From 4b487e1fa03f6aa005b1c916513108e93b32446e Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 26 Aug 2026 14:03:22 +0300
Subject: [PATCH] ++ eliminate identity-password circular vault reference

---
 infrastructure-secrets.yaml | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 7a3aa44..c5865da 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -3397,15 +3397,6 @@ environments:
                 cluster: main
                 db: bitnami_keycloak
                 user: bn_keycloak
-            - name: camunda-identity-db-staging
-              namespace: camunda
-              type: database
-              sink: vault
-              vault_path: camunda/_identity_db
-              depends_on:
-                cluster: main
-                db: identity
-                user: identity
             - id: camunda-postgresql
               schema: ""
               namespace: camunda
@@ -3414,14 +3405,16 @@ environments:
                 - kind: vault
                   path: camunda/postgresql
               extra_fields:
-                identity-password:
-                    source:
-                        kind: secret_ref
-                        ref: vault://camunda/_identity_db#password
                 postgres-password:
                     source:
                         kind: secret_ref
                         ref: vault://postgresql/admin#postgres-password
+              source:
+                kind: postgresql_user
+                ref:
+                    cluster: main
+                    database: identity
+                    user: identity
             - name: camunda-keycloak-admin
               namespace: camunda
               type: opaque
@@ -3455,8 +3448,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:51:20Z"
-    mac: ENC[AES256_GCM,data:W23t50wsfClvwTAHRXDxxJg3TEQ5TqHFuG7P5OT/c/872HCgsOjh3o6WBIspchYBLAtXQweecdvrUR5w52dLTpsKaCwJTAZ1i1pLJMmICYGp6a8QoNELcJjrRgkpxdeyVKV/V6ZwMo1N92P61V6OYOYdzEpaOvNHwa4fhpG0e2U=,iv:X13weR1HofdpZhuGcgSkinEf8DpzHnKkbV2v2GRZ+so=,tag:gfoz9sUhHNXBsiPZrGN6eg==,type:str]
+    lastmodified: "2026-08-26T11:02:57Z"
+    mac: ENC[AES256_GCM,data:EZ4ZH7f9rbft7ZiGpWQIRGOOC85eShvjSPr1FBHUUZp8ULj520GttwTQZMafzBbEhuc69eAC4vS34ZcdfHtU2JacmLUZynLT2dzWQprMwqqeft/40jLJTTJkmjFFEcqOOioIVkL/9diCrb7U6BlBMzwNpOVHs7sx7FFgzssvBDE=,iv:eM/B/l+ZAow39Likb8ZTqqU1YAFa2hGnLJHAh32OKIo=,tag:iZgKo2seNYpHe2UQm9UqTA==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2