9 Commits

Include renames

Author	SHA1	Message	Date
arcodangeandClaude Opus 4.7	2953ec3202	feat(vault): erp prod runtime may read the shared GCS backup creds (kv_read_paths) ... Adds an optional kv_read_paths list to the app_policy module (default []) so an app's env=prod runtime policy can read extra kvv2 data paths — e.g. a shared backup-creds path owned by another app. Plumbed through the root applications schema + module call (dynamic rule, read+list). Set for erp: kv_read_paths = ["kvv2/data/longhorn/gcs-backup"], so the dedicated Dolibarr backup CronJob (erp chart, gated) can read the existing GCS HMAC creds via its own VaultStaticSecret instead of borrowing the Longhorn secret cross-namespace or duplicating credentials. No-op for every other app (default []). Only the `erp` runtime policy gains one read+list rule. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>	2026-06-30 16:29:15 +02:00
arcodangeandClaude Opus 4.7	a3e121b468	modules: add env/envs parameter to app_roles + app_policy (multi-env) ... Phase A of the multi-environment evolution agreed in the erp repo design thread. Both modules gain an optional env coordinate that defaults to "prod"; by the elision rule, env=prod produces the existing single-env derived names character-for-character, so every existing app's tofu plan is a no-op. app_roles (per-instance module — caller iterates over envs): - variables.tf: add optional env = "prod" - main.tf: compute local.instance via elision rule + local.owner_role (snake-case <name>_<env>_role for the Postgres owner). The name/env/ database locals are grouped so fmt keeps the existing `name` alignment (no whitespace churn on unchanged keys). - main.tf: substitute local.name -> local.instance / local.owner_role in the dynamic role name, k8s role name, SA bindings, token_policies - outputs.tf: add env + instance outputs; kvv2_path_prefix derives from local.instance (== local.name when env=prod → backwards-compat) app_policy (per-repo module — accepts list of envs): - variables.tf: add optional envs = ["prod"] - main.tf: compute local.instances + local.non_prod_instances; remove the now-dead bound_service_account_* alias locals (the allowed_parameter blocks build their values from per_instance_sa_* maps instead) - main.tf: kvv2 ops rules become dynamic blocks iterating local.instances in the original order (data, delete, undelete, destroy, metadata), so a prod-only app renders a byte-identical policy document - main.tf: allowed_parameter for bound_service_account_* + token_policies use comprehensions over local.instances (1-element → identical to old static values for prod-only apps) - main.tf: keep vault_policy.app (env=prod runtime policy) at its original address; add vault_policy.app_non_prod via for_each over non_prod_instances (empty set for prod-only apps → no new resources) Top-level wiring: - iac/variables.tf: add envs = optional(list(string), ["prod"]) to the applications set(object) type - iac/main.tf: pass envs = each.value.envs to app_policies Verified: `tofu fmt -check` clean on all touched files, `tofu validate` passes. Backwards-compat reasoning for the no-op plan is in the PR body. Phase B (factory postgres iac + argocd + runbook docs) and Phase D (erp iac/main.tf for_each + activate sandbox) follow in their own PRs. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>	2026-06-15 14:29:11 +02:00
arcodange	c490d37fd7	add ops_ prefix to policies applied to cicd role	2025-12-03 15:16:46 +01:00
arcodange	50f8ea95be	allow several k8s SA to take an app policy	2025-11-27 23:24:47 +01:00
arcodange	98395dbe5d	vault kvv1/ovh/<app> permission	2025-11-04 10:11:05 +01:00
arcodange	24c3d92522	enable per app role list of policies	2025-10-30 10:05:25 +01:00
arcodange	ea9e41ff1a	tofu fmt -recursive and kvv1/cloudflare permission for cms project	2025-10-24 18:00:16 +02:00
arcodange	784c014224	add app_roles terraform module for vault and declare erp app	2024-11-08 19:01:22 +01:00
arcodange	bbb0bc7d5f	configure vault secrets operator	2024-10-30 11:21:48 +01:00