From 5d8ac8646099358c096edc5714c15685259a6ec9 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Tue, 6 Oct 2026 22:38:02 +0500
Subject: [PATCH] uralkal: deliver kafka creds for issues, flows and pm from
 kafka-topics

Step 2 of 2 - push only after the pipeline for the previous commit has
applied. secrets[] writes kafka/apps/issues and kafka/apps/flows (user proc)
and kafka/apps/pm (user pm) from the kafka-topics outputs, so the password
in Vault is the one actually set in the broker. Fields are flat
(username, password, sasl_mechanism, ...), there is no nested auth map.
---
 infrastructure-secrets.yaml | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index a4c572d..3f37073 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -6037,6 +6037,30 @@ environments:
               vault_path: vault/apps/transmittal
               data:
                 TRANSMITTAL_SERVICE_MAILGUN__API_KEY: ENC[AES256_GCM,data:yVcpkuRKgBw=,iv:Yf86p4E9uzx5X9VK3LzsiGVFxdvc6MyTd85wKcpBKc4=,tag:6rbO+yodbM/0rit1VHCj5Q==,type:str]
+            - name: issues-kafka
+              namespace: issues
+              type: kafka
+              sink: vault
+              vault_path: kafka/apps/issues
+              depends_on:
+                kafka_ref: main
+                kafka_user: proc
+            - name: flows-kafka
+              namespace: flows
+              type: kafka
+              sink: vault
+              vault_path: kafka/apps/flows
+              depends_on:
+                kafka_ref: main
+                kafka_user: proc
+            - name: pm-kafka
+              namespace: pm
+              type: kafka
+              sink: vault
+              vault_path: kafka/apps/pm
+              depends_on:
+                kafka_ref: main
+                kafka_user: pm
 sops:
     age:
         - recipient: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt
@@ -6057,7 +6081,7 @@ sops:
             dkhZMjdzdUh4bEQ5dDN2NnZabjBtUTQKeV6OU8Ob1P9j9E2G8ydznEX+vjHQhlEP
             fXp6UP1kQrRRAOEuhH4cyXT2YgPq5HMcDemyFHUH0JPxiew370fMzA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-06T17:37:12Z"
-    mac: ENC[AES256_GCM,data:rLSH0tzLo89vpiDxxeEGCquRY2IqOp4Nx+pkomR+NO64t5wOxmasH7ZBA9cX/iYO7b3FJi9K8cQwoQWWxVSvx3m2E957Y4QAoIloK8cbfU/3eGjyeu3kafmKys9oMOxPjjfCwAEpEM2NBblnOUqljk6C5mBYGadD6adOpzbHMmQ=,iv:TAjkOebP8VSFJ3eIq6uf/Pg37QI4XOy+DodMy3Wr5Ls=,tag:voMy9NJt4AQ72W0vBFqmog==,type:str]
+    lastmodified: "2026-10-06T17:37:47Z"
+    mac: ENC[AES256_GCM,data:fzj47xarhlaONJcnVvnwfmSdwDcBgTWIWtWMJqdOO2RC0LK5VX7kWAijbj4CYf2R8nn4Qec29ZXfhg6zQ+OIC3hhm8xiPRjtTzzPWkrkFmOARN0bLpK+e8qVNBwWymBnR5oE4P71LuT1VJ/lT3xBmzD/NECGFk9iUquSRTxqE6c=,iv:PbY6R/3vFtgiCp3dtEaWKXoUuo8fTH8lDcZ3pryrlEg=,tag:enG2lHvUqxUZiACQufnmIA==,type:str]
     encrypted_regex: ^(data)$
     version: 3.12.2