module: optional schema/ownership/source_kind/source_ref/extra_fields fields,
backward compatible - legacy secrets keep resolving exactly as before.
ownership modes managed/referenced/observed/adopt_once replace ignore_changes
for v2 records; referenced reads a value straight from vault via a data
source; observed only verifies presence, writes nothing.
terragrunt: v1/v2 detection by marker keys, targets fan-out into the existing
flat secrets list (one entry per target, same resource-key scheme as today),
source.kind -> type/depends_on translation for the five documented kinds.
brusnika-stage: acceptance environment for the two test cases from the plan -
regcred (dockerconfigjson.v1, ownership=referenced, value from vault) and a
rabbitmq.v1 secret (ownership=managed) fanned out to both kubernetes and vault
targets from a single declaration.
- Add infrastructure.yaml as single source of truth (like values.yaml in Helm)
- Make all modules universal (no hardcoded entity names)
- Use existing PostgreSQL cluster instead of creating new one
- Add yc-database module for working with existing PostgreSQL
- Add k8s-secret module with lifecycle.ignore_changes support
- Update terragrunt.hcl files to read from infrastructure.yaml
- Remove scripts, use native Terragrunt functions (yamldecode)
