module: optional schema/ownership/source_kind/source_ref/extra_fields fields,
backward compatible - legacy secrets keep resolving exactly as before.
ownership modes managed/referenced/observed/adopt_once replace ignore_changes
for v2 records; referenced reads a value straight from vault via a data
source; observed only verifies presence, writes nothing.
terragrunt: v1/v2 detection by marker keys, targets fan-out into the existing
flat secrets list (one entry per target, same resource-key scheme as today),
source.kind -> type/depends_on translation for the five documented kinds.
brusnika-stage: acceptance environment for the two test cases from the plan -
regcred (dockerconfigjson.v1, ownership=referenced, value from vault) and a
rabbitmq.v1 secret (ownership=managed) fanned out to both kubernetes and vault
targets from a single declaration.
- Remove yandex_resourcemanager_folder_iam_member with storage.editor
- Add yandex_storage_bucket_policy for bucket-level access control
- SA now has access only to its own bucket via bucket policy
- Add role variable (storage.uploader, storage.viewer, storage.editor)
- Add README.md with module documentation
- Remove comments from module files
- Add infrastructure.yaml as single source of truth (like values.yaml in Helm)
- Make all modules universal (no hardcoded entity names)
- Use existing PostgreSQL cluster instead of creating new one
- Add yc-database module for working with existing PostgreSQL
- Add k8s-secret module with lifecycle.ignore_changes support
- Update terragrunt.hcl files to read from infrastructure.yaml
- Remove scripts, use native Terragrunt functions (yamldecode)
- Add modules: yc-s3, yc-postgresql, k8s-namespace, k8s-secrets
- Add live configuration for stage environment
- Add GitLab CI with downstream pipelines
- Implement best practices from theory.md
