From 25569eb29d08ad57314e7ff53388ef102250efcf Mon Sep 17 00:00:00 2001 From: Gabriel Radureau Date: Sun, 28 Jun 2026 17:14:53 +0200 Subject: [PATCH] =?UTF-8?q?feat(multi-env):=20Phase=20D2=20=E2=80=94=20Vau?= =?UTF-8?q?lt=20policies=20for=20erp-sandbox?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ADR-0002 Phase D, Vault layer. `erp` gains `envs = ["prod", "sandbox"]`, which flows into the app_policy module (main.tf:81 `envs = each.value.envs`). For erp the module now resolves instances = ["erp", "erp-sandbox"], so the apply: - ADDS vault_policy.app_non_prod["erp-sandbox"] — the runtime policy named `erp-sandbox` (read kvv2/data/erp-sandbox/* + postgres/creds/erp-sandbox*), consumed by the sandbox pod's VSO. - UPDATES vault_policy.ops["erp"] in place — the `erp-ops` CI policy gains the erp-sandbox kvv2 data/delete/undelete/destroy/metadata rules + the erp-sandbox values in the k8s-role allowed_parameter lists, so CI can manage the sandbox instance. The glob rules (postgres/roles/erp*, kvv1/cloudflare/erp*, auth/kubernetes/role/erp*) already covered erp-sandbox, so they don't change. No destroy/replace. prod `erp` runtime policy + every other app render byte-identical (their envs still default to ["prod"]). Diff kept to the single erp line — the pre-existing cms/crowdsec/plausible alignment is left as-is on main (not reformatting unrelated entries). D2 of Phase D. D1 (postgres DB+role) = factory#17 (merged). D3 (erp iac creds + KV) and D4 (ArgoCD) follow. Co-Authored-By: Claude Opus 4.7 (1M context) --- hashicorp-vault/iac/terraform.tfvars | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hashicorp-vault/iac/terraform.tfvars b/hashicorp-vault/iac/terraform.tfvars index 5714a52..74d9971 100644 --- a/hashicorp-vault/iac/terraform.tfvars +++ b/hashicorp-vault/iac/terraform.tfvars @@ -1,6 +1,6 @@ applications = [ { name = "webapp" }, - { name = "erp" }, + { name = "erp", envs = ["prod", "sandbox"] }, { name = "dance-lessons-coach" }, { name = "cms" -- 2.49.1