Gabriel Radureau
2953ec3202
All checks were successful
Helm Charts / Detect changed charts (push) Successful in 21s
Helm Charts / Library charts tool (push) Has been skipped
Helm Charts / Application charts pgcat (push) Has been skipped
Helm Charts / Detect changed charts (pull_request) Successful in 14s
Helm Charts / Library charts tool (pull_request) Has been skipped
Helm Charts / Application charts pgcat (pull_request) Has been skipped
Adds an optional kv_read_paths list to the app_policy module (default []) so an app's env=prod runtime policy can read extra kvv2 data paths — e.g. a shared backup-creds path owned by another app. Plumbed through the root applications schema + module call (dynamic rule, read+list). Set for erp: kv_read_paths = ["kvv2/data/longhorn/gcs-backup"], so the dedicated Dolibarr backup CronJob (erp chart, gated) can read the existing GCS HMAC creds via its own VaultStaticSecret instead of borrowing the Longhorn secret cross-namespace or duplicating credentials. No-op for every other app (default []). Only the `erp` runtime policy gains one read+list rule. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
986 B
HCL
26 lines
986 B
HCL
variable "gitea_app_id" {
|
|
type = string
|
|
}
|
|
variable "POSTGRES_CREDENTIALS_EDITOR_USERNAME" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
variable "POSTGRES_CREDENTIALS_EDITOR_PASSWORD" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
variable "applications" {
|
|
type = set(object({
|
|
name = string
|
|
ops_policies = optional(list(string), [])
|
|
service_account_names = optional(list(string), [])
|
|
service_account_namespaces = optional(list(string), [])
|
|
# Multi-env extension: list of envs this app deploys to. Defaults to ["prod"] for
|
|
# every existing app — backwards compatible by the elision rule. Non-prod envs
|
|
# produce additional runtime policies named "<name>-<env>".
|
|
envs = optional(list(string), ["prod"])
|
|
# Extra kvv2 data paths the app's prod runtime policy may read (read,list) —
|
|
# e.g. a shared backup-creds path owned by another app. Default none.
|
|
kv_read_paths = optional(list(string), [])
|
|
}))
|
|
} |