ivan
cf347a6a1a
++
2026-08-05 19:11:51 +05:00
ivan
6421953c73
++
2026-08-05 16:40:24 +05:00
d645e43de5
++ add declarative secrets contract v2 (schema/ownership/targets/extra_fields)
...
module: optional schema/ownership/source_kind/source_ref/extra_fields fields,
backward compatible - legacy secrets keep resolving exactly as before.
ownership modes managed/referenced/observed/adopt_once replace ignore_changes
for v2 records; referenced reads a value straight from vault via a data
source; observed only verifies presence, writes nothing.
terragrunt: v1/v2 detection by marker keys, targets fan-out into the existing
flat secrets list (one entry per target, same resource-key scheme as today),
source.kind -> type/depends_on translation for the five documented kinds.
brusnika-stage: acceptance environment for the two test cases from the plan -
regcred (dockerconfigjson.v1, ownership=referenced, value from vault) and a
rabbitmq.v1 secret (ownership=managed) fanned out to both kubernetes and vault
targets from a single declaration.
2026-08-05 12:41:55 +03:00
ivan
631375d53f
++
2026-08-04 23:11:12 +05:00
ivan
416efa8457
++
2026-08-04 19:08:28 +05:00
ivan
8991d27c7a
++
2026-08-04 18:40:29 +05:00
d08b3e1771
++ wrap all vault secret values under data key for selective sops encryption
2026-08-04 15:20:08 +03:00
854013a415
++ add contour-only age recipient to sops, keep old key for transition
2026-08-04 12:53:01 +03:00
ivan
545fa25abd
++
2026-08-04 12:29:42 +05:00
ivan
98750a048a
++
2026-08-03 16:36:40 +05:00
ivan
6510ed6386
++
2026-08-03 15:18:22 +05:00
0836a80800
++ persist camunda identity client secrets
2026-08-03 11:56:37 +03:00
ivan
0584257cd8
++
2026-08-02 01:09:44 +05:00
ivan
84091bcd25
++
2026-08-02 00:10:47 +05:00
ivan
0b65b58181
++
2026-08-01 17:37:50 +05:00
ivan
acdb4b6a91
++
2026-08-01 14:18:09 +05:00
ivan
3d69653667
++
2026-08-01 14:02:23 +05:00
ivan
f8ec3dac9f
++
2026-08-01 13:46:23 +05:00
ivan
27f0770e07
++
2026-08-01 13:06:59 +05:00
ivan
b0cf57d5eb
++
2026-07-31 18:40:41 +05:00
ivan
82e5014854
++
2026-07-31 15:04:18 +05:00
ivan
b818f612f0
++
2026-07-31 13:04:40 +05:00
ivan
f0b086a60f
++
2026-07-30 21:08:45 +05:00
ivan
644ea051a6
++
2026-07-29 18:23:55 +05:00
ivan
b3502feae4
++
2026-07-29 18:11:19 +05:00
ivan
b0f814e485
++
2026-07-29 17:31:10 +05:00
ivan
f64a59dd51
++
2026-07-29 14:58:02 +05:00
ivan
359aed4a7e
++
2026-07-29 14:31:12 +05:00
ivan
1741c5d4e8
++
2026-07-29 14:11:32 +05:00
ivan
8d785c7a46
++
2026-07-28 20:06:05 +05:00
ivan
194315a7fb
++
2026-07-28 19:59:41 +05:00
ivan
06e586090c
++
2026-07-28 19:50:36 +05:00
ivan
d38f1d2bf7
++
2026-07-28 19:40:17 +05:00
ivan
914abbe64f
++
2026-07-28 19:24:32 +05:00
ivan
19e725fa3f
++
2026-07-28 17:14:35 +05:00
ivan
942bfa5d54
++
2026-07-28 16:07:13 +05:00
ivan
a144eb61f2
++
2026-07-28 15:58:38 +05:00
ivan
bdd21c097f
++
2026-07-28 15:24:05 +05:00
ivan
989c8feb04
++
2026-07-25 21:21:47 +05:00
ivan
ad0e358c92
++
2026-07-25 21:04:15 +05:00
ivan
31580297af
++
2026-07-25 20:55:58 +05:00
ivan
054d542968
++
2026-07-25 20:44:15 +05:00
ivan
1a7b67d506
++
2026-07-25 20:20:33 +05:00
ivan
4d7a55fd0b
++
2026-07-25 20:05:42 +05:00
ivan
c283f9c67b
++
2026-07-25 19:56:25 +05:00
ivan
27287ca695
++
2026-07-24 15:55:10 +05:00
ivan
7b5698e2d9
++
2026-07-24 15:28:18 +05:00
ivan
4b722108d1
++
2026-07-21 20:36:04 +05:00
ivan
5aef3e8f7a
++
2026-07-21 14:49:01 +03:00
ivan
aeb3abdb81
++
2026-07-21 14:49:01 +03:00
4a493aa6e2
++ fix sops whole file encryption was leaking secrets
2026-07-21 14:49:01 +03:00
17e4b3ae81
++ populate real vault admin creds into ugmk secrets
2026-07-20 17:43:03 +03:00
1f50e8533a
++ add ugmk test app kafka postgres rabbitmq vault examples
2026-07-20 17:15:41 +03:00
f1dfb90dba
++ add ugmk namespace database vault secrets
2026-07-20 16:52:16 +03:00
e445c6689b
add regcred namespace propagation
2026-07-20 12:03:50 +03:00
198bd24493
change vault deploy flags
2026-07-17 16:42:31 +03:00
3434187302
++ add existing vault secrets for yc-k8s-test
2026-07-17 09:39:19 +00:00
b8b77536c3
++ contour: yc-k8s-test env — test bucket+user, db+extensions+user, kafka topic+user, rabbitmq exchange+user; 4 test secrets (k8s static/dynamic, vault static/dynamic); vault-platform inert
2026-07-16 16:35:59 +03:00
ff9fe1ce47
++ flows-prod yc-kafka-secret: add cert key 1:1 from live (was missing -> without_ignore reconcile would strip live tls cert)
2026-07-16 11:06:45 +03:00
dbfa8aa594
++ planning ns: projects-backend pg+s3 dynamic secrets, projects_db/planning user, projects-backend-prod bucket
2026-07-16 10:42:28 +03:00
99d82d409f
++ flows-prod kafka secret back to static data (keep coalesce module fix for dynamic-capable path)
2026-07-15 15:29:52 +03:00
ceed71665e
++ fix kafka dynamic secret: resolve depends_on key via coalesce (was try-chain -> empty key ':' -> null map -> empty secret); restore flows-prod dynamic form
2026-07-15 15:24:28 +03:00
fc7dc2b101
++ fix flows-prod yc-kafka-secret: static data (host/password/username) like sibling kafka secrets
2026-07-14 14:12:14 +03:00
fd462cdb56
++ fix flows-prod kafka secret shape: map host->hostname(:9091), username, password via credential_keys
2026-07-14 13:28:38 +03:00
bc3490a5e6
++ fix ci: re-encrypt secrets to restore sops mac (flows-prod kafka secret)
2026-07-14 12:19:10 +03:00
Vladislav Verezhnikov
a09315dba8
+
2026-07-14 13:06:06 +05:00
81f3eabcdd
add premises storage s3 bucket + secret
2026-07-10 13:14:46 +03:00
e075bc12ac
++ declarative single-file secrets, drop resource_key, sync kafka with cloud
2026-07-09 09:21:02 +03:00
8d12527af4
++ adopt prod
2026-07-07 17:10:06 +03:00
