From df13f562c06d5a2e243e0702ad97fe130c371e62 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Fri, 25 Sep 2026 16:46:07 +0300
Subject: [PATCH] ++ uralkal apps vault

---
 infrastructure-secrets.yaml | 78 +++++++++++++++++++++++++++++++++----
 infrastructure.yaml         | 20 ++++++++++
 2 files changed, 91 insertions(+), 7 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index 6fade24..be1ffe8 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -5006,9 +5006,33 @@ environments:
                 create_infra_secrets: true
                 create_infra_policies: true
                 create_infra_roles: true
-                create_app_policies: false
-                create_app_roles: false
-            applications: {}
+                create_app_policies: true
+                create_app_roles: true
+            applications:
+                superset:
+                    enabled: true
+                    policy_name: superset
+                    role_name: superset
+                    service_account_names:
+                        - superset
+                    service_account_namespaces:
+                        - superset
+                    token_ttl: 24h
+                    read_paths:
+                        - vault/apps/superset
+                        - apps/superset/postgres
+                trino:
+                    enabled: true
+                    policy_name: trino
+                    role_name: trino
+                    service_account_names:
+                        - trino
+                    service_account_namespaces:
+                        - trino
+                    token_ttl: 24h
+                    read_paths:
+                        - vault/apps/trino
+                        - apps/trino/postgres
             data:
                 infrastructure:
                     postgresql:
@@ -5039,9 +5063,9 @@ environments:
                         identity_firstuser:
                             generate: ENC[AES256_GCM,data:dLlQrQ==,iv:fhWQqYQ4RdiqGZ87ujRKSoj7qqzhISJDt7eW9egGSMI=,tag:nnLaKPUC2uhcg353FrJX6Q==,type:bool]
                         keycloak_admin:
-                            generate: ENC[AES256_GCM,data:RiGk8Q==,iv:bJkHALu/TIzSGBzBbyDA6AtENnqhkMwFaZBkY5cjchc=,tag:3CmLaSTFhGEa/+/z4UZRRA==,type:bool]
+                            enabled: ENC[AES256_GCM,data:drLzRiI=,iv:g5Wr2wD3vFjTCcspmfMTHgdx7I1c7xXCdKrYZ3ZsY7Q=,tag:rfH/dkk1Ob1pKHJMlQqtmQ==,type:bool]
                         postgresql:
-                            generate: ENC[AES256_GCM,data:gQ2bEA==,iv:HkREXF/4S+hMNej3wI4YCwe9OkfKqphkPjNIUuUiiHc=,tag:DUVyElfGWffQHM3Fdapgag==,type:bool]
+                            enabled: ENC[AES256_GCM,data:5dqTc9E=,iv:8cBSQMF3A6CVpwPunLRI+GUKs+zMUiQH1Xud0WcerIY=,tag:qNXicY8posHFTCdg+OmfnQ==,type:bool]
         secrets:
             - name: uralkal-test-postgres
               namespace: uralkal-test
@@ -5127,6 +5151,46 @@ environments:
                 TRINO_INTERNAL_SHARED_SECRET:
                     length: 32
                     special: false
+            - name: camunda-keycloak-db
+              namespace: camunda
+              type: database
+              sink: vault
+              vault_path: camunda/_keycloak_db
+              depends_on:
+                cluster: main
+                db: bitnami_keycloak
+                user: bn_keycloak
+            - id: camunda-postgresql
+              schema: ""
+              namespace: camunda
+              ownership: managed
+              targets:
+                - kind: vault
+                  path: camunda/postgresql
+              extra_fields:
+                postgres-password:
+                    source:
+                        kind: secret_ref
+                        ref: vault://postgresql/admin#postgres-password
+                keycloak-password:
+                    source:
+                        kind: secret_ref
+                        ref: vault://camunda/_keycloak_db#password
+              source:
+                kind: postgresql_user
+                ref:
+                    cluster: main
+                    database: identity
+                    user: identity
+            - name: camunda-keycloak-admin
+              namespace: camunda
+              type: opaque
+              sink: vault
+              vault_path: camunda/keycloak-admin
+              random_keys:
+                admin-password:
+                    length: 32
+                    special: false
 sops:
     kms: []
     gcp_kms: []
@@ -5151,8 +5215,8 @@ sops:
             dXRWUzlUOWVYMVdUR2tlREJveWF6SVEK/99wDif8yD2VGEqnCeTT6sunURWU+IEu
             xwlt+WPoox0GUNw4efVFL4E7gd7FDJGtur+8si6i26XufQf2Tsk3xQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-09-25T13:25:39Z"
-    mac: ENC[AES256_GCM,data:p9gHSOe3qwn/Od2AUjBnSex7yFmjMvv5lzlFr2tIe6DQiDUisYkGxQIVjpp86cUR3PIa51zTAS3zJuCmjJeIv3Yrf+nsDow+ev1Wkcjo8pu3eXH7KbhUuKbBUzCJhNQGt2t0tJrwIut2ZnGht6/QmVhD5HqDtE7PgQzuayaDZJ4=,iv:6fOxCJBdYqan7RvPs5q3JD2Tj9+HyXXMS9XlK35kjVU=,tag:JGjqQbF1WYEzf659hAQ9NQ==,type:str]
+    lastmodified: "2026-09-25T13:44:07Z"
+    mac: ENC[AES256_GCM,data:osu74g3eiUgSTBB+e2SWWSdKol3eW9U7hIYGwqsgTRDQ5BqqMMHji8hqOQeL6Ed2YMEamiIkKUq/YA8fWXHmXGKyDfhJmbx2/sWNjRww/u7q38r7JF1R/NCQDCr3UZImIsZY6/0sEfockIkEnOU0zu1WGWhCFz4ioMyl1uuErW8=,iv:VRtJ3LKtEnTxdXSYEGNg3rVXA+/NCQkvXDGkOfBNw2w=,tag:Y5NDxtfPs+qSo883VUR3tg==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2
diff --git a/infrastructure.yaml b/infrastructure.yaml
index 726f175..fbe9677 100644
--- a/infrastructure.yaml
+++ b/infrastructure.yaml
@@ -1285,6 +1285,26 @@ environments:
           password_special: false
           conn_limit: 20
 
+      - cluster_id: main
+        database:
+          name: identity
+          extensions: []
+        user:
+          name: identity
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
+      - cluster_id: main
+        database:
+          name: bitnami_keycloak
+          extensions: []
+        user:
+          name: bn_keycloak
+          password_length: 32
+          password_special: false
+          conn_limit: 20
+
     minio:
       endpoint: http://10.133.0.245:9000