checklists needs only postgres + the already-enabled rsa_keys, fully
wired in one push. notes/rfi/contracts also get real rabbitmq
vhosts/users (v2 secrets type, field shapes match app templates) and
self-contained kafka creds via the legacy generate:true path (same
precedent as sarex-contour - the v2 kafka type writes flat fields but
these apps read a nested auth.* object, so it doesn't fit).
S3 for notes/rfi/contracts is deliberately left out: same nested
client.endpoint shape mismatch as eav. Buckets ordered via live/s3;
vault.data.infrastructure.minio.apps entries follow in stage 2 once
the real generated credentials are known.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds the eav database and app policy/role/rsa_keys wiring. The minio
S3 secret for eav is deliberately left unset here: the new v2 secrets
contract writes flat s3 fields that don't match eav's expected nested
client.endpoint shape, so that secret has to be hand-populated with
the real live/s3-generated credentials in a follow-up commit. Until
then eav's pod will not start (agent-pre-populate-only needs every
declared secret path to resolve).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Enables app-level policy/role creation for vad (was fully disabled),
adds the workspaces database and a v2 secrets entry that pulls the
generated password from live/database via dependency block.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Тот же внешний MinIO, что уже используется под tfstate
(111.88.252.72:9000) — не отдельный in-cluster инстанс.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
environments.sarex-contour.databases в infrastructure.yaml (plaintext,
без sops) — для live/database stack. Postgres внешний, отдельная тачка
(111.88.255.180:5432), не наш in-cluster instance. Только новый
top-level ключ, остальные окружения не тронуты (чистый append, diff
подтверждён).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
bi_db with ltree/pg_stat_statements/uuid-ossp extensions in
infrastructure.yaml; bi vault application role and bi-postgres secret
(apps/bi/postgres) in infrastructure-secrets.yaml, same shape as the
documentations app.
module: optional schema/ownership/source_kind/source_ref/extra_fields fields,
backward compatible - legacy secrets keep resolving exactly as before.
ownership modes managed/referenced/observed/adopt_once replace ignore_changes
for v2 records; referenced reads a value straight from vault via a data
source; observed only verifies presence, writes nothing.
terragrunt: v1/v2 detection by marker keys, targets fan-out into the existing
flat secrets list (one entry per target, same resource-key scheme as today),
source.kind -> type/depends_on translation for the five documented kinds.
brusnika-stage: acceptance environment for the two test cases from the plan -
regcred (dockerconfigjson.v1, ownership=referenced, value from vault) and a
rabbitmq.v1 secret (ownership=managed) fanned out to both kubernetes and vault
targets from a single declaration.
