++ fix infrastructre.yaml

infrastructure.yaml

@@ -1,9 +1,5 @@
 current_environment: yc-k8s-test
 
-# Contour branch — one declarative source for ALL closed contours. The concrete
-# contour is selected by INFRA_ENV (falls back to current_environment). Entities
-# use the SAME schema/contract as the product master branch; only the backend is
-# in-cluster (see live/terragrunt.hcl providers). ++ ++ ++ ++ ++
 environments:
   ugmk:
     namespaces:
@@ -350,9 +346,6 @@ environments:
     buckets: []
 
     kafka:
-      # Broker has no authorizer configured (authorizer.class.name unset) —
-      # any ACL write is rejected with "Security features are disabled".
-      # Topics/users still work; skip ACLs until the broker enables one.
       create_acls: false
       kafka_cluster_refs:
         main:
@@ -579,20 +572,16 @@ environments:
           vhost: test-vhost
           durable: true
 
-  # brusnika-stage — приёмочный тест декларативного контракта секретов v2
-  # (см. SECRETS-CONTRACT-PLAN.md) перед массовым переключением на схемы.
   brusnika-stage:
     namespaces:
       - name: test-terraform
         manage: true
-        image_pull_secret: false # regcred сюда приходит через v2 ownership=referenced, не через legacy fan-out
+        image_pull_secret: false 
       - name: rabbitmq-module-test
         manage: true
         image_pull_secret: false
 
-    # In-cluster RabbitMQ (bitnami, ns django). Admin creds - secrets/rabbitmq/auth
+
-    # в Vault, засеяно вручную из существующего django/rabbitmq-secret (см. план,
-    # раздел 11 "Предусловие").
     rabbitmq:
       amqp_host: rabbitmq-service.django.svc.cluster.local
       amqp_port: 5672
@@ -617,9 +606,7 @@ environments:
           configure: ".*"
           write: ".*"
           read: ".*"
-      # Пилот внешнего модуля terraform-modules/rabbitmq (RABBITMQ-MODULE-PILOT.md) -
+
-      # отдельные vhost/user/queue от test-terraform, чтобы не трогать уже рабочий
-      # secrets-contract-probe. Задействует все сущности, которые умеет модуль.
       topic_permissions:
         - vhost: rabbitmq-module-test
           user: rabbitmq-module-test

live/rabbitmq/terragrunt.hcl

@@ -16,6 +16,16 @@ locals {
   )
 
   env_config = try(local.infra_config.environments[local.env_name], {})
+
+  contracts = dependency.contracts.outputs.rabbitmq_module_inputs
+}
+
+dependency "contracts" {
+  config_path = "../contracts"
+  mock_outputs = {
+    rabbitmq_module_inputs = { vhosts = [], users = [], permissions = [], queues = [] }
+  }
+  mock_outputs_allowed_terraform_commands = ["init", "validate", "plan", "state", "import"]
 }
 
 remote_state {
@@ -54,12 +64,12 @@ inputs = {
   amqp_host           = try(local.env_config.rabbitmq.amqp_host, "rabbitmq.rabbitmq.svc.cluster.local")
   amqp_port           = try(local.env_config.rabbitmq.amqp_port, 5672)
 
-  vhosts            = try(local.env_config.rabbitmq.vhosts, [])
+  vhosts            = concat(try(local.env_config.rabbitmq.vhosts, []), local.contracts.vhosts)
-  users             = try(local.env_config.rabbitmq.users, [])
+  users             = concat(try(local.env_config.rabbitmq.users, []), local.contracts.users)
-  permissions       = try(local.env_config.rabbitmq.permissions, [])
+  permissions       = concat(try(local.env_config.rabbitmq.permissions, []), local.contracts.permissions)
   topic_permissions = try(local.env_config.rabbitmq.topic_permissions, [])
   exchanges         = try(local.env_config.rabbitmq.exchanges, [])
-  queues            = try(local.env_config.rabbitmq.queues, [])
+  queues            = concat(try(local.env_config.rabbitmq.queues, []), local.contracts.queues)
   bindings          = try(local.env_config.rabbitmq.bindings, [])
   policies          = try(local.env_config.rabbitmq.policies, [])
 }