sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-10-07 22:01:35 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity
356 Commits 1 Branch 0 Tags 25 MiB
b774caedce
Commit Graph

356 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
ivan
b774caedce ++ sarex-contour: databases (workspaces_db) 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-15 12:28:54 +05:00
ivan
37d89a1b44 ++ sarex-contour: zitadel role.service_account_names: zitadel
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m18s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m7s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m11s
Details 
chart с serviceAccount.name: zitadel (не дефолтный zitadel-idp-contour)
- vault role должен биндиться на реальное имя SA, иначе 403 "service
account name not authorized" (как у vad — тот же паттерн).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-11 18:19:50 +05:00
ivan
679e79e4e1 ++ sarex-contour: zitadel.postgresql (пароль от live/database) 
zitadel.enabled: true, postgresql.password — литерал, взят из вывода
live/database (реальная роль/база zitadel на внешнем postgres
111.88.255.180, создана этим же прогоном). generate: false — держим
терраформ-модуль в синхроне с уже существующей БД, а не плодим
отдельный независимый пароль.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-11 18:12:26 +05:00
ivan
0cde523972 ++ sarex-contour: databases (zitadel) 
environments.sarex-contour.databases в infrastructure.yaml (plaintext,
без sops) — для live/database stack. Postgres внешний, отдельная тачка
(111.88.255.180:5432), не наш in-cluster instance. Только новый
top-level ключ, остальные окружения не тронуты (чистый append, diff
подтверждён).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-11 18:09:36 +05:00
ivan
9741451e97 ++ sarex-contour: rabbitmq auth.username: sarex 
Забыл перенести username при копировании из yc-k8s-test — ушёл пустой
default, из-за которого bitnami-образ засеял админа как литеральный
'user' вместо ожидаемого, а readiness-проба (читает vault-файл с пустым
именем) падала на invalid credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-11 17:28:54 +05:00
ivan
1c6c0542fc ++ sarex-contour: vault env block (kafka + rabbitmq) 
Новое окружение environments.sarex-contour.vault — только то, что уже
раскатано через iac: kafka (bootstrap, role по дефолту kafka-kafka-contour/
kafka) и rabbitmq (auth, role по дефолту rabbitmq/rabbitmq), пароли
generate: true. postgresql/minio/zitadel/camunda явно enabled:false —
этих сервисов в sarex-contour ещё нет, инфраструктурные дефолты модуля
иначе завели бы под них пустые secrets/roles.

Остальные environments (yc-k8s-test, ugmk, brusnika-stage, wb, vad) не
затронуты — проверено построчным diff расшифрованного содержимого.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-09-11 17:08:12 +05:00
ivan
1d85cab221 ++ ugmk: bi jwt secret (vault/apps/bi), mock value for now
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m11s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m8s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m9s
Details 
Adds bi-jwt (opaque, SUPERSET_JWT_SECRET) to the secrets list and
vault/apps/bi to bi's read_paths, so bi can drop the plain
superset-jwt-secret k8s secret and pull it from vault instead.
Value is a mock placeholder until the real one is known.
 2026-08-31 16:31:05 +05:00
ivan
444e372749 ++ ugmk: bi postgres database + vault role, mirroring documentations 
bi_db with ltree/pg_stat_statements/uuid-ossp extensions in
infrastructure.yaml; bi vault application role and bi-postgres secret
(apps/bi/postgres) in infrastructure-secrets.yaml, same shape as the
documentations app.
 2026-08-31 15:59:21 +05:00
Kochetkov S
6d1e4fa861 ++ add postgresql namespace to regcred rollout list
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m2s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m5s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m13s
Details
2026-08-26 14:49:21 +03:00
Kochetkov S
a66155e598 ++ remove stale v1 keys left on zitadel-postgresql v2 entry 2026-08-26 14:29:06 +03:00
Kochetkov S
9006521b68 ++ generate real zitadel postgres password via in-cluster postgres users secret 2026-08-26 14:22:02 +03:00
Kochetkov S
96ff8968e9 ++ compose keycloak-password into the policy-allowed camunda/postgresql secret 2026-08-26 14:17:25 +03:00
Kochetkov S
4b487e1fa0 ++ eliminate identity-password circular vault reference 2026-08-26 14:03:22 +03:00
Kochetkov S
e122f93749 ++ add missing camunda identity-components and identity-firstuser secrets 2026-08-26 13:51:44 +03:00
Kochetkov S
863c4896b0 ++ fix custom_keys misuse that overwrote real generated passwords 2026-08-26 13:44:22 +03:00
Kochetkov S
d2c2698765 ++ bind zitadel vault role to real service account name 2026-08-26 13:30:35 +03:00
Kochetkov S
17aede83c0 ++ drop circular keycloak-password ref from camunda-postgresql 2026-08-26 12:53:12 +03:00
Kochetkov S
d3b447e34c ++ fix camunda-postgresql secret to v2 contract shape 2026-08-26 12:45:49 +03:00
Kochetkov S
b578f442a7 ++ add regcred and protect existing infra secrets
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m0s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m5s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m3s
Details
2026-08-26 12:32:46 +03:00
Kochetkov S
e28206025e ++ drop s3-proxy vault application 2026-08-26 12:20:56 +03:00
Kochetkov S
24de70dfa7 ++ add s3-proxy vault application for vad 2026-08-26 12:13:38 +03:00
Kochetkov S
5d0844b4c5 ++ wire zitadel and camunda vault secrets from real postgres passwords 2026-08-26 11:58:30 +03:00
Kochetkov S
917151ec16 ++ generate camunda and zitadel vault secrets for vad, drop conflicting db entries 2026-08-26 11:37:41 +03:00
Kochetkov S
ebb54303ab ++ add kafka camunda zitadel namespaces and databases for vad 2026-08-26 11:33:32 +03:00
Kochetkov S
8d39c5d612 ++ align vad rabbitmq with brusnika-stage contract 2026-08-26 10:57:05 +03:00
Kochetkov S
715177b0a4 ++ add vad vault secrets stub 2026-08-25 20:03:37 +03:00
Kochetkov S
c69704e250 ++ add vad test database
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m2s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m3s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m3s
Details
2026-08-25 19:37:05 +03:00
Kochetkov S
a81c1776bd ++ add empty vad environment 2026-08-25 19:20:36 +03:00
ivan
d5813ccd54 ++
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m22s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m31s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m39s
Details
2026-08-21 14:30:35 +05:00
Kochetkov S
511814cab8 ++ fix superset database grant
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 1m6s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m9s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m10s
Details
2026-08-20 13:29:26 +03:00
Kochetkov S
280559e7c8 ++ add superset trino ugmk secrets 2026-08-20 13:08:10 +03:00
Kochetkov S
0b7545670f ++ service contract compiler, issues on brusnika-stage
All checks were successful
Terraform Terragrunt (contour) / validate (push) Successful in 59s
Details
Terraform Terragrunt (contour) / plan (push) Successful in 1m5s
Details
Terraform Terragrunt (contour) / apply (push) Successful in 1m56s
Details 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 16:17:33 +03:00
Kochetkov S
78316216b3 ++ fall back to the rabbitmq endpoint default when the var is set but empty 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 15:50:43 +03:00
Kochetkov S
128cdf0958 ++ drop test-terraform and rabbitmq-module-test from brusnika-stage
Some checks failed
Terraform Terragrunt (contour) / plan (push) Failing after 27s
Details
Terraform Terragrunt (contour) / validate (push) Successful in 53s
Details
Terraform Terragrunt (contour) / apply (push) Has been skipped
Details 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 15:44:43 +03:00
Kochetkov S
84454b41ae ++ point brusnika-stage at the shared rabbitmq
Some checks failed
Terraform Terragrunt (contour) / validate (push) Successful in 51s
Details
Terraform Terragrunt (contour) / apply (push) Has been cancelled
Details
Terraform Terragrunt (contour) / plan (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 12:24:06 +03:00
Kochetkov S
a64eee3e4f ++ fall back to provider defaults when contour vars are set but empty
Some checks failed
Terraform Terragrunt (contour) / plan (push) Has been cancelled
Details
Terraform Terragrunt (contour) / apply (push) Has been cancelled
Details
Terraform Terragrunt (contour) / validate (push) Has been cancelled
Details 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 12:17:38 +03:00
Kochetkov S
0d34391acd ++ ignore task.txt
Some checks failed
Terraform Terragrunt (contour) / validate (push) Failing after 2s
Details
Terraform Terragrunt (contour) / plan (push) Has been skipped
Details
Terraform Terragrunt (contour) / apply (push) Has been skipped
Details 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 12:10:44 +03:00
Kochetkov S
ed3aaaed49 ++ vault creds and regcred for the shared rabbitmq on brusnika-stage 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-12 12:10:44 +03:00
ivan
962f748bf7 ++
Some checks failed
Terraform Terragrunt (contour) / validate (push) Failing after 4s
Details
Terraform Terragrunt (contour) / plan (push) Has been skipped
Details
Terraform Terragrunt (contour) / apply (push) Has been skipped
Details
2026-08-12 13:14:52 +05:00
ivan
e8a0544ffc ++ wb: real postgres/rabbitmq/s3 creds, app vault roles, rsa_keys and minio infra from live cluster dump 
Sourced from a kubectl dump of the wb cluster's k8s secrets, mirrored on
ugmk's vault paths where applicable. gitignore dumped-secrets/ working dir.
 2026-08-12 12:50:13 +05:00
Kochetkov S
decffe42b1 ++ wire create_users flag and disable it for wb
Some checks failed
Terraform Terragrunt (contour) / validate (push) Failing after 2s
Details
Terraform Terragrunt (contour) / plan (push) Has been skipped
Details
Terraform Terragrunt (contour) / apply (push) Has been skipped
Details
2026-08-11 16:37:24 +03:00
Kochetkov S
49164a6fde ++ strip trailing newline from wb regcred value 2026-08-11 16:25:46 +03:00
Kochetkov S
5b4b6084dd ++ drop wb kafka user and its secret, broker does not persist scram creds 2026-08-11 16:19:05 +03:00
Kochetkov S
fbf1f56362 ++ match wb test-queue arguments to what the broker actually set 2026-08-11 16:08:12 +03:00
Kochetkov S
e219da71ae ++ wb minio endpoint to a reachable node, nginx entrypoint is down 2026-08-11 15:57:17 +03:00
Kochetkov S
e9888d555e ++ disable kafka acls for wb, broker has no authorizer 2026-08-11 15:40:10 +03:00
Kochetkov S
d1337c38da ++ wb kafka to plaintext 9092, no tls no ca 2026-08-11 15:34:47 +03:00
Kochetkov S
26f511bd27 ++ print generated kafka provider block in ci log 2026-08-11 15:32:43 +03:00
Kochetkov S
0758eb9fc4 ++ gate kafka sasl on admin password presence instead of a sentinel value 2026-08-11 15:26:40 +03:00
Kochetkov S
ce6228d6f2 ++ trimspace kafka sasl mechanism, gitea var had trailing space 2026-08-11 15:18:38 +03:00