local.canonical_schema_fields), try(secret.schema, ""))
+      ? {
+        for k in local.canonical_schema_fields[secret.schema] : k =>
+        try(local.secrets_data_canonical_source[name][k], "")
+      }
       : local.secrets_data_base[name]
     )
   }