From 2ec53e53fce0b917f350b975fe51688f74a6fd3f Mon Sep 17 00:00:00 2001 From: Patrick Hermann Date: Wed, 9 Sep 2026 05:39:57 +0000 Subject: [PATCH] feat(terraform-vault): make the tfvars template and credential file inputs ENCRYPTED_ENV and TFVARS_TEMPLATE were env constants, which tied this workflow to ONE terraform config: the cert issuer, whose tfvars needs a vaultCaBundle and whose credentials live under the vault-infra- name. That blocks any other Vault work. A per-cluster ESO KV mount and read policy needs different values for both, and on LabDA the credentials are in secrets/envs/openbao-labda.enc.yaml -- a file whose name the derived vault-infra- pattern cannot produce, and which carries no vaultCaBundle for the cert-issuer template to render. Both inputs default to exactly what was hardcoded, so every existing caller keeps its behaviour without naming either one. The fallback shape is load-bearing rather than cosmetic: workflow_dispatch does not define these inputs, so a dispatched run reads them as empty. Without the `!= '' && x || default` on BOTH, a dispatched run would render with no template file at all -- the first version of this change had that bug. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01K2rfvVDXWjWZAKMcpwvgLG --- .github/workflows/call-terraform-vault.yaml | 27 +++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/call-terraform-vault.yaml b/.github/workflows/call-terraform-vault.yaml index 5b17494..247f765 100644 --- a/.github/workflows/call-terraform-vault.yaml +++ b/.github/workflows/call-terraform-vault.yaml @@ -57,6 +57,24 @@ on: required: false type: string default: "1.14.9" + # The two files below were env constants until now, which tied this + # workflow to ONE terraform config: the cert issuer, whose tfvars needs a + # vaultCaBundle and whose credentials live under the vault-infra- + # name. A caller doing anything else in Vault -- a per-cluster KV mount + # and read policy, say -- needs different values for both. + # + # The defaults are exactly what was hardcoded, so every existing caller + # keeps its current behaviour without naming either input. + encrypted-env: + description: SOPS-encrypted file holding the Vault/OpenBao credentials + required: false + type: string + default: "" + tfvars-template: + description: Go-template rendered into the terraform dir as tfvars + required: false + type: string + default: secrets/envs/vault-ca-terraform-tfvars.json.tmpl workflow_dispatch: inputs: lab: @@ -91,8 +109,13 @@ on: env: KUBE_CONFIG_ENC: secrets/kubeconfigs/${{ inputs.cluster-name }}.yaml - ENCRYPTED_ENV: secrets/envs/vault-infra-${{ inputs.lab }}.enc.yaml - TFVARS_TEMPLATE: secrets/envs/vault-ca-terraform-tfvars.json.tmpl + # `||` on an empty string picks the fallback, so an unset encrypted-env keeps + # the vault-infra- name this workflow has always derived. + ENCRYPTED_ENV: ${{ inputs.encrypted-env != '' && inputs.encrypted-env || format('secrets/envs/vault-infra-{0}.enc.yaml', inputs.lab) }} + # Same fallback shape, and it is load-bearing: workflow_dispatch does not + # define these inputs, so a dispatched run reads them as empty and would + # otherwise render with no template file at all. + TFVARS_TEMPLATE: ${{ inputs.tfvars-template != '' && inputs.tfvars-template || 'secrets/envs/vault-ca-terraform-tfvars.json.tmpl' }} TF_DIR: ${{ inputs.terraform-dir }} CONTAINER_KUBECONFIG: /root/.kube/config