Phase D2 of ADR-0002 — the Vault layer for the ERP sandbox. erp gains envs = ["prod", "sandbox"], which flows into the app_policy module (main.tf:81envs = each.value.envs). For erp the module now resolves instances = ["erp", "erp-sandbox"].
Expected plan (~1 add, 1 change, 0 destroy)
action
resource
why
add
vault_policy.app_non_prod["erp-sandbox"]
new runtime policy erp-sandbox → reads kvv2/data/erp-sandbox/* + postgres/creds/erp-sandbox* (the sandbox pod's VSO uses it)
change (in-place)
vault_policy.ops["erp"]
erp-ops CI policy gains the erp-sandbox kvv2/{data,delete,undelete,destroy,metadata} rules + erp-sandbox entries in the k8s-role allowed_parameter lists, so CI can manage the sandbox
—
everything else
prod erp runtime policy + all other apps render byte-identical (envs still defaults to ["prod"]); glob rules like postgres/roles/erp* already covered sandbox
No destroy/replace. The merge gate is the CI tofu apply showing exactly this shape.
The cms entry uses the object key ops_policies, but the root schema field is policies (the module input is ops_policies, wired at main.tf:82 as ops_policies = each.value.policies). Terraform silently drops the unknown ops_policies attribute on the cms object, so cms's factory__cf_r2_arcodange_tf policy is not actually attached to gitea_cicd_cms. Out of scope for this PR — flagging for a separate fix.
Phase D sequence
D1 — factory postgres DB + role → factory#17✅ merged
## Summary
**Phase D2** of [ADR-0002](https://gitea.arcodange.lab/arcodange-org/factory/src/branch/main/vibe/ADR/0002-per-application-environments.md) — the Vault layer for the ERP sandbox. `erp` gains `envs = ["prod", "sandbox"]`, which flows into the `app_policy` module (`main.tf:81` `envs = each.value.envs`). For erp the module now resolves `instances = ["erp", "erp-sandbox"]`.
### Expected plan (~1 add, 1 change, 0 destroy)
| action | resource | why |
|---|---|---|
| **add** | `vault_policy.app_non_prod["erp-sandbox"]` | new runtime policy `erp-sandbox` → reads `kvv2/data/erp-sandbox/*` + `postgres/creds/erp-sandbox*` (the sandbox pod's VSO uses it) |
| **change (in-place)** | `vault_policy.ops["erp"]` | `erp-ops` CI policy gains the erp-sandbox `kvv2/{data,delete,undelete,destroy,metadata}` rules + erp-sandbox entries in the k8s-role `allowed_parameter` lists, so CI can manage the sandbox |
| — | everything else | prod `erp` runtime policy + all other apps render byte-identical (`envs` still defaults to `["prod"]`); glob rules like `postgres/roles/erp*` already covered sandbox |
No destroy/replace. The merge gate is the CI `tofu apply` showing exactly this shape.
### Note: pre-existing latent bug spotted (NOT fixed here)
The `cms` entry uses the object key `ops_policies`, but the root schema field is `policies` (the *module* input is `ops_policies`, wired at `main.tf:82` as `ops_policies = each.value.policies`). Terraform silently drops the unknown `ops_policies` attribute on the `cms` object, so cms's `factory__cf_r2_arcodange_tf` policy is **not actually attached** to `gitea_cicd_cms`. Out of scope for this PR — flagging for a separate fix.
### Phase D sequence
- D1 — factory postgres DB + role → [factory#17](https://gitea.arcodange.lab/arcodange-org/factory/pulls/17) ✅ merged
- **D2 (this PR)** — Vault runtime policy + CI ops widening
- D3 — erp `iac/main.tf` for_each → Vault k8s auth role + `postgres/creds/erp-sandbox` + `kvv2/erp-sandbox/config`
- D4 — factory ArgoCD `erp-sandbox` Application
🤖 Generated with [Claude Code](https://claude.com/claude-code)
ADR-0002 Phase D, Vault layer. `erp` gains `envs = ["prod", "sandbox"]`,
which flows into the app_policy module (main.tf:81 `envs = each.value.envs`).
For erp the module now resolves instances = ["erp", "erp-sandbox"], so the
apply:
- ADDS vault_policy.app_non_prod["erp-sandbox"] — the runtime policy
named `erp-sandbox` (read kvv2/data/erp-sandbox/* +
postgres/creds/erp-sandbox*), consumed by the sandbox pod's VSO.
- UPDATES vault_policy.ops["erp"] in place — the `erp-ops` CI policy
gains the erp-sandbox kvv2 data/delete/undelete/destroy/metadata
rules + the erp-sandbox values in the k8s-role allowed_parameter
lists, so CI can manage the sandbox instance. The glob rules
(postgres/roles/erp*, kvv1/cloudflare/erp*, auth/kubernetes/role/erp*)
already covered erp-sandbox, so they don't change.
No destroy/replace. prod `erp` runtime policy + every other app render
byte-identical (their envs still default to ["prod"]).
Diff kept to the single erp line — the pre-existing cms/crowdsec/plausible
alignment is left as-is on main (not reformatting unrelated entries).
D2 of Phase D. D1 (postgres DB+role) = factory#17 (merged). D3 (erp iac
creds + KV) and D4 (ArgoCD) follow.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
Phase D2 of ADR-0002 — the Vault layer for the ERP sandbox.
erpgainsenvs = ["prod", "sandbox"], which flows into theapp_policymodule (main.tf:81envs = each.value.envs). For erp the module now resolvesinstances = ["erp", "erp-sandbox"].Expected plan (~1 add, 1 change, 0 destroy)
vault_policy.app_non_prod["erp-sandbox"]erp-sandbox→ readskvv2/data/erp-sandbox/*+postgres/creds/erp-sandbox*(the sandbox pod's VSO uses it)vault_policy.ops["erp"]erp-opsCI policy gains the erp-sandboxkvv2/{data,delete,undelete,destroy,metadata}rules + erp-sandbox entries in the k8s-roleallowed_parameterlists, so CI can manage the sandboxerpruntime policy + all other apps render byte-identical (envsstill defaults to["prod"]); glob rules likepostgres/roles/erp*already covered sandboxNo destroy/replace. The merge gate is the CI
tofu applyshowing exactly this shape.Note: pre-existing latent bug spotted (NOT fixed here)
The
cmsentry uses the object keyops_policies, but the root schema field ispolicies(the module input isops_policies, wired atmain.tf:82asops_policies = each.value.policies). Terraform silently drops the unknownops_policiesattribute on thecmsobject, so cms'sfactory__cf_r2_arcodange_tfpolicy is not actually attached togitea_cicd_cms. Out of scope for this PR — flagging for a separate fix.Phase D sequence
iac/main.tffor_each → Vault k8s auth role +postgres/creds/erp-sandbox+kvv2/erp-sandbox/configerp-sandboxApplication🤖 Generated with Claude Code
ADR-0002 Phase D, Vault layer. `erp` gains `envs = ["prod", "sandbox"]`, which flows into the app_policy module (main.tf:81 `envs = each.value.envs`). For erp the module now resolves instances = ["erp", "erp-sandbox"], so the apply: - ADDS vault_policy.app_non_prod["erp-sandbox"] — the runtime policy named `erp-sandbox` (read kvv2/data/erp-sandbox/* + postgres/creds/erp-sandbox*), consumed by the sandbox pod's VSO. - UPDATES vault_policy.ops["erp"] in place — the `erp-ops` CI policy gains the erp-sandbox kvv2 data/delete/undelete/destroy/metadata rules + the erp-sandbox values in the k8s-role allowed_parameter lists, so CI can manage the sandbox instance. The glob rules (postgres/roles/erp*, kvv1/cloudflare/erp*, auth/kubernetes/role/erp*) already covered erp-sandbox, so they don't change. No destroy/replace. prod `erp` runtime policy + every other app render byte-identical (their envs still default to ["prod"]). Diff kept to the single erp line — the pre-existing cms/crowdsec/plausible alignment is left as-is on main (not reformatting unrelated entries). D2 of Phase D. D1 (postgres DB+role) = factory#17 (merged). D3 (erp iac creds + KV) and D4 (ArgoCD) follow. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>