From 70e268745911aaa40a13b57041cca693fa6dd6a9 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Tue, 6 Oct 2026 22:37:35 +0500
Subject: [PATCH] uralkal: kafka users proc and pm, application topics; stop
 writing stale kafka creds

Step 1 of 2. kafka-topics creates SCRAM users proc (issues, flows) and pm
(pm, message-hub) and topics issues_broadcast_prod, assets_broadcast,
message-hub-prod, iam.resource.updated.v2, iam.resource.deleted.v2.

vault-secrets stops writing kafka/apps/{issues,flows,pm}: those held a
generated password for users that were never created in the broker. Step 2
re-creates the same paths from the kafka-topics outputs via secrets[]; it is
a separate commit because vault-secrets runs after secrets and its destroy
would soft-delete the version secrets has just written.
---
 infrastructure-secrets.yaml | 10 +++++-----
 infrastructure.yaml         | 31 +++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index dcfd3a9..a4c572d 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -5569,13 +5569,13 @@ environments:
                                 enabled: ENC[AES256_GCM,data:hhgQkQ==,iv:8KBnUHp/oNEc6gc3YYoTKeZZpla+axeG7T7eXZ0omAc=,tag:CVDQ94SXA2kpWIpjuWyQLA==,type:bool]
                                 generate: ENC[AES256_GCM,data:9Vaz+A==,iv:ktwr2P04dl4U+oHGgxYCtGCR+sHZ+gQWYoHmW1URkA0=,tag:6Rlp0jTqig0z/obJ8VYXNg==,type:bool]
                             issues:
-                                enabled: ENC[AES256_GCM,data:5Avtrw==,iv:+q50d9SMsqPjMzA/xxHUTyXpVoTx8/b4MgX/SNi+tvg=,tag:K4BQxGnrYUKnuVEjOYmq5g==,type:bool]
+                                enabled: ENC[AES256_GCM,data:To0FZ1U=,iv:CscdYLy9GNNYNmWMXYGR2j0qqgleizrPR6w+L1GB3mk=,tag:UKfIClKwaCEF6LquUsBjcw==,type:bool]
                                 generate: ENC[AES256_GCM,data:woo6GA==,iv:Uv+muRzskETKKX0Qkf7ScPnRwnvHCp/guG0YK9mo/4U=,tag:YnORrh2zSDy0tca0mjpemA==,type:bool]
                             flows:
-                                enabled: ENC[AES256_GCM,data:JXvs3Q==,iv:MiLaxYm3kzhZwu5MN7C9iXL5RmKxOseIlt9RW+z7VtU=,tag:lsNuUf3PIn1iAlMmmZsySw==,type:bool]
+                                enabled: ENC[AES256_GCM,data:jJoMdDk=,iv:h0Ehhkt3Rnc6SyOVgwHsSwKdaf8NctBeS0WDYAvF+gg=,tag:g5rR0MD8pl6Pj8pDaOkAlg==,type:bool]
                                 generate: ENC[AES256_GCM,data:+8Bzig==,iv:p+zF9jo+tzD2hV9CjGjszQwmjeDWzCp6HZxFw1gfnfc=,tag:QzEYO8aeghAxNpKBltkSdw==,type:bool]
                             pm:
-                                enabled: ENC[AES256_GCM,data:JYSn1w==,iv:A4afUwyZH40jfCgMycTKWSq6HGQ9sz+MMeHT2AdVSGA=,tag:V2NWRmmF1dvvnAut5TIqVA==,type:bool]
+                                enabled: ENC[AES256_GCM,data:pFLb0mI=,iv:OlKsAKKBwaXL9jOXUXnqBXpF+tVV1y9noj27Jd0UdIw=,tag:lq3pIbJSf3hjyK4mViuLYg==,type:bool]
                                 generate: ENC[AES256_GCM,data:92jLdw==,iv:wsc/1lxBIIK3lAD9KXuAN7fYaq8ftn0VYZp9VqYAEZA=,tag:EmrWciwdyiWlJfTstfs85A==,type:bool]
                     zitadel:
                         postgresql:
@@ -6057,7 +6057,7 @@ sops:
             dkhZMjdzdUh4bEQ5dDN2NnZabjBtUTQKeV6OU8Ob1P9j9E2G8ydznEX+vjHQhlEP
             fXp6UP1kQrRRAOEuhH4cyXT2YgPq5HMcDemyFHUH0JPxiew370fMzA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-10-06T11:04:30Z"
-    mac: ENC[AES256_GCM,data:4hGSiw/JeBAt1qz8EYPx3Zh0MUr93NC+5ok4sEF76m27Jc3KwLYYIjuB7zezJxwy8Iik4cyExcMejk9ChUGOanE8KPFpZ2++vDUKevlLsp6wiXIQko4ml2DJWp9r/2rPdz6FteQquxLhhn95ebJdjrcS0aQZCYnqy1empSuR31M=,iv:xRHOlkTcBRIuZX2BqQuydYvvvlIX6Tcw84+1oFKk0nA=,tag:i8QcEgAE3jehHFqS5cFW0A==,type:str]
+    lastmodified: "2026-10-06T17:37:12Z"
+    mac: ENC[AES256_GCM,data:rLSH0tzLo89vpiDxxeEGCquRY2IqOp4Nx+pkomR+NO64t5wOxmasH7ZBA9cX/iYO7b3FJi9K8cQwoQWWxVSvx3m2E957Y4QAoIloK8cbfU/3eGjyeu3kafmKys9oMOxPjjfCwAEpEM2NBblnOUqljk6C5mBYGadD6adOpzbHMmQ=,iv:TAjkOebP8VSFJ3eIq6uf/Pg37QI4XOy+DodMy3Wr5Ls=,tag:voMy9NJt4AQ72W0vBFqmog==,type:str]
     encrypted_regex: ^(data)$
     version: 3.12.2
diff --git a/infrastructure.yaml b/infrastructure.yaml
index 5b63d05..4bc2fb7 100644
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@@ -1716,6 +1716,31 @@ environments:
           clusterRef: main
           partitions: 3
           replicationFactor: 1
+        - name: issues_broadcast_prod
+          owner: proc
+          clusterRef: main
+          partitions: 3
+          replicationFactor: 1
+        - name: assets_broadcast
+          owner: proc
+          clusterRef: main
+          partitions: 3
+          replicationFactor: 1
+        - name: message-hub-prod
+          owner: pm
+          clusterRef: main
+          partitions: 3
+          replicationFactor: 1
+        - name: iam.resource.updated.v2
+          owner: pm
+          clusterRef: main
+          partitions: 3
+          replicationFactor: 1
+        - name: iam.resource.deleted.v2
+          owner: pm
+          clusterRef: main
+          partitions: 3
+          replicationFactor: 1
       users:
         - name: uralkal-test
           clusterRef: main
@@ -1723,6 +1748,12 @@ environments:
             - topic: uralkal.test.event.v1
               roles:
                 - PRODUCER
+        # proc - общий пользователь issues и flows (как в vad)
+        - name: proc
+          clusterRef: main
+        # pm - общий пользователь pm и message-hub
+        - name: pm
+          clusterRef: main
 
     rabbitmq:
       amqp_host: rabbitmq.rabbitmq.svc.cluster.local