From 54e27e384094418814ca95881eead3504381b1e9 Mon Sep 17 00:00:00 2001
From: Work <work@ehs-MacBook-Pro.local>
Date: Wed, 28 Jan 2026 15:25:49 +0300
Subject: [PATCH] test terragrunt ci

---
 infrastructure.yaml               |  6 +++++-
 live/stage/secrets/terragrunt.hcl | 27 +++++++--------------------
 modules/k8s-secret/main.tf        |  7 ++++---
 modules/k8s-secret/variables.tf   | 14 +++++++++++++-
 4 files changed, 29 insertions(+), 25 deletions(-)

diff --git a/infrastructure.yaml b/infrastructure.yaml
index 3079f14..09352a2 100644
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@@ -28,14 +28,18 @@ environments:
       - name: pulse-s3-secret
         namespace: pulse
         type: s3
+        dependencies:
+          bucket: pulse-stage
         lifecycle:
           ignore_changes: false
 
       - name: testci-s3-secret
         namespace: testci
         type: s3
+        dependencies:
+          bucket: testci-stage
         lifecycle:
-          ignore_changes: true
+          ignore_changes: false
 
       - name: pulse-postgresql-secret
         namespace: pulse
diff --git a/live/stage/secrets/terragrunt.hcl b/live/stage/secrets/terragrunt.hcl
index d376ef6..5fb27de 100644
--- a/live/stage/secrets/terragrunt.hcl
+++ b/live/stage/secrets/terragrunt.hcl
@@ -11,11 +11,8 @@ include "env" {
 dependency "namespace" {
   config_path = "../namespace"
   mock_outputs = {
-    namespaces = {
-      "pulse"          = { name = "pulse", id = "mock-id-1" }
-      "block-analyzer" = { name = "block-analyzer", id = "mock-id-2" }
-    }
-    names = ["pulse", "block-analyzer"]
+    namespaces = {}
+    names      = []
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
   skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
@@ -24,9 +21,10 @@ dependency "namespace" {
 dependency "s3" {
   config_path = "../s3"
   mock_outputs = {
-    bucket_name = "pulse-stage"
+    bucket_name = "mock-bucket"
     access_key  = "mock-access-key"
     secret_key  = "mock-secret-key"
+    buckets     = {}
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
   skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
@@ -35,20 +33,7 @@ dependency "s3" {
 dependency "database" {
   config_path = "../database"
   mock_outputs = {
-    database_outputs_map = {
-      "c9qa2coo5ukgcg93fldm:pulse_db:pulse" = {
-        host          = "mock-host.example.com"
-        database_name = "pulse_db"
-        user_name     = "pulse"
-        password      = "mock-password"
-      }
-      "c9qa2coo5ukgcg93fldm:analyzer_db:analyzer" = {
-        host          = "mock-host.example.com"
-        database_name = "analyzer_db"
-        user_name     = "analyzer"
-        password      = "mock-password"
-      }
-    }
+    database_outputs_map = {}
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
   skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
@@ -149,6 +134,8 @@ inputs = {
     secret_key  = dependency.s3.outputs.secret_key
   }
 
+  s3_buckets_map = dependency.s3.outputs.buckets
+
   database_outputs_map = dependency.database.outputs.database_outputs_map
 
   constants = {
diff --git a/modules/k8s-secret/main.tf b/modules/k8s-secret/main.tf
index 0b10147..f254df0 100644
--- a/modules/k8s-secret/main.tf
+++ b/modules/k8s-secret/main.tf
@@ -44,9 +44,10 @@ locals {
           }
         })
       } : secret.secret_type == "s3" ? {
-        access_key = var.s3_outputs.access_key
-        secret_key = var.s3_outputs.secret_key
-        bucket     = var.s3_outputs.bucket_name
+        # Если указан конкретный bucket в dependencies - используем его, иначе fallback на s3_outputs
+        access_key = try(var.s3_buckets_map[secret.dependencies.bucket].access_key, var.s3_outputs.access_key)
+        secret_key = try(var.s3_buckets_map[secret.dependencies.bucket].secret_key, var.s3_outputs.secret_key)
+        bucket     = try(var.s3_buckets_map[secret.dependencies.bucket].bucket_name, var.s3_outputs.bucket_name)
         endpoint   = try(var.constants.s3_endpoint, "https://storage.yandexcloud.net")
       } : secret.secret_type == "database" && local.database_outputs_by_secret[name] != null ? merge(
         # Базовые поля из database outputs
diff --git a/modules/k8s-secret/variables.tf b/modules/k8s-secret/variables.tf
index d919482..05149da 100644
--- a/modules/k8s-secret/variables.tf
+++ b/modules/k8s-secret/variables.tf
@@ -9,6 +9,7 @@ variable "secrets" {
       cluster = optional(string, "")
       db      = optional(string, "")
       user    = optional(string, "")
+      bucket  = optional(string, "")  # Имя бакета для s3 секретов
     }), {}) 
     custom_keys   = optional(map(string), {})
     random_keys   = optional(map(object({
@@ -22,7 +23,7 @@ variable "secrets" {
 }
 
 variable "s3_outputs" {
-  description = "Outputs от модуля S3"
+  description = "Outputs от модуля S3 (default/первый бакет)"
   type = object({
     bucket_name = optional(string, "")
     access_key  = optional(string, "")
@@ -35,6 +36,17 @@ variable "s3_outputs" {
   }
 }
 
+variable "s3_buckets_map" {
+  description = "Map всех бакетов (name => data)"
+  type = map(object({
+    bucket_name        = string
+    access_key         = string
+    secret_key         = string
+    service_account_id = optional(string, "")
+  }))
+  default = {}
+}
+
 variable "database_outputs_map" {
   description = "Outputs от модулей Database, ключ = cluster_id:database_name:user_name"
   type = map(object({