add wb environment, one test entity per resource type (namespace, rabbitmq vhost/user/queue, external postgres db/user, external minio bucket) plus matching v2 secret contracts

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-10-17 21:51:35 +03:00 · 2026-08-11 13:33:54 +03:00 · 2026-08-11 13:33:54 +03:00 · d5a2d639ad
commit d5a2d639ad
parent d74baefa30
2 changed files with 132 additions and 11 deletions
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@ -1340,7 +1340,7 @@ environments:
              lifecycle:
                ignore_changes: false
              data:
-                test-key: ENC[AES256_GCM,data:DX3UhBAdbh7yKWUWPNuQLw==,iv:DAbgKIuVeObF3XKdg+cn/m+AB9rkYjCROmykGOD6SKU=,tag:UNBWttsZdGjafHuzlBnCEg==,type:str]
+                test-key: ENC[AES256_GCM,data:B8th/+URQxw4lZwx0BGboA==,iv:RPR253FkVQY7+U0pmJ1XXUhKwXquNMSxWT1UXhH9/OE=,tag:5zinYmvo49yGaEknCEZRfw==,type:str]
            - name: test-db-k8s
              namespace: contour
              type: database
@ -1929,17 +1929,17 @@ environments:
                                password: ENC[AES256_GCM,data:BhJrmuz/6swAkM+jIM5XRi6zPbsLmf02E/3mKNzmm34=,iv:5vd4c5fyyZSOYdLNBoTuF0ziwQTjooRjpYq2/dOq/ls=,tag:cWbLMRXVuguNjkD4RXHwDg==,type:str]
                                topics:
                                    - configs:
-                                        cleanup.policy: ENC[AES256_GCM,data:/5EDtWyy,iv:nyn8UJreUZikGzse1GJuAOLu/UZZrbY/mWOukgVOy4U=,tag:4MeNFsQmEguvI4saKATR9g==,type:str]
-                                        retention.ms: ENC[AES256_GCM,data:5LroAP689xuT,iv:Mc1jwgoG6M+FLeuKn6hHp/+KCQbno4CdoRAh/JyGzFU=,tag:DHFcs8jEKMaISaZHNYOX3Q==,type:str]
+                                        cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str]
+                                        retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str]
                                      name: ENC[AES256_GCM,data:Df+Rsaq6UgC76Gg=,iv:LeqgrtdkOkd/0Xd7R57aYIbaMYxLB0N45PXgYCtBRTw=,tag:PcFe3ETDDad+pxPvk7ExGw==,type:str]
-                                      partitions: ENC[AES256_GCM,data:Yg==,iv:pzdu/ULwX76qceliTkMnltGH9oo7OnQEUVMQG7l0BPU=,tag:aH7Q8owfTM9jMDOJMiJKtQ==,type:int]
-                                      replication_factor: ENC[AES256_GCM,data:WA==,iv:m73FLiiipJmqK/6MOciDvV8xihr1lqFb0mBID7YYbJE=,tag:pkPMIkdHSOv3BiCML2qyBg==,type:int]
+                                      partitions: ENC[AES256_GCM,data:hQ==,iv:DIGPV4uWpYJ67Em0FW6mOGR2ee/dlHUr/YHLyC2GJrE=,tag:ogwqxqvUl4i5XcN09Epcog==,type:int]
+                                      replication_factor: ENC[AES256_GCM,data:7w==,iv:C2CG1LOdk5txLC2b5FbqrNYhGGlSfUcXi3O0wKny+ns=,tag:YMipZpRar+yLQoZlZJcgQA==,type:int]
                                    - configs:
-                                        cleanup.policy: ENC[AES256_GCM,data:rtiThdxs,iv:6QZs290joYQTFVoe0sUuzplpcemCiqNqF4XJCAwUbEE=,tag:Joj0RlVWEC4lV+SDRHLTzQ==,type:str]
-                                        retention.ms: ENC[AES256_GCM,data:YSUuD37KhnVx,iv:Vopub1c4UA4u29CBtNTLU/gfP5xaJqiqd04P9LNorco=,tag:dVh9Fj4vnW5xwtgUgsdPnQ==,type:str]
+                                        cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str]
+                                        retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str]
                                      name: ENC[AES256_GCM,data:Khmfl9ayUFBUgtT7o5Ehrw==,iv:Q5GTUNEBW+Se8Pks2LiHazs0pPpaY5GiRXpEK9aRE4Y=,tag:s9a8J2v90W1qVDLEXGDaog==,type:str]
-                                      partitions: ENC[AES256_GCM,data:og==,iv:nR//mkCSWcIs89Pi7XJSxx5UX5GWoKnb4giT6o1TMao=,tag:MvvTF5EpHIFqBrykTXHY9Q==,type:int]
-                                      replication_factor: ENC[AES256_GCM,data:sg==,iv:RR9Kblkl/3KSrkUxeOk75n9k4uSw6lz0ifCO0paiRQk=,tag:VHzy6BcZkZI+NCdB7h00cg==,type:int]
+                                      partitions: ENC[AES256_GCM,data:hQ==,iv:DIGPV4uWpYJ67Em0FW6mOGR2ee/dlHUr/YHLyC2GJrE=,tag:ogwqxqvUl4i5XcN09Epcog==,type:int]
+                                      replication_factor: ENC[AES256_GCM,data:7w==,iv:C2CG1LOdk5txLC2b5FbqrNYhGGlSfUcXi3O0wKny+ns=,tag:YMipZpRar+yLQoZlZJcgQA==,type:int]
                                    - configs:
                                        cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str]
                                        retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str]
@ -2627,7 +2627,82 @@ environments:
                - kind: kubernetes
                  namespace: rabbitmq-module-test
                  name: rabbitmq
+    wb:
+        vault:
+            enabled: true
+            kv_mount: secrets
+            path_prefix: vault
+            features:
+                create_regcred: true
+                create_smtp_auth: false
+                create_django_auth: false
+                create_rsa_keys: false
+                create_infra_secrets: false
+                create_infra_policies: false
+                create_infra_roles: false
+                create_app_policies: false
+                create_app_roles: false
+            applications: {}
+            data:
+                common:
+                    regcred:
+                        dockerconfigjson: ENC[AES256_GCM,data:5dbsw0RLol7SQg4kPNd0xpxOvuknGJMEDof6ef+Eooc5CCi7qlMgQMfJSc7u+2I0yhJ7Gbz05zV4GqcT35QHA9ci8eZa4kNHxEXaoHTzM2j9mqrwzP6/iwImYee9XfkdpT38LSQw43gX2OWdDAAQsxZCwkLQIlNSEmNpNtH9aGbpfP+S1EaLMkop49hegfphyzAP3ugJuMfdcRAVbAViB55XHW4FXUV+vjR530Ps0ir0aoCt5h3nZIbu7Aw4Suh691bIkHy0SmqF10CxYpsQuXoVdscJGSvjPYbnjP8rgSShXSAf8RD8v0Vf8RmKx8p6uy7FlEJ/Pk5Y2BHEQyYQoj5f8Km/y8svi0gHnsO8YwCMqEE9PkTLbQBd7Ras1tEFl6H+u7Kr7zk6FMhMyJxy3hQkj4LAcmkeXwGhjEieFtDM6e7LDrSGF1ls4gIoXn93rjDpO4sGo9w3sDD4WaUqO+FJW0van6X6JP+2fPXCN0Zd3uKBhtaehNR7KaiMaFD/nzDlgJgI89k7zY1j+/eVwO2tqqFDOlS2oOtrCawz9HqFLku95zKBZKuM+rNJwpJLHaPKcsHKombyAG7fsna2aRyAJhBmnfuMJCXnhrO/MllNnz36uFHO3c54aHQE5mby2gtYMU8FRlGwIyxgaY7eV4RPbvyF7fSsvLN5NvaYJEa5SCQP9P9HFMWOg8kXmEHBMJXd00chKtkbumWeA68r85nmMd366h+R9lQF5Dq6XSuU3V8tPrkYmQro+hDvNDkOO/5XvInp6nwECa5pxKno4zJvoh1JFc8h0anEOVWDfNwysFueTt8G0qEK1OUJIQuUmgV9Rg5HM1X32VMzf2kWGeqbh+BTrDoupQXSvIx4bvehA1PPexW1/EIbNXNXe16QRBBphiAbOP1xOiovPM7sQRO2Gtg7pypZatEpBCA8DkHPOSowJa+W5QZdBWX36QwptqgEm2Dug8Vs73PN8Vjtm3J/4L12FUXNMWwj/hBLoRuD7MFr1c02beSl+6vsVXZbHpcfY2sPDn17wg10kSX55ID/uUvvBbWZUZQqEqF9s4AAj3h6UW4pBa8azDu6LGxCTWkeUD9XunI1Ir2beuxa5xAnXjM5vXDhYMhaAvcXgJE1VO3M2j2JxRJNJwWcXUXTtjtX5bixc41ER68DPq5vcnO64rVBq9VIgRR73em5gDmUyTmr3R0h5mrJXheaPDEqzHJYM7HzZyOIVkkzB7AiCUsC6AXA1xukizwov6pOVFcmGc2JUuOJGF0sO/QVev3m56r9X8tGDB0jElnCasMPTgmq2Pg1lDUod1EzBffO1Y21pJD0UNxDrnlJkIv4V1LEPyPJayQoicKdv6bnw+llgjHCUqBUxiGxO6cPah+PkFhZY8PRaDyofbyoIiQs19CBkbvgtebJ8MipQP3amljxB1+jpbacmu+bKbSvdKU/l+gkGsGfu1jzWBoMpFJCqsVihe3WwAlkYbnt2816tfxxS3Vo/FxIJZMpBjmdqE3Ckpuz5jPvUMObkVMlbXVUO7HuKGW7wIrixE03k7FuxhAj1ZICMn6hc6syh6/YWilnR9L+xtxk3sYK+f9JSeY4EUIloqmmkdg01xZh76Se5BpsXUWRzlAub3hToR4NVvDMoX0XE6PTGm+k5itOcs7mRqlccaMQU1+VyJu9zWEgy4Ua08cIDrcjE8VTUU4quPfHhKdDK3pqgbExGFw5Ybm3GvuTJ6zdN4cO/rAMPlQMRDYX5CKouW0oOQEJmtFKkrELFgDlZqoh72awr6iH+rAgAg+7lArMvspaI4z9HSANn+y1/oO/HZ09kEb9FKsycVQYlFpIBmiWtFAMQEaLcjr07hQupIZd7INWpCjlxsF4m+RYIsTCVhybff+cX7GdMaIm9kHhOT5k6k/CxiPHimfXFjOWjnmrCURRf1kQWATBptsWZJ35/jIJGRrEBzeA6KnSEB4mvl+Jik+t0z4op+nukuG6tGmGG/+cpy0jkouihETAo7IRx4hi7QV9OiM1sYJ8dLRAzSKFhEGMmd6JrR9AF7mW4HPVGMtIKmOu2hJz4VXAJTisD2c0kckFCo8Gi6vHDdGurSU70KU31z7nLtySSTGHDG/5/sHnY+o3fCFlXxmvY/VfgW+TusSc04RCMY/e3R1JHGL+IRMquXweNqD6MXi/qNbnLKM15c3DMow2Gxp4Rpl6THpeINrhnhamMd+6CPKwPfh6XFRYLYNn6cWuEB5vy582PrljZh+C7w75lsDLdo6+GpzUwBMC8Y//ZtXYJ5KdHGbIWjkL1rNBAps4UVNpevlcf/qOetQMuqMrK+2aqWhmWNJOw5ZwTpm8JmDN+AuXqq+vJAS0RXZd0tm5s0z/RG65lKVHz37DT75vfsE20C4xSig1FUfpIVC/FoLWyD8OK5mydX2J4Zkt1JtahOB/TaGVuB+VIZbiFR4TITCQNZ7qBKBwAaVH0mJOVsktJLRJ4e3JdVfsigXuXHEbPJZCLjmHIpUz/CHtFN05Bal7f74kMrjKtfmH1ciNq4Q70QcP1REhGzQ50AqLcUyzhlNBM5AXQ0q4z6Ki6UsBxc5BzGLk5KtzkddTgzQYYQZ1TOcYBNwdIuN8Clc8Npl0wrA302OcFfp6KhmTWQ3UoaSje1+dsHrO+tYJZf23gI4abTAvZ3IL3hI3NZTffjmEQxE9dC2oYiNtGiN1a9g6Psg8uVok9HOpWBu51xk/HiGNafYkDUNtSYEJwIqb4CZLyxRt7ITvw74c46mCBMn/gD5pHQ9qnbKdyV5+sxSpj+GSQSjeE1lBQmvPqEwxPFNvu1xwWf8uGIwZcapCeNac9k0buOWjuxnWbf+cUpKFjfDTVBslwctSFdnAwFJ5NdN0p1AtwCUcOO4ASoJryyYKA1P4E1U6BrPRDYYwVY/nQzeNcDRgX9Otw5eH8GD6Sky/AWIGTKGNyLLuWAs02ACIQgwaVevhw46FHghA1/Mh7sIH2YfP2ziElFcvcaF+8+W2fqLY/hKfsO00GT4VpCu3g4VmjEBV0MHgRNr6CcDfkC0Soz2E5mQxpJM+BOb1v/uOfc5Nn+oX1G14vaC4P2Es1Dhnz7jWBhWKNqaG/8zeHhq+oLQgQA8pFeIVPQJa6SUe1iycYvsqKiXd5oERmmuXSlKBVM6PpIFmjJ9PMO8Ap2fV1pHdA+tp+REGOvG0X7GRc9q624JjqaS+hRDQ9L0eW08dw9zETO4ugbmQv/pOjC5qskqIW5IRjj3Mxpf54Hjj59sH/UHkhg4YAnPx/0vvpVPTa2mHwx+C78YYuBAH4jx29YYx5MYsoxkUYVMDhOMhpMdRDq9cKH68xeYf/Ux9QJnQG7wxCdSkpmh9oIVMl7vksqTKjiJKuKdVkZ7NAjddoFa/2iW0s/iYH3+7MAIGhn4T9V9OBGwZoNb7bd5k6RvsPudaze5f/C4Adszva88YOhFvYeOGSq8mXLIzLj1J0iB0ZSTQMhNntXV8fehQZgwzNApZW1TMxdUlWGXCRnSsa/sS0KF5RYCacc95pJyDxNrIANm49mtx5yOdyKWVmcQ0IpVE+X0HZh0u6y6Ff0ctsfdPhLpHmYOhyd0hFgY1hiVSt0uAyh4LCEmBEYkA7L0BEEJiNQ0VuyWJ4HPVrckcJ7gCfmIxtRufD67SzibZzIt/EEHrPvNFYF6irRtduGejYM6730nxtIk9s4YAqIBT+QH3erOnrvq0D7yCis6oUk6rHB0r0heeySxH6JWap2p5UH1nCIn20Olri/Rwmo0KHzQHfHRVIRavAciQM0+DgTogH5k9MkjYlxWMO9mEFK20DED7DB64jrbS9xQgLK0TNJzsJJ12589W/2tLcad/is21geVgQmc3Z8eXQZwaOF4noch5x7p1Q2tj3aH5gNd8M33jdQQIPwuui/G2bdOHUlndBqNbTK7Hd3lfD6gepgBwW3d6A5zoYJvN6tJtgGEEvMr8Rpj3yuAJpxG7HcCQf8YuXKCYbnlrRlsaJxkt2oBDLkaTHhMN8h8B45uZLgA8icAmPFHjmygqO60A0w6rOKow6ZNmyfvI6TJlVj906oF+jaGB2QMwvX4b2DRUKWxpe+LybJyYKU25PSxeO6jA7/CDdBn1NNED1X6TkPwRNwK5bGhE4Q9I0++KuS93DUo6r6bIV4LTBvxkySCb52l5PFX0n+E5fYBgQRo4yJFozvbOH0br8Wby8ABQk2uz5MvXIl6DwXyTWXODCetqOVtQIP6EJWL/8NEBzO6Wn9/nmP8XDbRpMTtjn3psNcsikcRp5m4MUQylptwjbSc9JSfGlTcmJz4QahJUdezfu0kpamsZe5HL1ADHVDnj/tVtgejVVUtR1qzbyOQhZwLgnXifTbdnVi/Yi0I7Rm2Y0o7xu/Yd5rs9Z0KUh0n4BNpIO+IRDScIL5IkEfEge1884Y9hAkhKeqgt9hgfxZbX2MAZ+UC+UZFBVbpKtVzPpDopIp0ijttH0UVEncllCwZITF2DIknQSTpmjt1XHyWGTtT9SrigZ9theXCtcqoAOzxN5+eNtnKKPyVcstS3flyP7ohCPUg2KqPgnXf08eSJqhrXcXv228RNVsmHQl49UQk99gjpSkdLm61ZOAtVCQ==,iv:FFCbU1XOgra4s3xvZUXtLqba1FmJSBzQW5Nz5sXe54s=,tag:seHg/8+bfOi2q4iixR+5LQ==,type:str]
+        secrets:
+            - id: regcred
+              schema: dockerconfigjson.v1
+              namespace: test-namespace
+              ownership: referenced
+              source:
+                kind: secret_ref
+                ref: vault://vault/common/regcred#.dockerconfigjson
+              targets:
+                - kind: kubernetes
+                  namespace: test-namespace
+                  name: regcred
+            - id: test-namespace-rabbitmq
+              schema: rabbitmq.v1
+              namespace: test-namespace
+              ownership: managed
+              source:
+                kind: rabbitmq_user
+                ref:
+                    vhost: test-vhost
+                    user: test-rmq
+              targets:
+                - kind: kubernetes
+                  namespace: test-namespace
+                  name: rabbitmq
+            - id: test-namespace-postgresql
+              schema: postgresql.v1
+              namespace: test-namespace
+              ownership: managed
+              source:
+                kind: postgresql_user
+                ref:
+                    cluster: wb
+                    database: test_db
+                    user: test_user
+              targets:
+                - kind: kubernetes
+                  namespace: test-namespace
+                  name: postgresql
+            - id: test-namespace-s3
+              schema: s3.v1
+              namespace: test-namespace
+              ownership: managed
+              source:
+                kind: s3_bucket
+                ref:
+                    bucket: test-bucket
+              targets:
+                - kind: kubernetes
+                  namespace: test-namespace
+                  name: s3
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt
          enc: |
@ -2647,7 +2722,8 @@ sops:
            M0JZb1k0R0ErQ0M3SDNDWGRBclpnZjgKlEUpn/tBw6bs2PQqAfKwnpAEEThfiVAH
            uKIOpOFRImGY/7DTwtqfttnmIXKOm5kUJCOxzgEjh3MYc3ChQar3kQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-09T09:15:43Z"
-    mac: ENC[AES256_GCM,data:ohWfEVY4gm+adbkzI6OcAiKQYZ+oHrTrXrrTuezNMVjwoaRllR0wQ4+/KlzNqueFjbf8oflchxlljrX7EtMQ+aatj34ZanFJnsk8BBEgO56Cam0mDPbgMVDrZCk6xMfJgj2BhWWm9rQMCgwqMJOxDTP3jhvYFM1wJHjo350VZbg=,iv:1/fHA7/WGJ4TZF3+jV/PMgu9LFVn11C7GZe9Q/okuNk=,tag:haFaJ1hIOhMxdT7BcgUw2g==,type:str]
+    lastmodified: "2026-08-11T10:15:46Z"
+    mac: ENC[AES256_GCM,data:YyutnTb5sSZWpYItoi6oAesq97eBMaozvmWsNOyusOnHfKPhdbhOh0KseGlE8lPIjL1k8d5kOmwGxjjqRKzMP8xwxQO08gTWHvagovBnkx8mu7szi0wbBhvhkDlU0YvS5LzcFYVtpZHldyzWzZlVCz+Xxehrumk1uXWUYlyr22M=,iv:iCLGFMbb1nKx8MR6CtcKq4jCJtKDEc07XD/Fcd5CQvw=,tag:a9N2xAA/K7o9soZi9zrLkw==,type:str]
+    pgp: []
    encrypted_regex: ^(data)$
    version: 3.12.2
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@ -534,6 +534,51 @@ environments:
          type: topic
          durable: true

+  wb:
+    namespaces:
+      - name: test-namespace
+        manage: true
+        image_pull_secret: true
+    minio:
+      endpoint: http://10.112.0.24:9000
+    buckets:
+      - name: test-bucket
+        acl: private
+    postgresql:
+      default_host: sarex-vpsql-01.xc.wb.ru
+      default_port: 5432
+    databases:
+      - cluster_id: wb
+        database:
+          name: test_db
+          extensions:
+            - uuid-ossp
+            - pg_stat_statements
+        user:
+          name: test_user
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+    rabbitmq:
+      amqp_host: rabbitmq.rabbitmq.svc.cluster.local
+      amqp_port: 5672
+      vhosts:
+        - name: test-vhost
+      users:
+        - name: test-rmq
+          password_length: 32
+          password_special: false
+      permissions:
+        - user: test-rmq
+          vhost: test-vhost
+          configure: ".*"
+          write: ".*"
+          read: ".*"
+      queues:
+        - name: test-queue
+          vhost: test-vhost
+          durable: true
+
  # brusnika-stage — приёмочный тест декларативного контракта секретов v2
  # (см. SECRETS-CONTRACT-PLAN.md) перед массовым переключением на схемы.
  brusnika-stage: