From d5a2d639adec54bbe8c5372177f431574ded8729 Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Tue, 11 Aug 2026 13:33:54 +0300 Subject: [PATCH] add wb environment, one test entity per resource type (namespace, rabbitmq vhost/user/queue, external postgres db/user, external minio bucket) plus matching v2 secret contracts Co-Authored-By: Claude Sonnet 5 --- infrastructure-secrets.yaml | 98 ++++++++++++++++++++++++++++++++----- infrastructure.yaml | 45 +++++++++++++++++ 2 files changed, 132 insertions(+), 11 deletions(-) diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml index 531b9a6..191bacf 100644 --- a/infrastructure-secrets.yaml +++ b/infrastructure-secrets.yaml @@ -1340,7 +1340,7 @@ environments: lifecycle: ignore_changes: false data: - test-key: ENC[AES256_GCM,data:DX3UhBAdbh7yKWUWPNuQLw==,iv:DAbgKIuVeObF3XKdg+cn/m+AB9rkYjCROmykGOD6SKU=,tag:UNBWttsZdGjafHuzlBnCEg==,type:str] + test-key: ENC[AES256_GCM,data:B8th/+URQxw4lZwx0BGboA==,iv:RPR253FkVQY7+U0pmJ1XXUhKwXquNMSxWT1UXhH9/OE=,tag:5zinYmvo49yGaEknCEZRfw==,type:str] - name: test-db-k8s namespace: contour type: database @@ -1929,17 +1929,17 @@ environments: password: ENC[AES256_GCM,data:BhJrmuz/6swAkM+jIM5XRi6zPbsLmf02E/3mKNzmm34=,iv:5vd4c5fyyZSOYdLNBoTuF0ziwQTjooRjpYq2/dOq/ls=,tag:cWbLMRXVuguNjkD4RXHwDg==,type:str] topics: - configs: - cleanup.policy: ENC[AES256_GCM,data:/5EDtWyy,iv:nyn8UJreUZikGzse1GJuAOLu/UZZrbY/mWOukgVOy4U=,tag:4MeNFsQmEguvI4saKATR9g==,type:str] - retention.ms: ENC[AES256_GCM,data:5LroAP689xuT,iv:Mc1jwgoG6M+FLeuKn6hHp/+KCQbno4CdoRAh/JyGzFU=,tag:DHFcs8jEKMaISaZHNYOX3Q==,type:str] + cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str] + retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str] name: ENC[AES256_GCM,data:Df+Rsaq6UgC76Gg=,iv:LeqgrtdkOkd/0Xd7R57aYIbaMYxLB0N45PXgYCtBRTw=,tag:PcFe3ETDDad+pxPvk7ExGw==,type:str] - partitions: ENC[AES256_GCM,data:Yg==,iv:pzdu/ULwX76qceliTkMnltGH9oo7OnQEUVMQG7l0BPU=,tag:aH7Q8owfTM9jMDOJMiJKtQ==,type:int] - replication_factor: ENC[AES256_GCM,data:WA==,iv:m73FLiiipJmqK/6MOciDvV8xihr1lqFb0mBID7YYbJE=,tag:pkPMIkdHSOv3BiCML2qyBg==,type:int] + partitions: ENC[AES256_GCM,data:hQ==,iv:DIGPV4uWpYJ67Em0FW6mOGR2ee/dlHUr/YHLyC2GJrE=,tag:ogwqxqvUl4i5XcN09Epcog==,type:int] + replication_factor: ENC[AES256_GCM,data:7w==,iv:C2CG1LOdk5txLC2b5FbqrNYhGGlSfUcXi3O0wKny+ns=,tag:YMipZpRar+yLQoZlZJcgQA==,type:int] - configs: - cleanup.policy: ENC[AES256_GCM,data:rtiThdxs,iv:6QZs290joYQTFVoe0sUuzplpcemCiqNqF4XJCAwUbEE=,tag:Joj0RlVWEC4lV+SDRHLTzQ==,type:str] - retention.ms: ENC[AES256_GCM,data:YSUuD37KhnVx,iv:Vopub1c4UA4u29CBtNTLU/gfP5xaJqiqd04P9LNorco=,tag:dVh9Fj4vnW5xwtgUgsdPnQ==,type:str] + cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str] + retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str] name: ENC[AES256_GCM,data:Khmfl9ayUFBUgtT7o5Ehrw==,iv:Q5GTUNEBW+Se8Pks2LiHazs0pPpaY5GiRXpEK9aRE4Y=,tag:s9a8J2v90W1qVDLEXGDaog==,type:str] - partitions: ENC[AES256_GCM,data:og==,iv:nR//mkCSWcIs89Pi7XJSxx5UX5GWoKnb4giT6o1TMao=,tag:MvvTF5EpHIFqBrykTXHY9Q==,type:int] - replication_factor: ENC[AES256_GCM,data:sg==,iv:RR9Kblkl/3KSrkUxeOk75n9k4uSw6lz0ifCO0paiRQk=,tag:VHzy6BcZkZI+NCdB7h00cg==,type:int] + partitions: ENC[AES256_GCM,data:hQ==,iv:DIGPV4uWpYJ67Em0FW6mOGR2ee/dlHUr/YHLyC2GJrE=,tag:ogwqxqvUl4i5XcN09Epcog==,type:int] + replication_factor: ENC[AES256_GCM,data:7w==,iv:C2CG1LOdk5txLC2b5FbqrNYhGGlSfUcXi3O0wKny+ns=,tag:YMipZpRar+yLQoZlZJcgQA==,type:int] - configs: cleanup.policy: ENC[AES256_GCM,data:+ZadnUU2,iv:d3eNkF7Hwp/lSR9t/R5sI9vU8PrMsT2mWnKzQmD51yQ=,tag:HcbQvf+PwGbF/ql4hTeAYA==,type:str] retention.ms: ENC[AES256_GCM,data:X/G8H4r9nRcT,iv:L3j07UfzpynoKdbiJSe4jFAjJPnAXH4TILzKlNLHIX0=,tag:eqlFbEOBX3gQ/k98rFSsMg==,type:str] @@ -2627,7 +2627,82 @@ environments: - kind: kubernetes namespace: rabbitmq-module-test name: rabbitmq + wb: + vault: + enabled: true + kv_mount: secrets + path_prefix: vault + features: + create_regcred: true + create_smtp_auth: false + create_django_auth: false + create_rsa_keys: false + create_infra_secrets: false + create_infra_policies: false + create_infra_roles: false + create_app_policies: false + create_app_roles: false + applications: {} + data: + common: + regcred: + dockerconfigjson: ENC[AES256_GCM,data:5dbsw0RLol7SQg4kPNd0xpxOvuknGJMEDof6ef+Eooc5CCi7qlMgQMfJSc7u+2I0yhJ7Gbz05zV4GqcT35QHA9ci8eZa4kNHxEXaoHTzM2j9mqrwzP6/iwImYee9XfkdpT38LSQw43gX2OWdDAAQsxZCwkLQIlNSEmNpNtH9aGbpfP+S1EaLMkop49hegfphyzAP3ugJuMfdcRAVbAViB55XHW4FXUV+vjR530Ps0ir0aoCt5h3nZIbu7Aw4Suh691bIkHy0SmqF10CxYpsQuXoVdscJGSvjPYbnjP8rgSShXSAf8RD8v0Vf8RmKx8p6uy7FlEJ/Pk5Y2BHEQyYQoj5f8Km/y8svi0gHnsO8YwCMqEE9PkTLbQBd7Ras1tEFl6H+u7Kr7zk6FMhMyJxy3hQkj4LAcmkeXwGhjEieFtDM6e7LDrSGF1ls4gIoXn93rjDpO4sGo9w3sDD4WaUqO+FJW0van6X6JP+2fPXCN0Zd3uKBhtaehNR7KaiMaFD/nzDlgJgI89k7zY1j+/eVwO2tqqFDOlS2oOtrCawz9HqFLku95zKBZKuM+rNJwpJLHaPKcsHKombyAG7fsna2aRyAJhBmnfuMJCXnhrO/MllNnz36uFHO3c54aHQE5mby2gtYMU8FRlGwIyxgaY7eV4RPbvyF7fSsvLN5NvaYJEa5SCQP9P9HFMWOg8kXmEHBMJXd00chKtkbumWeA68r85nmMd366h+R9lQF5Dq6XSuU3V8tPrkYmQro+hDvNDkOO/5XvInp6nwECa5pxKno4zJvoh1JFc8h0anEOVWDfNwysFueTt8G0qEK1OUJIQuUmgV9Rg5HM1X32VMzf2kWGeqbh+BTrDoupQXSvIx4bvehA1PPexW1/EIbNXNXe16QRBBphiAbOP1xOiovPM7sQRO2Gtg7pypZatEpBCA8DkHPOSowJa+W5QZdBWX36QwptqgEm2Dug8Vs73PN8Vjtm3J/4L12FUXNMWwj/hBLoRuD7MFr1c02beSl+6vsVXZbHpcfY2sPDn17wg10kSX55ID/uUvvBbWZUZQqEqF9s4AAj3h6UW4pBa8azDu6LGxCTWkeUD9XunI1Ir2beuxa5xAnXjM5vXDhYMhaAvcXgJE1VO3M2j2JxRJNJwWcXUXTtjtX5bixc41ER68DPq5vcnO64rVBq9VIgRR73em5gDmUyTmr3R0h5mrJXheaPDEqzHJYM7HzZyOIVkkzB7AiCUsC6AXA1xukizwov6pOVFcmGc2JUuOJGF0sO/QVev3m56r9X8tGDB0jElnCasMPTgmq2Pg1lDUod1EzBffO1Y21pJD0UNxDrnlJkIv4V1LEPyPJayQoicKdv6bnw+llgjHCUqBUxiGxO6cPah+PkFhZY8PRaDyofbyoIiQs19CBkbvgtebJ8MipQP3amljxB1+jpbacmu+bKbSvdKU/l+gkGsGfu1jzWBoMpFJCqsVihe3WwAlkYbnt2816tfxxS3Vo/FxIJZMpBjmdqE3Ckpuz5jPvUMObkVMlbXVUO7HuKGW7wIrixE03k7FuxhAj1ZICMn6hc6syh6/YWilnR9L+xtxk3sYK+f9JSeY4EUIloqmmkdg01xZh76Se5BpsXUWRzlAub3hToR4NVvDMoX0XE6PTGm+k5itOcs7mRqlccaMQU1+VyJu9zWEgy4Ua08cIDrcjE8VTUU4quPfHhKdDK3pqgbExGFw5Ybm3GvuTJ6zdN4cO/rAMPlQMRDYX5CKouW0oOQEJmtFKkrELFgDlZqoh72awr6iH+rAgAg+7lArMvspaI4z9HSANn+y1/oO/HZ09kEb9FKsycVQYlFpIBmiWtFAMQEaLcjr07hQupIZd7INWpCjlxsF4m+RYIsTCVhybff+cX7GdMaIm9kHhOT5k6k/CxiPHimfXFjOWjnmrCURRf1kQWATBptsWZJ35/jIJGRrEBzeA6KnSEB4mvl+Jik+t0z4op+nukuG6tGmGG/+cpy0jkouihETAo7IRx4hi7QV9OiM1sYJ8dLRAzSKFhEGMmd6JrR9AF7mW4HPVGMtIKmOu2hJz4VXAJTisD2c0kckFCo8Gi6vHDdGurSU70KU31z7nLtySSTGHDG/5/sHnY+o3fCFlXxmvY/VfgW+TusSc04RCMY/e3R1JHGL+IRMquXweNqD6MXi/qNbnLKM15c3DMow2Gxp4Rpl6THpeINrhnhamMd+6CPKwPfh6XFRYLYNn6cWuEB5vy582PrljZh+C7w75lsDLdo6+GpzUwBMC8Y//ZtXYJ5KdHGbIWjkL1rNBAps4UVNpevlcf/qOetQMuqMrK+2aqWhmWNJOw5ZwTpm8JmDN+AuXqq+vJAS0RXZd0tm5s0z/RG65lKVHz37DT75vfsE20C4xSig1FUfpIVC/FoLWyD8OK5mydX2J4Zkt1JtahOB/TaGVuB+VIZbiFR4TITCQNZ7qBKBwAaVH0mJOVsktJLRJ4e3JdVfsigXuXHEbPJZCLjmHIpUz/CHtFN05Bal7f74kMrjKtfmH1ciNq4Q70QcP1REhGzQ50AqLcUyzhlNBM5AXQ0q4z6Ki6UsBxc5BzGLk5KtzkddTgzQYYQZ1TOcYBNwdIuN8Clc8Npl0wrA302OcFfp6KhmTWQ3UoaSje1+dsHrO+tYJZf23gI4abTAvZ3IL3hI3NZTffjmEQxE9dC2oYiNtGiN1a9g6Psg8uVok9HOpWBu51xk/HiGNafYkDUNtSYEJwIqb4CZLyxRt7ITvw74c46mCBMn/gD5pHQ9qnbKdyV5+sxSpj+GSQSjeE1lBQmvPqEwxPFNvu1xwWf8uGIwZcapCeNac9k0buOWjuxnWbf+cUpKFjfDTVBslwctSFdnAwFJ5NdN0p1AtwCUcOO4ASoJryyYKA1P4E1U6BrPRDYYwVY/nQzeNcDRgX9Otw5eH8GD6Sky/AWIGTKGNyLLuWAs02ACIQgwaVevhw46FHghA1/Mh7sIH2YfP2ziElFcvcaF+8+W2fqLY/hKfsO00GT4VpCu3g4VmjEBV0MHgRNr6CcDfkC0Soz2E5mQxpJM+BOb1v/uOfc5Nn+oX1G14vaC4P2Es1Dhnz7jWBhWKNqaG/8zeHhq+oLQgQA8pFeIVPQJa6SUe1iycYvsqKiXd5oERmmuXSlKBVM6PpIFmjJ9PMO8Ap2fV1pHdA+tp+REGOvG0X7GRc9q624JjqaS+hRDQ9L0eW08dw9zETO4ugbmQv/pOjC5qskqIW5IRjj3Mxpf54Hjj59sH/UHkhg4YAnPx/0vvpVPTa2mHwx+C78YYuBAH4jx29YYx5MYsoxkUYVMDhOMhpMdRDq9cKH68xeYf/Ux9QJnQG7wxCdSkpmh9oIVMl7vksqTKjiJKuKdVkZ7NAjddoFa/2iW0s/iYH3+7MAIGhn4T9V9OBGwZoNb7bd5k6RvsPudaze5f/C4Adszva88YOhFvYeOGSq8mXLIzLj1J0iB0ZSTQMhNntXV8fehQZgwzNApZW1TMxdUlWGXCRnSsa/sS0KF5RYCacc95pJyDxNrIANm49mtx5yOdyKWVmcQ0IpVE+X0HZh0u6y6Ff0ctsfdPhLpHmYOhyd0hFgY1hiVSt0uAyh4LCEmBEYkA7L0BEEJiNQ0VuyWJ4HPVrckcJ7gCfmIxtRufD67SzibZzIt/EEHrPvNFYF6irRtduGejYM6730nxtIk9s4YAqIBT+QH3erOnrvq0D7yCis6oUk6rHB0r0heeySxH6JWap2p5UH1nCIn20Olri/Rwmo0KHzQHfHRVIRavAciQM0+DgTogH5k9MkjYlxWMO9mEFK20DED7DB64jrbS9xQgLK0TNJzsJJ12589W/2tLcad/is21geVgQmc3Z8eXQZwaOF4noch5x7p1Q2tj3aH5gNd8M33jdQQIPwuui/G2bdOHUlndBqNbTK7Hd3lfD6gepgBwW3d6A5zoYJvN6tJtgGEEvMr8Rpj3yuAJpxG7HcCQf8YuXKCYbnlrRlsaJxkt2oBDLkaTHhMN8h8B45uZLgA8icAmPFHjmygqO60A0w6rOKow6ZNmyfvI6TJlVj906oF+jaGB2QMwvX4b2DRUKWxpe+LybJyYKU25PSxeO6jA7/CDdBn1NNED1X6TkPwRNwK5bGhE4Q9I0++KuS93DUo6r6bIV4LTBvxkySCb52l5PFX0n+E5fYBgQRo4yJFozvbOH0br8Wby8ABQk2uz5MvXIl6DwXyTWXODCetqOVtQIP6EJWL/8NEBzO6Wn9/nmP8XDbRpMTtjn3psNcsikcRp5m4MUQylptwjbSc9JSfGlTcmJz4QahJUdezfu0kpamsZe5HL1ADHVDnj/tVtgejVVUtR1qzbyOQhZwLgnXifTbdnVi/Yi0I7Rm2Y0o7xu/Yd5rs9Z0KUh0n4BNpIO+IRDScIL5IkEfEge1884Y9hAkhKeqgt9hgfxZbX2MAZ+UC+UZFBVbpKtVzPpDopIp0ijttH0UVEncllCwZITF2DIknQSTpmjt1XHyWGTtT9SrigZ9theXCtcqoAOzxN5+eNtnKKPyVcstS3flyP7ohCPUg2KqPgnXf08eSJqhrXcXv228RNVsmHQl49UQk99gjpSkdLm61ZOAtVCQ==,iv:FFCbU1XOgra4s3xvZUXtLqba1FmJSBzQW5Nz5sXe54s=,tag:seHg/8+bfOi2q4iixR+5LQ==,type:str] + secrets: + - id: regcred + schema: dockerconfigjson.v1 + namespace: test-namespace + ownership: referenced + source: + kind: secret_ref + ref: vault://vault/common/regcred#.dockerconfigjson + targets: + - kind: kubernetes + namespace: test-namespace + name: regcred + - id: test-namespace-rabbitmq + schema: rabbitmq.v1 + namespace: test-namespace + ownership: managed + source: + kind: rabbitmq_user + ref: + vhost: test-vhost + user: test-rmq + targets: + - kind: kubernetes + namespace: test-namespace + name: rabbitmq + - id: test-namespace-postgresql + schema: postgresql.v1 + namespace: test-namespace + ownership: managed + source: + kind: postgresql_user + ref: + cluster: wb + database: test_db + user: test_user + targets: + - kind: kubernetes + namespace: test-namespace + name: postgresql + - id: test-namespace-s3 + schema: s3.v1 + namespace: test-namespace + ownership: managed + source: + kind: s3_bucket + ref: + bucket: test-bucket + targets: + - kind: kubernetes + namespace: test-namespace + name: s3 sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] age: - recipient: age1ztyyem7qy3fn7vjprnadhsv2txds8a63pr76uut264qwnwxv8v9qwpkagt enc: | @@ -2647,7 +2722,8 @@ sops: M0JZb1k0R0ErQ0M3SDNDWGRBclpnZjgKlEUpn/tBw6bs2PQqAfKwnpAEEThfiVAH uKIOpOFRImGY/7DTwtqfttnmIXKOm5kUJCOxzgEjh3MYc3ChQar3kQ== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-09T09:15:43Z" - mac: ENC[AES256_GCM,data:ohWfEVY4gm+adbkzI6OcAiKQYZ+oHrTrXrrTuezNMVjwoaRllR0wQ4+/KlzNqueFjbf8oflchxlljrX7EtMQ+aatj34ZanFJnsk8BBEgO56Cam0mDPbgMVDrZCk6xMfJgj2BhWWm9rQMCgwqMJOxDTP3jhvYFM1wJHjo350VZbg=,iv:1/fHA7/WGJ4TZF3+jV/PMgu9LFVn11C7GZe9Q/okuNk=,tag:haFaJ1hIOhMxdT7BcgUw2g==,type:str] + lastmodified: "2026-08-11T10:15:46Z" + mac: ENC[AES256_GCM,data:YyutnTb5sSZWpYItoi6oAesq97eBMaozvmWsNOyusOnHfKPhdbhOh0KseGlE8lPIjL1k8d5kOmwGxjjqRKzMP8xwxQO08gTWHvagovBnkx8mu7szi0wbBhvhkDlU0YvS5LzcFYVtpZHldyzWzZlVCz+Xxehrumk1uXWUYlyr22M=,iv:iCLGFMbb1nKx8MR6CtcKq4jCJtKDEc07XD/Fcd5CQvw=,tag:a9N2xAA/K7o9soZi9zrLkw==,type:str] + pgp: [] encrypted_regex: ^(data)$ version: 3.12.2 diff --git a/infrastructure.yaml b/infrastructure.yaml index fd1e342..4836c0d 100644 --- a/infrastructure.yaml +++ b/infrastructure.yaml @@ -534,6 +534,51 @@ environments: type: topic durable: true + wb: + namespaces: + - name: test-namespace + manage: true + image_pull_secret: true + minio: + endpoint: http://10.112.0.24:9000 + buckets: + - name: test-bucket + acl: private + postgresql: + default_host: sarex-vpsql-01.xc.wb.ru + default_port: 5432 + databases: + - cluster_id: wb + database: + name: test_db + extensions: + - uuid-ossp + - pg_stat_statements + user: + name: test_user + password_length: 32 + password_special: false + conn_limit: 20 + rabbitmq: + amqp_host: rabbitmq.rabbitmq.svc.cluster.local + amqp_port: 5672 + vhosts: + - name: test-vhost + users: + - name: test-rmq + password_length: 32 + password_special: false + permissions: + - user: test-rmq + vhost: test-vhost + configure: ".*" + write: ".*" + read: ".*" + queues: + - name: test-queue + vhost: test-vhost + durable: true + # brusnika-stage — приёмочный тест декларативного контракта секретов v2 # (см. SECRETS-CONTRACT-PLAN.md) перед массовым переключением на схемы. brusnika-stage: