Add BIM ClickHouse secret to prod

infrastructure.yaml

@@ -275,6 +275,35 @@ environments:
         lifecycle:
           ignore_changes: true                     
 
+      - name: bim-yc-clickhouse-secret
+        namespace: platform
+        type: opaque
+        custom_keys:
+          CLICKHOUSE_SSL: "true"
+        constant_keys:
+          CLICKHOUSE_CERT: postgres_ca
+        random_keys:
+          CLICKHOUSE_HOST:
+            length: 32
+            special: false
+          CLICKHOUSE_PORT:
+            length: 5
+            special: false
+          CLICKHOUSE_HOSTNAME:
+            length: 32
+            special: false
+          CLICKHOUSE_DATABASE:
+            length: 32
+            special: false
+          CLICKHOUSE_USER:
+            length: 32
+            special: false
+          CLICKHOUSE_PASSWORD:
+            length: 32
+            special: false
+        lifecycle:
+          ignore_changes: true
+
       # # Пример секрета для другой базы данных (test_db/test)
       # - name: test-db-secret
       #   namespace: pulse

live/prod/env.hcl

@@ -1,8 +1,8 @@
 # Конфигурация для окружения prod
 locals {
   environment = "prod"
-  folder_id  = get_env("YC_PROD_FOLDER_ID", "")
+  folder_id   = get_env("YC_PROD_FOLDER_ID", "")
-  
+
   # Общие параметры для всех компонентов в prod
   common_tags = {
     Environment = "prod"

live/prod/secrets/terragrunt.hcl

@@ -15,7 +15,7 @@ dependency "namespace" {
     names      = []
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
-  skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
+  skip_outputs                            = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
 }
 
 dependency "s3" {
@@ -28,7 +28,7 @@ dependency "s3" {
     service_accounts = {}
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
-  skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
+  skip_outputs                            = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
 }
 
 dependency "database" {
@@ -37,7 +37,7 @@ dependency "database" {
     database_outputs_map = {}
   }
   mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
-  skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
+  skip_outputs                            = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
 }
 
 locals {
@@ -123,6 +123,7 @@ inputs = {
       dependencies    = try(secret.dependencies, {})
       yc_sa_key_names = try(secret.yc_sa_key_names, {})
       custom_keys     = try(secret.custom_keys, {})
+      constant_keys   = try(secret.constant_keys, {})
       random_keys     = try(secret.random_keys, {})
       labels          = try(secret.labels, {})
       annotations     = try(secret.annotations, {})

modules/k8s-secret/main.tf

@@ -80,6 +80,9 @@ locals {
         endpoint                                                   = "https://storage.yandexcloud.net"
       },
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
@@ -95,12 +98,18 @@ locals {
       },
       # Кастомные статические поля
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       # Рандомные поля
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : merge(
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }

modules/k8s-secret/variables.tf

@@ -17,7 +17,8 @@ variable "secrets" {
       secret_key         = optional(string, "secret_key")
       service_account_id = optional(string, "service_account_id")
     }), {})
-    custom_keys = optional(map(string), {})
+    custom_keys   = optional(map(string), {})
+    constant_keys = optional(map(string), {})
     random_keys = optional(map(object({
       length  = optional(number, 32)
       special = optional(bool, false)