Add BIM ClickHouse secret to prod

infrastructure.yaml

@@ -275,6 +275,35 @@ environments:
         lifecycle:
           ignore_changes: true                     
 
+      - name: bim-yc-clickhouse-secret
+        namespace: platform
+        type: opaque
+        custom_keys:
+          CLICKHOUSE_SSL: "true"
+        constant_keys:
+          CLICKHOUSE_CERT: postgres_ca
+        random_keys:
+          CLICKHOUSE_HOST:
+            length: 32
+            special: false
+          CLICKHOUSE_PORT:
+            length: 5
+            special: false
+          CLICKHOUSE_HOSTNAME:
+            length: 32
+            special: false
+          CLICKHOUSE_DATABASE:
+            length: 32
+            special: false
+          CLICKHOUSE_USER:
+            length: 32
+            special: false
+          CLICKHOUSE_PASSWORD:
+            length: 32
+            special: false
+        lifecycle:
+          ignore_changes: true
+
       # # Пример секрета для другой базы данных (test_db/test)
       # - name: test-db-secret
       #   namespace: pulse

live/prod/secrets/terragrunt.hcl

@@ -123,6 +123,7 @@ inputs = {
       dependencies    = try(secret.dependencies, {})
       yc_sa_key_names = try(secret.yc_sa_key_names, {})
       custom_keys     = try(secret.custom_keys, {})
+      constant_keys   = try(secret.constant_keys, {})
       random_keys     = try(secret.random_keys, {})
       labels          = try(secret.labels, {})
       annotations     = try(secret.annotations, {})

modules/k8s-secret/main.tf

@@ -80,6 +80,9 @@ locals {
         endpoint                                                   = "https://storage.yandexcloud.net"
       },
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
@@ -95,12 +98,18 @@ locals {
       },
       # Кастомные статические поля
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       # Рандомные поля
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }
       ) : merge(
       try(secret.custom_keys, {}),
+      {
+        for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
+      },
       {
         for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
       }

modules/k8s-secret/variables.tf

@@ -18,6 +18,7 @@ variable "secrets" {
       service_account_id = optional(string, "service_account_id")
     }), {})
     custom_keys   = optional(map(string), {})
+    constant_keys = optional(map(string), {})
     random_keys = optional(map(object({
       length  = optional(number, 32)
       special = optional(bool, false)