viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2
infra/state/stacks/vault/terraform.tfstate.enc

4534 lines
574 KiB
Text
Raw Normal View History

fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"version": "ENC[AES256_GCM,data:jQ==,iv:FCcBVSYo19VTKyW0jhf4cBaK9VlDI7yQcy0IJZjm4h0=,tag:UhapBIWl+etXnXA9ZnIpBw==,type:float]",
"terraform_version": "ENC[AES256_GCM,data:IdJZVVZ1,iv:Jdq+oDMcs0a90h94lmny7Vs/JDFG7o80HMs7+DMa2LY=,tag:0yoWhYmXs50N6QYuoW4xYQ==,type:str]",
"serial": "ENC[AES256_GCM,data:2sXC,iv:4BJK+ORzNtvRSq2bvnKPYfvtTIMJ0uK4D76qI38+pQ0=,tag:2WUxQAuA9L9d2+jse6PR9Q==,type:float]",
"lineage": "ENC[AES256_GCM,data:D5A/aUF61u4nU+77XwxQ2+/pTk5MkyYS99IRf9BuJm2VZWFZ,iv:htJsGPrZplQjKmwQkvay26S4T90+xSFJbTQieqJrH3U=,tag:wki9JAVKR4rhXpBZSgagfg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"outputs": {},
"resources": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:IgXWPw==,iv:DcUMaYof/Jqdwy6ApR603XvqWNKxJX5KCMh3WaMmqDE=,tag:XCMPRbuWtvWQ3Sh3E734BA==,type:str]",
"type": "ENC[AES256_GCM,data:B3YfPrXyRS5GCH91MBl5e1nx,iv:huaI1TUpFUHgyVIRtnZyokvTH1Kd4zDFM0eLxXjED2g=,tag:IbTgOY71ppAsChLQmRvy4w==,type:str]",
"name": "ENC[AES256_GCM,data:RO+XZj/OPIXoNN4=,iv:a1c++/9+rmXEWRHG2E3C7ViqD7IccMMbGGMXm5XTJnU=,tag:huZXN4Lvo/E06Q4w+srWvQ==,type:str]",
"provider": "ENC[AES256_GCM,data:bgJUeKHJI3cMEmy+1nuLUC+BEWqpuIGQl3YedgNFmwYCKA99jy1oYb9sZ4wCDnmvNw==,iv:Bdkk3vWy9pDOR8V4+VWkl1rk+PFO8k8/w3bmfWP3zr0=,tag:SdjCiXmtZ5FgyvwincmLPw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:eQ==,iv:afTjFnEStqW1z/b3ZkLBBOfBMfjt2TcSN7Fp7XmrohY=,tag:1EOBwAakThQshUdUMnOtCA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"created_time": "ENC[AES256_GCM,data:RcFaJrRVmKbjkzsbpbprb8CX5ZRMo9N57h40/+ca,iv:YoihZw57ehi9DQeanUvOyvGmreKRDjMtV6p7+zzmZU4=,tag:Z4C53eLhBXWSLt+tpKYKeg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"custom_metadata": null,
"data": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:bSC98oHjvJlGFw+bDetnwYRRYTs=,iv:qyHlu2m0LB1Z4tFGanwdw4S4ExLc9lKampylNmldl9U=,tag:RzsNomZJgAXd9KiME2r3Zw==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:ttU8rIHwtm3k0a/026iifusC7G13spLiprHw1WTyW7BS/gzb6AptUsTpVtbjexfZgGWD/DBN6JNnQUs2X3lWkJAkgmnqio08HfUduHGdg2c7,iv:OR59P7kOK6j6j8d53xYfLASilYJuCj3itxK88dp89nQ=,tag:VosACFiZwr1+MthPHaMgrw==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:4T79G+7V/tN9acaLLqX5TC6jbgrVh3Cl4G2B5JOxA/dV/9j+o5jCPxY+jSPenz0z6hbm7uZ5Bs9RdATjk+s6RLrm,iv:StvVsU9rGlH3d+hfilDQtLLS2TiI9i7NZKuaSl8ccp4=,tag:oTkgFoTmhfBXKRDhr1mL3g==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:2/aXk5fTYL6h8BHIvMKozg==,iv:foIFBLKLq3zK+jm6aRFyEMZc0vNV/YjHAQAFb9mTxCI=,tag:wERxlBV6C3R0oDvprXP6VA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:29gcSIUlckY/lPvYCd30c9sxLK3+3iBZGLtUS/z96a4G7L1LGoQ9e54mntkrt1gnqweT,iv:EIehlaQimt4gMRbPdTvH+aK1UJdhgWXMd6PkQEH0oro=,tag:dDwGKuhBQj1dyFfcJBI8dQ==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:iYwijhI2ZIakXhfaMOi1gzvUE/RYLLbM5uSP/Zia7j5Zj5b+Tw==,iv:Q0Y5LBAKq9QKcx7Yv2DoaDZ3F5MM59Bg5ZTLIch+Nq4=,tag:u4qrKRnhR1P/nLPlB95XFQ==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:k1It5vyLYZw/7Vlht85fUl0/pjqJb6CdekeD/CuGkiTYRI+V8XXn0qcr6B2FWqp/dy/O8BZG5+cTqSRNvnkb+DY5I0B0x0EQLzwX9x86XFYREc2CjyCbhzW+F7iQVe+2/YvxHJrD2RyWr9gw+We83ClZ62oXiEJRR80bL9KjT0H203i4rsRjwjd2lnlolj+AjR/GJiesmAzOschC+Mn1+hkkeSxvR3tZZfgSlKccykJ3v+xDi/j6fg==,iv:PvKgKFKJDZvOe0ZzyimH0rMhRmn4oMbJkMItR2ftLM4=,tag:GFUF3SdPu4WDjI8k0CcGmg==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:8Pn4yTQfVtSfYHo1oPHOsPvL9DCpnyIcHFoO7TsuLR2ZglYTfzU8a2oXIg==,iv:+sln4WJihEVFnbqAwYYQetwny8p5BohCuLPqDEMxNBo=,tag:tTxk/Pry6oIQPGfa7cUxpA==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:q4ZdrZtNKC0euIHnFXRurkoOD4qhf+zIa35XJh4=,iv:wi6f0fraq0awxNWbjuIECdSJvw1LVapEjqJ8jDu59Mw=,tag:FaKXVLobgaoxlI/C4+vR1w==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:GkwpduPpSXwEHBKqogh/adow2s2RFYYjjqA+Yh7UV3D7uGF8SP3/52MXlej93TlGQDGNLlCFUCgueIf0UDQEag==,iv:tkjDctlTgfnZ3BKx4EyWTwl10kIbQSpKz/W029qxrbE=,tag:HH6T3aZ6e/99OOkXtk9JiA==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:x/cWOLDurV2xXeFsa4Y=,iv:xV1AVAAOsVMksBka3NJzMBMmoS/amwLjpQDvFopX7aU=,tag:hI5PIYyLiuVy5S1Ic8QTtQ==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:nJbpxNnfD9Lgb8RC8s5yMYFWO4rKKiCBlw==,iv:oseijmcp/TbMF36zvPO3u6jcyCuhpqEInLULh0H81OA=,tag:RUG9tjGFmCkmii4uwQnImw==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:HEnciMEu/1iLSR4XGi3S1rIj2U/e4Mv2Z9W+cRPkSdM=,iv:K+WoDDVz8swfIwd+rZncBYAqtboui4YvHXcJgZRuL8o=,tag:wyWqo2S/uFx2uBJ8ygTqAA==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:RsXyMmI1lLhT3TYo2NcLMzRfV/8F66jSOYo=,iv:v2JOiOWqcf800bhW6Z06oEg0Cy07Z05WX+rm21l8fNU=,tag:VXh5kbdunehfH/U8+fEgCA==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:BqgLHBSAkxJryzx3Z9yom7Rzl5aXjKQV3FGXTg==,iv:V+Xf0yh1VYil0X49QnpHm7uMrJAAbocJvuGuGgQSBME=,tag:u7ji17FlyK/jK5dHYL0Ckg==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:cu8joYfruzUcCiJpWxUscvnq4zI=,iv:457kRkbZnED81YGWjlrwABALDIT8qU81SzeS1ChJ5pA=,tag:8i+vI/DQW5ji/gQLSxJOxw==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:C+fD3gHetPt8OP074RLcu3OKwF2r,iv:Uj70FkXzSCXFFdM/6oFYw3aPqQcgpE/Gzs7nz/xCI/0=,tag:Jrd15JALCRRBWr2oDmrv4w==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:E7wkEu1WWWh0YGI0Yj/+QAlzdsnjjJwutj2izK5CX9CtM7thMrBunro9ZuJTiNbOEx1pbpjhEPHysGl/DxOjZRa/RD+GKDfdik/QABMjtnHl+CONc/f8Z0TlHGALi+fJusKa6eZ2Pki/3rM3v9A5cZ0VqhBst3IJu9R7NzthdSjA0NdEhHEdm9dUELAtdN6FaC5hyB69XUAylr3APdsw4qHoopYBPQpDXI/9y/2GNuPBIro2+ZRP,iv:oCaHWvpMbeHZE4usqbK9HNH06LSC0qaXj75XxMqIw+U=,tag:h+8gRClr2VIRzY/DgVmPzg==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:Yw+52fnncYyQhOPmpWkcIKuQEcYkgJ+TAhWzjEKrx5+T45Is+CJse0qkh4noqniMFWuKJc9vbOHA0zDyrR6ICbVEUjFwaRT4uuKqIzf/rrwWPAJHTctVT5Tq0msoKD0hnQSUCKUwCACCWDcNGfgD2YnVzabEUkBPVnrXV5Ffox4McXvJg22JnB+0wCpojkyP0vaN3mn9ojQLeDVhlvLxAQz8cLxXtGz+jh3Y/vthZ9ekVp9GIhQuaL6vtW2EdtRFAodSojZ97qqhwqhmdgkVLxovMjT41ueRhdL87kzWjY4YECs2oyZToEO6yEAB/EnLZiSZ6TU3jXqqGoIgYk/A1mJMDuVGxuazIhaQ4r1z33byJfrd4pvLRDU6Xupgh2TGIVLl4RDdFhd+RPYhZA9o3tHpPzQNbM1WvGHZLjskCfx3PY2FPX9uWKKkhIGApeOSMkrh8zRPUhdYawhwOXVV0exYdtYCyXgS+Lyk9Mhf/crgT7ApXetLM0iWdKxA5ZV2Uu/O0nXR+CFOrVtPtpnJavOh3tVtm9+wNSuKjQFRsawtEDNNgTP+DcGmzrbgR7il5j5k9YjultxhEG3uPKW0Mjg9X/fHGzdxEww44ds//BpgPv4Lx8SBDj6LnnJAKAkB2PwTHvXzzEAK/O2YdnoMU193Yu3d29Z9k1nh7/Zd06kEl9gbvZH/8ufa7Nnr5ibhSOnbHbtsArSYK+dfirPZb6gIaCgU6jJXNd8NHRiDswETAfyzzzbcMXHTTNTbe90j7jXviCrxUnxV3lnpcOG93cjH/E6q63Vb9ekpBy+/cPG+9B4UurwPthFLlY1A73hxeOyS5iU/VmbRsbSSHodnZK8u8YqjCMgHZs0PaB1j+cLiPOYxGSRilto2h28mWzW5p/u59iD45xVpdQx5r/nYDUexeZyXifSa7BZSJx4tGDE8lmdxpl7pCRrGCQ0mEMG1n7hL1tEJfekInXk9O/WosVqEhOTBXa+AFhPVttBui/YhXeyNiTKLE2E4Bqt9XgHUigVQLNsaneJJ2NLSy8n1XKwyDinNuR0eyMOBloqJtM2UY9W3mL/dxeEvCsYahNbteMG9dX70WUeO3S4PJ5vxjwzyD1a9cAU2se8+c2odPN6mQlcgAQtJAdlsAQGHYD+vVmKp79SYIZfc7W9ku9Em+fX1QS+NqdQ+szAKstenwKjxt3qZuMSjOZ/pLmdcb+pbYkohHJQl5k6yv2bRIB2hAEzuwlYm0jWQg62S3iJuarcKYhnmLYTBK4O9k2jc0T3dkqyrGsoGPM0eMX79r84JTneXNx44nuo+I4euc8jehyERC+nkNwCn3E8PQaWPQIRRbpG5CXNu58STtLZZiDY0LQGTV/Y5TX//cMKQ5moKzYdBXH0UVPT3dyVN7+Y9vCUYSGDDH8CIlmf4C47mbXfcG1jKFKc0f+PUyUh6mO2iYKrvBKytpNNwGhhvlu/at9E0qdTO6ReoSANrmGHTVZ51nIF6AAs7xHyuv2ukPNNAFioV+PZG5p4wFLLbWQfeAsUGnhnvuM8WoeDoKkXwcS9jDUZ9ZzEvqEtslDlD6GVG+wkajyHLigkzs79qfcBbKdIibpqjD2//dTVvPMyGST799hEVPwYwicBG0WE9GYFyvBbPH65SIKbr8mzpJo2JuksHcwiqb8kBniKfyWnOeEP5NzlIq5/57ryMR8OrOGZbCzxpRTU6DFAYwxFGQ3GqhIMCklOtIpbtZ8MVGL5m26WUebUEhANQi6G6+sZJ81lHjNqKy0YxAAVHFKW5wBrQY0S1scH7YwodzbJZW7HCMEkcvTJ9DCHp+5oS256BgT+lc5YL3uzIiZ4wm6G5gA3oGCj2Kq67YsSNvY2kwCs1RW0E5cva7KMTHk7cnvJS/5S0p6WZLWebx9tGzHcmJ2HxULSIdddAE6KirpPhp3znMacHuaMO0Irt99V26n669lzyNMLyEGhXxYCs/TQzSuA0gSLPzZClsVjIPzJfCYK+0MZtbGrbUeHjXIG5UyGvOxaiCR8A7yl6xF0mC1kNZmk2OcsARYaGKnbG83Pw7VbBkT0PJzAcI4+ojlNNNvJBFIzQvEj9UnNFipn/uFDehImcVNVbReDF0oZ4lSz+Qx+9eqWFHukDdoqiOyVIKwicYyvOB6Orf8ctVOgyEsYqs/pAX7ig+rNpL32o0sS5m7OIshdlspqw4FiM5XvEv+YruYPt+AwLkAHfM60Wtp38zQ2rqQUfV/lIfbyiTiDj9hkJSjQVKERgMh18H5ARLNV98G+wPcAnWc3OPvhEfkvonheViLPnrsr6XUj3cbkJoG1nxyEBn3X8gthMCjRbI8XoHIoxzSnDNtP6+dGqhxlD9tXFGlYzUmzd1JwhqYBE6PltMZ2KCuzXLpEVmTB6vmEbKjv6bBI+NnjOnQPYKcbpATBR6tpdV6VB/1lNk5Knchh0MiwqIOhFxtj+rEYTmqCycX4q85Uhpf0442+ublmv3HCVhF1BEROv2fVdjOGx77z8MEI8SJFtyoKIyQ6YL5DFurwEt+8AnFROFO7HoXtQOyXmp2jM6T3ZKuOgpPqd10qbxfDaAiCZtdSqZ3c3ijLw4CHNrTSqyNWnv8ahrko/05l8HDLSxqkWmLcukqrgkN8tEWeOXdx+Iw97Fqe1bTINGWImm0fAWEf14zYZSZiX/yRcJhmWXonNXtUjq3Zay1SbfApMQvXn6N3oJxLuSnWaud9tmbTSV/CnIPb3ruheQ2ywm8MOT7j6d33yT2hecIZTtniyA06Rl/m+UFWKNDbYdN/HSb19TFFiWfi2WH3CljwdfCoohxPFb+F+5eTV7iVCRrCRnzhWzgqPKMFMgvjlEa4H+Ftasx61GxEQt3SrqcxLlgDK2PB4T3a6jdJBcgbR0hzlsz3aLxdQqmZm1m7Wjk/tRnK71DGjykc4oT5y1q2nEhfhOz//SNPxy9gQkDvMdPPa9Kwu4soHyCeOkWTienQhxl2pZGPDLJ+0V+H2pzGTPPbLT2o8JVu1gqiZuixGk4Kk1b+kRoU6WWXJWhy8x/5G24PCRu6oijZyt8nlopLkNKcdYB85CgMFTdtEvJnkwwPqS/G6M0FCGSk6xTG0VPrQMdZsrMCPQKM34dP3mL7sJ74Ts5vY80Alj6fSjLUWfRlqtz08JPV1ntxVu/mSZWBgMUVaxIWzKQJDPZ8jX4R1HmsQTXWIP0aHpev8gPfUPwXj06l9Rnxvw0vQfvl9kwEwqssSi/OqJD5KffHGQJN5Yp35Ei0u2Dr6mz+FezISxgjWLpHWsmvtWRZ9M5AvXQlgsYL0NEDvsaSHxxhKGTenfh03MbCQwPxTZGgQ+DItipCf4OE5Q/Uo/xnKQyyFyMIIOPCydc+hb/Dh78q2XOtyhRvbi4jgkdxCft+urCTeEMdswZkb418oTBZoirkoXzK2WdsileWdPjJDqCS66sS9t6TV6yUdXO/fugX8Hi7JvuHvxxmvnN9Cmt4VKZqpevj7nswodhlyoR2a6mZd33HFgSxEyG6guAJxpBUMV7ZdTBHFGUUlynhhl5FLk9DXtRovaTrq5FcngPiaaCmYSeY1bp5eojGuKPU1SEIof5VljhSVj7CDg5Rh/iCs64YLGTU9nb/9rFjsRsvYSCYnchgk5bESq84pIQH6fJrTujEZLWs49yPA0pPhtj/uqxNmAf3wboIVk7U6cmpevPry9pFdxZJ18Pu4ww6elBtCx8yP5unAgquSBVtqXJXQEHkXTZ8FsWuDrAPfajpp2nR6SI2KJQL6XwdfYcTEDFDVjhRocCXXcQMwaguEYxp3YvXF83Gyj0tkvB09aB0Hq8OkumSCP/Tqa8hBjzivqc701UZqR7x5b7UhsEsr2YGLxxLM1VsgpXX9DUIoNCm6qTBQZI3sZTYvXzAy93zeY7nut4l26tRsqZqxjqODzkMmfCs2etdIQRip2Bb0BgBQHIB1ffwHe9xly66hVk+h8U1mfQ5sr12EuqjE4k+qqvKNOM1TKhBFbiaQcxmiWly3vli1KRZwkvR9XcgPwbVYcpQkq0y7Vm
"headscale_config": "ENC[AES256_GCM,data:JR//S1NbvPSmWlJYeQiolxITd1sVco69bm8EBbWm0z9vbzvi8PKLZpytnTpUMiDMPBgbJnq1TDNDjm2LmgEcaj4+6yGpkZsW0yMeWm3U0UZ4mJZkAllaYjAm35U09PlsR9MpJ14g3HkCVnYhQ8FpaPyGa/WaN9Mcy7EFvYvPTmh7JGa46b7PendfKZsmiwqWVNsvTkCao4HBONKICm/I0XdkhzhS8/gs39bQ4qxpnYrxRJx1uUQUfrUU7IJ4FxkrxanffluIg4i4q2TcaLGQcdiTaly6OzGQMIyblWEyljme/ONY08bCR2RvV8D9iKY+DkObR+NZvMzKuvGbp4sz+yIXgQZxDn+SiOi5xg1reR+lwZIGEEyB1aaf+FCYEuOxqDMqOQW8Cz6myCPuZfPbiNxW6FNiL0fZa/lLLSY54Qh9KPfBh0JxuoBpkvVXmfUjqu3t5KEoq+uTiiXMNRnbjhbQyQc1MOrxptgf58nZbJlOzZoAdnw5b3wnbRf3GsSEYr2QDSpeF1TWNXYD57+aCY2I3ezMWsk9h6NGYJyAhxgcahSMtHeurlhz4BtDzN6qYLHcc+ldfW76+1AOE5ZOMpaXMVIjdHJq5xdIPWPf+aVQQtfUQy2bKwxs3jrw5DeOZS8RXUnDwqJvuv6smpkfXzKFd5ecOQSI2qCcVm+PcbcDHYz6OVpNn2KDg66I3kl1XP5PqdtuBLGBpkcxBEUxIoYaWdxfpiQ6iL+jY0Z8XdLJztBJE3LsZj6zT/lE3/eVm8LXsQ9U9eTl6OJqMW3gGIbLLNDwZqtyUdojot0uPNAiQd0f+W0Ew+7kfbLjK93tQlsKcsTYZSOGz9DbbuegmOfQKcm17VrgfatCVRhnfSq/h+lCjzirk9MNX/VR6MaVkupaKe4vz7l+U+R2agHe3BowwNNVpZa+O9h6qPyrFUy6dgmHsbcVW2la+brp4OsDO7V+cZPx7WDuV1Urd0BRuKyJuZY9pzsAjHTrn9WQ1W36zqMnhASc03X/6ZskQQDZxX+qsUgRUVNDGMAe7IN1UAsYzVwYjY9B/iEgM6ofHzZoBrdaLOygX7v07unKEGfRjk5abOZtIvkf+EwfIsKKZGvZsnwzNTgYb8lUepV4d0NHlLTEBZoJGZkJDYp7PTzUfVOouLvvNnI1l4czGyKhBDOnIaYE9X6fwQyxiaw6xxN7S8uvJR7uRsHDR+psyhVNZg41q2qgB+6OhQeYvDTO54JyFK71bfrei4sqvkLNZZqzGUP3bHcGiW+/jXZOLoTNzF0isolHQlZf5++aau8xXZtvGS+/Y8wIjx6r8LcY9alkT0/bMnYMFciKEALg307lhvQ0YTEMSF1Tt+oHN5ogGwejxlN1nvx0zHMNkaAGT/KVOWlH08qPYI50jdxxG9+jp8PwLrgGzNkBqO2Fb4HJUHvXnLMgbHGPDDMAksToihuz+zrkjRn+dSlk8bZi5fhMVFyMjH/+fANdkyZNO6Ra20nsH1QoN9EHYsFLH5mtFqiHPaM9U6Qs0h0y/5gRBf7ii31RdcYJJYAdG3MHmy4PL94TtO4SYS/RzXGmJZvPC2CO127sOw6xy7rTkLRiDADQRMAjmojR9zyj6WSIgmw/T/0xEQviAAky2yp31jtqdZ5QYZQX9jn+/ptSZVdtNKelS/Fr4fMWmQ2roh+V+jhsJPx4UwKUJkWmF0HuIVVTJ4R8dUVx9uuuGlvJ8BoDF6KxmnboYmsmTD8WkwmEmYT4TEB0gR3/OyY/wP2chzAZEgbiMd7iRL5P0CCgBhPefZLIciwT7eI8oGm6b93aKGCGWCyFWVkW45PmlU4hTejRklei+A3XxiR0ZbShpYoqqEXQtvGGCQZo3FwIVnDabS5EeEyTZqia0/BQCnvNI1ugPiep1a1EbpXEr3HuH+7zf3O3pan0f4SsVWVbTQCNx9dtSBCPZaw6Y/bZZpZbwdMmyOt1/c6/XLKdxakr1gjZsLdh8kWUlYEDzR+lw5XBpk7+WV1+MeyMK0aDJs/Asd4TPgLMP5G2m4RcGEYT9vJg9ZCNEYmgb3VdHu2baeiXAKMupmhUfL18FMrqF2SnaFesIeu2TTMaBtJoPjG5Z5FLu4UrgwaPWwS5GyAit/0Yi1C7CQaaTnGjW2kFi2lLg/91JdBcC72G8TMtBAQgRvc6NI/imZAlVqrXzzcY5WEBzDacCa+AHV2u48RM49c8yhfYS09uMsggEpNIJ4IaM7xwUvQLH+izIaioo2h26to/DGMstjNGPXSJJPB5C1zzieJQDqAsIZDWi6x2djjX+sUDpjGqPreTQfV0IYa3bD5NUWXBE/1qkPqIQwB5g+8K2P6c/hpmkAiDtvCXZv/HgDrJ/QACUEPUJ2OjSeLQBjQHAcmQJR88vsPa2OkZUes/Yt6hpJFB5fZzem9H59LCCkbU/UZVX9gpwWjoC0gOtLO4/2c8RQ07yJtStfN9sSMi8ASxwUhPYAqA/93x7gYdL/k/Ei0Lm2pvuF4VAY52PTLV5za+540ljk9lYLl94AkkumyD2gLs1O9485QLQYODUHNV0DQn6bq+vhBojogJ56QiefxFsRcCd851p4MoGvki2jsfakQIsuGmRgbB4Mdy2t2OyyvoiAbkAT6UHmIQ2JbWE3wwByV8dp0bkIlqAkFaFclnld+e/I7nnAZqB8iMBP9Ruo31/8QglcZKQY4cpAluYFBElgsiU1+Erdbn2ASxONhMNu/eTEyXTGQ34mAI+wzBIR4BA0tThV0ALjSXMJzRcdM4unvZk1lJZaMl9isVWdgzVi7fX8NC85J/VIpMbNUbXtbdnOQSN321j10IREVOVhEpIPSC//7m3uM6usHzBQjfAW+yYmQEWjbfuU8hwXRxILyT0/xeFAJvE4/oF9eWCyn1XemsXLZ8WglRp8mA0rnA99NKhV1KwHf7k9davRwYCA8guWVjRRMnlPUzWWNmdIjKWv83WDQodmBz+pXLLQ9nJvFiGn1H2UtmAkvQ7d8n88w9MjHhcWMIoKmNPiEH3kYT5wWCdq7z9PgaR41a5LPea0COeO8dpvYtkSFu9of4Ce5Z8uzyy5IASa41A/ifTeDzzH6fAxo4P3Sqy6MDd4lV9gO8axnUdJwRGrZk89Bk+fXSt4CW80cBm5K8qGRMAegvm/Cp+MxufynQ3y22TEjnZHGT/YHzutEKhcH0yVjWHIjB70QyC8v9I6A0h2R1mkALkeKq38loDS+L8JhWi6H+vLNxy1A6bZytBYlpOGcOablRXEKF/sV8NC+jUC2DfxQizVHoSpYB2LvLrpBjV4q1hmHmce6F4IsCMe3JG61aPPXfvp7eY8R8LAbgu7gpGfPKWraikPKFng3QndfFPv1/nmGmO3pRZpMumGJMST+dLRFSPa6p1UKudyXtWpNe2pNFoP9X8KU7Abp2mSgzCi1o+9r3RfdEPYLfHprULVuXg16LUTBKvgNmIyLefuffD3DKfyi+oON4No34qVbzCa4ocNRl0as9ZEyoZ84Me6Hb7FVsS7EaaY4aO7w5zjocRmADxiaS/8dzxT4N8ZAQzPr1rnpN/+nuFjVhf1xVZMMLPfM/Jwmucz3VJUbGbDum6yKH3CgFOiOI6mC/ZQRLcPhD6GoeDUhvAlsgvIf5lAOa3Oj9L9PqLD0RdW5l9RVyLIavmgU6y2nuDZA38MUsP8LcDaodJNytplbAs0LiPN5J9zYm1B2OooatJG89WGSNyXoHq5ucDZOw+LcgfzKSrOVsNSyCydLOSWg4ln2OtiKcHGR0FBmWs9h5XyZbnI7M8rpWr4m4uJDd3iE/j2sApY+STcFOw+tB9ywS/qDYQBDjHuLc65Ed/i1iGDzkL/HQ7zCDGW7yOd+kA3VZvMgrUjNRO1imgNyThdOVphs/UMTGzS4T+T5odkviArEHmm6fAcFPoul567Qyx4LL/awsMzOY7RoYn+BYEdi+CL41WmvIft1aDDpOuHBeiXZP3GUpP0HUwjHGqMdqlK0aH7SBTWNV5KJLw36THVj0KM6FaemeCZZ6qmPI7cv9WoYLC6J
"headscale_derp_map": "ENC[AES256_GCM,data:snKqv5PnD7RscFuMcMNzhQRHnwa9ZlL80ppprEcrTb0px2FlZavwUZkDqnWEwdLoznmBiLPLeN6CCf7xUjrotaLqxmtuHbuzhcJOOON8JK6tiblIgm/jpXoIETiZSValJ8qLdAqK1GrmdBd08J/0wA0aP/e3lRKzUTSOJiXw/7UvwzeOppxOlPKrtg+sOH3pRujsT5sdbnr1IuyPlfcSVHd7kJ+Jv8sjhV+Si5Fw/OP7cEIaklkYmQPaQsTpHWjdHgpoCnRW8KSoVamaFiOlJCckZx4v0LufqpaVtNBTrXdvvigDzxJt3EtHe8TQ0nuPDXETfB0LhJuNUM2ttDv3vYNKR2Rh5d/Hn+mt3xP1ycdItFeL00uyWUe+ijV0xIcxOfHG5IQPD1Q8p01FvOp/rQ2GJeAE4Aa3Wuy1C+QqUZhVa6dUnDi37E9vjLhn4kmSmkLGuYwGbtEhlmHHmzQyrNsCHl8/10NrAvoM7qKqg7W+Gwv3y+8ypD+1IfyPiDYaAEm2XtYP/5Ev84E1zAZpcfFmKWMS0mgrrmauvQwMqjHzxOjPnXuB7Ov0S0z64TteXHub1JrksAXoNpuxkYRJXs09ycbYdEGNCvT9EM+Y1Iw+yiqq7/j/tdaY1LCS6+avS8p0A2jOm5TIEdVO3q75H7b3QbDxB/AKeRQc2IJzM7/2VyYsEHrvR4e4K3firAXdX7P0JVHxjCJkaVPh9XAO2LVwwCbqrtDk6H61vvqwqbjNmJPzOWvdiTJABy7JUhh2ZnAwMW5jBNdBZtP2s0ZIBG560Y2VVkNptccgbP83qZ/AdIHaxYEQVKDll2MFwo0G8vD1hHfA8RgoqZUNoH5dyMie/Axu/OjjUK6pO91lVYxIzQAuXx31w0fdXeV+kbCWQ2wcvKgBEcFtbFxeuvbXkzyFAs7Kh81G9Qn8X+ojCurXf/heqMtMDZI3vDmyyPVwOnzlxrtxQlTaZvo1caEDJfjK4gNJwJ+tM3yzNMFMCTFduRoPIaaN/mrHM7vnwXFaEcaXsWNTMbSdr9lbNWUzazHLdYyg5uPoNPKboh+EUNQjWRB5X+WKqaVeg1wcYuAIdX/llWzRTwpGDhbiKCuv0uMnyjAZaExojFugbSASZN8sPWkuKnOqf77gBZKVfneD0QPE1ot45RpmY2RMbgrIjR8Pz0M2cfJ0ALfkHMDS8SXFuy2chPuG28nViZK7wVn50FWyHEtwFBgr6slyXqIKZd8rflttYMZxIPHrZ9t6+ekZcX1AMvXdcnZrkiBJZAbxXxN+U3QzS8xBBB/vW2v/sRIxZ1TZZiX7/FSRxJrDHrs8hxSHijyW4yx/d5ONHm3PG5HHcTpXvH49as0yUuZSrmdl0bMTEnkzk5RkLIP9UPX31efXRMiP3wFNCdoC21AUKFrpdp8ozvUxZP0CN2OlxEKhfXqBEGq8U1Z/w3EM0lXmD1ZtxKZtt/+KY8Qb1Ojwi3EY8+6d5rBzjtlnNuQ5VJGS0zfPOcb4sIZ0lAS4MaosMz3c8FHo6TTOozn6fRt2bd0HasCF9nBgk+MhmlrcMg1cMFCsn7t7bM7wjeuiHgv5iYRgd7xdrZfH6AEnXWbV/wMyOGvZNjv4vBxWrherDra+yA/xI6PE0mkJX24+bs5+H7pQoo8ZHWJAcDAYSVgsA/EfETKpsVaUiAF0afxuK2rrw/gPb1ph5xfzMY/9d2ju5U77+1/Yqjdc209FzXc/7NcoVDspaTNCHa2B30QUa81jkyN94Zl5xM9XRWZhUO48pRokdDAa0P8R0jLBnz4d0FDlYLS/p9HFCAbg1YweFRA1Duu4ZRHrg8h9JMUeyWMNX2RrwunDTVdsjim7bu3R0Gjl+/C2pgyyq8GvkBkKnMKfXR7zzLzJxpa+gQepxsnVdCFDN2pcXVl25yDrGdWSHCUL3lwg4YftoNi00yMHHdiuzHSeSj6woBF8BJHgi7WscFG44LpfzwngweWY5uasvDrXE2xH4gSp84//5BBS8GeT41x2calOQMcWy4WpKMKFlPEqHan2UY+5vbSk8KkuprX80pP9BPSp4kgE5leeKwIOF3N/NFssVEHgOH5R5+7WnTkfr7U9t+8IcVtTji4/L4mAwPu92Leoc0f2PKtBvSPKjRJL2Mwg+2rNgbfLzr760r342x1mkg7ZTqmnKCO40NpPaK4dqQOYDD277pv2cTPiY4qXAzvXyypsRO/gdIXw6L8lA84IEgu1fpic2G4+CL4Xj5VoYFfedKejJLcqTcvx3kfSmlmljTMcRlQ7y0a5sahqycNE98o47/wRodmE25w2425LjWYOaP0XdXnABRj5LCR62Wmv9RU2P+6vP+0VimQbdtmKWqREtZEkxDRA64ui7jDbSZ/8T5JYKSvFoFsF0tH4o4WSUi9qZMPzMrFzqcptztX4AdpLv+etOZy0bv5PEOiT1azGXM1lFyijCifaMZ+qf3vO4jiZvBc3c2jKLZML82tzb3oy+czuPx2oac38XF5A3w3TIVfpUfYvlLSEck8jkVT2HxfkAdo1rop0uu1rOarUD9dEcRCAmLbsopO0YpAHBz16f+NaP8g++OF9RLm+cCLOBMHMn58acZKLMNHGR+J3SgAfvgAiqppX2nSZ4xFcYpb1o2M2U50lENMbZnk8jEAY2zU9VbAMz6oP0Ha3dOaXf/stKWDXLSi9QLVF0Wz2necyjfYXUrBZHbffrEUApQoZmMWaSLPrrV/mF3yt83TAU+w6/9ExJRp0NGtvLf5+B0V6pK5tXxz+yOvwfA1/OkKvP8tfSh8/DppR+wT5y4p1idiKFwf2n/f2A7rc+V+8jYP6mlQxq3IFuCeUSV/HjKKMAyfTX7Mub3Fva2+7209aMJeXOc16npja1Zq1qBa8YVgE6uRwYiGOgwKupgGWOQzYEvTODOiperTTFhjKM4c0KRHmM/KbNQkhBdrSpTi/yH4HVAbW262d8oOykhJu9fi5WWMt7yXTaiba5p3vKqg8IfVn5EYMfwGct7n1lxN85rbGi29YPK0WS4PicFTHuh2Fc8tzW+OegbDNMlZLWsbC45Bt/PC4a/rFG6yR4j+WT80kQVHbR3HTEieD/2jeRO3HCjM+0RfcoCsqe1c3JMnufx7dIp9/+lRZ0LnQOEc3uJ4UiwVJPQ9x/nLsfKDe+FKWOucih3qL65h7px8GoMd5MMXhoDS3m9czHDJBYeXpX7ScKGzSh433SxWypKXJuVnbhiJXgxosD8PpbUkvjVwyZ9sj7sKedKpQmbEyJYrxKUw4OQgfqCSB0TI93Uj5vAVAeeFpu8eRI/PALhpQa8VWghVRRXwEi2B4ItPsE7pYowebIIFtFTu7xb1CCkY4hFSk/dpFrV3TtzWdmr1Hj+VK3vwfXEbgmzJsLgXe9sB4urm8URd0c0WFdwVp6Lv+hEuiQC0rTSg7pndTNDL94d5edgaqS0XhsFYYOCn6EMQApZ2tj2WBDW5XJZaBeac+ohqOY5djCgn7xH3ORlEvVRsSngOoxk4rEC2fhLVQf3sSnclx+86SgphpnM88CbSoKHKxO7dq2KQ7gYSbNP1LcQVFkSbn1hXjzfGKy52W8NSg08SvZwYk4qOrnmkSRMuFkeknNZ1rNz9g1aaj5CV6X2bQwp4Q0H2ID8iL5ZbmRSjqTq+AZ4bpBa4ZnSZmpcW9Crz480t+o8w4/amCVT9Fnuut28UWDig7wTifly806rUFcShvp5zkJh53DmA3/fzNO4PuZQzty0sRJ7HPD2ixCDydfvxurVOfgDG6gKdgOyf3H8z7tg4+RsbnldcCxNB8iNHVkKQzxOMm+RmnN2exC5IS2FYM5+dxuQaF1BQg3mnHdkqZ9/BLmqqOxMPsV+aCbQ3UgXE/aHkeIDjZY50vrYdkjlWkQ6FkgLQYbgBzJ+V8MiC7atxBMwvB4S1vUjDnf+yTPcAHfDP9izD6ekBQ9OsYGwLWlvNfXYMBN1Y9I/Y2xM/bEOEY+z3EORVtjcqBXne9SaB/elZukJLcKrH8ykiM9erRJ0zrMy8zp4d+kZHRpUxm3
"headscale_ui_api_key": "ENC[AES256_GCM,data:/BzVXFEkEAOt3Z6Q8z4KFd9f55X2KXpSS0+LfcvD5sUCgbis6L06BUC3j6pg3OhOr5gLYmHohA9jx9QxRO2nvg==,iv:DGm7AZ1bBzGAqAmFSa0kpR3LmPKcHiJ+JDH41oAurZ4=,tag:KiaiRJGUVHI1sXOEJEly2w==,type:str]",
"headscale_ui_cookie_secret": "ENC[AES256_GCM,data:hNlJ2nh/5oTW+he1mpjbR4TG6lMKIyfugLA3P5dF5/5LGvh5d2lugPUxQDYoHk2/CmZEitvihydy7nRgAo11xQ==,iv:a6v880/xkdvpZC2l2+X9do/tWnMgV8PoYojoyon79w4=,tag:pJl8IBNOd2H6NF5NFgPp4A==,type:str]",
"homepage_credentials": "ENC[AES256_GCM,data:9taL/QJkvBONtUrMaYQ60xBtnQ/ZkH//MB16KUdTul2pX90xXpANUcb9P31fYb++yVAbQP8kr8GiqH1La7qyI5pl00O+xfKe6+hOKM+OYAFRtt+x8peO7a+iTzUWUgxWOmT2Gk4v3LylRbe8sZe7sIoVONlaoOteOKSpeiX1tq5iNidWIN266bNHwwUrDho73VOPddtRmMXW1YgMV4OBiMSVxPmvICd5wxK9EqLAQrRONALElITjjb8oYx4GKTGdOE7lqTladeTiNaCau5Pdq3FiwQAVQZY6sIY4xDYJTGOYmouGFR2uwa6otlyqHMm2e25lWliOhn0iYye8nDt29dDC8Orpn9BgKFR2xCS8G5fxIbTDj5Rfs2HZz0cHj/t7nC/6UAPiWoUM80r1+DeXA4D9dm9KRec1/WL3vrB2ahJxqRv+63NSChxQrIcvGUpc/4PhVyqiAZxkoAlDFt0yLqdm0BEysIGBpPfH3KcqYwA6/Y/Tna0WX00EIyZlTGr4vre/LIz/N8Z7BQHnZSB63OoXFMObqIRfM9QPBJJnaXORyqYPYrDofhUaorlJDAS+b5LXh90HcqCrXUyQJw2IPQPYOWUkJCqY+f3lZP0bPA45hdG4294uvP7mw9naYkNBp39oWJe5BlBUGBkaZkSVsnRjJPgbokZyO/1kB+6mExRb6Ctzkuku6DECROGrZAwAHckUixI+K6jsCbZfYszD8DicZZaXXyy403mi0tlra+MpwwSgxDnX+u2bs+aFG0A1bD2FYASYPViSwk7RjPSESkwogSoUNd+JzG/0vyF4swHGX8s8ou4zpQI71ox+nY+TY2g5a9M5TIx2wzwnGoGAQzUwlNSumiMSrzJjX31Ouizq9AL3Td84jhuHtx1mKNySbKYqL0lrDvkrbDVOiTRs9IIJknmZNK/RwaSL/3PKFspYrHvjJExYoxc+1knlpIA5HMwvr4u5nJniyzrsC8wG+1kYfXLlEGYa5eD4OEWtxYgjyZvOPXBYYChGuByvxoMMvWcmvogUJreVl2HuFyMVuF/tgyULX3dTre0gY50RtcJYgIUawpOXtIgYytUhSDn0r1knbVXsIW5wKeEu/bqRcgfQUkapDnKMZJXyjCCgRu6BuNXgBxdma305tcicdfeUUOdgLCxhDgCt3Nh9MgyhhQWt5qGv2kWZKDLALLeJBUbz5Oh0EJHnh6u5aPBpSLSxidRR/on0IPeRcdra+uiFL7FKJFwiUnzrvlbMCHpzmK7FnYY7yKnOnFyE4uI87KlYWOo4q9DjyhzEdYF5d8QHaa8pWiBziHENdwEQv798Mmu7WSYw886stZn3Bbpz4pgZNDSJe2xNVUWZVkm/fDI2gS2LKF/hGA2CgA7rQzwqldQU27wfogFKldnQeyi13a28nckk1soWOIUy+D7DZlTS/cBu6q3Av1j3O+P4hJUS2Nd+CF1ZH2ZnyozPPFCH3cohYeXek2N5Q+eJQQwZYDr5/sTZ4yWgOoBvYBHq3qnzxih5up8ts4hicEZZ3v03NOhOHQfTi0ei3gl/QSX+4baB9Ds9g2Bjpc7Uqd1p3FPKeKSMHCeACAw3DB6QMGk6qY7iJitQ8OW6NqVY5674By2upQBBTGA1Zq08r206d71k/oT1OPreh7qvHkCOKJdqU579KThW6PmD5RlwizVXZDIXKRfPrv7i2a07fKBbXQ1DPYGaJYJvORcMMQMZ0ErFjt7h8jETrBz0sOb0lvEXPfW//cpNvbCj4drJRAqv68lGnHcyzcMVCJV0J+KSg9QujYvvsCIotiMU2mswnY501z0uaezgZ2Jikjg02LpKM1vCNI1Uh+UJ8ViZh90G3BrWCA/mPR6JX8dltdU8zprBOPDWhGng8ixOi/v5OvKwXWHgYUnxPutZgfGyT8cqP7mN9QEdFhp+z9fGJg5iq7ddsGAa9Li0rdswz/vZ0+DZmHXl5V4bk7PBQ+PAOoX42Jlam1Q+MP2me8HdUhfx4Dqdbg++oV2SpsADaGvq+DVe0F3cj86dsTzzLUa+A8QUYDa38X5GUu7lRHHeaBgGJyZA3KgZyk1n4hY2vq0+mYuI8Pg3Ijmo3XefnQBaCXFugNHuPzcOBg4Y3b6SX79UawvdmQFxXNJUBMxI087WHkhVe2hL5E0qY1OUw9z4ZwEs3KQfL9KzVLoJkbaa/5PHNnObrmGeZRCGygAMR1YD6AsE7xUpKVd2p/SV4THPDed6T+wVh2Uk9Zkz90d4uQoFsZ0cu/AGHKHgKsB7spgkhK22JhECdsa4SjYoR2AglGN7aqWyA/Q0w3FLBbaO9LSP4ZYijYr2afvfUsxsguVOZ1hYapg2ENRGyQPTZ/0qFQXAoAeo3C3epDEHhkarNUWgA5fQSXIIwHPUjgAcym8oEhu9Kp67pZyPCDKCUbWibp5tyqvRMISirz0z1v+0FOG/dMf1C/RUKJTEIbiJA9PPPcjsud1Eg1IeiGMhDEVb8/C0z/zxO4zlZqW1AzZd+7RszumOmZTRPmN7gD9LLwd20+e+bpBEqeeG+UPC4F2OnqkgSBo2bZr0t8RzuallRURR0gO7HBD+aWKsejX95+uhe7WW9/tXO/Fpu4e21RZGTMcW0tUdlZfBXTUczsS3p9z4AG+n/urKxXIHr6N1ZEsNbPZroIKemlMYgSfywOXJ1qL+eLkgwNRX5pFKWxJMsFAsbqoACQZkCfFnP0yhmGPZWle4x7jdnB8V6l2kU0LpEwx38Fh6i6CN7E0=,iv:b1qEhaR8Wo1iglMoZM+tR8sd/TGsWeLsbvLKhjjh050=,tag:IQS4KwxrZyeavG42u1p+FQ==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:9k6WAR3LLhOgQiWumF2UlrHyWLRnGEi6f6UCRFMDn8VB3DwW07G6uViYMQ==,iv:hqfmX8eJ/dIna+/QOLtP29iWAB3V7+qQ9sE4KUWMFXk=,tag:LLk8W4oh0fW/N+9TwgAM8Q==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:7CZVWpcV4l/GgNAHeBUixQUIF5CxIwJoyssPy2At8MsvzoYykSw5YHJgGv08C8a60LdP3wRNC4mbRIMCrlR1I5qCsvjuIUvY+1t9XgjTp9iBCwov0Xn3JLEzRmAKpQkTZ3goXKuMYJ3vThxgb0CUihvGw6z97Q5B2Coffk9altFo7/PVL/mIizZMoTHVA62TlNJ4ENVJNDz1fbRPRxJesLuhF+3uhK3XpGOb3NH8136DP6FEYdJPZeIsFf7xjLwwd33XBU5AG1HZe4cIGFk1GhZ6J9zhfxemQWgN09x3VwBueaKEPL1CK1372CIjbb9moTTztqxaA0yYCtW3D9yXn//WhEhli9IlnO2Bk5UawsbZ5/mb4Gxb0cn8XHjufYP7KWrEndPSjpq6s7/WpFEL2vCDdu4OWgksYAw2l+U94gqtNskU47GspBRxwwOtJNp8aHSZPQUXAYSk7ZyiYQHucGrXdSGHmRAYtt6ICq70TAFWqI7rJmNa3hyoNUsZGe9xK2MsI8PmXYp20gJPaD4rac6VhKwR4cG/R6wEy2ts6UPWsKT0cOpRF3e001mEqR/KouRKkZVP9b9+35ea7Iw77D3o8vxxix84xA9M2u0ss9Rq+sqHFcPU/q25RV01pEJalw4l3saYcXIqv7jfdhb5xSYZy/iaP+Stanyon7XpnOtzu94=,iv:lYMfG6g+2Sp/Kw+6lLhv7dBNFLRyICU00P9lTqDWBq4=,tag:I6uEsAgpV5STfyTBOhGQnQ==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:7aVBBgXW1S/7EEvyn2ihiS3hOx/KkPc9lO5+zbX5j7m+aBsr4xyZ2bqyeUHcDM7tl8DZMXmlJl0gWG0e+S+xNhRgeX7GZq0BwJJmDBGKLBU+ci1OkcsrAjHfihgUnBF04DAaWi810P0qoc5QjaQ4eFoWA5MlRYkWuUCO6DMGfempmVcC+TDn45Gb+2TWnyLqeMswGvBCAO5oPE424L475SRH2R+905IJnSXj3O4kn0AWEjAD3RdxwgibQbiGSokD9rMQxi2WK2r9bVxGUfQYpqlsDpu8sibT6iZpqHpQqlhXbZUqhV0h6l6IwBwzeLkDv0P+LbCqNBX6q1ryctFZKB8uoNhRIQ1pDW5z+D0+xek5uUe59Agj12WQry0v3PaLsqqNqRuha09JxphRCQBxteYSyhVLXvVtAO773U5E5kdPJInWS55gtOl6wU26Aq7C8pJ1N0S1ixQB4kllFwCpvoA2O8nfF8N3hLiXfkCRoByABbOriMHSCYzVRc6HlUFsK9uMduIVplE0V0p56H8f3pmjOQwkbFdmF0RIHZ1W7nzkIFrR6Dq1miXO/LQFWrdjUpQt8dxidt0r3pMSR0kSp07867GE/GDmLe4fsYGvk1mxWWQUfuaDy+4ORlmWAcZFkajfB/YelEtaIizOOxP4NN1ztzofauLbIuLC+Qr0kfyFELE5qY4IYJS1RlZIT8Yr3qHqNQzsePmt1qW3+hKCgQ7zRfhgHgeBEFamENn5V1rPEonkBZ6Jm2NdYj7oPWY8aX0usZc4Fakqkx6O00uTzz08ZYP1sPCV7OUvJysPCl11zJGpog73VhFq6+wrXVmwdWUMIVyggCxaf3SaYc9ulrJV7WMPy6U3S1CHGhS/lt1jh+T+wueGv3lM4yq5GMV7+xNH3DVtupf2GMC8XO1p,iv:4m2JPmR8HeDzAPm2Eol6Eb7bN7K//ISTUkbgzVNu2ZA=,tag:qPuy4CxC19a6wCrKkiVOcQ==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:73r0YHxy8ukC7oUMV8pvj+xRNypY7It4aMyVqZ/u5uhK3dio9R2Vaq7U7I8yti9BaZI6lyXXLSzR5l85/wQrJ06iGE4JZsvWw2gR1i93OPENtuXm0WJ3zK83NXLjkzQwLRhGlhe4g9do9vApyj7DkyptROy7gkHohAuVJrbWyxuZ3yAuvjNj3ewcEHqmlvJGx1DrMP+UcrqKVMtEqdjc/pGvMnIe+HwhQZR1Rnw6b/IBRXeGEfx44wkjZlJ8dduRa8tYUd7fKVkj9/kgv86nVfFTWSN2FK8XIm0H/KxDSUwtxv1rdx3M3M5NYOjRWz7807KFkXy1ZKStIptc0ILHPmsxZbzJRjMraL0biTBW5DX2L9wL0Wz0pMxyTbE0nq5fHefKeiPZTghHb5hPkoy1+ftw+kMElToIBFLRGBFJ43g4yFT+v0OweKHrie/j6aIkmLAaWraFESkn404+Aw6FDr99k9T5eIRMaKB46TNFqm40ZnfZb6h+55cxOlklQATM/GTYni2WlBDFPEu+47+hk8P3BdCMb955f/hb0cy+NAuhzOVdromVqKXUfc8miv3JwVTTng4FHCBcdUpTy33cEgvW0RFK,iv:E0h6obFxFmkFhlrFn7k6kzAr29PzpB6i34toO9BDV50=,tag:S6z3lH0sY+4aAIVYIUH0jw==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:+CEta+CQMS1oA4hBLv5AEurFUHAnUI6UmpBuKRTy4oaPbPqHXHBFSes8uihLzeYrHY7drlz/fKm3NpocsOre7imtMTBSNp+lwZKeEMXyOe9qi9RlOdl1cvhPzeV0Nupfm7bCvWNhiU649aOlvUvN1NWzqMgRViAUsNtLEIRM11RiK2ZrRY/9RnOsI+MfUZOZlC9DqHCJOpQilo5md5vvNyW+a7YrBr4Z84ADleqoz6a8F/PGQvCJeJz9ZgBtL0vmJuWzPYnx8dVD6/hb67Vq9qOW1/Dur3I31Z6vhgoVZ4zZW5RxCZ/FbUm0DTJGTD8MzOAGNkpWKj5kootuaULKtCXE8JRJOsD+zBmeitowF8bNWGEX3TmFiFyJFG3x3NnRaT1JmC2A4xy586DiuI36C8T7BZxQ8vMZbjZPUyEejSk/QTQfB7CsG7uhhacfWxKotnqzrs0AbBkzFOClKSwizpNK2/jBw636Pvjmf0GGbH4L/sEEWZ1cArWzDP5Cv5dO5zhjkvjsYjU1xK0N+xW6DjMkBt3sPVboE1r5PhejKDhQhc+cQU+GzClz4igMDurYdeLAc2b5DraRxw8LmhZMBl7yuXZsWeozg357MMzxRvmSY/LOr6T2iXiaarD/pGhq6r0JXBc8OfgowsMWj3SsOG+Mz7DMFIRP4U5h3GMPV+le1Qf/DtM7xy7BEYPS/nuQk7buPZGX24KgQsQFWFTnEIFeV65XZr9GpXGUW2KDZtsyEkHHg+ct2wxT/hhlxicf0+yM2+svNbcMiG6W8OA9Do225T0VwNlXtSqwzKHWiiC75bxPiELxVdImtsyWWvY9GNy4PPg8e/8YW3ZzJbXdweu9JMRjG//zhVpecVMEn/cYoKcWrLWnTuqqk0Uz1UR4JUK/we5xFELPHzULszL416CknI7jbozPak8W6CRL0Vu7hPmsRnAIsn626XeosMB/GPaV1xgIgjqTyY+5q4SjTZNejzhVHNKd8Wj17uddTh9VAgy26o6HtPCX2pBUxvFhi43s/PVbx8WlRpAKaTFJtwczTTiVQFpTE5E2ya/Kv8+59dHUFSiakI1OI+Ow0eQLKf9LMgItihNpO10yW0z/69JgHs3Ep+4XjOT1RpgIDOL7PObM8Fly8RsdDnJ0HNgo3djF1xMxM8eKx2lC64mBR74VeRh97LL32T/b74o68cqW8bWRTU530rv7lLl1QvkTIod8wCuhPTIZxz1HNCxQss+Duav4wGZVtskGCxPNccz6UqFelFGAcCUzDOYTr8nzKgu7NcvMxfYupk7qAI5iGQWKzImSUA2vjQms8WmQH55w0ujJRCzIc3AYrE/V1y2/UfsaPpy0bKrlwEDRdLr5MjPDPcyHxX8TFSVn3kh4BmP6Myw5EEa70Qh+wAFJnOfNzgBvrPlCfx2gDlybbeI12LWOIo+tUk0fryQ+RGh+Owxh4vcQ2yWPwrwMAzBkZbuNZt3glXko9QYf5TYpc1vDOwIccKyV3EWw3eMuyqbY6MEdIP9FpFrcbyDkuNlQsbo53LCf6Ea9HJ9yB0Q8ECx4jhGpVacXoM8BwmEnAFa4mNJfQK0LfKUAoTAjPQpuOd869jq7rRGDQ/zXvG9AjZgmiEqLYG5sFCBI316rrHv6SP4RBCSps0K2gozIn1z3+ti/fCaiuFX1w84OdAES3rjSG6/2yNf8MoPOarmDVF+dm18ubhEwmJNjlTbST8MdTrmuifcygI3l5q47G56zmbJ9M6n7gvyq09F60D6/MuuPvnfhrq/P9gKt2R2j+IBu1iGsh45DRdbHptP/N/z0ZtyXkZyEnnRf6tqIKaQHTOHZjUILzzSTaTeWC0Qwc6drwUkwp/2rP0EKgY5ZOG1UppD/2pkCBLDpvKrnQrvoaBrgF+orUBVCHX70xaE3l6zmG+B8mO0+JuwGM1T+YGFYgznMA0heZqVdwDlD3jPWXy/2GE2X4yRP2Y7YPNYAg1BY+pY5OZ3OlCrRZ032/O+HUBvx5p22QohAX6eIkf1Q4CM/Zilc99l53uwze90Cv3EFPiHDwf2UNk4s4xyEFXPDgx97gK7y+38Y72f+5MgZu5RaecB+tOA9PrtFV+oLWirJicBpH+En73Mot8lF8N0LMTW9NQc9p4YkrVdTlAdZuW+oDEujuYfUzVsPGVw4m6+SCdABPCCbyrg124NWLKSGwkH3g7vcYXlN6ZDr4Jm3m6ExetTLPXK6t0KL4ap9ZxtoAk61N6xQOza3qH66jvVOEUd/V9/6U64cfYk+Yal1FA==,iv:SepW6DA9oaiIaPM3KNUhX8LL48qF17WWxBkX5v6rPKs=,tag:/Q/EEZ8D/xzD7F0cx2Ubzw==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:XcvfvTH0ISKBslsOp30=,iv:Qw7CwkW27JVniWeyCDkyDM61oIaDfsYq/Be9a7k8j3w=,tag:ZOO7cBfLK0TB/AldL3Nxxw==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:63x2U76ohnUnQI/oxJP/RrBbUuk8aKvXJZA5QUVhQi4MPXGeOUft6oS6GY1V0b0EzkIoCBGW4kdEiez1XufyN+OIa6wltemeu4iZLKL4p3SfSXt1HgncLOK9qyZt4+H68f1IgaWYf/Zf6a9q9nn0zBMWVeazaqE43KDQq/MqRmebp+sOnhWFLSKiOQQHadu9zYY=,iv:zbZCZul3UH55g+tcWJuza97i3x0C3kGuc/6xHIRMMT4=,tag:E2vss5wWDzGlRs8yxy7ggg==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:Am9/pLdX,iv:/uXEBTgsMuYshihYR9HM7JLtKtmY7RAtJJWOsmvehfY=,tag:ej26qdT7jNmEfQRf2WrsNQ==,type:str]",
"pve_password": "ENC[AES256_GCM,data:d2WSaqhVyhCepwVgPYR+l5JwAKthpCkXNbiEqw==,iv:3UWze1yohvSz4W1P4QRepZ2DThcGhPUosSm+2kehFKA=,tag:o93N1Mz4Wk6Ws9iQBhlLnw==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:wpN2TMEfdRyZErss1Ws=,iv:uNxRpIzoifFjpZqVDHdEmk8s3swTp8POozmHu0SiZP4=,tag:kktoKZD6vVcQAKfBYOR5gQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:wCYw7uHYpGu4dOMs+OaO6kS3l+5c97I=,iv:GxCuItU/0pVEd+qJJCwB7cfccErHq0/KBx6lmdHQmec=,tag:qml2sFDNuD017BubLJVTHA==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:/0H6R6A=,iv:bAPIgbLA7Uv1fAQPpWgzp5AMUbJ2pgRdtcij3MSgkxc=,tag:EhoQtol3RYDXtpbqvtAVdQ==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:zcKSO5MqOD88CKBpRYUyGzC56D215g==,iv:dey34wdqpZDLhZMgFFt7WOTF9FPpJ5ETQUga/pqd/8s=,tag:Kl75e8TkHWN1jmt6Q37DyQ==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:SyhVpUFrpUJURBr2kx05HrvD+W2MjXpioEOU9e8i2KhKijoNRNkRvELHAx5kq7L/ZVr4UHZ05Fqe1vGfXMRcqXC+,iv:/vLhRYE45F7mCGFULEsnihp3XNhgXel4QDI48dmGEos=,tag:T15u0pqC5IMIh7l2bitcWw==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:Snn2AZLIePc7GRxmNaBgeb2aTXsz0pjon8jbbIkHbuswAclGy8N/xDfK2Utv0yMK1uW4WypG+x4B+zzTtRaZiJQtmUxz+0iHwhCuYd8TLkZq2Y0hGMfct50aw147umTXi5q+51Wxvk3hQxQNrQkvQGrJvYby7CZt8cuzXJAEARy173Hkr/W+Lxzfj95WNtwa7AGGZ0PWc+a4VudSmvy80eHwaHtIWu7+QloFdESJpdKs+TPnVSF7GQr174z/r2Fj0hwIlbDYwQQ+kbm3Tn/aBvx1u2Q5NDpalPAgjRaObuMxm04z6/u7GpGCKeI8DKawGGRbVIFhoH2hJPaseyJi0lOiplueNvgnXIPvMEtmI8+F6z6Bc7HRG84t1AqEGraoiTN7C7keo85VaPFHwECgw5vYzw+PaFWVxN1FFaWC7CHNCRoogLjE5Y2rZlnil8YHnc6Xs9HHYL3e6omEIwOeJPROs4SbtzTO5twRYHoeqiryr/J+rEl2jXbn8mCj1RPJHGQruRq8NOOCmKF5QqZk99mdE7cBvG3SWxLZ,iv:QaPBfzvJqxl9Kju/XN8/QHwQ4cvpD+E77q0GWqRs95E=,tag:Ha6TuBnzcgpF+K2mgW5NkA==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:/KQLOAAbWhR3HqJ+lamX9Gbv6R0=,iv:k/9F17UUr5DBd7Bst7gHa8R/zKxU9EWfGNTo+lx6dds=,tag:D/Oov8/dPHHmu5mJSnInaA==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:D8DEU/ZZBgz509h3atvxlTWcQyjWrpJHmfLY2N4eeHnOelEJLtVF5Q==,iv:Dkttdm0YpvSUs/bXc6kmmMM9mPdNQiJH0nSSu7Lc1nw=,tag:dZ+VhtwdFmtO6/tGDq7OZA==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:YpnU4YROr5+6TutU,iv:VFMxya7jlGawWHDvjpZy8oBBQuTv+nB2XmMi1y4/uOs=,tag:IeF0SRqcYhsql3v1PoXLyA==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:SLjQhevGOhmwlyowIAUjNO3tgar6skuCvKdgptv5HBn7tAkY/i+Zlp215g79VFXFAbXmh2VT8Bxz4bHBEDsqgx5Es3Z5GgXTghnM8s1ws0AEksbRdgmgNIAIghQKmxcmDPYU9evLUiSEgJ9pjDMjsgu4OCCkTGP3H58T4nbuyiW5TkO2deX0SHBPlyonfiSALUqD2fxDr/LlUHidwlDB9zN7IkCgLgl7OH4EFAJJI9mMAjG5eYCS+b8XAe9UqjLsa8livxxuvyEoTGm2cS3Hz9DzOsssrSade6m7BVzBX7MfGpIY+rPyvOYlCuhOdE2qSBqe1BN2r5w3Pjfh7fde4UXwCeyIQIrPPMVytqn8/P+Qalwj++5d790EPYkuTGnfHIizFInKa1P2Wb1JqGhU2UAIdpUmKC1ow60/LhHx3AgG4LmkufDoiV4hAuWnQinLRJ21GJ0nG8Z/vmrwH7k880R0jqPDXWXFU88Kx02O3YvQhGxRVY7Y0B9QyYKB/zgkQEN47veOPSMedi1D5h5LEKkUhdypY0XmSsSsVQ==,iv:+7hC5S3iszx1HgJ2YUkOy/7Do4o0alSkhe5p6866q/k=,tag:WQ26JEKb4rp8zefYz4MnOw==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:46qFfcZIfSLxJM4pU8wPhygaL4HudbYxWjBU/Jui2QCEyNObG6HFQvVQs9hAT94kqHnC+IzN95CwPTqQp52ZKVI8lOMt3NDjytgQwVa0FCaZmvsPy9H8hK/6fUKpLpMll5nFSq0/MVbuytQ95oH5UtM0Jh+M5aWYvPcMH2aGpEXGCvbo6ZgLRg1lqhl8HDVJM4l6bQRczC+is/8aF43ORbUEftXuWFa8FFoeo/lq/t6fxP3CRSiBgayMHjnNVoIpS/HmBb8XfE3T27L6+PfsZAvPT2LilsvekBF2Ne6VOXacReoel0oYfWCovunhDmMlM7QY9I9ma3midU4A5ImLNSlB6o7CkjqesDtrS5YT43srPQLwwZxDKib8037jWEiV5Ir67Gcj98qAjeTEKu7qDpfZTRxEan64vjOzMyIqgk8yd8D3rUxjKFvezCVDXIDX0NFNQ8CCfOp2hONghqdG55w416FQPSPhLuvLhKej87aFk1M4FxNJ1iQ6CWmTlEKdEXLTAAXUeLJhquwobITkZXWdandLr1RWgOliPUgOQFajTqujWxJYocpA7hWepMqDQ+8t//5HFbFUp3KvqTch1036xO4K07/nKMc+Txum1FEB0yXCv6UlRgfLnhzSRcPDL5zTef53VwjiPiWLlGUULIjGB1ylmGohfgLd73R8uDM5Uet29A4UzMWTK2hlAW0WL5OICv78r35uOvlYU6KpSywFO3Sdl1h20wQTi3N6IxlOwyAgKqsXIYS7grjQQvd7PiLuFzJkzjq/h2bhyLwPAUBvUmRrA9vNAIYkEy/fB41uurzgGMJor99RJ5TvNSxDWMNIovs6dcGMtA3feOyXlBNpCC0dxxO1/l06zr5QN+61IeUCBBFgZXqyoiBqz3Ijtif5ZopNc6oJ0UpULFGa9eJ63b6oGYh2nEOwmroBFUFs+QqR2cKY4Jj4uGsFYRnv2q6Icbu9Ary+NJR9xWRWiyYqsFhjaYsNsLRp7NaZeSfDkiSDLRLgD0/I189R4Qz+QYRtC9JD7BVdFc6EVh3x26C/RwRueAHZuB25KAAxGrH2XZEgeeMayB2QfFCFPARJ2VWJueDtfbayuLlAqfYTT8mLdI/oAZgP93G+sQgmtl/aRFZDTjzeXO9WQpjmLzvNMtwcLNb7O/CrghR7G15OjlOEIT6zwNZuuyEMIaYoYYZiusVBCzEE6OqPVJqICekM1HUyAghOSqkGLblaz/J59bFd5ohpZLurhj+NgW9nBVudqBxCI0FQIyOnvyh3Urkcz5KqH65Jfxswrq4gXSnHHPBfD1qbDmGNAh8j8YnC574bVaR7ikNT+/cTG6/+Mfq1Xo2V3/FanaXsfDbT5IDZ2s1eFHJb3Wk0GpaJqJ82drYkNy14cRPdorqkdX+48XovmMqtQdIyvw4+nx/MnYD3r5wD1TzcNJlbZvxZaHw8lfZVSDQgYJ5lxdPEXf8qD2Sg8uDTxgJcpxVWahIaEsPYMLMYhN3b35Expy+G9NnVk41sruiYJf6VX87SGFfnptRNPHW040g1kyPKingBTuvJXKgfSWBDQGo0K29adN+XXfo9r5AUhei25cumbcJ9Po6KaVFh4R+BMVhrne6I5rSn7Vt43jiBuLzvzON8XIuqEsM4swrv+YXGGOxNJH+sd9qdkD34vdrbvs1QewKq9E2Zxpnp+Jq+WsqPbLKYak5/Cq3TkHDO+kqSNt2mnUUrMTi7zzetOthXV7cHE4Rb6/g5v/L0VgHOhcHe6i0cMv4XSkCIALN8p4bMnf1VwwZYeZpk/umA6ITmOXnZjn1piL4OnRCcMaWSaSvmBLONxgHmSUoRZmIevS6VY4KQf4YEuxP8Oz7AJzBZkvjdCyU4j6hkmnexATWbUKvhMrEC/tSMNcQx7meWTq7hz1s3L2wMS6rROGdbXMpF3tB3/trzWMO392qFHWTRsmVNkZ+BJ46PbHgjCUhKSjV0m5Xmn35qyFbVSaBw71WH0GZKqvDDHbH4LrgwbOwS1GY4/R4PJ4OqmPAUNs6WigxWn5jD4AFy0ZLNOpVv2jWzFSI1Xd8w4BQg8Mym004AAm7l0VN13uL/RCYudwKOcC1XtxmKL9NEpZe5VBhHe/ggsswGWclTVw2IokrE5nMMKjz9oqWqNujt0fGC87PBvSUG5OCMxsWYx8R7UYtOSuOxHY6pRb/ZS2Mvvcr6IkHSXROwW1lxNKvwcMNoyJnxn88BLieBYQ5nvnlicIP1U72GN21eg3YH779/DddOD7mnPoImaNId0dHBaDjKF8IORY8ncUxlequ0TYRciNe990d5YfyILlcIVb++yxLrBZyvPOAXWMGx6j57aG63T1b2OQ8bMaziMzkZV1pL/zVOLkDezWThzcc61+2XOdBtwPbrTPrP7dCjhOmLK/g3l3KkrVLFPq7nuv7vxDG6H4gXYXr3I0txr25dQyPN40f4OZXlwVTMVd0puRqv2WXouNQEaTHJlH3298NfM1fMrYjY/IMijZvIMcJQeLNEwJulF5UybFS80WGGMxbN3FJNDNEJQfIikTGW+hst+GHf4AjVoNIOHXa1I5qqks8+O8+NLXZ3ZdAmQ5OT5GcIO/o7jjFrakTMUBE1vPAzRZwTdD1ySSdkIJkP5jNafhq5/FhrsfZD9F71I2mOSUIJ896YiH+4S8b78KnWWF3r9STASDIUmv2mcPhqFLw5RQVXtyNzlr7UvUcg9wDe056QtvC3U3jKp7yJZ1pa6AWhB7GHmLZu7mLkS0qNO6ooVj43kE0+GlNXhp6CuIYUTa2IcsKnv58uKDQ8IsyIAO75mf7UdL4zYOYMhCsJpeVLcWpLiQ4m/CA23qmjHrmbYrPvMgnqYlAK9unljbG5fE2RR+XWxCz2popbrsCxMvEQMasKX32ID7Jx8cjDrLim6CU7IAY3kDPAei0+UrJC3ASqoCQrgTkxlYBO09DCObbzq7k06UGKHrwE/rnq5xpqN8u3pZH7lMr5i8QSFfNEdd5a3t86YBMt4NLQ3u6JnRrkCDnbuZTUtmTA+K8+waY7Jn270uT6LIpnteidMaHlct4TCDXNedWQEIxQaEXmLQ0SSKjMMDZpr1WKAWPs8FGjdXgqjC34Q3rvQsu0Xr3W5mnv6ftLfe8zMBwm7ZMtBifppYHoPHk4/LtiT9xk0DwjiHizJ94tXzdCrX+STmDIvLz7DUAsU3PDiG7k7oGSxEEA3I6FO9LxeXnfcsf/r4bTYRkLObZSeZ/i4ceKrhMw1DZW9J/kMKyiODw6FOPKv9h8xxujW+reADZ2ZYIzAC/PrwExowZrxY+49/hWK+KGJ9+yx3NSfcB5FqWuVkSvxw47aWUSGouu8lmmahoA+J0odzPeaCN1BY/cRjGMgL/CkZ9WNaBOT5l39NW7U4QHa281S1sAN8IIY5C9A6uRYQcLJRywUyh4W32ZqKdA+xpeutXEoPMhyJDFsGynXU12dA==,iv:kaasKG4OeyCol4GB419nBy3si/B7M9AzHEja+jWX7lA=,tag:WeW5ikJA+WnthZaE6zTMZA==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:PASPJFdMZ5SDU9A6jXSaofMdXYjIoLglCCozsf7rnbh0zbEuyGaei/40JH8=,iv:tUnci6tWAs42W+PXTQOp64Gm0N0tTM+FCDCKgLFV1o8=,tag:eWhAhW/3pMPeeEz503rv8w==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:dAVrJyVvZoGVR3NtqTpCmou5VeI9tgPw0ut2Vdc1d8WRmygHXW8nQopk48J4svI=,iv:H8ShKbU8UBjKqgtb8HsAQ0+3jcgRrfJQfQfkc/pkSJA=,tag:FvlzmsGIx77ydfjWNCcw4A==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:xJoATC6kttH+iVdbBKHsO3PH0ut5N2Yw3jwffgYGZsgHKSbV1unLPFRcCw==,iv:tyEyI0aRPruTVPT/bkmMZ/UXk5H07EZGxBPkkR7WxAs=,tag:fFbw4tjEBN+6wrRSSbC8rg==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:bNipcozdq7ONo7e55tLvOH9hHKsYez+7gtec0+d10b3x6T8CEOszXIQFhqlJWLSTPMvEEBBKPRw6wkyNLrD2Wkk=,iv:YywSaNKryeiA0YjV+9Jnvjt5RjsQZhpLCmRDbqnwOq8=,tag:CdszHciO6QzJowRK8b+Gkg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"data_json": "ENC[AES256_GCM,data:GZ2kkHdPpjh2KKa4psh1lbsnNY5KD/bMJ0gsCoRoev61woI/RH4tM1eCfnxtnrbYw8o5AmIavexGQGfkXRNxv3q51K6F0OZA/+a+yZKALXknbOznPXCIyuR6r+HzH3usWL3cp11cWpxj+8r82JFLrTBIrLGHWq6ZWY97Q9mW24UVjuhqBwtXamVJqRFYnWdyVd6kz+kNw9fsery1MedNnopGfND0N2/DFcOSq4hOPy6h22Kz1A0XJedTsWjQgo+kTKr0c5oPgxuv6PogWaItg0eI7WHFhH6fzsApLGjKDnrmMfizOT3uXbi8+APJ1orx5yxTisFNmOfFJhHwg48XUZX81v+AKamaiIv3uE9w2efbbiCWSlI44ZT5kHTXDn4J0RoxXZlJA4CM/23suyyUQtqS46tPdSibA1vTcx2JM4osim1+yckybV+rug/i4V9udwXNVoKXqLuBoSBfFbQWJwWXTsoSqY/nGQMNP7uCoJjXUCSEjzId4pqHrOkhKQtUgE+Zkf04GGX44jrIBbzrmg7amVFlnbr9+hdFLOwyPHt65rJ/h44blU+CaiicErPZ0eFCcbSJPZXq8mpb92JP9COX5drnfrBp4t5iUucVvnIgfLtsC0BJl69TMreDICXUedrwea1EjqO0iQB0XuWSN7wxYTggsuVFYdRU0y0/zHoawgR9DIa6CQj8hgXKoyriUAVf9qxIXnXTNAkIskBD7EBTovfvFG2L6owIhLD/aGmP3LU6gBZpw+t0Bb9h/puQo1ySPk0XtFO7sh7Kzw9H+lyB1IPx73PiGnij/gRloCHtfNTBnnJnkAza4MtmpQ5+d0EFSmSeTgoRICui4WlSLzabgncbhB4GS3Ny819ugrvwyRig6CrfrIl7I66Gz4iM+EJR0m6vYvuxAy1uV8kTCVBJ9jWUpmETKmLM7Y9mvzkM9kVYJa05pn8c/CX7d3306rTXb7PO7l/M5AiGYIk/Iwrb7+kwzVpB56UlKZC38anm/h5giF+qa8zFlIEue+z3E2IvQhJY+FFIaHoQ78OONO1yjOd6iizP8/RUir4MqHOXe7YR1nory9ghbAGB2dyhxRRZnXsToDCiJ+EIwhq1k0ByxzpgWUZSzuDvL5VM4F7kVtPRijd6AeR5CmS9ArVTcdHPViNhhUTBpJ95yi3Ks0RwNzLrWOVr5yRv7xACvyxqEEdwGIGUf93W5t2+lKWtO+dWiAnkHuLTbplanKQJQmcBXjWRxNFzdt2WUKIaGS1uFIf7+n9sEg57U3gNPqmYPLGkNAGY9gJUm1jyIMjmgYClculUblqPiepxNJ7+adG7nFi/MvfbjEIJNIUiBGgusRr3D3bn9V6h5LnBSO7gdl1BH0pgx8SbzHaKoCNLikz3z3PbdHVWSG6l52h378ju2B9FJAeVN5IVmD2LcHpnNLWgVgEvVD+gY4PS2mC3rlI8ckTqX34GFA1jpUWl8zY9xonxfY9oqROTZ4gBeVMZKyXA6KcNNo4PdyJvwWjkeX4h4HOjN7zQ+romrLw1O9nTDDg/s7kHd5PMRSsJ+Pof/kgFs4B+uLSNH/SluYqEa0rRlSbHl1RxCOBnDgU+ofn0SpeyKFVlWNMyk/gN1/4GuHmbNO9sdbU25nbpN9cGdjuRnv9J7dgKAeO6oquJ3bt+zNUQUBIB+QmVKgcyJrqYL14t7jC7sIxL7vh8LvtHmZGQKNDColuDDcQlLgimvKcvsWYm3SPY0+VEpRmvUb/p+fx6/CGKE1sggLvC3afS8x6faX7vFkpG1ZlQ6J6BOYrLwjRfO94ZwLivIsh+zm5ID2YDoBaVN/GvtkbUOzXiQ5w+2zH7vsSMY1E48QWPthRzG8BOgAHMIZBD6YIybhyzYWHfK5aUU/nSFdC5xpB6sULu4/T75BpDBt1ZInliTECLXLSes8uJyQWpK7J/nP9lAOR0AfkqZAINxXRk/Ub3cefComzp2WD4A799G2cv6skrdPsC49EUMxTvVXbJujpFkh9p9bkKURZ27kfvlCLsbaExARzew1cLL6osvRr9+H6Tzw+jrRPDqWvGorYwnVvdrEEhVEfK/1aAp/ctJrb30fuzjoX7UbDP6i4qE+XDOG+QWrrl9xx3d9ElHV9HRUY3xF8zdnUbDmD7YELUmIpYBCVeOA9lstUTZDyc9f1iyNVdGlacVOcysK9kjokG4N5PV9cJiLK3A5OdOfMz9dQF0D928ILf9avA0BgDEeEJhlsu++acWWro2Oer5daU9JSw45bT+hslhlihptHjniofgz50d8F4IIYCaeF1OdTVocXdMQ33MkH3AHik4L73hKiXH+BGOaVyuUlJSxYdCXGVaqI6BPtmHfutG/J9414KfPVs0sH0o9GPTedUroxLfL9Lq1mpDBGMmVvqR17tTwOGKHdtBeotMAgAHwWei9s3VDaWUvDW0T3ZudctDVHCfFxzRX7Pvn5zE/7Ig2xdvhVKugusKufeCsB9SZuKHdeAW+Ch3pErmN2KAHUuCv+hLYNTBRfO43rNJsUKfv9SssSMTm/JVzBd1+LZZeurN7ttdO1tcU7AdGrf9U2n1kS+/djmQR2C3kC2x6bRXLq9IVFhBQU8cglVSX0+TMMmrc5EUJbOzlicMLBBbnL9sj3vzQ2827CRBkXk2DgGi/yWQIKW4VhMt6VaI9M6JMoZ2g+KXr4cnJH3bliQYJQ1F63lezsE8I5TYU0XxpmasJEm90xIlKy/mXytBjTBjR6vcaUm8rRKEHk9iZdsWqP2icZl/p4ZduTqx2bY2z1RH8n2GxOrJ/ZkVdMsFrFLRCeYeWccP1FqTgkIqBJ/7Fa+zMryMxqygJBD2TDGRvBnRDShBleplDtGIP9yiTmNLLT+2QItAXZCdOEbdFwctHZE/Hay72IW8qKk0gzwWaesv57C/RqpC5bTJL1BdfeUT9/QNNnNPYnGRKMXpQZA0sPUrDeH5sL+bRIP+pR7WekViqvuvbUm16wLW4P8jceECN3e00W/C/D50CHVc8mPg26YxUdXEBNW6v/+S+OZyEv9XtqxdhRP89MQol9R0tJ5aMX8D9zz3FUP4VlogHnwacinF38fIcAzoVqOzidwgJKv0pQSD1lQdI+NLHMfRq4boww8PDQ3ZCbh05VQV2zEHhHtv6sGW41jGUgQtyK3a8sWalGFTa8AbUc+9qju5rNWo2SZqpc7FLJ1cWsW4Hd4ULpPKZxEbIE5a1FftsihJPM3yO0cy5utjlpMy9i4sG+36sP0j8MW5wfG24Uz/TS5s62USDq7TcFZk3My2llNN+xwGCcuXA1KACzIHbsii5dQYAVPoMwkTlxlsGlirB+v94tQGL4ZqMugQodpl8svIeaqgXb3RcX3DChNSNfckKXlPFgPDeMLBpz4L1r314ZQoZeeUHULblJFjaaE1lnu/XbLdAJy4z7NyQHTnkorhBsuOz80BPBZQwwDdcEbuJJXP49CphZzTrc0P+/SfsVSls14n0DgpxiDyN1gz+VIlugkVw46OTU6piZkzkyALunSjCK6wp+52i3TnvLGRqJRRp6SK6FX8jdGWN3o9sTWkDYh93lN+jSrHg5F/kZoJb++rirhY6bP8Z9RbJlt1I9yoY3sRGiQ2cDTcHNsbERMh/6kC5z/R15LcCvAeOKfIoJWL1+XLQ2oqf4Fzry/l04nm8Xhxu7+ZPq+Lb+PYO8xvdVl+doeXBLfYlQw5bjdRmWSsdHm6fU5bsDiNV5EPBxtkf6rjXlmUKINEWCBf4I0NdjB8wYD0Fz0UDax272Mruui7UkU3BcEj8ZgV/XwfmWD2Ud9JxKlcPvWBpi0ok4n3/QQp3q79+kmkn9+EpPXSi2hEq74tjReYRxCvcWtr22HN/dSVkdm6CmI2bpBTy48fQzzahcBH7QTm/AFUqORiLMTcyGid+VASBLGDs5TuD/3uISE9+5zogPOLvK7HKtPisgCB3rcrh057C4QfsxbbLqk43/zGQrtngla9XXQqKAb05m5a0Vc9fmakKtCEsKF+VvNm3qZ1d5nKpU+B28fEtUyBs5J/qmo0BsYOuV
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"deletion_time": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"destroyed": "ENC[AES256_GCM,data:Gbpt5pE=,iv:URIDrZPjP2qwRa5BW6wWhNbin1HsTGdDJfVLpcoeE6s=,tag:qTr7jqk4C07KkJHgL8Gv6A==,type:bool]",
"id": "ENC[AES256_GCM,data:tHBFSDJc9X3NShzTcqo3MGHeKiY=,iv:2QNI75LI+12GUYetbhX5EtUHQ5sUboflJNSEy3m5M7E=,tag:9/OnQV0h7EB5O8R1/JPQGQ==,type:str]",
"mount": "ENC[AES256_GCM,data:AgSII0L6,iv:W4gU6mMOpihccqwywQYHaIFJVjfoJxE5OYGp9lZmXBM=,tag:YSTQ9WsH5UoKO7VvGqEm2Q==,type:str]",
"name": "ENC[AES256_GCM,data:kuibi+47X/w=,iv:ob6ZuJ624pnY4U91LbvT71l4fmG+2uCNJNnxxOd3CDY=,tag:eg5HsXTNUGc67fhbUVEw0Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:WoRQWDMYBI3SqlhnwW5xcse6LIQ=,iv:pZTvRMTRhhDsWy7D3UpdxiLBUCdhGvMkd/qPUVe1IYY=,tag:5P32354bBgOn03IPty//Ew==,type:str]",
"version": "ENC[AES256_GCM,data:xQA=,iv:0cDQ8IlyRyAkyuVeHPIvOH2zbQCnIBjIJDKsiksAywo=,tag:znmqxFBLEi+cMTMNkO4Jxg==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:s4Z/kq7ip9k=,iv:30y2IKHzIIIrRU4JNQKAaLQG9hvfKFu0Y1OSPYnTBDk=,tag:cEAd/98zFl/TfPD5Vsf4IQ==,type:str]",
"value": "ENC[AES256_GCM,data:7a/OmQ==,iv:9RD/tuhNhhZXn2B7Th4NhmSnRX0yaD0yRNIFzmuuXj0=,tag:VDwk0dlmCAUwNvB3TDUHDQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:9i8BNRABtsI=,iv:7WS/kuKSLJ7pqXP/zHEGxesZxhDIfyCuw8kEYSiz8BI=,tag:Fh31sXPWtvfZyWZfdw8Kkg==,type:str]",
"value": "ENC[AES256_GCM,data:kNLtlVztsdPc,iv:mVq1WCI9h2NHD5pMIuHCyHSrX/fwPHHRteObrFQNypw=,tag:sDKRzzmok9wT4QBNP1x5Ug==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Tg==,iv:MOouUmmGPFcNHI7xosEyoaWc1AP7sRSjJyAPWRQq1Rc=,tag:0wlMHmS67tpsd9921cepbQ==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:tck0tA==,iv:ayXOA1Ft04TpAaUGcyk8HcJcxViqYEIOJNM2+/p+Ea8=,tag:PaJvlq2Ef28PaHZh4+hBQA==,type:str]",
"type": "ENC[AES256_GCM,data:V8+sWrZrqIH2TALlPSyfP2cn,iv:XGi7o9KTsjsXnT8r9xPcsSwd/V4GmhAFFh6syxQLTuc=,tag:XWvOt76EH7dpti6wPgXtcw==,type:str]",
"name": "ENC[AES256_GCM,data://90nEZuLbQ=,iv:8wS3wbTi5kgms7WQ8I3+TmoWsKJRT8SQrQ6jRTmijvY=,tag:uHQsfUYOpm9rkzHe0GOGBw==,type:str]",
"provider": "ENC[AES256_GCM,data:mPRKg0MAe/8AaVUTkFGH2lkWIttHzaH6dFgIs4R1hWHaeyX9aKE/kdOurLvpNUmbpg==,iv:IfyABc1WJXHMmwe+Tq3Oxnz6SRJLp5fT+nh2N1uYoV0=,tag:05BVr9Jdf+gJ/WjiDBfgVQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:IA==,iv:dYuPtmg0J3QwACbNKP0qg06CvnF0dZj9AsUvVXHWu98=,tag:wKSvjVFZ37Xejmp9n273jQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"created_time": "ENC[AES256_GCM,data:puM7CMs2x96ludQ46GTzFPNBjf02PO0ldnp04X/F,iv:5PPzvDtdPI2EdMz8Ht28NC7fVwzd8EdE5Z0kp7tAbcw=,tag:305KmlivuLUUVAabUNbu1Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"custom_metadata": null,
"data": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alertmanager_account_password": "ENC[AES256_GCM,data:UuZtAFIjqlRprXV/UN8RV/453Lo=,iv:dyou0rhIDhzr4FF+asVPM9HMuGf/u/Cu4fr0AeBTqmw=,tag:O7bQaoJWDwFtPK1P85mLdA==,type:str]",
"alertmanager_slack_api_url": "ENC[AES256_GCM,data:SzNgH1dF+9rIvm/d8d7MlQeDT21Gr45/DYiX60HoC6Ow3KvpcVReSA8Y4tvwOt36l7Mx1v9KFPltLSFuuhMyUeh3+wm/JBkF1bk9UowzTvib,iv:z8nvMm/FsromrnPx5Mdhpd0UOJBX2UIfC0UmN7WOEGc=,tag:bDCRCvvJ4p4BurILsgc1pQ==,type:str]",
"auth_fallback_htpasswd": "ENC[AES256_GCM,data:ayOOqmmFAKmtP/+6Ri2iqre3btcVQl+8PZMGTGHkjs+LTzp2rpF6lGmzsPWC+cF2+IFZ/7SqNt62tuPcmmP5MLzU,iv:HG6h110SBeSTvScjP26hRrNgUK14GWnjLQqfEEgu3Yc=,tag:pHJbcG8rXsit2D8edG5B2Q==,type:str]",
"authentik_postgres_password": "ENC[AES256_GCM,data:dGBIyhnryEO2KIUZwc4xzQ==,iv:gG6GFM1hO46e/uJIdvWY0gaQIed+BQbriMgn/yy+PRI=,tag:LJrX8+89L5FwUsXz8StenA==,type:str]",
"authentik_secret_key": "ENC[AES256_GCM,data:2771KMqU9ZbT7bRhlEO6z/hcXWiZ3B0JpPWQ8CcmCimlgOUFucACuNzw9e3GrBMaPBM3,iv:uPWDXVv+ti1KTuCEQTlTU/YNo8aif0+FuAAnGSf1lRY=,tag:zoxKbvaR/L/FjBgMqySjpw==,type:str]",
"cloudflare_api_key": "ENC[AES256_GCM,data:GJwEk7SToO0EZAUv6OvMLjAEoMC18D/enICjJ8I23BlYepmpuQ==,iv:3TIKlReuCAKfBGukBiaY93c10wGGnAjm4s7X8DjU0LM=,tag:aF9cFtwae+zept24VxBDbQ==,type:str]",
"cloudflare_tunnel_token": "ENC[AES256_GCM,data:wavoTBNhLzmZ2N+SCSRiT5Wb4CJ9y+b1JxqyloeQ5ltRM9L2QS01YHJodNvSa+PVDeyTwWyjBhK5ysciSsRt29S5cDF32KhfYbSQgmHgvvJmROAbZvh8w8LBfEjB/RlPbApkbcCY5WXv+xg2ZvHZ/Sgmpl46lp52cMxDPDGOli7x+XtIiqT/rfJ+y/xLzgz4fdopWLFJD+j19bUxVN4FftYDjWfELmadwfwj3tgKRfXHSTrrI2EVpw==,iv:A2bktfTB+aAYDC7OktqB7NatnZWzY9Kv3MZL+r2xVQ0=,tag:Em6Hb4S+pwQnZtD243OTOg==,type:str]",
"crowdsec_dash_api_key": "ENC[AES256_GCM,data:NyJDhkN3Tz9fS7xJ/74IW+QZROjbBn38dN/QRUremMOdxHpJ6o5Uf7BXgg==,iv:Fjs0DhdDtS+H09pK0gZIfTE0//BZn+1VZodEETw9i/Q=,tag:LnX1Ae9UMIcRZWUXUg+0hg==,type:str]",
"crowdsec_dash_machine_id": "ENC[AES256_GCM,data:8zHo+8TgcuosH8KCE9BIaUwicoVWJ4B1JYqy8MA=,iv:rezOiZa/7Y4kBiPHnHc7I3WVVnU8ukgB/GBFp94wLfU=,tag:eKG/Vwcj4MEb8rg0rBSdpg==,type:str]",
"crowdsec_dash_machine_password": "ENC[AES256_GCM,data:ZaCXKiq8aUkUXEOacRFickAfzGQnQ4xvYEzHw8Doyusm2secryo1W4XEB7JvD0hqcNBcHeAWB0+2VnpwpZaofw==,iv:zsdqeGYdEziqVB3Rk3kmEBzhdVfkq8LNJSVGiRrcmIY=,tag:wsahYBUm4zKy3vfkm6VZmQ==,type:str]",
"crowdsec_db_password": "ENC[AES256_GCM,data:qlXuQXemH2IvjmZBB7c=,iv:Wh5bQR8aw7J61ZqQqXRQRa8CmmKyoCcWU0kRMkEJkgM=,tag:KRMgT0iyIU4S3x5anwjZ4g==,type:str]",
"crowdsec_enroll_key": "ENC[AES256_GCM,data:lr9iXk9kFm6MhIMAY9Tl/l7h1dxQ4C6plA==,iv:P19Exu6wjerMC24laoSN3zuMLwXoYo3aMMYghfzzmhc=,tag:9qhCJHI6wfGp23BMUbDtAg==,type:str]",
"dbaas_pgadmin_password": "ENC[AES256_GCM,data:DwiiM0h2fbmJPA7K+EtRZT26zUnKxVxABG5ECBQDiX4=,iv:OQef5XDy5LwOBfxyvCCvQI2zkAk/dCmL24dsszqxl+I=,tag:3bipW4SFhgh0KbjA51EirQ==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:0xQPj5NdGt6GMqka3vlGonBi//uqNSU+28M=,iv:aVh1hChK1K/z/y0wT81etMyCWunUNQoiqIvGDOfCIZk=,tag:PZ289fLJFiYYWGfgSIQTCg==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:+NSFJ+yYbCksL8Cs02S5nYuyWEBcoh5y4AK4qg==,iv:p8UI2o9gWOTRtZn6VQx8Fy9jNeO781I14Ul37bebokk=,tag:+NRtxHJHwv1JggMiSfsQSA==,type:str]",
"grafana_admin_password": "ENC[AES256_GCM,data:+Wyv9Bj4xR8aonCEFjIwohEZsoE=,iv:A3sSU/WRqgmu1XDL8nm2syHZiQHJxNtC3BkJFVe5CMY=,tag:/yWsqiiUJDgORQ8xFeGMAA==,type:str]",
"grafana_db_password": "ENC[AES256_GCM,data:wEeG8+AiHKeJN9Egar1rfEaV3X7G,iv:NQfOViA1FcQY5s8VTmyjYgCgnPRhTC0qGEcaNtKKzeU=,tag:vdbgNJ+BPNHa2LQWot6X/g==,type:str]",
"haos_api_token": "ENC[AES256_GCM,data:18B1lw/Tei5jRSxW3sJnky3OBWni+2Q8QsSmfLAxuXaEps07ZulnV4hYfZgtkf/9W3PV2Q+Sc4HryOSA9ophTcfnd1FcF9g0y2z94hE9Hoib8xnCeaGvoYhQEBuBUqjvAohETCpdhYNDt9BzFLhy+MVojmWOhl6uTz4MTLl1QoSypu9oX0XaA5IVQr9NsT0RZ3zr43RvZVUDWpzHhYkFsKwkbcggVtlCBBGnLXRxqSclJqnD6rIL,iv:3V6QS9DYWW1+M3ZFsKzK81OEi9bz2fDTs/fe0yLcK4M=,tag:cmfAZzcKXO4/q3su6CiDvQ==,type:str]",
"headscale_acl": "ENC[AES256_GCM,data:1/FM/Nekmp5IVj52x1QNDM2M8LYyvb6lpnu3k9OSbrVBMQMnlXFCQgqEZ34/ak94bV3knqnlsnaKGXRta/yhcuqT4e8v58FrgT/TuPq8uQxuG6+/ClFk71idDwSEZG5Ynh0AAuBltUAxfrfPcS2fqk7SoiuBqDHax/ja75MK8B+UM5tqUosgB7NQ4+iEoUEd9ybsz1W++Ih5SAjTpfq7MZvPz+8J7YOvvDn1kZ39MNs6UDHkZpJJ5TYt6ekLgCFJg6UNjur53WE7641vQBjHu08XX0hwTL3oj7w7ExojjwNv9tJZjYBjEXDRWFMYWjK7SaOW71+WGT8HX5W6HESKEjqSXqFLA/TJO/f8+lrOS3D29sWzQaQp6MDNutl3/tczLPDmsvzOSVTI80tjpAfsbC3/jYlwDppNJ6lMzh8y8aj9qUFOSFX7LHpmdUslC5N3WSwS7mKDO1EflB/7f3MMLgOfjHTh6lZ2zuhQEbZSzqqOMguwFgCvpesuqx13ooUiwT96UT1oF7JM6NrOM2bp90RQlSxM4z3MLO1EtOHipDb77jCuODMlBvhJNG2ZpNaUam76Rw4Ny9L0Vse0su40X7poxE3y9X7hHAmt1pGKvBanEPFqnpdmkwarrvkOJ5PrH8WQBIm1hXAgKZ+9x7b9/xq3Z/MWfU+HmCw+RWnX28M+LRl6mrqhF7qjVBiKdZVPxDWgzod6HscgLDezarcmn2f6wiqA5FenSIhmwhw0SsnJJcnsUJqeBGT4Rc6vhnt7riWp3nWXsYR6g0MuY0w2K4cyfRpBLU9EGpSYpo5f/nFLOp5yWv1ix0Uf9pQV6fSFIRnYT7gJWrbXV8QhdmHbclHC4XVjurKWK6c7y6v1HaWliPVLeebX29sVuv0s3mHaqS2XXkUMY4sWjfRIJ6/i5jcXkioAru3YSZWWBmFG9iOrZ1ifNGyxh/2CM5jJlcbw6axuaKWJwd/TfxCiL0yxLPZ6dICEm44Gc0doCvAWBaafIN4fIUYKmalWOFPU6ohHeC5ArqzgdQnx/sHwBD0PRamtWZ/6h6HoDfCbBiVvmT+P0fZyabRAPJZkL1R1VSwfTJ+1GLS1MBQWHaRit1Tt0MChCMMjxSH+htqUEOQpJk9lK2KCVliJDdl0ajIF4EPXa6m+OmU5PtUBfP+ljGqO1lOMwEjQpwAjDAC72uIVMrBCujT+m1FSK3Tiezxch+UNZQR2QtI6sOJmL8MxXf/lmasMD5MfzJjbIA02S6FAIEOkKB7jh0VXJisI2opttgNEM2v0v/+Vnd9ZC54C4zHdqu8IxdnxcqW7o71aSLFVNtTxIoqmdiNnMdtcz2jApY6Kcfocet+Dm8T+5aZRAVQ15cOnLFiOAVi11UJTHKl/Rcrgs8lTga3bBLHyrbfht091XL0quhlLa87UYZhzFVXXLwN+70kSZyEOucNhDXFp4X5PfcCEkJazKiqPTEEjCoIAmcOJA02ftV1nnDdzfw41Bn1/1X4TpOr8ZgvZICm0vy0N5AP8mFmyE1pM/tY2H6KBNog9kYoWI4MXpD7UCK//qEJc/h1KOtfDg6nQX+c2nnq7YIpOTEybNXfM/WGwReNFzvYy2DLZ3HBRYP+OV52/oJl15+ibC1IaadVMDhH7ktkPIS5opP+jLsUVRuijeDNemRMJ7dVPLpZStkaDbQwblNXfwwou37a6FLfY+pK0KMEhZ6CUtqNHsT/DUSubh5p+fCutoJhCJy7toX0RM+5H6hQC9y2Ii/8+QUaJ1JMZtMUVdYrvDga2is+fXQzE5K2486mbQecDj/1WeahAo7zJAUptGF/cEHoKv16pRcJeym7vZ3/887OGCM56lI3eraL/3gFGCKdz0En82ia64oYkUOlFHN126BJSQtbY8lailvLF35RWLrVPAKm/J9NM9C1D7AjavTSg0B8VG+c6+qj+FM2GGDB2pRmr7xjgezkp8xKw2WRJfoWrw95fVt59YhUpBRbU8s6swMOaGqpsACws1DQIl91EJywaSuYBYl0y057VeWVgauee/9SeuG9BKw3RZVO7r6QBLp7dxAcQ5Yv2V8JcpJexT2kFR3LCJMu19lFsCZpBLLV1eSTTpI+0hFtLzOVqZ/gDZrde3A9ZFzZ+wgFvnmDpyovmqd+HpfKxbAE8sboK4jxN2+15OtTPX3fjNOxGUlB85WyOVM+77pLNymz47mPhCqqGa5ShwOuijFJkaYoZed3VjVEvCmL9Ha5ecZHeQqZVmKAcHKCOQA4FBVPyoOx6Ep7vDYL79owsNzriOPKgE9PhnqCVWhLnA3qrZA1orkOP4TtHbGap8GXB6C08pA1fq+xyLe1wnyZZ8IdJ2WiOUjfA9loodihTEz4n/J5SWS4QXS6TRJio+6C8osEYUfO3DynKLlm49Wdwgl/EhOq28y9r6KlQ4uj/jSR3t4OhOdExWXO8NlddNd9HFSco0jq9KBTEblD/DyYgQoV3BZSbyuInGAVDGS2wSxllAwiBEPMsc5Nx1dSx0+eufUZVU7F5mt4py0PCtytTsoR2UMx+c4Ty5HbDs8k4RrozKLOmCri0IqALmP00AgWoPAmq7rKr8mf/Z2TmEHNRfiBMLjT+fGQcpERYBZOXQr8fAk8T4QWwaJJACUDM8ctCzEJGgbPCPmRSfqVTHRNcdLfHuj09T4WAiApYdOES86tBmaQud4VvctQhM/RREGCwXdDx1q8dCuvghT9iY88LSKd7CVdjcv/cvpfpyaXRxPtmHw1wLipqEjbD39S5i779Cgwk9saP5Hy+uZ63RWq9lhfFBydZZP9GfXYg1oMQZ7P5LDzTpRc6Xcsj+izKqhSwRHdlpMlSSXZb7QDld82Fr6gF7eCdLRhHg1G5sxlUxGQGPNC8KkFtSC3AY5h5qu1sCDcw9mxq6LJQ/YbWAeXiEZOZ9DazvuXod7zQlU2rWP848/YkBdC6EIKCRqEEK0nRYtoPLSxkELaC6r1jXyJSuLvchCA1h8WxfNfPx1XbZVkKnjHg5FqhJ7GekNlX10AqF6u7gjP25AyNWTWSbwrtQhcwoFoWWSlTiBgU9pmkTNj2PinaMl+9fZTRrVfjoXT2fVd/8XRJ7hZ0DqnIpeNAqE/fUFp7OJoPyHIrXCy/eKBKGWPkqT2ChO1WA6gsVWwLY50MsGCk9DYi93wWOaTDXV1v625YK/4ivFIqqpzaB4ZTvGmPLZziCZZFUWK8mhxWdZvIuZPq/dC2p2nYs747mCagOWdUhNFnT88oDwDkhsZRIrfXDaWlCX3x3VKvlutxIGOLMfIgGq1NW1BzCvLQjScIySMjW4CEg76S4S3avTohcprh7k51Fb8mp01L5lL3vVj/PjmEJL3V4rEZB3obo3x/KkfEcqfL8rPhs3/UihSHc8Q55PISFtz2ddqnE0KHA02FTFRPexjd/GlEwXNEn2tRdwvGcNlCGVky9BigP5g+CEcVxkiS8EM7UOhR6Yfih1ZdMWJBO6GMg+RWNAqf5z1R9F6nx0o3enVvhMTk9PA2jH8jU+Gw4VDiVze1JJvX2fDml1v6EkVcfJOdst7zHAgAYKR93ImkHahT1zWS1amSL2MEFQyCU+C/6HuxOI0UZoxTT2d+ws7EhlMf/pTeZyxJIo3AhRwFXCa0PHLbGDOPCbsiiREQnm5wqLv7070kxjwAwrApFyUtf6D9FFa2h/ZEs65gqSNeKRcArtpq1wwYOGE5/rzoq9JWkZm0uKvLKBYN7tyVah7PWIwESCp6Q/Kj7f138PGoxh/7t3MbdXTrdO/AAgyPr2wOebDhMF03enq6dPTmHnDguYPNDy5G2ULk42YSIFCBNzUcA0+hbzZ79LvBS4InV29buDFsy9CQ7PHtOodShvWAqB0KbTw7u2zaYeGLOv1Za61tfu/6zEPz5rnYinFZ7bzFZ3lniDQkIDZuLgO7It8aguQiuppfz8cOuK9lrAe/lLPWuJZDSiOQ7Z9iF7GV1n7Le23lLHw9fojgbWcoeXBw6Lt/MErQsHwmMfkihCD6uTjA12bXIqh6cnPUZh7TDhWjGjvgQi
"headscale_config": "ENC[AES256_GCM,data:tSuidi3S+exus96w/toddTKmNzfvwoo93P1F+VXpUQKG7hqRTwoA6kwyS0w4C61Av2RZwLVCdDXWxpi+Bf7axXR/8FqGq431Yw3bY0b8dHO6ljIm3dPlglFUA/IuLv5hNTuenqHstKmn+AJfCr5PgFUfq6B46ikzvBSrxncrpTzafxrLR+UGZBIsaogLJhFNr7NNMtOcuH+DcVPQT7b4tUPYTje+3xhr1pDyQiRVIEEBEQLBZhLuT4rKj4mlvDS7VbXiz256yv9P4007NR1Sbo48eWWD/kcV5AHY9vygtabBHO/d4X6fdwajTJekyvRMeo/+mPDAJ/OUytrEDPp8O7luIZRHdTIJ9Y0FMbQQjy28gTmaYDRLtgCHczYq3CTVCsdun5JhHbyf/k/f9JfdM1PqXJRKxr6PEfdb7J7wiSnvlxlqgV5rcbM9cGRuzRkUZaEADFdBdi5jjOxkfrVN+lLyqr2IZYuu3dNIlmL2XsJz2TutYIH2qDLWyJLAyq/DPQ6+6WwTk1glV3ycb/KCYdwBegZoKp0/+Qt6wAIn29O3w+Y7dFMyi5LwaSpbx4wEaax0/EzZGzLKfi6Qyn8LIeyphD6X6J0YdNnGkXHnnYrvxwiinlJWP1FxVMRno2lp8T9Me6dugZmMUhUPgStTs6W+A4MGZqdEZMv2KKO4wKBb9V3lltbCdUnRii73W+UOS6HtMuXKbfdhyEVBgJgMcZcHjqbMvC/011RTOG+AtEc7cp4GoJz7DrpRchJ7zQDbpBAJyOSbA0W/ARah1VelQwgwUV28OQZDHr4ERFSqNuiIp5BjNfJHMMWzc4lL8zxb+pilIrHHkMCsbnABVRtElfMcPirUtM3aecITY1ssE2PwGvKuW1JHOP2MVDiigsNisxbkEctAWYI1d88C7IAEUE5QJaMEL92g+cQPXRpbEsnCSp4RWfgk8xmHlbCpiVDg7Wg78AF79hPHQtb9Wgw4K6OL8uAP1e4WL+SbcJOlNXvWLbO6y9dMvs9Ds8kj/aoEIYJmb6m1WbTz4qCLTP78NK8b/OVLAY2Ck0Umh/tI5piBJphLpEpv1l22HMeUh9QUmXZmiRoEcU1o1Ck6wytcrUiWx21b1txTEfCaVh3pC2/bqM3aKsZoqY6OnNKufRIg5xtK4vrrHsuWcHcolLHc/qMGMshUqxMxY9HKeweoh21H8GZoqkoqeUmkqtsD/ZBZ+B94TXH2aktUs9E42VCfIAMqCXtWiuR9amC5e91RIRLjIjb3DPS6/+suVAKgsEVx5hOmNgXsZH2SKLe+jJW2+MuX1zvUcRI33FtPIRgi5Ic41z7pNbwShqfQBZkMhYPnIONbrpU5IZmPirNR4OgKJ1yun3UqqXJAOlIUe3TLE2yJAdcpXYFEjJY1QQ0gxMDr8C2YT+HuZwKwQW0K128xV7DfrKO9xOlyZq1kIaJrYA6HK7MSUg6awV5M+R0RbW4XRExG0Y0UGVcU7VD5Tq96gsHQZF/m6uPmmgHq+pzCx/aRZhV76MBW3ZM+XQ9PYWHCRJQ7feKH2fJCCi8fMb5yNPzYXKZsyrOmUshhoScXYSV5uPRe7YJveyZ6tRi/0Wa30QwqThcTHQ8Wy5NPmFpYSl2klMCRlkFc+PbCeDtDTmEbMMTFiHtEhgIlJfpxIELaes6f4ik+rbJ+je5zGPnW1L/aTcAz6oQ63qnt4Qsvb539txThO4acQL2MchK3D26LTdFcre43BPJjc+teem+8NewvTVuW+Ic5TkBzwEppM37fWe3MRsHtegeeBNX11ptYRkToVPS7FyoJI99f89qgWLtejWcf+YUua4IkopoY8JK+JMZcLQFlSqNo1GS/DW6SvlIfs4mK1CkLe38vdkSs7YUAUr9I8Go0eM3Fllcfj8SgiFyBZUQZVMzfPrQEAKnZh9pjXa9VJyA5BvYygR2Nvlkaz+Lbz7y3dorFoYuHVZxlG+4/14+QDGVwEnbj04AlTehDKc8paqeVsrzBT6PsVdF2ujS25HUakY9cqtzjL8WrEUFu3dOmeCPradGgRP3d/xEikfnB+MDPuKK2im8DMW//2B1uhUmpoywfQ5kHuJdJ7ml8Un7SMS7ittxTJQXM0LK/J3C4pf4fWWyN1sd64NmSmfDP9c0kCrPmZsJGiDIWSRwFponpENILZC7n5n3tJqyXjrzgtT9OlIRe11Sgx2QMsQD7Epsjma3hXzlYFByHoCOziYiyvj5PSrJE2hy/oon9ZI0oQNonxUAbsBOPBYOYKie7LH2PN2qPJqD8EJkTml0ThpGRtKUQGpZhH7Wjr6G3IPLwl5EIPy8sdBXWQ6dif93b9gNvryzGtZ/+jDo1DKFLFMwlRUXXeN5mwfE/zzDc67FYKkw8yUka6XrsnLtPInQTtT4X5XTg7cy7l/kOC9/eVClDjdEEdumolnk5TNflBTMl6GqBVsOoink5mOI3jjuMYaWOyS04WGsOHV0zVF6i8l+f5K3zgdYWfEdCTZb3m+8/uS6uBSHUGjT/80V+MAySvmsdysHBLoeXje9E2MpLiWv57h8+1RL4HEhBQJVUKbMqxTPKuMRdJ4BM5fZIe7SBDqgrJyr/Xz3NQsw0BZZN+SWWfutRUkqBJCcso0xRm2nxeQuOjx6mnM7l6x3vo7KBlJOcE59tGAvytNn8NgKYb4x0iTIn8ps9BremO72GCZn9neODEVpbGbYU+kiDSVsa7pCHqNmPFgggFftJkZFxqUIxaeeE3WxQYM7yKgz9K1OciU7aYB2siEylaql5G8hqbGC3ouyv+/XD1GCNpRCYYjqKQXQIvLS8jw6tXrxl6GLTIbYEbz8WvH3She82lfRLW1+3ILR0gpra48QwRjMFHSiCHEUNkiQCGVRgrLqGirtE3X1JlB3YYgfJ6BhQdYBtuFuL2r+AENKkxAWGy/z2HalsUvhS4F+f0mOMaW+esqwrxMRrz0/CIb2LTEV174ij76OOiokOvucIkgPzbkbPYj2s1ZQIsoYALngnIBLi4J+5/b9pq73+f+DHV2o/L3HbxqD7LE0U5uM+Mlwtf7wF350pOfU2glYDjumanXBdqMQUU+ir3sd+ZlYp/EcfRNPLTs1H1mczao0svLPVHQM+JMBCdEvIfbvxnkSVAVEkcvHf4VT2QZz1N/2j9u+OLYFH49/vjyDTY7fnGOTS7JBJCbJ/QdD+It1siN2C6jLD13iR3CHuTB9yfqR9pNcG9awkuaGxzp6jbLumv/2Mn4t4HR+2f92WYqIRfX4s8siva+m4dawGn68Kd+gp9yJL2Nt5Igxonu+a8WYAKJGHxkWP6hLo6bT2VZVIqpHRH4RPJj02RT6AHB25Yfsn3W5QvoDISiqpmK9mreBXbUZn9KMRPhzwkFrYVo1itw06LKk2bXptQ7HthoQjlit/GyMVzsT+5ELIAahk7tM2RRG7BX51ohxyaDTQ68eoLFblPf/BToNDDPs05LC+0u9iRAX9kABqbYjhk4ktuGgtz52Hq/N6/XgoY8YszsFAJilbfY5aeJhb9aE0TleLb5oBNlY1kDEtOGb1WB4sRSACXn7S9pFAKZwttIvIqO4lNHtlE2W6133dZzZbQju5tDjS31kjE1Jc1nVMfoiev2xjNQMwQl0Bq/pOeNVF+8AY2YZevMj25q0szv+sOlkVN2qRgqgoswopP8mfFe8d1aTC7nOvxwWXmBRhv0Y96czsSLZVjXiWiNCMobrOROdoqVuoGTv97xqQPbPgIR2NYnwlwf8rYRTZ622SQ/qgG5sXEswzzXSRq2CzQjVbysYcTTMD+sUZJrX2b8eA272JYZITAKWooEY3Ctxz3FuI7Kkz8rmMghvL1cLE9CF1ebRUvDhStc1I3pENODvaoML9h/W545F9cmrJfIcFFNYMdd2/Nf2rwTgfHbq7V4yuH5m7Ivcplcp6OaROsvEXlWxovC+xQ2QHPSc0yB5Rm/s3K2Z8wr5PjKDRqQ9fBueMeh+rpSv7SO0pHrcyLZ3syZpbXw0aoUobJbILuA3fUWJimvfPY83QRTOhe/UQsQBLQ5U
"headscale_derp_map": "ENC[AES256_GCM,data:Uf7euNU+BXiSP2UCzkYlLWVm7GU6Ya/7TgOLtvsSkJzPHo8aOwU246fwFbZ/vAPTetMul1MguDqpxn1PvjndlLJuMQFy+qTETIc0a1SCVkatsgZHxVS2jfmp7L6+ZltK8zIgGSbSAKP/9eTOruriVidFoIflfOEfwczEAj0A1sJQKKYKABdYhXhFQXTM1OGDgNQsYsXzM/AV9Fm0ER4W+aed5Vip4rPq/9DNa+DcLhYqQ19h2O+0/qNuP2ub//7vJy7NuTSU29ADWK9hH9fYsMlTObC9bWHKXri7p43WWKJsA4s1zdu74CtJhiZw/WuLFZ/ixiUtMOzAXkIFMvIxCMaxV23erAKv6L2VIt13B4XQhMHt3942WI8uHkDNZa6p/A376buZVP+SMob0BvAvhZVIZV+iXjFiFf0QCnXcUTuhmf8k1+R+ER6/6VHz8nDDDva6RZxShN2glVZvLhvuaRy2GCshcZ9b1CjkwzqZsHX9BGFz/quUbR18sXuCbFYNhPQWfwzutx2NIbpLQSTvG5irvQapxUCR50zXTivsYs/2tW2gbCctM757APw1Zc2A5W1eWX4neHiF0pmhXPzPp/AGLe4iOs0neouEKPwZyIJH+Aa3SLsjjpEp08s1Df9BUg5Rlyb6d8rkpxf+1ERJKFK7zHtiDSV5mL3pB//StCrayGSibB/KGEZZIYr6RS0ReNiWrdXrT4tn8pLE62YuBqwvjWtVeKdVOPWaFCOyYSTkf8FaMm6ibRKnUx1+jKzD4jBLmFOxixnpuD/8/XDvwAPDXM4WKt1fXj+zzqJ+T4tlE/zY26YsNQknop4kMSvEmY1ezrZe4inrYqTebiS5ssbraxs33ruz0WD2FgNzU2pVpl4Nykmuuy2GwrtfkFr5z2VUjbFyu6bOVTsn6X0TZWLTqMF4TBHO7LrGxYbfYtRykSN/8npZLm7RubRtX77Ugp+RzVw3dI1+xV7DU/lPtfxrR95XTybUJBfak5SxN77IjDpDy4MlQyhiy/nc/YX/poibCdhTGXMwBNlJmkJ7WgIaVUnnmUNtQ7eUw2qURMrMpOOHqNKGYsTDl2uSiUe+ZJiaHUbm7+LoJxUd1dkU2dUm1LAtMRwrKpQK55y+20lmRw94U4Q4yaZKcpUM0H7+fOpLkSH4938Dhx97Xn8/Nbj5fS6MTLtbpGUQA8bRY2AEhepov5UCrE4mcTOX/udA9qW3yMuGR4EuhdFgC2u4RImr+sc26NYGLGvr5UM/Vf7GBUOvJhN8Occfl+49+8TwXmKmlYjvn4X58tia0vTlP5fmvzyR8N/HLpEVKmk845RgKKCZYC46aq8u5LCNMxClGwGT6GG5p57DjRqFB0RLFcUbYCM/QhBTQN40NOTWR23m9unQ+rdDKEAT/zR79B0kaf3qd+GFzb6148U6KnwQjBY0CclAgQtkyttMEAeyxqJHVPVx3urUgYX2P4YyzoealxoxPPDVm09sdHu6jmu5/xt06tfBLBnmaxnbKXu7gPqm9+/eBix51J8PSVGZqpz44wGqP8lfi7m+Wz67uWJYGWVuax4TQ9X0oZwbcF4h/x36yPdfwdPRCXA1QA67QCkGHRIB49AvKR5FesplRq6P1ahrd1FaBSv3BeHkC8TbdkzOc/O2XF+9EIEW1hqVrfaJHP0URjCDhkmlkCcLElf2rFUmA4XCzUH/7Of4f3RhXLbf+BrhcWLCt0kL5cc0MYuTXRiio7HC/TmITSgndh+5SNKHeQIYzdusd7s10d5gW/CtQejVaB3Zlb90YXQa2Q7h849TpF7oipTCKhkwOIBWEnYfJ5fPHXn+F+4Hc0mbHEOc+nITrOu2dRxHDKqRrS2wscP2QlMj22A3jnRWm+BJJA6DpjpABsPVJXeh/LtQcSpjS3d4MLp/Pw3w0a+cXJQAsiZqqSJb5EHr1cJ/gzvCmXhgTRFmU6stHBx2LbYDWbIeNXoQSarNvB//cq/0Bt/RJ/Jqj/UdxQ1zR0oBkyF5I5EDanm7OG/N50GYI5ieNa+InQ4VvhDZJwVozCbV2ijkBrQQ2p3AFMfrdaxAJLdsePcX1knhPiu9vc0pVeUwpjdSNpM7Q7xsag7FEM5t9J8bgZPpK9Vy+Blpb0JXrmCvcMVh0YP3+wYayKYDVwTCUuVSrA9z9Wj3CDqvDCD+/+oGKKQz14HbxOe86tbfGFYVOWZCHvuaQMCi/szzn6VbiNbSYh5njHuDvYY00rzB4AQ5NYAEEo5vr5BhG3R2GOvu9sL7EMTdYRz8w1hFJGhR1t9q9ePBp9Oav1MZnXmjyv4ADPMCZwj8zAKzKCsugB918LO2OXYulzD07Q7we6kaAOM0M71BF7blS7mqTV8pGtCegMPneucLkTDfu0NKcRko+pFHgc/bFXkVe5A1VEHTZx43KjvHc2p60zWVqYc/rRpAnl8Hv8mkWE1Evwr+wCWw/V5y5LZ98VHsRsirU2QgM4mG1TJyfYCKyYnQaNQy2/ctfKWNTxNfYfO4dKbQzhJv4SnrQbbRg0tb6QrdpPsaTp6S6+r+tVIqARY/cFbHIhFCW5I6wHdfcxtQoabQBWbYw2I1sy+gAN/WNwBzqe3nnG+RHJs7ZYlsUKR/QuMy4PIUfJe+WiBdKKffyHl5Sc/mGyLJEkX6AgC49hVmjMu9TZiAhcj9KiXVVPNJQh0TfvBplndPtILfOcf2MGM7CYcVnsLJ3WK1eM/fkjl37CUMHJWqL+qj7xHroatndCVkjTUrSzW0U7byTqIkSBPx2nmOHZ3RICF2fqDRfG5fKqsXcs9t3BlcLHQ9boyBI4ZNQc4CcIQC2SmAhfr+bMR28qCrsDmxmkIzkJkFuxNNx73vzzqQfBWidsk+csMGcu/OrpaBkDuCG63OL1PbFtgmwgG79qt2ESOVAbBDK4m9pe2AyMhwBXTmCbSsZFEf3fUTGiwQsf31ozzjcBTv7/c5bT9/w7gCEply0nJ4xho6pDKvAoIbQ1nDUCYmB5UY1kPuc5fTT1pCHfiKkA7FC7qNKzXeOcOzR7QhwRGpNYP5lCyLQEfTfy051ITiiKX79uk0RuXm+cD350LVLeu3AvyPWm5iSxSNEeWULVcTr+op1uBdjXaXlJb0pnia54qba6JmDdsyjlEKYLtDc1GDDJVBjpeuYfPhXgimgoYZ5idZeLAGNjZBGM2IaMGBo1LgypSeADudE6ghsnmB/UFi5ZBYIkuk8dSpwa7ZjPXysL84iJ7RTu2deWAjWTTkkppkMOCpmkpQe5enOyrOr7aGrsqAOvRIHKzVrVU/gzVzPYSI/mUAy3o40Y7ig/TYksgPez+2CQ4uTXHwHJeXLARuX9fyWYJrgRVwRXtcjke4ZZjgZAFNmc4+wCyrKu6V06Jp6WTbzhykR4nQMjyUKpYyt371cV1tIrGdMpINHVlSLPpTrv/NHfMX+GRPCP+z7glCKCjjVEjvFK7LVLAOxpMzNJUzEspNPGYfCFkNPQbV3N3D3795GdVgvj3rA3aNTJueb2BU1v0W2edS4DiSD2Luvezsz+z9CPEMOPohV27YoFiTAKKwTZEPPvNrOEepzC7mxrTIMts0Vkw09+Ku/9L87a/RW/17hFGqaKrQ/zhvynRK1gTCLWXfj+dB2KSeCbU2KOzKQoaQMZiMsSFpXQIEGZZT9CHSNOoBEOglCLiKGsEdnvj74iQgd8DobQfjhqwW68l/U3ukAOwdz0XOKa7nDWOZoJEiJlW8YEog4P0g+3S8JOJfSofUR7yW7JBzDOcr9+N2uscufv2rpNYDfCmn2GkAj6GURAcQqMGWiLBI9SUGSVUPSeV6jNjM/nNBqCDGpND4SZer46EqXWfC5tc9RTjEZsNk/J/EhYlzIRpyNllZJSQNNCPAA4A+D69lee/blChcDtw2vjeWGS147yDzOQ1rhxOJ/0ThEEUpjsLZgxMj/U8JjNbO/AS19w+taxwUabMf1DtWklFMqQ8O0M1aVH7sxh5RXe6VVzvzIX8iSUqzVbezt2tocfFVRoxhkHvKI1aj0YxrC3k19ItlPCD1s
"headscale_ui_api_key": "ENC[AES256_GCM,data:4IkuB2IR1QJ6P7jjhc6Yhy7g+yK5dMOSFEln2iYILm4E8zP8uxGQQC8bofvbIcMKzl9w9L2oAyH0pQnW27ulWg==,iv:9vMLqESn/Po5LfEx5Vuuqko3QbFLJwwBEWbFhzncrfc=,tag:3L37R5tKzSdfR5+ve0/z1w==,type:str]",
"headscale_ui_cookie_secret": "ENC[AES256_GCM,data:4xo03wVuDfrKzDDJJhXQLOX+tlRRDgCmL4+NUpHOBL5K3czumtN0GjJDJGJoKcosuGHqgj97IHMlxoa4DSHShg==,iv:ln5bQZzMFtX9haBrCcrybyrhsCBg8Hgv8Y1xaTJQhj4=,tag:B+w4Sr2u/wTHNkmSUx3f7w==,type:str]",
"homepage_credentials": "ENC[AES256_GCM,data:0GfcLEBOFCZUb4GhJTQSl04pELjVyyF5dPlHqSGm4jeXO6ra/3vxyE4W3520OTzruSu+9APzh9T59Beq98qXjpI6Fa3jN89+/htgf0Pc9JoCE5J6zHQb/SZ7Iar0p29uOkGeRMODxNbswF3hshu+ZNespI7HzkDumeNfHAozkZOC86pt0b39FckNFB+n1/5Yhja5wKpZaT7mWQlSbuVm5tWq7ygzcWtAcIBviNh7NmlksDyJFYxkXjxb1McA5cechJgVAEod6hTDjDG4x+tlTUGIobJOTYLODsxgDb4IatSxZ18n6pNr91h1SwHgqCWOF3PRGi/AFStxV/KPoU7Hq2xHhSF+h9inFz/whgegpQ6pr7WMAshmhBwurfq5n8mf3na+WcdnE75++p05hBwLo8ulsLvlWEP8C+YMmA+ld/oINHd0a0iEy2O5WutaeJy6Dhdw5RU7o8vX2wiVBIxEsF2wIekEYItyUYjgGEEIocHF5nhrMMtrZBZWNdeveHsVSGPL1TmWC4+Yo0xHBFSqK9Z+4NypWH77puuO8utPCgxZFdVido9v8uAEirSa6O/mcoTyQyinBXtbskF2PrTNmRtTbsFSc4Ou2q+4M/wIykaW8g5zmV8UkJn0STioWRoKxq4E2PI70QsDp98cyuUgarBgEL36ldz/L/wWyVWIk5VF9dgNY+kNXzwO/wI40YWRqekiHldWPMBHs5LNyWRx7oj48hOrlnoR5y/Cq67vV6J2Xwtb+1nxG1VIBc4RGo79AiZo9ZZXF9tjYJYYNgcFmaMcAZ4q5PX9Siomw0iA+ZanepLspRGWGiyZBeqB+98jvP32e8LlxYI64NTujqnFjRbEsmBWTE956UcXKx7+Ltesbfl+SjnJk4h6QaHxONNa1l0dDZMN4Zb+gSVO5gX5XV1xQFi+46ovk8AatnlQ/ZaYstYW5o9hfXw7pvKrBdIO60oE5gs0MPuyDZcauXp69H9gy7HY0AXrgHk+ddov7cmIaPknA2pkMnZXb/HO9sosddvZtMXKGPQnEUn2wgEbopfXMZkCyMh2J138Y1dpWhpCVDOBYhQ2J7UaUJVKicuuKBgLm/iv4xOrSsWFqh3YuKy/WVxCXYG/7uqXG3Jzwvdm9OI8xavC7VOz1/eXpxuef3hgPofUUfAKXl6aFnKYsreuN0px5p93C92JTcOKZKqBkeyouFgw4T26ISiyD2duemsrfun5ScThANSSUg7MI9jyPizdv77jdFBxVzBwL2MsZNRl7qQL0nrBHYtaD5ipAShFCzBEdXia8mHIE5HXRNltOgC2VWODeqituCCsLlY4ZIgMGgvbM63MkE5TJuMxpN0QmgJk7GaraKU9tXT2KDja+x+dQT6f3xic4uugJwqA7Wqw997uH08ttUzZj04i9A5WpKepQBzq7GUGUpB3YNSkXnrgzSlueC4e0AmF4TCUqreIcwvlWcO2+8f8vm7f0CSOA5ILxc9MsMgXOJcYfqHUB/tEzbb88OhWi5Rh9R4ngsDYfMzm1/J+gv3FoiPJoSLTEmguEfwaBwScFJCtNwXE6VOTQDHZsRzrhydsyUjBORQC5oANqCNwI7VUQEjp1s32/pyZALsnOpZ+p3HEKK+E1gmcO47pXtWjbMRq32USCspr/7Cjn7jGqHo9BGEJmcrQkfLdVWOQm1tpkRVmXrR8lge5rXeu61sODkrZPwfL2lnHA/jL3xfRjgsKySS4ysfGYnaUlFTKXCrJIh6XZyUN7SSGn38aftTE9AEiHU12cKVv+AjajEVzBDepnawwpCRgZCCwYz32PPtsY9nDhI+DB8w9OHFmeqyd78JazTyB2fZW3w//GV9y0aPAmd7XB8dHJOsqb6zyxqs+4YPJT9GJCX2KlQ7DbpQUe+pYEWX6j/uPpGCH+mhe6/CbFYw1GI3GDBdZ4vHOGBjif3uXUBjYzxrcqGFgv2e6B2f4jFzygIRvRhOYiQPADTxscyujugtgAlwJPhKvkRmoPbe9lh/hv7PkVUXOXwSF4RUHcT/oDdE7VlG/TRyd4pPRs0qkkn/Z5dQq4va4p+EOoubPJRzbE7rdmo05nlcmTtV9U0u/T6PueErdtJ4bhGbx3kEul8BwKi3yoBLQ4+n5b+P9U93j9o3mcrDarBnstqIRD/gxux5MGHgIPHvZKaBR8pkzd60gf5bavo2mcVJ1WzasAepWwk2Dut1e6xaPAzhc1kWxypPg8CNyuFIFDnyYx3j9+5qOvgX4G4jfjwcPZNG40jKV2Hv5LjyYjc0ctt0h4ywIwTsrEeyn8vkDxIN38FzOP+gn4KzQKi72StciHB+irvBQSM3hEfe1JxSFaUuhKWvGPmNRHCsBZmSXfKYsa8D/2RQXLmElfhkIDEdJj2rBK7t9zq+Ed9lhnHya1ujKPjcC63S8QSWl5wip/1Jp7muvj8on3FHBhKofQGwygzvozugTc4RgW6TBjzmpn/gDEkedIBuxyB5oeuUT8LZRSmAYi/zPAb2uIvT1d64iWBjOqmPhrJuvAaz7fOiv6wKnAzALNWvURzyW5vYg2iKYobJwPMSPFF8om0pAv3uvJRiT90ZHZy13NY9PGX7fDX8Jy+6ryo65OgI48jac2aQvMhomNUgxDy1EuxATNf8QEvQXx8RIMWjh8KKRMXKqM8bge626UzI7294uIGT5xd6sptqYaEvZaLPFdr6wfcqxTgOiCuRuGiIkoJmmSbD2jgz7WAKsQFmT9S+XJNU4gfo9hb1WP7M=,iv:Hh3GwmrZZciovwjUsLSTUIiRHlVx9y576JlFwPCX2Dg=,tag:jE9M6hGi5y6I0vM57diPIQ==,type:str]",
"ingress_crowdsec_api_key": "ENC[AES256_GCM,data:NCe9GVn/BiM7ELCnK0QcPd86NIM0o8Nn02rII9au+xA//bfkUeJ15ebNHw==,iv:t+UR79lVhl/8ugIX2vYPQJyNu/josbHylDN/BcchXB4=,tag:G2iVMtb8+Qw2+dCmEwIz8w==,type:str]",
"k8s_users": "ENC[AES256_GCM,data:c4PUD13I7SF8b2+E7tYcDfGgkHJTISSiDo23YeBuFvzyI/OcGHWDYrjQBanHrvrLWFBkjVyouxgg3l9hKIsuPf2MKGwb4U5qroYwTud+xj1Yo0chEkOl6ecPeRLAnuAOL24xjAjBARB0WURjxFnY5/e1e6aeSPCSR9o3RPNoizfifpnh2IIdTdjYTcQG/xHuQg3Isait3xG61411y6Lu2JM2SUH0uVXORokihnEdmKgD7Bxi24pUN/h1CSYTQAzOj1kIuTPC1LJkp7jCWPFHPalFjoHYgl2Q5zyY39jLQCofbPMxq04oypQN+m/yFZL7kCd1/9wC+z39nZEcWeS/yoanL0jo+lVsK1caX8q76UCsx0m0ENRlTQzYGGBfayTonOBJDSfODoWoR8+zgN61ACe+XuTuxJvKCIePVoGYyJGsKjNXB5OiumP4/Au2Obb3zEz25r6XnC5dMJqbK62bWsk5BvXRX+j1ADcF9Mc/UPqJyCWBac7+Ge2ByKwfxc7eh3HEVsjzdlGl4dIhzlGJBn9f/iDJfeXE0dkaVsAc5/99xS+vxx04OCpX1cRygpTsEdOyCQPL8nZhoc86L+FGO1jjsXCfnBOfElGMgijtjl9kL8Jzu9Vyo11kxzUHvJ50HniWojQBMN2LZOuah88mRduYOM4RrGvPvxFTjXriNvz2JdM=,iv:mvKALTjjxuA0J2UZnrXVawS/sQxzeUsDQV+Ar7UUF+Y=,tag:HWZEokYUkuevbQLKU/DB/g==,type:str]",
"mailserver_accounts": "ENC[AES256_GCM,data:WDwUc3yfYMDA8PDha1LHqjdoga8Z+hA3r5/NTtZf2qYgZDbv+IbDf16zfkKMlxauBOGvxZTeFh3/1iDcDiBK8IhMm1auNxzg+KeCQqlAYlL/9aaRZqevc3l9dQhyC8deGi9UeydN+M7UAyWQ8/X9QuY7bRWlqjjSCqjnoIbMU0kFq0bXzlyLesVm5rQ6nnPFqlcYVGROjzrjwl1Y0wjNutHX5bMUniRvYbSmD8dtjlyKY+YhH18zkT65n/9ss7Ij0vcXQjJjJHJ5tGq1WS2S6YcakDCVe8jIW+vFQuHze4O8dBdvH5la6oR9aCBqsJPRpdfLyt/Y0I//NeeAeKymEw+P2Yzk3R9g00P+QfLXKtTnR9poYgzVqKOxP7HhEI0a0MlTr/JSw+gmUZzzv3+BwRIrGH3KkbYKeClowiZBMr44duT0lJTQeSdh3P21fgQzFsjC0a6rj7awiO6TKg4a4llFxXNrLVA9BW0Y0bqNtCDY6+MHir0EkscJIryIwpPdvfQWLssjvEffIg6Di9/tP4tgcOlHS7jLQppYnzc1ZmOyR0qgkt4zO7W9Wxmz4MxU2YULI3kAsz1QhJnIhW1EqmarBalAYDHDwP01NdUWWBDCSZ1PxkojQKVIEAQP7AffJbRsXwEwg7NcM0+ZAVwHK6L77vo7qHy19+2Nz5rQX0dZJHt0AZwOCcrYtpB+ephiLLp+nwhBUMQ2dxm6jEqkgPWdFWV73bmvmCHg3mpmjL9oGghNzJFhwPPzYrWtRPlt55vL+CpHmbwUBVL2f4lkgiFf7XiDnhjfk8ck9/dTYTXkUZ/Ne9nxGf78k1OVfnD6k4vMjLVDNY29IjmgZJT6aSrENfsqvbUfTQ8VvBPLlKxA+3uBE8+u3dAxpen3jEWOjkRO5ZYFIK7gUTX9kYqm,iv:20eyCxpIP3qPKhdk8yss0bIaaYWvGgfTFowfH7N1284=,tag:WC3UYmrOD5sWs0KnRd82MA==,type:str]",
"mailserver_aliases": "ENC[AES256_GCM,data:4e/ch9HB4Q34PyMzfVwdBQyPom14jjgrfT2jaBqFZoNXfRQeG9QupOJiZjON7PlPGWWpXtf++pV6Mv7r9Xh+TztSESup2/s9RZ9QNrTrxZitG4F+vggiOd0EBKEfJt84IqKIuxfTD7DaMgTPV4MuVp+arJREQXlOunAsG0rFku+LFcdeTN8zkETQIUX3VCB/83cfdQ7px7oDFImFsp6mOKHiDzYLra+vXoSTKO1uxQ74sh+rEawvzBDapMdUwvGX6ag0lx9HWMrHnD8rJlDj+PpqT41Olx4/p37xst/k67kiQwD7gDxzGqBftLUxIUvtHy0QUl//gj8rWSU2jKeCNNpkPojaqnzw4TuDcM7fD66RKqNu64OpkCOOMLwO/J64RgBI5ujLGtlu9DnNhA/2gY+D4/Hrr6M8kPYXnKQyCW7qEJ+Ee6T44rF8OUcYZN7lV35KZbjhu/5teP0qbC0lZtesWPKfXSHGra7RdbhxxP8ne8GZuIuZucGZ0EZ4sWl5RbwbIJDdn2a7UQpk/Q2WJH0ZOiewP5Kn3vR0RyOEUmLnaXjmLgmhi9ZCu0DdOhO4e+8hZMT/a8S3oGN0O5DICL17P4PT,iv:6VZAvbjHiO4ejCXvvLJpOdoXEQTzP5hddIx7aK3R91w=,tag:mK/u/0GKgVhmNjHZBmHdUw==,type:str]",
"mailserver_opendkim_key": "ENC[AES256_GCM,data:umatDdvngS0YekR1o55btg2DcD1Bkpneru+xQnk7uxpK1BbKGLxt1V+vD8ejJ7nItaeizfBd/VMbBr/Y/ikMqWKt0v6tF8AovZMQzGcfIo8W2JIQB+DqO2yRZzBfkR2pT1dyfb/5R5hqogkL1ZNXIAoj/83xQwXor7hVzS9PBIYKZePHOvfKIhR5SFm5Co9vnT2hUQIR5NmynPucR/J3rqHkU6QWa9BtN/TGmkFcgRLBQatyEf5CEhkFA5kjTYC+NPeemzgfF9jwmIdwJwrrL11pAK1dTTYFWQ66cr6vSvWuMT8M7d5fmUGkpQsUovmfDBniYVMU2i1FZtVYEuWOmke543DtlBn9G1xAr8BYVLyCMyzEjmUwwhew/hvvTon+WyGsxpidUKJcvm/0ITn71uX0/HDKpC3o6gZdVwQhBn4KtSdTK48Nf/E7o1SpY2N9BNAUaJ5NcnCXHtL8YlCoMUm+EHmwx2lV39wNc/ba+YhHnP4VwGtpWsIIIioSYRYTK5yx3k3fyUC8l/Vy8dhjv3umjNGliphbdQXd/iEv/kG2LzBpaiVQSYphtDwxkRXmYj6LvNhtkq00XseFswEimczdL6OAd6cHCJvFyhp9ixSNtQQbo/Z3cJfenTQCDP0Udubg74ITlVFj+RwvQN6U3nemfQbwLdfEHLsXTiQBtZXyUXNLxlcAzPIGKfGetgps5Y0VX0zVI15OscqiBanPtCGo61wiTA4Yd39QYfeZJqKAwOGAerpKSZUoPGjM8E2IWgNpFUEGfrYJeIxZT8c3v7pyFl/tLnjzZHDDg3A+/G3EK8LdmwTyfIc75LIyEAchNMRCMAR4NI3693N3VmPhCFsmeKiE6IrPwXAVCh/uveS/A7vWHGf5wW6/FWCfv134Oc0KR2lIoiQASq5B7B6BOVLH+Mt6DoASvd5O+plLIB1P984Owz/u95YR1E5iWjXAFKPhOMmmBdxD3d/YEgbL2bKFCP+lCa5JMrdnDJT5+B5oxDneiFWRluLkAHPeH3rdb+XKwFdOymckIXweB/F7Q3NqwUrfdiazpHHxMjDjovjLA7qxZKIem8C5UceMJZgVQIjFP7ZciyCaWTHs/DnMwfVorX4q9pKdHiEA/8FIpKfPMeFKYAjEXELZytiUlKdyXD4teCD457QxsoBUF5JTEHAstv9s/LdyBDSk9KkStX3/p/eL20RHehe9f1G0y5fz/6UGttWQUmRR9ib9zVSm4cNaduZd+8IOoAwS21ct5UighfA6V0wMkRvkenuVCWJheoa1SngvCUOUxSDPLKQv6SjJq1JJVmKnK55cggbwgK7S7k6Xg7+Jkmp7M1HIT/5KezrPSq8jxjkQnZsN/96Sm+97wm79Go6DWdy0sdHkqEzPwji/Emx7aHe4Y3fbiALeS4aRE+RdiwhWouImPJLJYnCpT+tdILKTjROAfDuTIN8Zoyvz0at3NU0Sf+OP5B0NoPuxeb0K0u6NW0kUmzPQ0s4OFp1yDzD2uLd3kUuiWJnr6LpdBXg/YEELI7K3JAh0TMtb72gmjIWlp0HTM7rxmcKV+2vkL5upVpDQibz8AF5WexnpNvh+E/LoBEPCnYsov76YnAZX9jjvBpWpIta2nnDsLnhy8uoPD/EMsFpnIsYCQum9JWaOLcJt0SLdF3kzxqzQaU62dhRCqe7oS/m7cJw5YhdkmzzDJDp1O4JreT2p1yGWnrsLTHjW7zuyf3adxBy52RZgCuw1iW7/DNLJeP70g6sWEEF8WJ6fwPRayttiu5zm3HtsATOma7NekPlu2uNuw6D6YsrzWYXcYud1ymSD5NLsk7pIaBu02q0xp60E76u3yncMql95DAQlQPqNjJIOI0utX6Asndh4l6NFDqnjmKQ9GqGNq6PkE17vsw9fCiyxEiTmrPwdzg/GHu5DqXsPn/BKRXoVayMAOvgjfLSFo4Og+lZ2CoWDu8wDvtPdyYnnRu6gRas2C5M2QwnaF2y10Xan3ECAA7PnEOu5uBWGXlHauVknxROa8U77SMGNg7bzSw5Q3DNEM+hXeb5vCaIzvwZThWJW2wVgCE46bUEUfouHtxsKm4ZNKx8RQHYLWZEZdoEaKnrB1IpNOgLTf1olJxod82hzhxnfeMcVihxZFWkYH4dDrTZb3iD7JaPNoBSVg7fJEyPDU1LO4SXJPxzzKti9Zs+0q14crCyBKK6ACfTKmRRpKmyIOKCBQQWnnK6oGbDdt2o90PRlFIMPdXtwKxFdAP/oCrfSDwiI+Ylw+V4FOvbbisBRhQ==,iv:6tp5kuOS+n/N9/OqSH0jNsukmksYLdVO2P2eo6mqmkI=,tag:/MVUcbeP5jupA2KZ0Em1zw==,type:str]",
"mailserver_roundcubemail_db_password": "ENC[AES256_GCM,data:R7484B4Uak6Uuoz3O4I=,iv:MXPCSHh+AT2W7ra8sgM1LoSHGLF8UpucZirpdTxo2VI=,tag:BoSgHVUJX+PA4GLPQFxCeQ==,type:str]",
"mailserver_sasl_passwd": "ENC[AES256_GCM,data:AlWTEOBuMYTDONrK1X+3i11WQCDE5SFOlFTDPh097DO3AD09sJHRBZMbEKLpEf66fYRXOjV/gkV/LGOj44tQ865v6gorYtipfhiuHA4HWbm10e08GbTbeYmpTlQo/R9d+2BLpTdCdoKRdr7KeP2jh+nDaADMx0ZVHLkEAqHZa6WSzsZvTorVrc2xPhggVQv48ys=,iv:QWpOOR0SES1YnnZOOeHlqfempLtv3oRMzSYAL9/l+1w=,tag:Rmv64fEI2pvKPvUJSEbwpw==,type:str]",
"monitoring_idrac_password": "ENC[AES256_GCM,data:6CAfhtkU,iv:pUe0Y0EqOcMiL/qlhPaxzP3JIm/3RVd18ekkzULAf+4=,tag:MYPGY1tUTYmnmI/MaB58jg==,type:str]",
"pve_password": "ENC[AES256_GCM,data:nvhF4njEAy3kUQMfafxtCeFXTu0o1vBVylfysg==,iv:Lhm/e4SIZMUvMN/gUa5O0C18mo5pkSi8YnrEOfoA0fg=,tag:p6AsxDwTY/V2eAPczSRcxA==,type:str]",
"technitium_db_password": "ENC[AES256_GCM,data:7cjOxkreK6GcSDyKXVU=,iv:qCU31wYxx1deKduRDDx3KejKW6V1BhgHWJnhcfFpTH8=,tag:1riARTixnzY57UDHcegOkQ==,type:str]",
"technitium_password": "ENC[AES256_GCM,data:cwOnasHAD2eUo2SNwPCB+ODJbWbyyfU=,iv:7mDqWt6WxgpeJhPuzjAI9XcF5xcmab5ZwX5gQF7dwKM=,tag:qpOJUDr2YVHciuE5X5XxpQ==,type:str]",
"technitium_username": "ENC[AES256_GCM,data:vuvz32E=,iv:pPwrU7WuynUgIZ+85p2iK2GQOT2Az9N5mGIsWE8Tq54=,tag:jRLrk8afLzINSauOsBRuTQ==,type:str]",
"tiny_tuya_service_secret": "ENC[AES256_GCM,data:cYM3tE85S42JLj4C6Bt9sHQtMrqGjA==,iv:qUCN2lAJ/x3BexTw76Evu+nmEjbDbWDoPzUYl4t+buw=,tag:OnaVSUOKHBwthuwo0kGySQ==,type:str]",
"truenas_api_key": "ENC[AES256_GCM,data:FBsSG+2YR9c+6iZ7vilQffc6Epz6ZNMVttEfMhbJFrQy9GM5MRiWF0HXhIbNZqdeTBazsIndZtnwrxgp0ir+x7Hk,iv:8KkdOgSPfkecU2UGqB9XKNdghR4GULUdnj91KFV0VAs=,tag:9DQpjt0gwW2mQ3nN8Exngw==,type:str]",
"truenas_ssh_private_key": "ENC[AES256_GCM,data:cHfX0327Wo5rOBJlBD3v2V8gxCu9/BbkHIX4WTwg6Z/X9UKQw7MJpLEiV0zaH6tju7GciGrWNNiRzdABFxbbvILGbH9ORMM7y7MoaCBRcnMEVwf9MrdS9mSOnvGla6/S9fi2JDkxVDKRN9kjfNXUk3ussPyMMdSH//aEEdq8qwHH7R1tU54U6ZuCbER0HeLHlXobXs9uT4H6raZ8AjUIP4RQbgZcyX+7i3+n9eO1yDdNApYXcb3fWWkx8mxSaerd59SFwTAdICba1p34qh8BkEV3cFGqf91QxmVIgtxlsnHwIdkvuCTvflk8HHWf/FwWwVAKLzC1JP149Rdy1bHgalA5NoRAYzpfkhfvrKZTyhhPNOHetc7sUYLZAsUvsmHfeiWwMu2Qp5HWv2NR3QYwU1Ao3eGJNGsTrJMIfEDTZHuya5P0nIj69ap/KC8T1R3nE4qkga5bQ1sVepOzTu/UBD0I/hFiGIr9BjOgsM5xXUhpODA968yU0F63d5LA1SGC4kcuCxa+qWD8bhtu8g35XCyVd+6HaFGDHpV7,iv:9DaVAsS66zA3L7RfumL+GL0L5cD5icoift6i3ENphKM=,tag:ek0RNTFmMFEHNX+EBbGPCw==,type:str]",
"vaultwarden_smtp_password": "ENC[AES256_GCM,data:hSNUIaLJT0pQjuCWqEIjMhISDb0=,iv:S9yidfmB7sERJxHpu1AC+IHx166ppSjP4fVU7HVroGg=,tag:NJPZ35fwzpym1j3w7LvTOg==,type:str]",
"webhook_handler_git_token": "ENC[AES256_GCM,data:xn6QaSbsQx/NMEZKxt9Cv/ukzzk5QcOz/NG8rIX9iElpPw8SmVTLvA==,iv:A3k/WxJ43DaGc/iiHgI0lUQnWSsM8aRtTq9QJIcaD50=,tag:6oxqbCcbNBWYGmrLaortQQ==,type:str]",
"webhook_handler_git_user": "ENC[AES256_GCM,data:VX8DA33CUuK3/ddU,iv:I+Z1ZgFHaCHHpH/BFe6oT4LlhCFXU8rSiP1JsEKJgyA=,tag:GVDVqXQsjyiPthY492EHAg==,type:str]",
"wireguard_firewall_sh": "ENC[AES256_GCM,data:aqrhnkQYmhJ1Uyd3QyzMTFx9joEcGEk2Fm5A9cXG3Hppoqd+Myu/IsdFRbHx8VNvVjM5vv9rB3wvSA+PNvzEr0kJ1VTGvhPl0ygvqolXrbi1GdspaI05lymq83wROFsZsuBBCpRkog/CrVtjLgzpI/yUnTUbcFo4ppXvD95z++wylCSjHdIdxvA4/L4vliwryDPV4/dNWNDBaNjnPLS6J5faYs+CDTWFtTI3UgNBnKKqpArgZq2SmUYR09KlwV9Xd5IchZtA9hqlHIDCqS6HWxrKHVt3V/PbiUdnAisp1BhxfoSOFRGBL3zvx0gGOQ+0yKneA/8fi05QO6fnICmNAzJ9c37FMoCV6sd5CFMXM3Ia2bre4ShT0W1QRB9Li7Bl8XX0xKVLLjUsP1AajbeL5SCNGKrYzh9yBVMlmI1R7JPVyfUdzr7q+0VyXlLAOiGWfub7EewVL6Qb6o6E0Pc6lpPI5i5wcujo7MnQIloL/rOt3IffUfrhkGOP6dezWHteCb5QN0mGRMBgOwAsCMGpsApwftuu5ivD33DA/A==,iv:FWsixBQHFbAnzTan40M0v9a5Hg9Y+qzkQLsRb/VAiZM=,tag:OmLi1rgSDI5lu8fsEUvXtA==,type:str]",
"wireguard_wg_0_conf": "ENC[AES256_GCM,data:8uS3ZrYZTQP6bgDCym8kgoxXgRshunL2ZQ8OQaBkksmxceH5JGVzzZiTppssrcrcTo4sNKozRwFfAZ3hIHEtKT2hsZSFwN812FujsNop7w02JgfcWTERYCb5J7JfPN3OIRfU4TTe35b/V0V0BZTUcx51mKLjxyAMRy9kM6sYaCnNAznzHp52/rFCtCGKAEaytNvd0aXhJ0EwN71ASeGm9Ba3CH/M0+doFyLSFddsTfwx+/426SIWva0KDQHZTm5x9LWOv/5e7sn6ctS9k2sJNONQ337tGJAXoVshhb28wAabOx3J0/G1FXmubll1XBN1C4UpMX/dJ9q3UzIY+iE1p3IlHMlI9SIWvUPrsSxJtjPvNcortyPm7A9bcdMNj2srh1xzOaG8kwWD0buNx+Yg5bSAmUWMpH+iXgsciuF4Xbzl/a+VLa2zWcn2p/IZaPERcCCjjWdGlzzDNg1qwl3mOjscxywgTgYSw4PVIQukm7ySx95fBKh839UIfe6i5kcVRWt1WZvpSgHbbrSETuK9j7vUN0mYKYOzWoTaN9CuLshQGr1HUbdeTYmkfT5lcI0lp4OZLKQwjh6PlqX2P+VHddIY88WrW9WALC4lOzutEf3X2WJO6IeKVgGI1oi1ZV+TulvU/s8vbjqbSo4HuSEOe7nhlsCjMFd0K91GSvfY3m/+CU1bKvGXCGXRW1JzpPf3aXTBqw4IYFFdKR6qEy5aaUGx9kFWAtEVvZFuTvq8IbeNTmAgrVK6zu8iNmLZrhRR19WU0FAs7Ejfy1+2CWuZ3gWOW2MEtSRhsth4oEAwaQOlGS6A2CKcU62fIiZw0r2hiPXR9qP3rjvbRodGX/JqcoSeRlho54n+STB3+aFYXHA51c4dla95+xSQkuRvapuP858fFDmmW0nCDJP1AFcpDPjezx85G3poAp/4bNHy9FGqTVdQJ6TPT/gQwQfBCZxZv3KL/9bCmQVOhUV0/q+s1xcyM4tSN+CLY0gT6SRF7qZfBlZVicFVGyroplh+hY+J0KisfOsk/NhTuXY1ARCxsxx9BYcpnML1zONlxDRm5xx1Nsd8Hv7Q7N4R1YFELwWN7DE6W9JQvlUCj7U74sFzWWAM1Ub1QlyASvcOXYjC4ltIGjUvaNHnirVThhtGrGQeZJ8ibDXFtVw9N6AKvqZYit8ppIuA1PWTTZtLWNVGT+URUyz6k1+K5cLwrMMc4laihW2rdQ92ZuEKsKkflAPkFnH9gXh2iff6rlP3yuxtZDcjJa0Akw4sWbzvcRs9I49T/qTuK2pMMR0B1q2zLbGFkx2YUMZzu96RF+ECx8+Ann93AhHjiwVJmeoGFICSH3UsM1RrCDzEE6ikkA3fbdK36OAmRLgTnY2VUeBpzQIBVilVLi+TDSIfihVZBbxhIXOXdWjkcIGPIZ1Cw00x4PvmFkplNYm45gFFVZvYESYLir4Nu/6tkzoepM/lu4Dvy7Mi6wOGRLFO1TqZ14asu12YVfD7XCcdxh67wyaGOTIsw/UYXQY8s0E6+5mpUi9NvfZRoFZ+Hrw5Admfmf5j+KSVG6nQpjiEC4j7ULI7RvmaJ73ttAXuc136PLAKi/STbQRXd0YeGRmcwYaKU17+66TowePn9bEvsY/RGWQhGJlHeTThu9Rlw3eMZtOQiKIbE4B9917SugNfHpxQ8l4XVLsEGWlwzyl3HIkP5Brg6cvyqWtVlYbAAjqsZi+ZisCuxhwBK1SoRd2gyXB1fJ7TOGEBNewLe6Glc9m3+PQgEScROej6UzVH1SAugrQK3ZRHTt5zeoZMf7ohOh9Nqv0i4nsX+F2V0ow707XqppWhRd+agZhexTgfIIKjtAJkB+/OSXEKQIKVnxyFLMNjy0boKwIKz+nJY+RhilHA0536HhCGAh7L/S94t3n+jv8QwdtIA6COPvqL3Cwi5pIvUGAGX+uMBSzr+cbpWtAWXtaRQXqIyG7U4stuZ36ky86arKXnTkYWxRRlUAK+C0nUhJJ0DJSeeJ5n1o/LGzIngU6Kso9sYDeHNbTLJV8ckCtiLLrwMyELeFuXbldSvKc3fCsNIO6o8JkvFgzz2+G+Na8Gms1Qjzq5fTidRw1HVE8fRPcs3CU1wxCUbg+MuErg9jXMZvH2GWVg0AfXqGt3TCJkYvWCDaEbURm7ZfuRFyCxkZ0fTOtzGVXhMdWt7PMZ1abg00yV8ReA4TR9k1dufa3LHBEfYh7Q8vZB11lq1mcwflDowCzlFdeycaTUZswigEq95dnNb+ZPv1MZcVotWsO/sdHzmlaBDu+NN6Q0ggmUc87qypQe87Dp4B+l4jaOIK1H/KxT7zu5IaqfJRl/weF7yAggX+GY8JEY5a5ZImNsPBFWZSgmaAjctq119RLpoLCJRiNqNG0KhYlWTuPu/j0IrrlkvjPM8OVpqZgG2H9wOrDPSr+s7U9J0400PMd+bn/vaFmFQ3Sihlu+N94lbfRWWUmskpPpgE3Slu8z48g0klkFfBpcHLlZUcbXkkYNEAS4SRu3DbJHOiyi6o4RS2O1sS9SFjfGeoLuZlsOF8O93zHuslK0lPp+0+riQia3vyrKw0E1r9AEDT2p3h3tX/imaJpBdpI45gvbiOndNIizyN4kZyC0YMRALMo4EvnA7yRBgOPpddZfDjkNc2+GS89tMlGBQH/9r56gPth7xir4a1qPx+J3q8z/FBMz0+nYxE+xDYQZY4cbOsKVdeptqZqbmE8LIMZhDyH47JIJJL1+ssYA0HPn57wYjhhj82AhwevBGECs9GrKzUosIQA2vsG56hkFwtLj7hLNj/HuzsOKSCQjx92eyforTWH5erMZVzBN82q5KxpJWMR4dgR8OVcR3M6JndOrybvH5oGX7U7cpUVw3Zb652HVPYAbFhi7jwtAJIjrZARtxDiBZVYzkYkWMFvC4EivaLdr/f+3P9YWbcyq4I01sWG5/RbHR/zp9le5Pn/YHCA1FhQW1mrH1LrFVgUlBxcu4xFTvWN9AKprwr+UJ6RdDOuO3kG/WHUVQhpDSsFi8OTpB7gJ7O7fNpiz8VgaUBvNODewIKGypjViPCqu4O/RSKi++mKt0AvgQBa6yWJQtDvYrQJMcZ9JfWnky/yKz1YMYvJRzd3Xdlb9yEqoI3976yns7182ESk7WXCQvyGWQk6bi+n3tCjGzVM+fg1wqoOxi26Rzlam4EONMknaP/YE9gi+vnVPOrdH+BnTJeAwArbvEXDk7FnlinwUAP63cgOjuDxZN31zLmbYl7UkdLBLveuhpRncAB5U9uA7caHzHhDqkbrYdhxglC2A4SVLewbOXvUq+u+C3WCpI6RpteepZpJu3c68WQQFWEm/1UZIYncazIcdYZAtzeRmSCA4LM8ufoAT2YJMKzjri/93jjar2bqceTmvG5/MwFYCxgN54imDgDXKpiAjhFEghO3rBGQya0HmNErjGOIl1AdQz69oO3qMXRw6eE9kJg==,iv:UPYM1OYcPO51wWxTW24dKlPBmL2SZwlGL8rNyWVd5k0=,tag:Ca9msJvmw+HX3ZJ+wfvaww==,type:str]",
"wireguard_wg_0_key": "ENC[AES256_GCM,data:e1ZuZAqdrG8SFwhOffjRNarprAnxiYoEf1795NhjC5fqwtK/fzSGf+tQkhg=,iv:HF+WnncEjEyNEuuwqycK0PoDRkFAX8N0m6J7yE/fNiI=,tag:hgvP+1QZ+qMGJJEFopeHQQ==,type:str]",
"xray_reality_clients": "ENC[AES256_GCM,data:xepCMOsQZcdf4jOtyV3K+PpvrzgIqrRx5b/d0LWZ2tltlSMXuBXESMthP6/J/0M=,iv:qdY2bH/LksA65FrQE9x9Iz17nuOlb8QjxBYgoRr9sQw=,tag:lh3RZtNZqNrK7KBkUMHQNA==,type:str]",
"xray_reality_private_key": "ENC[AES256_GCM,data:F76fPpZ4Bc2qp+DvbRsbmKnQvxdjUHuRx2uTmMb1bj9LQGcrG9Rgi4NV8w==,iv:Du6msKUfmyXZTyjFSGvjcItspw8tnhLHIyMHCg2AFJo=,tag:U68BVACE9K0l9y8P0pHAzw==,type:str]",
"xray_reality_short_ids": "ENC[AES256_GCM,data:v8dnGWYwvsP1IhjSlry4S0OrwrflUIRloZFinybCep2YlhZmhtiZAQNRTYEmA6YEdSnEIdHEy/qlLk9XI71eUL8=,iv:ZCWensNILHLnGFaJyObEVF3MEK+CzdL6/ACF5mUs92w=,tag:/KHHueiOYvOIrYz4OQ4+kg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"data_json": "ENC[AES256_GCM,data:pMUr5bQlWaUw0AvS+YpfgySk2+AjG0zHz395s2PhAr7Rh4JMIaSKKKJ5h0rBElbRTQDJJxNQujRTbF9J2UP0y+Z0ZtVHQKGB5RJHpQztvC1pmuzE96cX3ygFIq27Md25axEHEcHNub4RXqRDB3NS1Eq+ZZxb/nBkxJOzhLmmA7aNxPwrT3DoOLMNodZHvH9u0P/IMJua0ZmJm8zalSOFQtQsMrVQPOahRkjkDIXpEI+MkLp24qgCFSdwXbxUct5mchEeyZPulwhGg8fQh4s7gNox5q1LDOUnN/36xQFgfQ4gr6hZMbrfbDing9PomibMG7vJt+ye4J+qcKnK4XdOXq/Hep/dIAep7QKsgIJr2DOgeEwAi9szj16OZDZ1x3T+GgyiPjLi/6VnPIzp4/7iqn628wOONTU5iBQ8fMHh752JPcgCdxceM43XRs3z8jix7VvXRSCxT9Ml8amoy9WpE7hIE6/heCyMIEo8nvToRmss4aUbPkdpavi1vIMZnUKq40f9SxZYWl2p821v70ueoqWU5VYPZBfWPCzcfm09mawGxvtC5MHi0Zumcrb47D3W4ChasNAeVOT8LmIefz27B0QstKuX6si3yT25uZvDa9bRrpDL8Gweoq4xQv+srUY1UwZWlXpA2QDVvC8beESJgD6jeSYC+QmWnQHoBkQCVqarXfQDq+ZHOiDPsaghsdOTckzSKRGPPl89ZSs/9Pf0G0tG+kLIpWvRB34cjypf8h3VATTOQxfuznrrJOcGIwV87RFiluGO1aNbJGilKAGfa2inseHs7EFWWXDM4d0OfKJkn8UQi9HFUq/uPOG+rQ/yyh4TNqQmjAfMFvpSXeFcsWFWN9hyaiG4Wda7O8iPBzHyKlSYotTBUgxNvZ1GHt3u+gUQTy+EDlmqpRdowQhzRPAhxPH5ITbz5ciYKhEAykERt5ae/20c4p237PKAGfIFsq2M/OrdWsIR6Hm79HcQwSr0KIBxIsIt/K3XWUDw3PMYxLWJO1ZFvX6p65u/12/gVYY4BHpr97k15Rfc4hqIAMIqj/IORFnaFWs0ZTH291hBD7IM/Cq3ua9+RwTWrsZJvqs0O4gy6NlIyaVwebgLK5vDa6jdhGP2w9Rcb5AmxJueRq33kSXleWblGjXeUbGHwKl3m53GzaiB2rFGmaIlFkUq9rfeqnHlgg+DcTVjQ72AClPyTma4lPFjIjPZALj9qW4AoinK4nbiGNWNKv3UTO4TRzCzKE6L/rgd+SuQ2GFpnvYRJz9jDl4HNo1vKT/+ws5DK76jL1LDL41OLei5VkDgrwKF1pmEF1mIpAlol8ZVrO9CiaeBMCGOG7E6lPWARgn9J0C7bKiNhq98A+uLdVzfu+hN2sdZzRAdrN5kbhzAlaQZnp6XX3J599SoEA8TPEDvBafi7dJroU8nmj5MdvtkfVj7qikFDC2MWb2lqUGNFA67WxxHzDW8SLMDYmEBpAhpRYamrqK5kuUczLf4J2z/23hx1yC/cJwFA4KSKmMIXNsGnXEkWYBmAoVHqTwg/kmx0YQDY6Cx0DZ0CFgInOAD0/Mz8C9039wjCVfybJmpzlU3QVhMYDilNlMfxLJTj3HSAP1Sn2nT+NzI7l+8hgGwCg3FdMzV0b5atNfNA9fonboL8NJPdg1piW3QIs8k9jx0no+8ww6SLq1LecgncL4q/7EBMI8/dpPSs48goQr5uZUrpmZxtCLAeD2kOI4+fVGbbw8IVLX3V4ZZPfLsBkzcQBLge98U36BUhr21HD4NcZH3pN/L5wVuXpsAISqGUXOOCv42BICDq8tlIp6QdNqfI+qsi06MODv9YDi1FNJv2Eb+y3TVIv9j1UrA4h5khaBvSaBuz+or5FXyTFxSyrDZjwF01k092gOlnNpXyFpN7EeJ/8WzFPxd6T7Q/idJyNVKI4javiidUVY42E9upVhMEtSqTcPM/D+cIyGbaWnlglUa6p63KV1qiv5AcDS94temMD1K2vzenqmeVwFU4x8hXl1q+N7wLWdXoWadF7JFtVIRECuJq6K5i3DykBxdc5GaC+6fWOb3ANBWcG4xZNLTI19jFCQVRpI4UIMbEge1oahhztuGa6KYEABt6xGFSgiH0mUzLLuOTegbDGWjy1X6zIGD8dzaAUgAY2eXD0mtQ445MHIEll80aEbJYP40eurzJGQAcrWKBBy7XFN9blb8E/LIPQbvodQt+b055N6X/yBHJsRNGWxpL0iT4zfkCUay7V1pxYDeCSXigRS/MdWU4jkwsCQ2An128nioGwjkakdOFSeFw6NPkZ3FyvFXRbyutC7NXyDyL3baA9QLNcNqRMBXcDRWFTN3tBqdVmA5hTlMq/NPWcttMLnRR71tgpLr0SEzTzBbF+f22qtJgt9ovhmFruNge+fT2uHO4TF+JDft+FQjqaXwz6D70D47OpxTrOjgFZDCLRM8PBEX5mVIFTTdq6aaxxPaNvPoeEraBb8yJ4K5Z6WqLeHiiHpKbVMR3lweUoJlLd7RXWDLrOs/LL5uGrJGQCxSeyfSVlDFvy0PrvGqV2yEZCBAghgoW5pfvnmimG4l59YHmyIEjuIMUhPTOgneJifBKoFX8r/uPOKpOuSQHJ/ZFPeROrRUUi/GKyBQvkoHIfNSE65+PKxZm4ESSwTT+Ukp0mlVBJcqEnoLxM+YFbjrRgJfteL4reWNPA1MDhjrpxU3m4z2vxbLFY6p05ngUWEBTKMbUh6snuKKYaAfUIrkRqXbuKtpZZky9QmOhXRBfpjpyVIER1AajtcpLSxObg6mvuL7i5Iyq4yYSPAy7g+y3braSYfZTnwdkPxk/vS0lFXfuT31CtWa+pnRXpzUNfnibzYMG18iDSzmQy1+AMwprGpIp9PkYcUJJ4QaocOKuUmLFsUArnsP9Nyyu7dyPumpHal5HZd8Z9UuMS/84Pp9p00lNeAc6amv4g6QlbdDchAzXysiAP0juz7X8DX8XNr4OwkyUpAnwjonn390wArgOU11a9WUJs8SgF6+MQym425oI1Wn/gPShWOxb0GUu7dyIQ6MwfIie+9ALBtjkApTSmpExyEBhxGx4pj6B/t4Er5f+vbjDtxnrMhs9rwVBXJFZInuKy0bvciQ2t1Q1SwC3WJ5j8+P8LyEFU5BzDRnsNUrmjxdYDlOaFQRuWwnxhMs5LnupiJ5MRYiER1rEE6fV26EOdKadUs+qRMo7gcKsIjVHnpeyp6e56p09+WrPGpNQJGj5ksbf/mCjOa7B9Zt4ES+wZnxst5P3oXw3mIbXxMIcH/pnjhxY7PPmVadyJvESv//1t9Zpx9Pk70uBP5cPfiioAIi3uDo46l9Ex1paQwJNTb//fO8K5CqQUDTVe0aYSRV+S8zWLHFXZI1Wbn/eA/aISc8HCDLksQFu0CMFvY6LEG0wjLVioQ2kSlCYM+NIDgc8bgFUFuDFJSTatkBEaVYqsgGw/XlmSOPlE2tKvJGf2yaUYr7hVdp4E7Ttiw02+//vCPN2p+O/mDsbayZ7+pPg3M3UAaRXNL5LPx+X8rcjbvL3uNudGhsjF/YibmJXkn2adOnSutJUANv2PiVFcbeSW0BIuhgO4EiC/aIZFMITPqbJfFQZ4+2fq+PrfDybM91zN5l2slRcUQGHi9ahqOHHCccc+5vSf1QIY+n3qLC1j2+uTEXX+zACvtXWBG2JUSoLGGY+DIvrBgAyP4WSZTRKnoVumJuSDpDTyaW0ZSCkAd770ZzjUPC7UB3GgbGRSVM5UuAUlfW0JHQnM/NGxbSMfFfhuDfBGFGjC2ihBJtWFMS08fJts2y2kfhqiiT0Jrbx7HttoX+nVVudZTuYpRuCfdO1rc/QxGSu+xpO07ZYAjdmkiqTQTMDgGeYEu/zradO3Y1Gb0vjo/g9sao9HZINTqMUJIK0HLrVJIoYFhgSC5HkhTrrEgPWDP2VOXARKFPXm//CYiBskG0mgcMLHlEOSct1HuhFH2GpfdTuFM0XzF6cMUWw2ruenhdufhfGYFIUF54sm5MSSi1sDG1dGETPL4Vdj0RTniQjiipyypDeoNb8lt
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"deletion_time": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"destroyed": "ENC[AES256_GCM,data:EUgZcn0=,iv:51cyxDLG+PtE9aqv+CG0gMuwi9cngH4drTILqjsIDhU=,tag:WASDIYGP3hsGyVFajYaMbQ==,type:bool]",
"id": "ENC[AES256_GCM,data:AvaZmyu1suGyMSgctLYEAnJIHhs=,iv:2Ne0RHjlF9aY4MfwRIp8TkYIwQvgxrJGgGceXZ//00A=,tag:EtCUfyKfrLTGp/KNqJcXtw==,type:str]",
"mount": "ENC[AES256_GCM,data:PJQDcwFX,iv:TW2ySK1l2fqM2UHPCcMpMXP2TgH91T98cSmkHs8jPYU=,tag:voLtOFlplJkPXLFR2l41fw==,type:str]",
"name": "ENC[AES256_GCM,data:WJxXpoQX8es=,iv:zHd3Cd6iUgaRvTzNWHZD9H1lQ3mo/mWWks/IQmU7big=,tag:TfCIs6UpA9pEMeHDTHwEJQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:5ofxsVilb2ozKRT7RnBSTmlrCK4=,iv:csIoVXmp1qVr2Siz5WCcUjKmbCgyo8PYSXsnJrUpQ/c=,tag:/0xr6MIY9XkGlonYsnoftA==,type:str]",
"version": "ENC[AES256_GCM,data:K10=,iv:Nf7e9Atg3VcKUbAsn/HajbA+00yljzPxmSQPGzMGiWw=,tag:0MOtnnkVURM8V1RVjTxVpQ==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:T9Im3JzjHgE=,iv:1erS8O3MPtX++/0tvPypqezSqxJCBgKqWN1MPK/aKU0=,tag:g9bzX2JpMgp0pmGFmHRiHw==,type:str]",
"value": "ENC[AES256_GCM,data:XUD+fA==,iv:kb7thbtulkHrCr8TRzWr48rfcVRZ4JVObjG1hCB45kE=,tag:U8ZfCazjXUbe7uHZbALyiQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:Aut8NvvrQ/s=,iv:0Fo/N0vPVdxDoK9n01QWneZs4rNdgCSRnOgF1mu3kVQ=,tag:G9mmCzHT/wy2F32NhpIxtw==,type:str]",
"value": "ENC[AES256_GCM,data:He/YulH1+4f6,iv:+adbCFX7U7xWr0kqYZOu/wfOlxhpJBc98dXIAZtciZ8=,tag:0E1Uf6x2ruB/0RRfJKmh0g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Bg==,iv:fXIAR4tXkF/CSkwySMW2iX9A2ohmEEdpt2YRj59Yx8U=,tag:FUGdDoBjv1YupPrAtfUVSw==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:5TBMuw==,iv:DWIVulvIOXBlXFHacJIewh3PGjLhLp0c5bZCI+AiP+Q=,tag:Q/b+LELnD7WOU17pXA4AfA==,type:str]",
"type": "ENC[AES256_GCM,data:9113AHylgJYYzleOhofXWW7k,iv:1ylixUdoItLCv8M+TgxSHmiVreYVemEwIre9zGrC+Hs=,tag:Zlx24ByZKDQxFC7kpgSHLg==,type:str]",
"name": "ENC[AES256_GCM,data:XF+bE9o=,iv:mgoLDJ2On7pQyQsKCBgZa8tFMRzVKVRmjJF91s9HDeA=,tag:GY6hoMstCG0xrS0umBLEnA==,type:str]",
"provider": "ENC[AES256_GCM,data:g6ozG5vOGYtJ/D70fTPCXbkvLb0AuVMmaL2SgKxOkQYAJgzz+H4pijDUozYTOJxlNQ==,iv:h/0cNPLfRAiZOyVeCC0Vet9UixM17k8o09+ffPVO+pM=,tag:a5+JWSgxqiNsKcODvh4atA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:0w==,iv:1KcCaiwg+GhSgNKTOP7dTVhA3XjGNi6J2jL7ajNzFLA=,tag:2M8FHZt3UQXrkfFMmMwRTA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"created_time": "ENC[AES256_GCM,data:zwAi5r6GqJlYZhafLF+VlWl2M35tO6yLhm3ypxHA,iv:OLNcttSpjyqzMxmLuek0VLYy0G3S2S5TyrC4auks7AQ=,tag:vffMLLRWecXZXwS1cJVxzA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"custom_metadata": null,
"data": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"authentik_client_id": "ENC[AES256_GCM,data:cKNmaMifPapZgN/K5ZsX25RK6yWU7BHtDP3bLjYHDv9QaW4BGUtz2A==,iv:X4K/jQiRcfjD1N9tICaxJJhXP9jkZKJOxobzzDDeXV4=,tag:2NNvbdd+j8LsjZAblByK3w==,type:str]",
"authentik_client_secret": "ENC[AES256_GCM,data:sA4Ahj2qI7k42usRjb+045ZxPB9FtNo/DZKcuWTW16mn0Kq6ETf0RbYXE5ZRkmZ8uDvD0hznnGg1jKCU6d5ksmEpGc/w8F8sxoOZWYUUCpWpP7wr+eNeynm9JuiKoMP5/RCA83fKgPqXj8NI+eL1VQQ8puFB2ayZDo8lYEcBBYc=,iv:OCVJljPLh8Poa5NzMOLOTXZMArlYwQxAkCGuXyXpc/Q=,tag:I4B7rU83XeLuvCZRGB8AcQ==,type:str]",
"dbaas_postgresql_root_password": "ENC[AES256_GCM,data:eMfJkhoG0fknFXTWOwbZRGKV0c0ZamFNFUhtO/hyjqaFGWeHJ5PQVJRGYfnty667DYBySBuSQIa0yoJW0mzrpQ==,iv:2EdhfmqxNaUYc6GZG8is/TUhVELqOgA2sRf84/BlQmU=,tag:FW8MAGlo+TT5GKnVjGzVGQ==,type:str]",
"dbaas_root_password": "ENC[AES256_GCM,data:Cj7URwt9la6KK3n9r9+AftjbZM+kh6lRwcKiMg==,iv:tavzjHfNslrexRlskSthtP8/LbpcHvYA4ZHww45riuk=,tag:BCfHBdCj8yw3wv+zq9z/tg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"data_json": "ENC[AES256_GCM,data:8hXHDPn05sp539lz/mf7kkMhGxfJWDZt1FsIFyTQ54Husd97f5LnWYy7TaWRGqqtUiE69pSxwoJSpwiukDYvOhsps5hiRVqo/j5jLizisGhWqG0AyEWN67coCWMe2nl/cdYwdOgHdsiVDhARdZ59K+lo/xACcFSAn2ZNXhBbAnZv4mXh9LFbfS68T7cVm8/0bh1LGK65htbcjHCwoePJhkFIDZzaJgpRAhBpqVhfXDAdcIzaHHJF7Mac/iGaHFpyuGHqU6F3QbDyZUOhVPDCFPSX+J8nUUTiQ3qZ1N/TnJEG6nYCXkpKZ8g7s/a/e6cHjMAqnjpI3/eLYW6Co5snhAc08SrkOEShZdmbJgo48Bo6Pp5Y91fOokXIl7Kdh5DyAwGB62FIooIQEWaeB97ovi7Hy3ca0wzZogV8na9z0yHAqUiM/kQ3KczStuta3wbzSTJgVwrU6RhvxJQwV/ADMnGgRS5T9zYb91GYiGWsRt0gtliw5bFVJw==,iv:HSbniJKfnGbi8TV66r1Ya4oFRgqpQhCga7USr5c6FrQ=,tag:MAHv5MFudq3MdgSVHpLXEQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"deletion_time": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"destroyed": "ENC[AES256_GCM,data:7YqWwz8=,iv:3JnF0xezgILHzsVob3N81yenO8fqNrhVwxpxtbzUGAA=,tag:hIMyVl20s8/oE87Nh2yhIA==,type:bool]",
"id": "ENC[AES256_GCM,data:q0v+w3v8dEb8OwBulbNDp9Q=,iv:9eyxoe0FEebrPbRMXTifUUnVId9nHl25/jbMWkdZ+gc=,tag:SjmfuLW+jcL9durLdKAPSA==,type:str]",
"mount": "ENC[AES256_GCM,data:5VJNE9IA,iv:bWd/k7kd7RsiixbgzY690Ihgk9XsB8+AV12RNDIhSJg=,tag:s05vZ5U60E6T37wdhYy0ug==,type:str]",
"name": "ENC[AES256_GCM,data:0OVsJHE=,iv:qEmV4qF+sHkq3bjh2w2g6+b2betXqPPGnNSkmtg4LCU=,tag:ovOrYPuqz8JE8wKEduTq7w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:owjg/sk1gOgrPC7iziVih/w=,iv:20TyidG1UvpJTkgXU4BFkyrbotCXQQ5yPsNJd2oG5Qo=,tag:ZCGh/ddtCId/L/3p0PvJQA==,type:str]",
"version": "ENC[AES256_GCM,data:xw==,iv:g+NM0Md8GJ1ztvIEOUWNPr56y7z8C58RGsW8z2p8SvM=,tag:mmyn1h350IyKmyEIPp6VvQ==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:uZ5cDrGqZQg=,iv:bJ1zjnlbYdfWdwDuYuOA6iaqLwiDxq7dU7ZVRH08Xe4=,tag:Kbqw9NMydVm7he/9WSLtOg==,type:str]",
"value": "ENC[AES256_GCM,data:A18VRg==,iv:gQi08CnYanuqhL8JWx9OpfjRwa+CsC/SeNsOQHJkgTM=,tag:LYsDxHBB1NmZa+/eGxgLhg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:ZitEU9RNIwU=,iv:Uu/HR08JT/mn5T0SLyFojDQ9DW/j+b3Lg+VXhyfUxYA=,tag:Kbfl8qIXzD7zaaThtPnIdg==,type:str]",
"value": "ENC[AES256_GCM,data:yTE/RVAuTRgo,iv:bX3NibZZjKSXQtrOML2hIXFSV0qquIkmCPC5inWc7W0=,tag:xcHAUNOE2/g/yHwrg84TfA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:8w==,iv:nLwAoS1CpvRG0zC1Otak3kLoEEFg+YyBzB/aRzqb7CE=,tag:7yx9IQcuXbGylKIBm9lV8g==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:YSoFtYrR1w==,iv:Nv8YYd1wl8ndS/79izRkRhGmx/HAOrvLXtkZpEN9sjQ=,tag:5WVXsZ1aiJk1zWu6jIwZgg==,type:str]",
"type": "ENC[AES256_GCM,data:aCIoO/3mxiWJsjyp,iv:2U+ld2yDX2VLbPGPfgO1Q3RyT4XcecDXaIfwLh7UDNg=,tag:ALKjVOSPnA6eOxguBL9ZSg==,type:str]",
"name": "ENC[AES256_GCM,data:mSM/90s=,iv:xCCG4IRTfyow4vFvH0dUr6SnRjjs87dPT8CeWZnWzRs=,tag:yGKeFsk4bagqiUq7KCqGZA==,type:str]",
"provider": "ENC[AES256_GCM,data:d2XYvzAYDz8ibAkaM0Irh2OOaWAu2USogNem8mC1fNgKDL/xF90pwDjTpIFWrmsw,iv:XmLfXTy9MD6kxdVK6lJcWAM82aiz8Mevr+Bz7sJzVmA=,tag:rOxudgHO6hDfpcKJSobhsA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:zg==,iv:PGfkowF6K5bNvNwC/kaGSQrKSZ4cFLlDb0V8hjVS3Ks=,tag:sbjKHgt7jEU6zsY2umxfbQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"atomic": "ENC[AES256_GCM,data:bemO3fc=,iv:8YNRvG4qyARPz7ow0lbvjD0eiX0ztOMtS+NUlCU3DzU=,tag:8OODwYNDcFJsxVICea6tUA==,type:bool]",
"chart": "ENC[AES256_GCM,data:hG2d+zI=,iv:J4KbNfBBpHpYHfkjUXxEjcsqd1VbuYZVxGh7/9hIeSs=,tag:+eGxrEzOLv8Gnff3x7QsEA==,type:str]",
"cleanup_on_fail": "ENC[AES256_GCM,data:cGJ0eq4=,iv:jdu6FDMHsJ4PycAtghB6AtrEOgu7M3twqEuiKrlIsLc=,tag:J2ZT2oFw4aKrTn2dxod5DQ==,type:bool]",
"create_namespace": "ENC[AES256_GCM,data:7Yq/6E0=,iv:HU8xLDbWkbdsU+5UTYIxZs7QJ6rDeVoGN2sXg4Tz4vY=,tag:98AUA1ZLK8XYAnVwNXQQ2Q==,type:bool]",
"dependency_update": "ENC[AES256_GCM,data:d1bv1XY=,iv:E+GXrFYBhLUm6d9Fy958VOs3NH4FKCDtQJuauVVIA7k=,tag:aiPcLsJXasuPQm+eYtw17A==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"description": null,
"devel": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disable_crd_hooks": "ENC[AES256_GCM,data:2QcUOMY=,iv:7PcfWU4P0384kLQvDHyFUYNZqwwyavhPhGwn/DiYRps=,tag:q3UmZAzMTmELkyOcWj/xGw==,type:bool]",
"disable_openapi_validation": "ENC[AES256_GCM,data:5yfhW4A=,iv:+OqEdHhrtHTFtVTUuGm0c/cb2RlmM1CAutCUlw4lA1A=,tag:3zpzGF7UgMktsZko5Jw5jA==,type:bool]",
"disable_webhooks": "ENC[AES256_GCM,data:mi4lPdY=,iv:JtJiUpiqYSsc+xWElPtSUsExX8bpUbFarAHJu+Z8zjs=,tag:fNfKvCvJZ5TJgwBOqv8zNw==,type:bool]",
"force_update": "ENC[AES256_GCM,data:YqWFKLo=,iv:BJn8/G2BxJKh5GEK/46qaXfMnFMc8J92P62o94BN1Gg=,tag:cB9sUH3W3we2d1MsdMnsKQ==,type:bool]",
"id": "ENC[AES256_GCM,data:H77iLMY=,iv:IEWVfd+dMPFjaAsVxXWwKWOvOtOPakZbM2GFWH0fOlY=,tag:48Znc2JWmCgQh3oIyGvkzw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"keyring": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"lint": "ENC[AES256_GCM,data:hTTCHSw=,iv:56Q1Ya0B1mXwKiiac8EIH4ocYWs4DBNQ0gCyA1p3WTU=,tag:n620dyF5UvrQS0d3ClFB0g==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"manifest": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"max_history": "ENC[AES256_GCM,data:JQ==,iv:a99AuplfAnyvCaVM1+vp/otFnUAIsKdg8LS6xLQm8Pw=,tag:ajuICZiZq4nDZNY/Aqcrwg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"app_version": "ENC[AES256_GCM,data:1TU+Tlnr,iv:gUpRuOTrwdxMqX2jfFj62RZikhFSxsVUKNK3fW9sxec=,tag:cCpWngo93YSUMSzxq8vqMw==,type:str]",
"chart": "ENC[AES256_GCM,data:1fdPd6M=,iv:1N9dDc9HPE3U0nXuGzPrzCv00lpfzeOCgTU58+G/XF4=,tag:yk2LeOWixo3IPncMtKQtyw==,type:str]",
"first_deployed": "ENC[AES256_GCM,data:SMtdwhr5HRR0iA==,iv:pda36Hp8WBNtCKpnk/XNqrtfeQte1d2Jckihy2A4yVU=,tag:Y++0qUZqdjrSP4JGyF7+rQ==,type:float]",
"last_deployed": "ENC[AES256_GCM,data:fxwQYXrp2RpcTA==,iv:vU3qhlf0A49MPPBEn9TbsGK0CQhlxWPSexZFBw2CeI0=,tag:W9woK2Jt+nrpXeUtazxXqQ==,type:float]",
"name": "ENC[AES256_GCM,data:3CQ4zS8=,iv:Lx3AKBeYenbJollY4iLGCc9vmvfTY+EsFj2H4YfxJqk=,tag:nMi/wAOTjyWDirBz6QKoyg==,type:str]",
"namespace": "ENC[AES256_GCM,data:wXKzRvM=,iv:I1/Tbg7zOBlOInX+ah7OfgDt0EhlmS7AAs5aNp1+vn4=,tag:5B8ASKvSEJgacvQOQHMA1Q==,type:str]",
"notes": "ENC[AES256_GCM,data:sING4rbvOxKibXMHKw7/vAarYelhraR6Gtr8eZPoXwOhj+6J7bvAtGXIayMoiY+MY0JRIZxQennYFJP9D2VgQ4qb+lyVpuiOsy9iDaWShYmwFukNtNotFpE6J1waOEJZK4wEGERNsHfX43hDW/g1y2hjLeY3YkdujMUqZEzBhSVbvK5+sbllB6sYyGcTqpH5oM/wRxQt/TiCo2xsB9lEVpzYnuYPO4yzm893m+P0bJ8goBfQ7P6rsID07iKh7gCBClbY4lQ0AOVUnDms/g7i1P0pMt3CkTl8YbWtcDgCPycFfk2CypMQ9U0InYsauuHBMxU6HNeeMH90yAJsPT8JapeikmY5QbSga1bGoMukFfgnJdE4CVxwCltawWI3tnr1Wl+n8ef9TI6eCQMsb5Gx3c96VZtufVzNjEkLzvYtuGk=,iv:Td2rMViUeqvjVW1bIzeJkJXhjYUtPpkiPIrcgnOWhqw=,tag:2UpTimEBSV2bQhTnMOpj0A==,type:str]",
"revision": "ENC[AES256_GCM,data:mG8=,iv:C+IXGok5Thac6NJh8Tz2dwRRwS4YpUbQ1mbdVrnsvZQ=,tag:KWbolbZwRaJ6E4kozcLPPA==,type:float]",
"values": "ENC[AES256_GCM,data:QcyIiQOq9R1lWpaPU/ssfkAH4cAA6Daru6YIRBzrfcbdEr0RiMelZNo6LyN5wnN4KzGrUpvMuJX5ZhUrgACvTOAoMBKyA2fXmP1emY9D6tIARCU+dshTYXfRN5XVbbzFtiTZ7LP6EpvUtnwDx5D8mA/CUcv4xReiR8GH8FByUCGEc2dMdBdyqx2TcYdcTAYLckabw8lIQ3eQ6x/Go3vXE+aOiUQflQgW+PnzrZPPDCEhAYviJxA7JB46Z8C5nUi5iUkT3WYZCVA3z5PZcKwI2GSvVBlL+vA3FbcwYnc193IXRYvo/9HUpGTJ8ebYbtNQaAgyZ2yEKY116cJPV1A0dJt3Ua+l45tS0y+u++UyJ52ys8fxnrNPG0Kc4WYS6YUDQIxJ/x8qBI7x8wkqfN0RocBTjaRHmsNE6VWOXUOdQUwLQ+295ts1cPCnS7xEuF0VXAaMHDZZ5FA+ho4M+UvGmIIscdekUrC4niwY4AKdjdCbREl6zdobfC9+Jydt3H1ux9TyWWlyy6PkIPTUrvJjPdXbJFWi0RB10d2AsFeANB9OSSP90ECB0xRqal3tPKIXSddX0SDVyZ9Y5rtzm3ABy60pfuMbGwtDvQ5rRb0sowpi/bEpPHKtvt05t7kByjtfMpZNhBNaqile6y5D2Y/x5sD5DhfyD852pcQ0O9z8iTYAxNIA3EBjCmLJqyInwcra9G8Wral9T1aCt2I75gpD+6twcIKHncRVCg6tpNmr0GdaN5Dw7IhGXSIQIZxNPzYB2X1/GVG8JIqY3iw4CgFgAzzRoufQd0nXud8oPSZ7eHj0lEPxNOnKitJfuKf4cC7Dw7aOsf7hiuJUuneHDebPiD+oSdbvQNQqO65DFQ79ZHq2hZu0IszGgprX4HHETMGCLbS/DsFEtAgJ5DX26gPguuBE8SZEht2vQWfR32iDvP++c6aDZpiHKpSgybVT4ZhqMKO2Z48Af7EpIeTSIpzwovl6XQDPz80imTdS2RgWaZBmHOKk4nCnNEgfgUyfhXG8R/c+W4sfcIvH2qobOfN0oDloKZ+xxgDpaQAx/PiUE8gxN2XKqghLgb1O5A1I00+3H0vfM/0JSakkw0keBEBhL0/Q8mAg2cyC/O7XIbB1TJ7Px9imlYB7Z2buqeQ85CMUk4/j4IJbFGpT/oUnS47OT20jjPemyWkeEJMAFlDZ9PpXW8NojOtM5Ba1WU/bthHWQrByV9BJzwg8b2IrY3t2a6MMLROcen3DhQyoGrtvxHaJa5ZxRVF6NFYtCHHJmj6zicI+Bxr/ERs8vXAD8yi2WOTnLFTFitghc9an30CMWdJUipS+eJOQsGj9AOG8Ix3y9C4xUeTe2oiZQwk/vz3wB1mkxLSYozYQNxK4uRl7FdRBPvXDiT3NboYQ7SXT5TFpjlcfSKGvV6a4dHG4BQgYvgW2yzdYu/5omy1A7R+rezrcsM34LS5dovG4QJhpjipZbKVJMUrMSmK6bUNZY1ffkBgftSNCBHLZnh3S0Mp760Lvl7oJzGWTjNQXyLpelOtWtGzsejedaRBldPvNPtZpenyjJY/WMUcCGSv4+F3cFdQt2wOQ7EQd7NRJk6Y45hRXaTmMwg073Way5QhiwVNOLMsMsjMPZyILOtiB+VTMM38wh3a1f8Uup7jR92/kx2da6DH/U4c1BOq7pEVOWgXN1ESx6k1hnSfK82SzJsrf5kE3oI9UqRhpzfNnbB4P3rq8ts72eFCd+bQ9KpQwvgm7cREVOXH89iVEkMgsLJpuYJ27f5ivmH7Vj0f7dy/MlAKnesUAoRYNBmRB6daSHQgq9jhIjrWk+q7wO6AXO2oiIQVCyoGG9wy2EhSrIJO1/+PzRdT8eWnniLibrkqccAZnaesZUpfy+tmJfJmdLRTgz8j2RLJwYjCfOk5RNUu/h+fThWl2gE4qnnGmXS8wxCygjrtDTf+iuMD5Stt/pn0j/tGp1NRWniELRhqdReS2onKmU8GMC0C0r0x7nX2hvTVU+kL83OMnNxBqbH181iDCSQE8/dz4eAs1Sbfg/j933UvFSdXDo7JcqghVPtVYiiLQGoUukvRMVmxJB3Y+9G5ibCWwkUcEgzXgxYnoVQV5jgVy5143Q+sMo6jLvbUquOvVKWqdC+/V9B3TzCV5PMZWrOqndUD3aGh6bnhpqMqlkH3jZ3BWGxrFpCN3x5B39TMHppAacdzwYuXGNlxPEbaanH9DvjwuMRX0NCUeAG7/PRilu124Dv3LmckoQlkinfVQqS/bTSQr5+NW78qAF6PUawYnbt5XLblhLDKhsLkUBv8j4Zi080wJtjYkcp8T4draUJBFcjo7RZdRwGiTk53Ns6me+j7jZln5W0bfIqYz36k/40hH1hk577Rq+g+zS8v08L7V6VXDEmYPBftnfvHbA/XargATx0Kasyw8trgZLzFsNdnAQaITmYIlF6f0kS0QhQeoti002P5VSz5Bb7Ng8DDPBv0Icq32WR3xSFk7g6fDfSvFQIPOIcrdx9J8GIz6ZikzqxfNnHD85EJC6Ccrwh55ddIYbpYBfIhu8S6hchwPZzpswBi36uYOoEQb5VomIokArWvsxcyngCaqxMDUBNde5G6ceQOSJFMWeiqL1iex3MfbRCu7S1Slu5qYihOdA6/7rJSwvQUV+fo6npMVSZZj3jn3fX4MLf9WhrEp5nAnF5exuh23IV06w6vCWKvg9hHtvyPG37TdrrfT0Liczj8etqpI+J9nZvY1VOjALR84OQedJ6llTJH/WUqM3Hxh/SAUQ8/noyCS+XcPTLhYZYnfB/WktJmC1wNVgYK8yXxOyqfflY+TYECZS4BIZgnz0TSlFX0qxOPJY3qe7JGz6B1ETrol6A2B9IntryrH2G8OdYhvkBolnlUKogEKok4FhtntFD2ptD0fkZYtBauIM5onD/UA0wNMg9rQypYuyOCBhiA9oAeyeoI+kDH9PeYaFGVFfVJz6mvYQ7Wjdk6fctxFC9CBt9qZWl85lzeZO3egN7agLJJUL9OXdYvrRWE566Exci2IWT1Z3Ko8jC8viieKgiU1pNsRVIIsmB1nmuBB3msyVq1RhLsKa4L3xbVQapXzzaEP1JbWKLt/1C1AQdEm9WdXqy58LPxuIjYwf1JQ4bbkOuNDWn9PBPmrWvHP5SkBROU+oLv0tQZBDF0pKiv8d3fDn6bvFp1iiPOa+9IZ+qL40Au7iJZx8IobFDnf06V6MGVFs2Oa3IwhTNliApmojBDYJCL11Y71kzZTV432Lk7ZTU4/s3oV/FEjVZxMlOJxQsOCybNNl2vJ7jgfGhjkkQamnnIKdS8WMzYATZJ9oOREShj1zHPfB2J7Y5Q7uMp3IChmXYOUPLeM/HHYa07cqodR+nyq+Tj5phhLAS+Q8E9SG1Zpte8PwS4VH1c4SU4vOiFCYGJ4tIV3UQiomjKdZk3s8unQscjKWcEkr6gaSPrcLkWeiV5j6j5KXTUPJyS1Xh5I7AN1MkGzYmCxujvOYwiUlYitQ94zG+AMZna4toOjsa177LyrGap8KeTikAO4QA5RJS4kBTvwQ81/Dwq9mQ0znnAKFa0H69C9gKGjMAEJ2UvvEsOiZaPQQfeJ0qf1C/HNKN+8g0Rro1nPYOkB8K1Xss2wSQJv/Y2m8Zph+V0NCDFV2CJ+T9NgMijcr+5CIXJ4zyA6me9/OvnZkSfXm+ES3LlguMiQ6geS844hnadpW03rArU2BwnB3mOCxV4LpwJwh6Dn8VCArjRPsfqX2qVDk/zi3r8aGZ2H4SxbPSNeWz/LkXXrJXQEnxkEW5xfJw==,iv:FQLGhvQ24Oai0jApJTquxa8Zszb0OXtKfFltu4qjy10=,tag:l77wGgZXbs12GXGih9qlMg==,type:str]",
"version": "ENC[AES256_GCM,data:YAPTnNOv,iv:ELJrZjRKXg1LlcRxlcpq0UnhXxvwssvvRBF346dqdOM=,tag:tmvE0Pci45K2y1VkA0n7Kg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:qRWDkPc=,iv:ydp3MGUs27/ZpsUgNY0XswkQxHKuhZsORUmPZGKpCQA=,tag:5XfY4DVkYl3y2+0N4YSCYA==,type:str]",
"namespace": "ENC[AES256_GCM,data:0BQLrlE=,iv:MDh+eKz0CvpXBqranlfIfsm+U8Z3g+mu4oMymcPr1OA=,tag:bmbn6SZBhJpgPy38CKnwug==,type:str]",
"pass_credentials": "ENC[AES256_GCM,data:a6xjOwY=,iv:tA/saNDa1Bpn4yVbk+LGc/q7XxsO8Iru8/RsACSoRD0=,tag:fdGM66dw5F5Aw5mGZPC5yQ==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"postrender": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"recreate_pods": "ENC[AES256_GCM,data:zYcKh5w=,iv:85AeAN+XBga29H2Lss7LdtrK+xD55VaCMBEgkRh6G98=,tag:Eyj2/kf7EsqQqLnNlnMt0A==,type:bool]",
"render_subchart_notes": "ENC[AES256_GCM,data:nveVEQ==,iv:ie6rF9ONtPq8IBjVGAVpgF0SIYUbyxlWlJ72UY1afsc=,tag:39f5Hj41F0nOehX+qpN2DA==,type:bool]",
"replace": "ENC[AES256_GCM,data:u9sb/H4=,iv:jkqfNW03XeKTlzGRH6V/8hlDtZBEsyXq76pSJzYdwL4=,tag:WsEPxvoLWbSwF5F4X7/6hA==,type:bool]",
"repository": "ENC[AES256_GCM,data:5ECLnckoqSWcotf9R0Qh3AGH7/ir6R6Oeh+MufChUdI/2+0=,iv:ITStn93snj2/c2v66Ler5g4vUw/bdZLzh3OEWA6vOqk=,tag:jR+n39Yz/O6N5DTdhsWunw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"repository_ca_file": null,
"repository_cert_file": null,
"repository_key_file": null,
"repository_password": null,
"repository_username": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"reset_values": "ENC[AES256_GCM,data:FZ/OfKM=,iv:kLeKhTnNztxCOmpyjBJXgy3uMe4ckvGNiKGbbTnxurU=,tag:Byp2EfCmQMv4h9mLvtqb2Q==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"resources": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"reuse_values": "ENC[AES256_GCM,data:7BVRzJc=,iv:ahZGuOjCN73ia9dE/ZsQUaM6ZIi/jd9xrzQoTTMEwkI=,tag:B604TWN8yh+aVlMgBc89dg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"set": null,
"set_list": null,
"set_sensitive": null,
"set_wo": null,
"set_wo_revision": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"skip_crds": "ENC[AES256_GCM,data:a9Yp/44=,iv:M4ieSj5Ipi0fzc1EinD3l6cniV69OwAv7klp9PmmzYI=,tag:Ql17YaLvqeuD0xxY3aAMNA==,type:bool]",
"status": "ENC[AES256_GCM,data:cAMHmMAxhE8=,iv:jUjWVFQ1ckn2mwhHK2dTUr6QGHTw8VxvHh1A649EdaM=,tag:tiJpDd2k73vjMeGbHZ5Bmg==,type:str]",
"take_ownership": "ENC[AES256_GCM,data:ywKZ1XU=,iv:lFI4+/7ZAEVuX8K1I6KycCF+jmtpYllB7KR34R2/YIM=,tag:yqNI3njdQPyZLF2DRFqcow==,type:bool]",
"timeout": "ENC[AES256_GCM,data:UfPE,iv:hmBoY21c1z/Nmt/cSEh1OSDjfweTFldRPvwnGGEaQlY=,tag:yjfJOUnqLq/d6h314aO71A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"upgrade_install": "ENC[AES256_GCM,data:uvZ3PLk=,iv:JyDz9zsXjb+dDfFtUiIlHCnxfGv/MluGempZj03NURc=,tag:gfj9HRLwJp8m8CMOctvfXA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"values": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:6VIaSFBCVUrDqb0R4TiGkBUAQoEQ1sJahFLkil0jl8cdoGLb0JBekyv3oFQI5CtfHm9fT0mmtiUe5B4OD1zuvJO0szqD+8DqfEtkZc0KVqil7Be6mU45x336Zrsi33C3wEVKSTQsRkHMRIpEgP/zfNi0HIYWOMIZ8dPLqpuC6FoOmN0jiaT7UmtHD8h/3ZKd5z19zYEfi2kaUndy61+9dPVutX2diAjJ5bEjG7i9Bj9F846LFOAuVe67BbGYFv7+gi1ZNle6dvL273XvYa8dPX56fmW9cK4mErgXwJmOSNtDTLqIybgc65RRKsrYa/Fqy5R+f0AJcAQEXpQxZ4FTAH7r8HPemYU+8JtB7F12lXhs07c0gvIAq62kiSiTP83kcKfVn7pYO5kZtAjdc45Ufd/MJsy1g6JdRMGQbvju05GYAPp01JSi8ufsE1FyLBfgIPugvZ+DuX3j3Y8EQysHx1uRwdGTotMseY9Vqvqn4zU8aGAZCemeCzAQvCmyG+9bx2o3jgEU2fbhG4mDUU612qqMFtgWGwCkNwHSnhdUycf8DWm76FAVwWpLIr0Ffsan7rKFvjpr8vaXv8PU47CpA2iwxwi/fvQhDDXLvdfS+3s8SymQDDcsNw466osjftXVQM3VAd4dDpLMAD7xkicFY+lyYWW6MA432ti9sWD9maLmyot3T8V+9mpOrgANB2RuYWwGFx98eTHWxO+xZLKxdKK5xLiWYHjDfrAy9CPe48hviZFmjqc0mcotvWIsM8VcRUsfxkDzq37SKvOsJtijiA90TfPBXJAYGMWu8QEWDKxuA/5tJLyjwPJofGW98oktuVwYt7BppN+ki+QVz//DT9yttqbUcan9dxoI38t+C1xEM7S+K0ELWa+Xn5x8Lq1XaVoAasZtfZkSLru2QRlMSW4/3vsnEpHppgHa7opoWA3ghrQblyvIAGaoMFGTWqb5js2p1hHebiquF99sBjd0A6EYZmuHErsNWnsGiaPvArVS8LoFHFV71GYoVVv8n1Le6tB/ftDzV3KWEZ8+0bA1f/d5mj1tsQwXX8fGvKdOibquyNfWloQZ1hE+kPkiyCgQqpgp5dRRG6sBOei9jFtgmRMtzclJX0TiABBm9ty75bti6zdU4Vo67qmKMc1lQDPQeowLMYs70Vsen00HlSw/skyaJZP3nfzV7vYrEAr8lfHyILVfa58CJ3GGq43YWgFLFXrl2l1B/PFyGHTPuVUl2B4Y02IvfUU0FxrKMF2Zq4pSoZm/2OJl42zELpVYvkNESj6FKDJpz725RMfM6av8Gd7myXSd7mXTUea9G26gj/o8ZIQBff2wL6tiXPYTmAgpw13N0n8SfXSv8hlaBTtUTWIOollG5qm9zkkkxf9cvxMBQA2MHcHpEFuw0TrXptMMLGvxre6Vs+GvQWxbUIyTScEPUncn+GTuFzYfKKoKQ668ummijGqncS4TmYcmNn1zmQHaYuyLdEzIVMW8dgsLWZHwLi8Ys7XSt24Le63fZ7bESObHF/nSZJUuW+yh26LNxZ3moqxyu9D41SL4EYnRd0yVAZs1VdBisvdz9nh/edOg/D2F3OKO1DRKWXF+QB5C7y/RuZv5D2/m1KhyZXahDeVQKiU4936GlgfW1SupxSGH94XZgq+VxR4DZc0eT1dWx+IVpr+N5i3CYfJqOwg8fWy/srE+qQviouM5zOb41SV94XIMW4rX9KnHYeGoj1NNZeSTENywRRGZjLjTP6hMEMhS7Fwqka75+WDLolqjUQDUP5ifcHnyoy32H0mFIGJFC4o8q/5VlbObv/wxZ59Cvm9b6ZcqCQNkqH6w5jL+vX4UbnWiGM971SShozNn0ZS9EUU6mWKXEqiblF0mPr+zQUuFngIcmrG0uyU3FN+47cJ0tiJPjn1Kl2PPi03EWMiX/cPx+Z/UvhGl3XkH7ZqBZZG3aW2fxti9pfHz2mOMW9SCz/t+eV7HyFKCwHDmr/qkKSlfHd60xiEszW87/5LZGoLoS1g/OgGPKbxG+iTZT0KqqWKCCxjiyoGm0Y8unzpV8v9VZNFEI3m2h08DCvvgGZEHV210+325OApPhGh6bX6UQfD0TyVIZetomBaxE+12w71WdOOpjYq0wWB4/UQ8g7Cf0WrwGVXUnByVu4G3SmBEs6WGzMyAbVVXDtmR5Wgm6kObsBNJ1HaCOmshiKLSLkSMOltaLgrKpgbSqotO4D6VsB8TyrbhhKIQgCjUWW2BgzLf8eaR+eTk3nmsGGGeL3bG5LSV/oip0JeuoV1uw/6MnAWXXqQu9eGNrfrxI9c5igKC56ur2h8gO9FGOQxhYfRy2LlP6JMSMxS6VQc1M74VBxWz2XLz/ceBRY5Lg6kDJMT1ZjVJ8kdyWVQEzqGBv9NujuGcgynFFL2rVskweKPaKhd1MJn+39uZ9AVnwJhUYlkCPQo8A80aV99Jk2+bCEHcoFTHSLf+NjrF5ivb6iu7OPiw3JeA/uEbhe//RazNR2Pdo8zy9PP6lZMUCCEs2FfyzBap30LUkxPZgIxhFHI85T6GNhtHLe3dSFO03KgB6Gr1DBS/RizDd58T7buTFGSqreyo0xdVvXpS8yTxsW6wczdpahxmJKClpgSk0BTgBm4OJECz94YmEtPzmL3Rip6r4Q8RYEvjbBg7Y5EcVswC5esUcQCw+hZByt3ZifW9tiIOLUlOUZ5EHL04ADRjfOfKvwlK9u3TFxutnkR5ENHpO4UvIdRxSNkeU4I0hcmfglm8uAyC7sQWWJkO25wVcmr+bAHzgRIHVmR5AEZ3U0Q3GrUSoGl+aCD8Zdeckh01F623QH2Eti5l9ui5H8Vyd2jiJ0E5pH1MMwpHzf+GMcC6vFF0JuSSlaC9mLuNnG9ggLzoSUOlcW5ra7y+/UCk+iEuYmMExGKaU1ffaeR9CZn8ubYGfmocucPUxNkYqSUdBYrXqSkquYlhYq+vXj51Kr6R1Y7EgC5mdS65EzQlKa+jvuui9Bu/Is1fWWD94MFWa1K+dCrRZ7hAHd6g/zP7q8WoTKeJ71Pr1AsWhT0xlv7f29oX5xozuKENmBh1WMJoxVKV9ED3Lv22Myrosf3ZVurzX+Kldzum/MdPkEQycYCPMjmjaO5/X6KNQq1KegyHYOF10cGVll+WPBH8ZWjm8xEZB7ie173uzvzcM8kUQNFQPirUq2aYJwAf0V/KGvsEincFMGk96d5SP+0LeIMq09rLf2RYJgRSCv0g1m3DSmTKkkvyOasFp+kOP8ZmeUM032VcVeQmUQ92POF9fZr02tqQPZ49LCDNeS0qrlk5bzR185GUsBSIRyfqIgzB59Ni3an/R9F9jtkgguTnXX8LSgtqydjwzmzTHYjGkJjeF/hrpOcjALLe+9RcPJQXHPUQR/JzcVKEH7IDDKhzE5QrsYDQVwe0ZkT/rfrVVxS9W7NT0ZhDgwV0EhZ9y9DDJEnC2CYLp44qdwQmEi+8QV9sW8zxNTaXgAnZjh803fp1QYAA3nbBilwz617dtqfr+Pi5tpn9hEJA7PpzlOLt7bW/zDmfsikBzSjw/P6wzC3vXxT+0eoGzU2MrkdO+6avLE5qOR8C5zxXqkOahWQhxzyLcuA/rxkkjRmzCHW7TSMn9C9ErV4qSYKOS6Pixh3cUMJuCZ+zsOsI64zQJLXEWKi/ze4j2qIY24+2nOMppZMX6Gpq7Xi02t7DHK+5tEZBSoCKXjfCjjLWjSGZ946RagHAscOtsLcc72v1KE0sweNKTem+paf2q5Xcj0G1dWNPTKy3CIU38+BZDbSIo71/uYXs7DB+NLEQ+yMSa0XqJtaPBk9UkcGA5jbFjn7j6YLfJFqEz2om9J9XN1uNAqUyhB/E/iYwiOeUh4Mtt4SmM6d6MTKSFs8SMWv7+/0o5WWbV0yXkGaR3lLNfV2sbuxMUgd+ZoBt2q//kdSx/q0X/+F9ZanOUWLTmHhBcKVjn3FBBcl9QIbtWfuqyqdLtoQ5ie82utnSgnjkz2beIlO92d6seKWJSuvoQgdZAQspGQEjkUVkyBU6JdT1Vy6dncyW+/pkbL8rpJj7zjnXIC4
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"verify": "ENC[AES256_GCM,data:l0J8/hc=,iv:U1UG8YmMsvKYU0KICLkBvO57oBh9Zd4ysVpb/FwpHbI=,tag:s6fJUNchIMDeP3sZ+e28Jg==,type:bool]",
"version": "ENC[AES256_GCM,data:VRcv+6Qd,iv:ub3+ZKQq33AWonSlrQdJyAfjKDYSSVRpplOhbMoOhkU=,tag:+kTB+SFCvv9dH+BONArMZA==,type:str]",
"wait": "ENC[AES256_GCM,data:kRd+yA==,iv:XOT2YRG55354SCt/D6RG0guFkI/V7Ds0SqfE83w3zvk=,tag:5o//YfuLTcIszi7yqefsRA==,type:bool]",
"wait_for_jobs": "ENC[AES256_GCM,data:psXrwcc=,iv:3f5U1HvjvicLDnv5pogbbJ/XiUk5tb/9lDfNYx426JI=,tag:vIbFyAzJ4yfdlHL92OOjJQ==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:ItAj1DdlAQ0=,iv:lxJqt1olnldtGOfMsuCvg+HotMILaEsef2GczFjgcIE=,tag:+rLr+bjsvFrFH1/kCQ4KvA==,type:str]",
"value": "ENC[AES256_GCM,data:scBKP5I9tO/IQ0TJdAWbmJhQVQ==,iv:QvrpMXyCcq9A/HTBCCfTmhvFytohgHbPxSis8zT9GEk=,tag:sc2dWVeLf20ZDgSX8nKCzw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:QA==,iv:6Do2x5HW9yW61PJeYMJ5rM/XnJDATLXRZvOTQS54NZY=,tag:WiWdB8F1+FzHkBboZSLTUw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"namespace": "ENC[AES256_GCM,data:r3rkNH0=,iv:OPjk1Ej08ESQFpdrJkd+Uw1mbUK3HdXUuRjS1Iy6SW4=,tag:9+8Et7W5XWcY2ACF3RpFXg==,type:str]",
"release_name": "ENC[AES256_GCM,data:bZdDP1A=,iv:k7gN3eu5BaBjXffkD9UT2JCVaZa8LwZFzbuUhXyx7kE=,tag:N8SIhhUFHNabumKxJVRhgQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:spHF0t94EPi1FEH5G1k4NIKi7h0o0fU5oxU=,iv:XozenqC8RyN+rjuUK1kwaUt70iOa3yTeNNFIwNo1gqo=,tag:oqy4MQWRGdb+tx+OSk56wQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:Fc0YoXJE/A==,iv:MqdUoKmB3uKFog7JeND7x+hnqBqoKjN2gElCk8qAZiw=,tag:4SDl3jWeQxgsMS5Q4uYQjg==,type:str]",
"type": "ENC[AES256_GCM,data:1+DuF8GEoDLHslQbUizjYBOAkjEktQ==,iv:gnmOI5jMz2Hl0Ry7QkFBf6lMWVVemYG2NoLuF9UuaRk=,tag:J1T//rh/7aX9Q+W8mOBvhg==,type:str]",
"name": "ENC[AES256_GCM,data:2LY07a3ulCTk6BXgUAa3Iw9NL3+U1zo=,iv:pm8PTyvAnkHODOXjqEWC5Jfgm14tHboSGhnxsTFhqwk=,tag:0+oUynZ4gr2+7ojcYGGomw==,type:str]",
"provider": "ENC[AES256_GCM,data:1ECiJEPwDuiXl6vdLKiLc1auqhsbL8XhkWwEp5sADNtO2mmNHEtGmtos8F4eYjnd4jhS/B6a,iv:Q0/j7AZY2rOltzXkBm55RI4zEUxawxnV3zX09gAURgQ=,tag:5FyklTRRxo5ozLkzoLPKkg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:Og==,iv:OLFHoarIF/PDSZtIeinxpNIGvvcrklcyprPneWEa0Gs=,tag:j5T3qqG3y39o8iMQl16ORA==,type:str]",
"schema_version": "ENC[AES256_GCM,data:rQ==,iv:dnHphn75/I7bub2l6Aw42n5V0prw/XlphvPuvDqL/QU=,tag:xtWJbcGtJju314k4KtO0Uw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"annotations": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"resize.topolvm.io/increase": "ENC[AES256_GCM,data:s0/HBQ==,iv:OUhsNq7KVNccAAzbXBB3dWI2tkThkXVzUU1NED4pk4Y=,tag:AonL8oBgP2gTMZVC+jePqQ==,type:str]",
"resize.topolvm.io/storage_limit": "ENC[AES256_GCM,data:GrT0uQ==,iv:yfTb8fmdu5OIHeLg2uFWTlOIhv0Fwx82pxJi1a8stmY=,tag:tdgwdmK033mDOP9/ucRbnA==,type:str]",
"resize.topolvm.io/threshold": "ENC[AES256_GCM,data:gIa/,iv:+XbndePpOWkmg0WthfOrscelE2CAivwUtpNw4ShrmXs=,tag:rWtCU0gTST7uHKQtCqqGHQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:wig=,iv:anXpuw93C/ojmjrRyDjesgYelsifWPdfdA14et6SxA8=,tag:jbH36j17B5dEMHKOLT1yNg==,type:str]",
"field_manager": "ENC[AES256_GCM,data:bpOy6zkhzpi3,iv:/e95Al2ypEusnbMv+bBcesWDVcVXlvxK5gt8sODny2I=,tag:wAsF+8fo9HJiR7VcPP2Pgg==,type:str]",
"force": "ENC[AES256_GCM,data:jjoA2Q==,iv:CN2rwF8QeU25SA8/07dquL25gUMj58UmljOyQsQkwyw=,tag:8W7ZRIHHnsTdiP/tj2qvgA==,type:bool]",
"id": "ENC[AES256_GCM,data:3z2spghdJKzK4Q01L93Lq2QFvQ92dsGB59Y3an2czRZ49pJw23b6FwU6e3N9/7GmZmO7FxjPGUjtpQfaB356Of2jsKx8JKOybuMZ,iv:9DskGdbs8aMtVaMpypOSW4fj4MqMEOIv8wPsoFeBznM=,tag:aKaios6R/00joCnugzCxEA==,type:str]",
"kind": "ENC[AES256_GCM,data:DXoQrk2RboSG+9B1DkakIyIMYKXF,iv:NE/EvGikXxHOtlTMrgY+M9+vCFCSEXyx6anRcoN004M=,tag:EYJwXIyCsBh5mpuV6ny1CA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:KY5u7vNJN+84JUBagA==,iv:9Pzqppyx2nyDu0RdXmCa7njIcFA92XmKhlUZb/Tk0eE=,tag:R9cBFRS1Sxftj/iK60JN7w==,type:str]",
"namespace": "ENC[AES256_GCM,data:v46t3qs=,iv:AaMf9A4JTsMvaUClP25LL1wpPudyMTzuJS9WCibpwrk=,tag:Fq8ofje2fvg28lyQp3N9xQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"template_annotations": {}
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:xA==,iv:+Orz5gYsa5Aib/WFdQLCk+T9SdMAZpPLCb+xfn1cOi0=,tag:SbqpWXIBzXkZqrYDoZWp2g==,type:float]",
"private": "ENC[AES256_GCM,data:iKDWlcwUYVE=,iv:dJl7vLlNs8nYwmv4iyQ5vf1fhvNDAZFUmJnIFJ5kAa0=,tag:IC68AnF6k5luqs0UKElJ8g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Cm2i9cGAzITElugBc4mAdR0A,iv:NO5kHlLlca9+yiue6lktFOoOskT2iONOOv3ypq0LSHY=,tag:whDCoVWtJ0usN6wX4x7IOg==,type:str]",
"ENC[AES256_GCM,data:yE97sAdD+rTpau0O5HJIQ/loBi2d7JRg5xA=,iv:oQsujVyd3RdNhwVML3+5KL/82TEHta+37dXtRaYLu+w=,tag:wEw7a9sWfUqY+ku1UBu+zg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:3w==,iv:GIzNnciWTijjOmsY/S7+ItjBi85vPQUxywlqyactn30=,tag:wA97a+hwSOTfNCijQPoTwA==,type:str]",
"schema_version": "ENC[AES256_GCM,data:sw==,iv:rGT4+7s5xZydCN0fQWy1IDUSu/bHVW2ZT5VQfCkEtYM=,tag:tKKDZCF99cV4u57Ndby1vw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"annotations": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"resize.topolvm.io/increase": "ENC[AES256_GCM,data:R3ALLw==,iv:9MYqXiZ2UoJYS0zEtlbT1TVBnwoMD+Xoyn3YAZFs4Kc=,tag:NcvjEjlRMPn5swWqKur1Fg==,type:str]",
"resize.topolvm.io/storage_limit": "ENC[AES256_GCM,data:uyQC6A==,iv:eeOElYw8Ly7D3YJG1AB/TMe2TJ5A7/nYrJ42r1utkl0=,tag:8GzgQXKpRVZlGzeaJDZX4g==,type:str]",
"resize.topolvm.io/threshold": "ENC[AES256_GCM,data:7eTt,iv:tCsACargz8Dr1mdA8V5ii09UleUas+LYSrkswAy0WjA=,tag:Q5q3ilzVdVW1p9HZUB1tiQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:U6U=,iv:xrRUt08ctMTUgzeRyl3L2Alf/On3X+Mm5y15JeEUS2A=,tag:EwYQ7WpSjtvqe2dePZbRIg==,type:str]",
"field_manager": "ENC[AES256_GCM,data:2IrfkEAWCZdm,iv:BSa2XEkgHEfs5VQhTMMGfROR6ZZsMyh64zZaA2PlNAY=,tag:4HI5Jbzl9fTjAnYxZebacQ==,type:str]",
"force": "ENC[AES256_GCM,data:68NqRg==,iv:gy1a9pIm0e9afLUByT4+8My0uF+f4x3giulUYPd1s90=,tag:csKr4Zk/ibK8eelCn6L2cw==,type:bool]",
"id": "ENC[AES256_GCM,data:QbMYKToDC6pjjvNYzBr6Dazv3CVC6mzoUKYrr96Y6+9NML8N1CQwCEdW+qFxJk5DJb+MgmtFpZOO1M+uXTRGsCoblwcKeCnEzOei,iv:/WKgVsG+QSWxPEfmuUbkOYjEo5OQywxQGX/s9/dPGXk=,tag:6kHWZwzLCw1euoMvTAqNfg==,type:str]",
"kind": "ENC[AES256_GCM,data:+Dfq6ndDyPcZQVFMYIw4Gu7XJser,iv:ebGELC71p7hQVYK7QIhbVRT3lp5YaTL4zdr6PB1UaZ4=,tag:RZQJz3Gdpzrq0/iCTg346Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:9dT3P1k1cGuIfep1dg==,iv:QfkL+k2g60PIwQFzJUIL70rhnjuXx5vu4tXPH86tWiw=,tag:hZLJd8Y9jrBsKrqUPhmpbA==,type:str]",
"namespace": "ENC[AES256_GCM,data:qqoT+O0=,iv:04jKXF7WZ5Lug4peQg/qVNXN9pcmyFeFUin46ZqQ/BE=,tag:gUdvWeVlppJcFQvqh3TLfw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"template_annotations": {}
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:MA==,iv:QEeoq8RrxqxUkJkBHeQwIuDSuESW1WQvWw3KnmYM+B4=,tag:Mk5296lCP27qbU9eI50Djw==,type:float]",
"private": "ENC[AES256_GCM,data:fVyUueucMgo=,iv:zUG9Thva2U/nDR0JbREDSZOGMH5zini/ZWe6hd2QAnA=,tag:u3viHR9PXy8nIjPCiXmIwg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:nM/DkcNX+EY6Bq8UkmUig4I2,iv:yulY8nB7v8D3uDHLhZOw0mKAD2VtN7Lz2eRjculzt6I=,tag:gZT8c/GVM/Cr5OQn9HsRsg==,type:str]",
"ENC[AES256_GCM,data:Ga4rhqjW0tjK8a/mHJO5akbhs8pCn2I8HcY=,iv:KkN9QuKNuh46wpR5yxspCCvQcOezeEzOQwCjrq4cIFM=,tag:wgblWoUCAqvvqDYDidPhGg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:IQ==,iv:2Sm5BcadjJBX0X3wsc1fDPdf163aw/Qll69ceVsDlCg=,tag:jz6oJ7z0UYe4s6UVr9dvZQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Ew==,iv:xlBXSRF4D2JQjD6cer5ATRf5F7zh/6c2IfFqtGIA3LU=,tag:nubHMCgBnRps95zbzcOhNw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"annotations": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"resize.topolvm.io/increase": "ENC[AES256_GCM,data:zY/2vQ==,iv:QsUrqMzySJ8dHAlSiCAug0m4tqCgqiIgsxIBhfSjOQA=,tag:B2CLmt7HGKzvQ/9FkVmD0w==,type:str]",
"resize.topolvm.io/storage_limit": "ENC[AES256_GCM,data:MCTOMw==,iv:PcpfkCyyWcsOvz9WhaH/57mg8uzRwYjyn5w+A897Pbs=,tag:8/HfhcfR0wslnBAI/fvmXw==,type:str]",
"resize.topolvm.io/threshold": "ENC[AES256_GCM,data:pb3e,iv:b+TpHIJeqg9jvqp5Q/FsEzkeWxmM9bCcOz/Q+vvqG2c=,tag:zNRb5dJOMcXmzg4fwdYeaA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:zq4=,iv:73klKah2diq/e5vIjdtZK7fxERjfH5YO8UHHxrHLgCw=,tag:K3MHoUAeRDsKi82v3LPnSQ==,type:str]",
"field_manager": "ENC[AES256_GCM,data:5a/u43K6VYrS,iv:Alu6n7FW16DgpSC7qTo/IymGAE4cv+fKCUnPqTm4M+0=,tag:GlgmbId29kYu9wz9mtXBbA==,type:str]",
"force": "ENC[AES256_GCM,data:dPNvSQ==,iv:06JIsj/z8dgA/sPbnATktU8hy6IUuMj0Q90huL2FBFQ=,tag:W27EfzlhDhTzTkx1HFYcNg==,type:bool]",
"id": "ENC[AES256_GCM,data:ZvZgMhbWAhW5L+vPIMQuw5g+h1/dGi37MjVd8ZqUuB39Z5+M5lVo4NSVnigKuU/cln3+HsbXpdIroI/v1cQbLkiZKb613jvozRGq,iv:Jl1Y2fc6yxbPJykGa3oOe6cMCoohSuphTIv0GDB4Ny4=,tag:srYc8ub3fYCbTmGXA83vNQ==,type:str]",
"kind": "ENC[AES256_GCM,data:gHlK3NOZtBQOAax0XqxMFkzdW35U,iv:f65dOjNpeaRiwunHdSQ2Nh+B6Em3ksHRDVylVmcqZsk=,tag:mr2jlgzBLet0744HWg3Xnw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:FzTn7GasQApqLUV4tw==,iv:B5Px+SJkYOo1DI1akD44GzzggbV6CtNUVkQpPPWKmMk=,tag:BzwJCjCbU4bfwwfr9RQ21A==,type:str]",
"namespace": "ENC[AES256_GCM,data:BpCfZrg=,iv:xCyXPCR5xJZZCL0m63k8x8O2Jv7Tzppj4Se+ajWpO6c=,tag:q9tayf5tfbwW+dEK6iPYxA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"template_annotations": {}
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:WQ==,iv:4DvHk+b2vOScORlR/9+AQSKM84pLr66VQHkhf6wVPYs=,tag:/Vlf76x8nXRB6zqB7P4eSQ==,type:float]",
"private": "ENC[AES256_GCM,data:WlgRA7x7kc4=,iv:ioULQSAOldv/ujgqUu1hC8xUw4dDMCJQSeAVVR0NG1Y=,tag:mLE3It8BjPgA2WpBHUS49w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:fTo8HvnxG/G+/kBdxWMUWyEz,iv:RVQ2ogriWznHrvWZC2ioMqv1TUHzM8gVd0VDXtd4Xug=,tag:KMw65HXx2zxAR0r12IdGsA==,type:str]",
"ENC[AES256_GCM,data:dIj8kmOb76toO64/M08frd5FUP1Urw1zFb0=,iv:8x7Alsk0lGA46Y5ao94P2Sh3sP31zL1l7xRVtoTwWPU=,tag:alYg+VsE2A8OdvulWZu+Bg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:0HjcVum2Fw==,iv:f+lE2vMSnIHA7ogtuOKib5KpfpfAcCuRH/g58e6zF8Y=,tag:/xP3DqED2i3amYHtRXA/hw==,type:str]",
"type": "ENC[AES256_GCM,data:fUIoDoi3gOj3QBIamwEDL8samBFv1k8=,iv:3Lwix5ovhHPGO5sFYV0SwGrfWW32wVaV5tOsu8KVDwo=,tag:ePa2oEy9LpP5DB7aDhIXBA==,type:str]",
"name": "ENC[AES256_GCM,data:PrCzM9IYoLN0We8=,iv:lDBu9ML5GVIya+VSgB5WK2z31lQM1BFd9mxG60hPUvI=,tag:f0t33l0oZjAyJpIxh4zHBg==,type:str]",
"provider": "ENC[AES256_GCM,data:O/IE9C84lyRDThWezWYzNQuOdGT/HN0BQYAAAgC9EE4aEbbcDYmDuFcxDImAVCoOCIxU+c7V,iv:M0dSs6uR7VI26zmrVcqjRqqcGIqEU2dCaRhlZG1wGXM=,tag:9TiW8xBnbNsRxmpOTTSz4g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:jA==,iv:okGHp9qtxJQ0TQfSlYd2yPvCBkUPSv6tml0obD/TiA0=,tag:oBZuxUc+ySrhIrE/0tjjTg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"aggregation_rule": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:70+40QyEZJd8iS4=,iv:CY4JTgHXWiSx07nuE6Qgb3Mu5bAw2c3d30Z7WRIO3tE=,tag:2gBATj3Qgksbstyz7+NRgA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:GQ==,iv:t6dm+KG2E2/ZFUHLCPEzFHIDQdiRG6D5GigTx1watwM=,tag:7cBTxwqKOKSPmohK7UrezQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:kxLJrfAaNl0PccU=,iv:COpsK95/xLggrZwSefEbN/lfuBQeJxz3DSJGYzBQKmg=,tag:aEeAevQ8UNknvXDwx+u87w==,type:str]",
"resource_version": "ENC[AES256_GCM,data:ch+nD0Z5mItc,iv:piduPa0QxOTre6iG4xQv6Xngbw/eJRncFtMZzUXACIw=,tag:kWzhP7pSmd3MwZATywwaQA==,type:str]",
"uid": "ENC[AES256_GCM,data:37WrqYuKklG4kJhdhFcMt0A163HG6LJqERVsXqs3Xelf8gjz,iv:FVVAvSZeNIAvz6+oK33weo4j+veTFYu0iaFCglbfuWs=,tag:w/lFRIk9bT573djJAPsl3w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"rule": [
{
"api_groups": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:kDbXqA==,iv:49Kf7qFAKy9/1Pq0GE3QDdj242/dm7u/AuO6R6K/QAE=,tag:sLdcNqFLfbnXvsC3g8eb/g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:OZtdJci2sM1lhLA=,iv:pkRnvWrfEUkn08zwO8n7JjWGdHtF8NGBKQAbY4P7FLc=,tag:QwSWnkbbu36Duk7CJ5xp4Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:S6vv,iv:l1hJ1LF/hO2xDA0HrLFp89CgqGA1FVWNhK2+gI2XivA=,tag:KrTQiP1Hya7oYow4aq2DIw==,type:str]",
"ENC[AES256_GCM,data:Y1zB7g==,iv:b4LJmttdt8c9IdrlU7dgdhKe99foEnqDY+SWBfQ0F1M=,tag:AVJ/DINpM0NKaG4sgJwRyw==,type:str]",
"ENC[AES256_GCM,data:2nc7QJ8=,iv:4cGGrlC+s/rRZNFB4/fMs5tLcNearxdvFkWPlUdbtc0=,tag:kv4fWYCWvcFbovlsW6DiiA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:KThG+w==,iv:blkFxFHn2lZwTQTsbmIX76C3V0UNul3FxpJbepOtQv0=,tag:FjKX82CFI9D78XHx7KuGag==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:4bUF,iv:F2tqu46KYtnO3CWZdvtxH10EQHxpCUXijBxoBMaarF4=,tag:TUjx6dmZAFky3RQjIPLvoQ==,type:str]",
"ENC[AES256_GCM,data:a2BVsw==,iv:nL5ol0kRJZsv3mBLNnFkj7UsSnjWGqEfqOPGGyg+Ri4=,tag:NZSlCvtBQN23y4GNHVCJ8Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:2w==,iv:W7nNnNcgZuDSWttRcdnnvdtHHBcVqmHS7zcMCycMQp0=,tag:dWTOptTYKR0Hrt7YfxymdA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:2gXNOJnmVcOjRwVk7PQH/90zD42tlAA25Pl7VA==,iv:HoDKlxJDkrw4Jf3bKzoiH7exeh80sQYREQhgWyo8P1g=,tag:477ivIv01aBdQ7Jnxjp+bg==,type:str]",
"kind": "ENC[AES256_GCM,data:4N8C77mV3sw7oHg=,iv:JwfCsk3lwmbOryjmlAT4PhVY3CMnQa0jLRSFxOYfb8c=,tag:G6wt8WfaDpk/t4kahC/OPg==,type:str]",
"name": "ENC[AES256_GCM,data:t2WlhCbTblzPl3U=,iv:acb1wZHTKVF5KoQ3DMBw4vn412LCsUxnxPWYGmrSNpw=,tag:By5bRv3O7IOc+IX7C0wI7A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:J8YxnrofADE=,iv:Jeg3+HPh0L7E7CzUJEi+YKle7nW94cHXmk6jS1OrOd4=,tag:Hoik123mfpkdvuA/Ft5YWQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:qv+fxoU1qg==,iv:wyJG6I+YM57GqXDkdRJXOmUZa3am8TfkcVYe6VP49Ek=,tag:pjEYgp6EEqW8+h4CtKAGVQ==,type:str]",
"type": "ENC[AES256_GCM,data:Tfh0aZpfwKOUaf6x+2c5jqgD5ZTTqek=,iv:O+eMVbTABz+Ome47YzQzkXj9XaGlaNCqDegdlavKWMk=,tag:ICMAMV29SJ5WKNgu4oXsTg==,type:str]",
"name": "ENC[AES256_GCM,data:MEHek79KrQSroraNSes7nQ==,iv:+Ro/H9E/7LX/pt4MAMKIHL7H54Lp+1/9TZgXkMOwjhQ=,tag:sxufYkhoQzXF0b3IgtUUYQ==,type:str]",
"provider": "ENC[AES256_GCM,data:4+u87+OPR6ZrGsfIhXiuufGsYdqAu7SogoH/gBV0nuGXNg220EYtyimLYO5MoO1FGrPyPWg6,iv:Li/aKJB8BGynDCza0hHWI97aRvHg4356+XvNwtnMgYg=,tag:rgO30Tfbf/yccuhRaqIdTA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:0Q==,iv:sVinKZEGxwTy5Ak7cq2ckGUIvgx8r1WDuIIvenK8xag=,tag:93er482BRH+fnZFBERd5Sw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"aggregation_rule": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:NaNXMgKf2rffyQajLtaIpw==,iv:S5ztoTHC+kWDbCFgaSBdg4wl6bNwYfC9heDtvvvNXz8=,tag:on1ob4iO0h5zb/YhKK0weA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:yQ==,iv:J/p8QjqGSMK/mu3yqagopt1q0TVy25Z7YlCjQOuxCz4=,tag:XkvJwTdhlU4NpX7Snn0GFg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:rbijLQsAxeLHOcZMpdd3lg==,iv:NLJ0AnvSeU5jeDEN0hReoFp/XjgaHDqLXfzJCYLERpE=,tag:XwDIB/UzTmZvzlmnmc3oUg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:IYckSEBhY1QU,iv:ecESvnDpXBMzBGCIjfhebKlwPcYst5DeQUB0U5qq9UY=,tag:f/7hC0NON76H0kc+rLt2eQ==,type:str]",
"uid": "ENC[AES256_GCM,data:xfdPOcZQZ2vNc01qwJTpVHfQiLmsod1eRy8WEEXicb4972ez,iv:F3zMn3jxsNjJZzRdkFEQEodYSTEzyhhs8pHDp2z3Q/4=,tag:nfAjUQkkWA6ZpxjU/6lZUw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"rule": [
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:eZXBTATW1LcY7O5RtzJ3S5ABiD6c,iv:4rvrJdcrpNcnrPEkDoiY4ie0cEfYnrpXCdBAkLrw8Sk=,tag:vPsnNx1Fa3AxSHOZTD5uxQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:hCBs6Yvm,iv:0GYX1kULV1McBbK1xkeD4oU6u/c6alpcUnSIbs371cQ=,tag:9HM42By099DGZBsmBfg/UQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
""
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:mYu/GDAJE/rtrQ0a0R1S,iv:xxxZmY+mPJ5fvpjnWJeX3isDnFA3ROGha1fle0Ktqiw=,tag:+2mM67LBG0zYfZD6ligx6A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:n2Qh,iv:XWNjdMG8gqZnEQXXoaZxvFgFgq9Tk23DkAl9v5GPLO4=,tag:TnXlA8oVh4B89EMDNFIAjw==,type:str]",
"ENC[AES256_GCM,data:tgUqJlHL,iv:58jNkjtoAiPcregbiabE94o7rtkCUr35I+ikzUGyx1w=,tag:5Q9xq46DrAnNtKA+QI+1Pg==,type:str]",
"ENC[AES256_GCM,data:b4gBelNb,iv:/FQptdlvVc+TzB/JIkLlmoLLfG+sKMN5w+crfh2s/RY=,tag:awAtB115EZDgu+oMnxe5yA==,type:str]",
"ENC[AES256_GCM,data:X2OREMKk,iv:OEC9ceCz8oiySfjc4upm8ITd6HqA5WOTelzAKDxKrrc=,tag:UuR1grkakHCP0NoN/1WQ8Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:64f6A6rwGT+Ag/gkm8OQOCRNEQznhnHS3w==,iv:8nVXqy+gfCyWXZEUBe8JR8UslMDDt9jWmwXET8V9Afk=,tag:ppjznVZpfy6xqRrBPClFkg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:BYjQ/u3RisdF9OL5,iv:OL+1V/8yfqK/Ibd1Le0oVrMnj+i44x9OiKN7Ggfwto4=,tag:Ljb+Du6U7UGQMqImBLFzYw==,type:str]",
"ENC[AES256_GCM,data:SNIg2hFvaYXJfg9fPlpP9Kl+AQ==,iv:XDsjorVd4aP8o4o42hHoI/dbgy9AgA4GvJSzRtUCdsg=,tag:Axz+kVJtq74T/xmAV5lTWw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:h6WTNFD3,iv:1GRj2ntjwKvERMYLU2Y6EAtDRwPvwi4v6lZks8fc5WI=,tag:kbbfm1W7XP6/KjDboQT/rg==,type:str]",
"ENC[AES256_GCM,data:GKptXpNy,iv:9WhQNs9FEhTmzNF9l2+WkFZOgXCsoLV2W9lKScRGCc4=,tag:iLadIqGpRtr9odwQd/tBew==,type:str]",
"ENC[AES256_GCM,data:BkFcZQDt,iv:o4R61kcj4sL2ZZ9wXxQnqxbd6l14JenJqfCkDNapUnY=,tag:CbUlk8wVtHJocJF5kQLcjw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:0kl3hZUmHUhS5VoQC57mm45f+7rWc8tWsw==,iv:7B7Ek1P6R7g0I4qyjF2KCV0AfSarMFfpFXvROR0EQrU=,tag:H6BJDk5EOxfh338j01tvog==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"non_resource_urls": [],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:W0wo4mk=,iv:7p8rrPYTKlJ/DhyaI19wbuGj0FdqA9GKbsAK0ZtaR+Y=,tag:SZgAaqZ37AfWJP0ws9n0Kw==,type:str]",
"ENC[AES256_GCM,data:STNRfV3d3wlJcNI7,iv:cX+tPaiwX47BOX07306Ipz5Dq3NwdRKsqnExKFWUG2s=,tag:/9506gdqaoEgdwkQpYYcZQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:qEMPsg==,iv:EFUtOT5fd170UIoRseG21fcZ98rEczaQH+zOqSKjTrc=,tag:jvnR2VAnpEfMFW/Uy18kyQ==,type:str]",
"ENC[AES256_GCM,data:7w8mO9Sldww=,iv:y8wEo9Olxw4KqvdeTgXBab0uuhRbrDsHEcCn3GZFJz0=,tag:j/NhlIXZcHuKX+5EZ+NvPQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:mw==,iv:BXIXLgSTzEXZCqI7cL/stz4x7qJYkum2BSivSkJWbrw=,tag:iyxQs4Ci8xCu/vCneCL4zA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:r+bfYWGDaSoB/YKf0vJTuH9ZkpxyTbM6zSKjlg==,iv:lTDuJDXAdcD52Shlom23+crXYSe3Uzi/+ywrLBxN+WU=,tag:JqrVGJZW2HBo9mp2C5A8Yw==,type:str]",
"kind": "ENC[AES256_GCM,data:c5mmg9n8+BNa5/A=,iv:Jx+SNxpjTzaCJnkp3jIeGvlbp/7t8n+VKVowbcaWXpI=,tag:E9BYf0nZKv6szOXPVlHyxQ==,type:str]",
"name": "ENC[AES256_GCM,data:8HmjEHBgDXOPa1qJD9s1ew==,iv:SXzdGTgL2nfbkwo9e+O4FzvM7bbrK36XW6tm4NF2sYc=,tag:dGAjiSjw3JksFiTJLgUNrQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:aEwC47nXZOc=,iv:mygIKIImCsg1wicXs4NOJkyOyTJR5xBq6hsWJOis4Rg=,tag:as5ZpFFEfvNGlFardtNb3g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:yFq7oLfu/g==,iv:5LM8gjvsHy73mr2mM4+3W+VwdtzKJdzSSkHom301NRY=,tag:UDvB2kPWtCegfwmB/sfSVQ==,type:str]",
"type": "ENC[AES256_GCM,data:U/uOImAI0ZcRNE74a/s/QC/cG/LU4m8YcJ9CLhiGWw==,iv:jRoVD57JQiHoRzfCMtlpdWf1wz0aAn2VDKlqOwxwbow=,tag:FE8SAefUjtH6RiZhex/skw==,type:str]",
"name": "ENC[AES256_GCM,data:aWb/h6ZOmb8UrGdND9IDTg==,iv:gf3H/XaPS+b7hgy+PO2tyRKwKhnXdy5fVKzRm+pToNA=,tag:MuVsHkeL756u8ZC85AFBWA==,type:str]",
"provider": "ENC[AES256_GCM,data:lIZiqxQK6StzT1qENcD67VVPC9kJAGJmMOFyZnWxin1rbk+n/dFCV2eiX7QOHkzSOXbSTvaB,iv:x79YHGszMndu21LL87HkugARHl3yzYq/8gKJ8tgj1sA=,tag:mBWtAIHkXHKUevPHudTj8g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:xw==,iv:NaZ538MdjpwvJ9AHDMM7iWxQGtNWifzdmS3pHh9iJrw=,tag:IP8R8yuYBHx1CcyIzmqxCg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:T6Y0x0q2BpIdwPRTYLr0cA==,iv:HkJZlQAKuHJ5zPz1mpisCR+V64PnfqsPE0vVa3af8sI=,tag:XHd7jmqkeQgKC206e1JwJg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:JA==,iv:mXjRN3Sv1DjEZPL+1v0R0QgLX86c05twIG97w3pc7e4=,tag:x8vdcbZ3BT8vX+cRzLsnbA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:0+YVt6ageUq+ZOzOrn1tCw==,iv:9o6pkCby7RO1ZFbwb2Ka6oQRHcDQoxEcjWgczIlYCtM=,tag:dFI3EkSmcKVWm9WF2DGX0w==,type:str]",
"resource_version": "ENC[AES256_GCM,data:Opkr5suK6aaD,iv:rxoDl/5zScMBcxh4nw+7PRTs0qSlCvPK8E9+mczi1n8=,tag:CGDSUiHbkzdsl8hAxRwIRA==,type:str]",
"uid": "ENC[AES256_GCM,data:/4X3IRKJzsCkHqYdA8sQkjO6hiQ+dFLz7/NLXRlDB75rNhjN,iv:4zVq1O/oky4Pc9H6jBEpcZucK0ir7jArTyh9oc+PlaM=,tag:SashiGGZKAQFjKL49ZJCTA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"role_ref": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_group": "ENC[AES256_GCM,data:m0MaFRNjaoCP/guYCMnK4BeZZaopzz31fQ==,iv:xGfIy73XWwgFcpHfo7fMYu/KHTPZ3MiT/RHYx3hceaY=,tag:bo0LXx4VfYxl3DmaZOgf+A==,type:str]",
"kind": "ENC[AES256_GCM,data:57e4DASxOohqmfg=,iv:uXuJlXLPQiYUYFIApkC2H5t8zWZqYLTRicYK3lQWXpY=,tag:yliwlf/znVu6q7yb5eSe9A==,type:str]",
"name": "ENC[AES256_GCM,data:xdd9XQETj7REZDOxPMFtHQ==,iv:nhREXTtezoyJNkBg0HycjiMzG16lTLbn4MZoRhnfks4=,tag:kUCbhQadYxAshORpKs4xog==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"subject": [
{
"api_group": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"kind": "ENC[AES256_GCM,data:ZCZKPVzWbmcI0+iJF5A=,iv:Su+9AQySCjmY3RoKaIW+Fa1nuYTFHS3bv5xzC+mqU54=,tag:cz+EMaaj/aLqMsXH+oeMdQ==,type:str]",
"name": "ENC[AES256_GCM,data:3XbVbU8=,iv:NMFyqvoPMNk0XuYx3jXwt34g153GQRMOt96vgdUNlyw=,tag:ugIYwUG/ox5jQq3vza60Nw==,type:str]",
"namespace": "ENC[AES256_GCM,data:kXG7a9k=,iv:UEg37EjP+9A9lQAskOW6Bt9Iiefn3FskJ0Zg4k4En4g=,tag:Ozld/BLOUaXMYzWbywxHQw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Rw==,iv:+MQa/hH8sD/lUVtMd9jX9PipCPc/HKs5mKXNcSr08rM=,tag:NdAqO1TYzUAL1HV+2d87qQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:NfALqKImGlcDSxriJpHc97RlJHDZoOZhsx4hdw==,iv:diT51NNizKQTMeNY5enSRQsI9NmAUJpVNIfi2egz/qY=,tag:8vOul4R7AEz/4VQDd3L3OQ==,type:str]",
"kind": "ENC[AES256_GCM,data:wck2RT8UPhR491DADndFki/1,iv:JMMDtXVS8DP5Q4XNvFGTWrgXAhNm7ZICEDZiyDtWDFA=,tag:gpJ9wCume5Q0Wla2r2DUpA==,type:str]",
"name": "ENC[AES256_GCM,data:iKfvWFD5ld3qew1O0yqnyw==,iv:ZTm2i9dtzvNGi/93TsRwbY8VLhDppSS1DMtMl9JPHpk=,tag:kvbehyzJ48P7jYcQYE847Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:MqImGuRsp3c=,iv:qTGdSqfR5RnEvgF24OK1FTS/At8KGHni/yzbNTMkJP4=,tag:oxD81qwBGJkqdHSNXbUkeQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:vOF32QjF6TAHyy/Bteh2chk3c6SI6MSSufrc1kRJOTIo90zR+Z5+Kg==,iv:4g71UhRCGjr1fbmiA+6nbFKYDFdpbh82st+d6BQ/n7Q=,tag:riUjJrzoKXImcAHSSV+wuw==,type:str]",
"ENC[AES256_GCM,data:KX7ehKLU+Y6VBGfSk9vhhR9um2ZjR7QkWrI=,iv:VujnBwMwTRS3uuvwHZjk9HQ2qCKkpMUS9SRYV4cuNiA=,tag:fEWg5gphzhrP0+CtuKrsgA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:zvlMkHkrhg==,iv:34H4lQaqd39L1Wo+v6YUDUqDM5V+Khho5janhQ+hmxg=,tag:C7w432DnZmSW/8mfNbKYHw==,type:str]",
"type": "ENC[AES256_GCM,data:vbVkKwPB+Ip4mClHUqx9zMOUzViBlQ==,iv:nO3bM+ADFp9Ki+enzbWWr1PVW1TMm2o3y1MPbsuIOT0=,tag:qsUuwR7te1bz/x5JyAtNbQ==,type:str]",
"name": "ENC[AES256_GCM,data:aaRVTA0YsNNwTD23,iv:cOgjuY6Wa+408OZWHUS5xCxBW+Al2GYDvxFdp+kj90w=,tag:zPyZ0yAvyAMAT/WBX1K3vA==,type:str]",
"provider": "ENC[AES256_GCM,data:SzDYaSTyJGnQCrL+7aimvD1spZo9VHEV/EcJi6kH6EWeLw9FeYL581P2WiQVUNT3QjTWHebl,iv:vqjAHw/XqkIdOMZBx5Tvr3xS3Bt7f6QBcMJql/Yp2xY=,tag:wbvo008mPK/hGqzIvc+cFQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:cA==,iv:N2TryfU+BNbuGLFRdwPFqCmEYhlJ9l6w3dAr5A0ls6c=,tag:FtEWERG62W7RBbKY+K1Wzg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:MoXOnMtOa8fYCWzRIWZ1Rhhw7fUpIwA=,iv:z3VlYJSe27zZfnZGKUHipnrOX/P0nGmNvSIQ865dlXs=,tag:l2jm2fVYKU6+7ErI0WpcWQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:Og==,iv:mbYj42e3fvo3dTGFTxQsfWN33rPuiUGyxuV8WyaNbxQ=,tag:O49ddGgZGB0NtxbOCSNVBw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:PWrmJtDeW0ENTpDVyrP3iTc=,iv:OUX1KHsUxOvpyar9I5thBJXppEk1GPzlrFHqeC56soA=,tag:o6Ny1laXzdS3s0PcXHF4Ig==,type:str]",
"namespace": "ENC[AES256_GCM,data:0hTNR/I=,iv:BAO9eq/EriJ0Wwkx//be2OmH6ZGNSxYMxI6XebvGIR0=,tag:Npf/HdCQejnffSVuojGGgA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:75gWCt5xEAXL,iv:cmUYbb15hBpLzu8aDTxYjuQq03TjkFUV/jTvQpBOmTg=,tag:aUYCBPBcVN3BiTnpA3C+Qw==,type:str]",
"uid": "ENC[AES256_GCM,data:1KpzNXRD2cUMjPoBj7jsc2UNJG6inMB6CnJsVZV7xJwQaIyF,iv:sPV9liehCDwmZiLBMb/uE+lI5vx7J284WxIQQXfpBAU=,tag:YJRPvt3Ka4nP2N6nhf8Lzw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"spec": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"concurrency_policy": "ENC[AES256_GCM,data:aRE4BO1Z,iv:xAQhccfqfMmnZiQPZwYKm6PCcwyVBOIbui4PWN86YeM=,tag:o78Dkh5Yl96wZwOuATjVmA==,type:str]",
"failed_jobs_history_limit": "ENC[AES256_GCM,data:Cw==,iv:ZgGcwL7qPIdtKP49QX32h14e8Xogon3czmo4637wZWI=,tag:UiCoI2okECSMfFiCkqQbxA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"job_template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:xw==,iv:CQhSFJbU27Qo4ocKiIWM6g5cEpbU/dE+L89DLOw1Z+Q=,tag:2Py8o6+BB6Z5MzWDn+k3Zg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
"name": "",
"namespace": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:xQ==,iv:3XhQ/18xdjT4yLP56MYmgSbTz7vseXCeM3VuUahP8Ic=,tag:QbNYSiaUa25S/IFjLS1FUg==,type:float]",
"backoff_limit": "ENC[AES256_GCM,data:dg==,iv:PAb6dqiFH66ytFUCWCaTpzocyO2KAW9H32EmkrQ1pkc=,tag:BwMPiFfRNXTolUeEy6RgWw==,type:float]",
"backoff_limit_per_index": "ENC[AES256_GCM,data:Fw==,iv:QTkJn4Hr/EcO/koFNzdzWutMd8Tb/wwoBhM92fYm46k=,tag:JX166YDxy1qFDqF4Jyf+3w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"completion_mode": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"completions": "ENC[AES256_GCM,data:dA==,iv:SaO2s9MecWXaEmVngymmAAcaRF02zW8QJHx+odjIvPk=,tag:umQgRUxUV6CIJ4MIbwPv7A==,type:float]",
"manual_selector": "ENC[AES256_GCM,data:GfJIwyg=,iv:iy0dLoDNtPQTR7jmCfF9bmU7iyBDxE6eJGoYJtxMTxU=,tag:bgPt1qfGTBbUkCPEqpk7DQ==,type:bool]",
"max_failed_indexes": "ENC[AES256_GCM,data:bw==,iv:QYmId3O73ozeuIif9UaB/xm6kmOJ6QnVfCL3fw8UC8U=,tag:qwdA2hoq5K5yXorKF71usQ==,type:float]",
"parallelism": "ENC[AES256_GCM,data:Mg==,iv:bOtNxzr2jpglyloE66dSdmfGLr4Qel1/rtM9LvOMPNc=,tag:SJ6jXkzXGNUy1ioLpNHkqw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"pod_failure_policy": [],
"selector": [],
"template": [
{
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:fw==,iv:4BePpISmw0swYRs61OPhNGfWnNyYUm1Fs8os0MmeeAw=,tag:DtwFiNTikiCWJ8MURDGAsQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
"name": "",
"resource_version": "",
"uid": ""
}
],
"spec": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"active_deadline_seconds": "ENC[AES256_GCM,data:5g==,iv:gak9M+YMNjAFLjpXZHCiq1zQy2r8pCLvvkqKKqTB7Lg=,tag:QWmBHJE9JrCiNWQTzLHq2g==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"affinity": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"automount_service_account_token": "ENC[AES256_GCM,data:k7kH3A==,iv:j5+2LlUg36i5S7gNSRsvtxgADf9ulihnng3RL5TllQ0=,tag:b28NsWXPuuHaHHW8B6cWSA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"container": [
{
"args": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:FENmBcP7UwiL1P9qwiewHEcwoxC9kbR5R6uaRrhu2EjXMPO6Nia9hoABuX+u4VmskDn3dJexOBTWQZgw7sHcLUN1U6TGUG0qhItjthSraPxHGe/yXKYJ5WwQGjh7Vt8UEjGQBA+gPO+s5ZRat8WuWi4DzHD7xWUQJFFNfVLJmayfISyJfZzVcYAs1iwoo6YnIbY01Rl7xEJSCfT+/w6bEp1s1o9hEXBDgEOGNmLzueck0ZZsG8zv/JHXV6Ren+niimKKndlYYuUwQ6D/mWNchT4+9UxY0rBDh4J20uRIzXkfXeLeZT5B/o6Vf6vLXoR6INXaYIPxtVv6LjIJFzheMG1BxnPMLKpL09ZyZhLUat35ad/JPiTVBJ3ESOJ/1wkJ6OFm8Y8Ckr7rbOPld+h9ePUXe3uiO9+38Z+zMtQooZwKD09+yKtTXOyxyttmjdv3Q+F5WR/LYJc6VvYc8YaJH4dlxwRSYxituv7tY6veiqHWDRoKQnOtXxjNaukRpnbw6Ty1zDbwQEH7bX8y4oGicSA/sDWpmJ00nlWbD+/ePIBhcI6OMxQiXcirfHM4wpF+cy7c27YMgSGVD6Ogu8v96Bh5qQmRWm0cyj65doPnPyVEW85n6RH/qbYhc8dDQd7nCfbNJD9+mvzY8yAAqZgETlfiOccuTRaP0EpUsjPpOK7UF8+d1rY3T6AvQPn5QlrZrheXXLVQUm10xgnx6tBikU5cIj8CbH9k5Qj5wY3P11kYLs/6ao9ilb+pGqD0lhY5lbe34BVhIj1qxUk65pBx9re6cK24EqNC0ZbQB1hFtNhbRIrZHFYbDBhEkn58aX22NjaBdE0bNydkDJHk8UM0SR3sSwd0flCrM6mAlw+i15rLlL53C8rKKOZthONSQ3mHkCmw0FA3Q69c+OYvOOTvJmlsOm+kdN1KCHiMjWL5A89lwIeRSH5zbTai2A780KemgVvSGBM4jTm3gUFRyGjZb2GgTZgneOL+hHHhu65FND2AfqEm3gz/MHJyVBps91pKvbyalPdBaBq8j3SJ6P24RTieXhpUYVoWtSnz1jdIC+AD8Essmrc2Ffrq3L935+nBTR3vdTODd5PVL7fTjIzXcbAckhfHokVVworeX04NIWEzlROKxDRqKVB4EJPqCTnjupmERwBPG7oVSIVOBzWm+1jcM3+BwD7lIAxNLgJIDWeiMeuzGKQGotcatG774HuTckU/cSVV6eBWehUK0+fmmnszSRQVHukrMaPanTlQpeLB1t6PEn8zZeT9EvwY4gIl1UKYfWJ2oW+D/K/sV1xSWVLiSrSUqRT4PUSTetYjXTfVKODtFShrxIKN5jaioGI4ynywwCrVHEQpnkhNMbz/r56bY07oTZQfwIaoH6xtKcl9n3Qia48C7SHAuGIExwXHvrAK5+YQEu8cILVFnm+4fx0DntN0K/SjWBB1KbN5Ksth+3R9/C0XqxYPNZ4Ta9WcJxXVbNOfx1XI4wnAPpv2Hc/bV4W7zjqtAx243PyAx4saedvePM2lh+eajNTatBzkFRpui/AwFVV9qc9xBrNpsc0WpBK9PQQuIJ28TFNveTMX/TW5t3ySzJTDGSxh3y00cIQdqvCJayhNzDpTxE7tqAjYakwXVAZMmMCUd3EnaWTl9RD+tXDOLQuzCKgNeuW1fwMLX/OSCq4xNOURHhT1URCqbJzfwqVfsjh2jqWgMc3DpRMoCZFXlMpCAyW8jSjRfLaUfNnHKQ==,iv:SX9VhxCrDcR/6LcEKPjSjLe+/A4Pvh3UyxnN3Q3Fsvg=,tag:y7kH6Q7OkHhiyKSmgE6DHQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"command": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:vxLrJb11zQ==,iv:8oP1aTwdWf5D7U5KwB4nwD5Zks/hS9ItJj8TwoCTJPQ=,tag:exruLMbnL2UuILChsTnFNA==,type:str]",
"ENC[AES256_GCM,data:m8Q=,iv:dZiOwbrIZhLTYwYokse2tmCwgKVQXCWOA301+/3h8O8=,tag:wU02jDUGfagrd2ynSkzaOw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"env": [],
"env_from": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"image": "ENC[AES256_GCM,data:bnYApBOG9uIqKEQ+KJs5213a3R3SMA==,iv:oPsmvyzH/Ypey1pqHn5ENCpT3L+C4y//ifrYtuDu9TM=,tag:/UYLf8p8h9k+90pf/PjFRA==,type:str]",
"image_pull_policy": "ENC[AES256_GCM,data:vDgUDS1fbsCS9UjT,iv:y1ZhturfA0aL+X/pDowPJ1e6C6d1Rt4SgIlf5knZXVQ=,tag:HQAOYViyosCHyjxzJBbcmQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"lifecycle": [],
"liveness_probe": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:8NZgGyMe,iv:kzGxDK7a+ZIIhUgn4NWiriF5S8//Z/JdbiN3G3PPDWY=,tag:r+xIW4XBLwQLgQfYkArXAg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"port": [],
"readiness_probe": [],
"resources": [
{
"limits": {},
"requests": {}
}
],
"restart_policy": "",
"security_context": [],
"startup_probe": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"stdin": "ENC[AES256_GCM,data:dOeMdZY=,iv:s55tjERXZ3LXwCv/3Anp9VcRuWEg78wUBRXo21PDRcI=,tag:IVA/Csapbk6oWSrVAV+/gQ==,type:bool]",
"stdin_once": "ENC[AES256_GCM,data:9D/DwDo=,iv:4pID9fyrUhX2AKqp7BmLybo/gbCF5S62Xhm57irjMtc=,tag:SDNHv0Wu6WPiINsod/xopg==,type:bool]",
"termination_message_path": "ENC[AES256_GCM,data:F5BBR6qAPiJB7EXJNZMjnB2HUyg=,iv:OpENpDJ7wI4b/A9M4oZgrIrFpSFTHBh2M7kk5XcdReQ=,tag:8E4ZrSClJz7jebUxotXtfw==,type:str]",
"termination_message_policy": "ENC[AES256_GCM,data:IZ+rMw==,iv:PAjnodN6uiEY7H4XkLxQw/VZSMDZLaTaSyRD7TLyM7s=,tag:h67ofoMO05ktMxmh8P422Q==,type:str]",
"tty": "ENC[AES256_GCM,data:CWrCbOY=,iv:qdpO2j2P9M/LkSnR6VozTobCNw6x3PG7y+7GifWHtjk=,tag:Z8RS0SOxF8AmibWhoK4k+A==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"volume_device": [],
"volume_mount": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mount_path": "ENC[AES256_GCM,data:OFk5zl8/7w==,iv:HQG7xprhuegQx3nCqFAsP4/TCZE6oAIJbIccaKZIFPY=,tag:4Q2eQvHDWvrO9kkNw5z3sw==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:MNZ7zg==,iv:GmdZYEbbPlNtcyvrFwwA+w4QzQ6QuF7PSDZKSyKaeMU=,tag:K0rfc1aRfqMavL9WJPdkHA==,type:str]",
"name": "ENC[AES256_GCM,data:XiT0mxnZcWVbP7H8YAo=,iv:N6v7qTl2pRTuo9QXuM8UW6TZn2lOl4i4OkqexDApT5w=,tag:5W/q2iH11mPXKQm3iFU6Ow==,type:str]",
"read_only": "ENC[AES256_GCM,data:qm3g79w=,iv:kolpHq3M1ZYBqjuCpYgRhv4N0we2XY/hQcBMADOACt8=,tag:Nn+MDm9lii0h9enUim43WA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"sub_path": "",
"sub_path_expr": ""
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mount_path": "ENC[AES256_GCM,data:y3+kmCRmjpLH4wLI,iv:KMGd9e1r/XOOsGEndktuVn8I+wBMpoXg/NblAytvMqc=,tag:Qsp8zLEp1tBtX+Snukh0Cg==,type:str]",
"mount_propagation": "ENC[AES256_GCM,data:YfJ7hQ==,iv:JkSBA5EDq7Yz+xbOVbXN6UfEFzqyhHfpt4MutVcaq28=,tag:2o/Fv5QFAHY6B06jFr0zAA==,type:str]",
"name": "ENC[AES256_GCM,data:yBNOcQHtPU3S3U0=,iv:xO4LD4l9YTcCJmYAQDOo46xM594rZf5fDK9M4lvs0ks=,tag:njybtB4tdlY5Km5BdFOuxw==,type:str]",
"read_only": "ENC[AES256_GCM,data:FXRESA==,iv:G0yQRDOuxXK0KhFopLfa63V513GXMmdg1Am5MEIqYok=,tag:SpdcyTVMM9fn1wm/q/e7Gg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"sub_path": "",
"sub_path_expr": ""
}
],
"working_dir": ""
}
],
"dns_config": [
{
"nameservers": [],
"option": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:InUAz5k=,iv:PaW4kRlJlB1W9voD6u+0joI91VBchP/Y2WLjhjTIOxU=,tag:+ATVK5SnsavExCv4Hk/qWA==,type:str]",
"value": "ENC[AES256_GCM,data:xw==,iv:oY7jWS/Nr1FLW+YtPaC3K4J4JGB4IpLajc86oqnre4Y=,tag:eTBwm3am9H4PHuXmniI/Wg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"searches": []
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"dns_policy": "ENC[AES256_GCM,data:2iecPlCEgU4l9Qpw,iv:0SDw1O/AztE9ChhoI5gvXQRyNAHxxTV7xicA+kYIWaU=,tag:afsm7wefCAUb956CQU+/TA==,type:str]",
"enable_service_links": "ENC[AES256_GCM,data:CLht6w==,iv:LrTZ1sfWYDAFIeIkaDE86mLa+iQY+OjlwMmMTdNs8Y0=,tag:vrnaYQhzf7CkFhwhpGIF8A==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"host_aliases": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"host_ipc": "ENC[AES256_GCM,data:ST9NsN4=,iv:siSFGJIevBXgNxyYpqTYqulQI81ED5yMknKXzXk+5y8=,tag:7XQrhNReT9k1DqBksnYu1w==,type:bool]",
"host_network": "ENC[AES256_GCM,data:NzzD+UM=,iv:X3HlVoOeBYLe/QE6oKUMo+ziyiu+Di3h4hqIYm7yQO4=,tag:TpulaBKBQQ4geYnfpvJs4A==,type:bool]",
"host_pid": "ENC[AES256_GCM,data:HOuQZOA=,iv:SZmxeBp8b1AWK4IEIZP9DuMi+q0SZ08CWiEBqDWr+Is=,tag:Wp6IwDYcHZBDHNXdG5jIqA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"hostname": "",
"image_pull_secrets": [],
"init_container": [],
"node_name": "",
"node_selector": {},
"os": [],
"priority_class_name": "",
"readiness_gate": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"restart_policy": "ENC[AES256_GCM,data:lVgZbxpO1TfP,iv:cWZUseQPkjb29y7YvkLZYRDjyGNcc2puwsABpDHjudA=,tag:XWajXEyEZOf9Na+Cgp+z3g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"runtime_class_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"scheduler_name": "ENC[AES256_GCM,data:qU3/vISF2yudOPf0t9DZGXg=,iv:Au6Ya2ciey/+qB8qLHN6BA8LlC37O5j9JAP4aqduha0=,tag:uyIZnilMglurf9eXnmJHqg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"security_context": [],
"service_account_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"share_process_namespace": "ENC[AES256_GCM,data:5Kex5MQ=,iv:x5aKo1TfO/lX3pG0qxD3bdeFxYBb6M4DAjXiq5Q7e1Q=,tag:58D3rw6RVaGlKtqBOHOzMA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"subdomain": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"termination_grace_period_seconds": "ENC[AES256_GCM,data:ZoY=,iv:n0CRg6BtjdkM9brznFolHVz5s/FXtDT6qieQ7LhO8c0=,tag:/SvCmGjk5S9YhjhVH/GBWQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"toleration": [],
"topology_spread_constraint": [],
"volume": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:FSnOtSShY1/15SRSTuU=,iv:/bkEZktso/2I+CGqPam3CXtIUDlSEibm5H0PGvHpvJA=,tag:gmHAeze7hOr7ZUtPdsSdMw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"nfs": [],
"persistent_volume_claim": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"claim_name": "ENC[AES256_GCM,data:aTd1scNvpuuKJ92HHtQxWok=,iv:29D3Y0RBY7ipIKYHiGlpXoHuXPEqL/+WHWRRjmGuMIo=,tag:NAwkyzzLqCEHSbkXW/h9Og==,type:str]",
"read_only": "ENC[AES256_GCM,data:Rj9PFu0=,iv:Ib1Z+yABdxiQkZk7/0755PgT3UJNYJnzwKxV7SN5mtQ=,tag:7WjpZxWunHa9AO31ZuyIYA==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [],
"vsphere_volume": []
},
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"config_map": [],
"csi": [],
"downward_api": [],
"empty_dir": [],
"ephemeral": [],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"git_repo": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:C7ZkJwXNa9DfZwI=,iv:yjtedxM6TadJr++sTnTnrV3mzaZ5GZQaYZ9PbO1K6ps=,tag:NLgSJ19lNpd59OunA10FOQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"nfs": [],
"persistent_volume_claim": [],
"photon_persistent_disk": [],
"projected": [],
"quobyte": [],
"rbd": [],
"secret": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"default_mode": "ENC[AES256_GCM,data:sh0ngg==,iv:sCfOwbZ8BgcLyuxlxWJKG4p8fB+eEUrJB877mcIEFSc=,tag:k7OqW5OOi0zT8N9/u7AqeA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"items": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"optional": "ENC[AES256_GCM,data:YJ57G1Y=,iv:QM++/TzxeLP+W7QTM8sbnHSHmOtaIln0qbhwZQhKv/k=,tag:4rp0s8yibZdnINH7VTXLNA==,type:bool]",
"secret_name": "ENC[AES256_GCM,data:XU1OL+/DYFpWagiWvVdagA==,iv:aHtNFqNJSxOzW3S6aIIWuyeP0h2nlxWqniTpmriVNlY=,tag:uJFdp5L86wOh8VE7NkkdFw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"vsphere_volume": []
}
]
}
]
}
],
"ttl_seconds_after_finished": ""
}
]
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schedule": "ENC[AES256_GCM,data:VVYMS5MNlIR+,iv:4jNX68PUVwUdjyaEx1jWyuubXQANWLTgB1Rv1QtC57Y=,tag:8W3zaDwI3R37fWzYjQbIxw==,type:str]",
"starting_deadline_seconds": "ENC[AES256_GCM,data:cg==,iv:UoGIsb61mohLmI0ubzpHT+EJ/ehNrt5FYQfsEFRRmB0=,tag:ehUVoDlz/JMZcFXEIkIAiw==,type:float]",
"successful_jobs_history_limit": "ENC[AES256_GCM,data:JA==,iv:3UR/WxPIeS4LiDnkPHAcXRIM+jrkUYIKn4u3xh81yUM=,tag:DEgEzN4QM1SwDHQzms+vVA==,type:float]",
"suspend": "ENC[AES256_GCM,data:cUojFCA=,iv:bmP8wq+MNjTgaPefPTFTu2Yj+sUNEX6ZBXy9PvYSMZU=,tag:y/vmC4/gA6TRZWORM6RRlg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"timezone": ""
}
],
"timeouts": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Yw==,iv:xhOvscnqCMImL8IaX136/VNalPkCMGeHOX3JYU5cIhA=,tag:u4UP80ekqT3S5FDAFq6otw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:bh1LshiIl3g=,iv:h8fLDGVQguItIVShPDwZUhO2BuCWu3pICIafcW+dVmk=,tag:P3wh2yV1bdBk2V3tNh+RAg==,type:str]",
"kind": "ENC[AES256_GCM,data:GuK1QEdH2A==,iv:DJmxzEsHoXoR304KLihoAzDfDFeYR3FbyXkLtejrBFk=,tag:CWIzyGggm5zGkNZ4jt33hg==,type:str]",
"name": "ENC[AES256_GCM,data:lAZdcrBAB17IQjTkP0HP8xQ=,iv:OClxSC3b9tO4GyR/lvdNNjVxv0iGGFIsB3fzQcYGmrc=,tag:bSk8ubGH7kjGJDTWuuP5Bw==,type:str]",
"namespace": "ENC[AES256_GCM,data:7FMx13E=,iv:oIGkc3MzJadG8bbgvVPmbkVBp4kbXoAjaS2IGvFuIew=,tag:dqna2JonmBIJgSdf7LCMEQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:/gEiLhBWJoYLMISGhSoMHLtWA+eXp60/Ey8+ChKeEBAAMcJovsBtbpk1fJ+EF1f+1FxnM+KkTzNRB2jh83aNPIldFNILKiosnsS1kReQ6BoWnGk1,iv:73IFcDRGGFPTahrs9rAV78SPLn0+gzahvwo8hhz4ANU=,tag:TGENg40aMjThzMnnBEZnsg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:F3ugfJ85MOzB57vk3ExHlQbXS8OXj6rDMWE=,iv:VetRYkr4xqTr5NBV5/uf+xxl9Brkoq2kMG/W7CIZmSw=,tag:XCT9AslU8GOPQvLZ6qyx7w==,type:str]",
"ENC[AES256_GCM,data:v7bBH7i3XM2Ilhp86LWjjUIV9CdF+Qmx6smp8eT+aqXvYWmCJyNdUFCtQJxnyG3N+5LP7qWYC+ibXo7yEco=,iv:Bta8P7Jv0RJXC+EQB66+YMxweI79Zr8L3tx9pauiTr0=,tag:9yjbrVvirLt0Wif4Rn2ovg==,type:str]",
"ENC[AES256_GCM,data:MdS+WTtv+EardeZbQXGeJIJIQpA13IT8uB/S+XPOon5PFaLhCDLYSm9h+8lCvStV0+n2GZ0cQJYWWDyXifeSEpLq930=,iv:oTxaazaINFAN5b/cwk4Q7aRxuhvbS1NA5cwXhCjHn04=,tag:CUzixquCpvYJXmcNJlnarw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:b/+rEhXwkw==,iv:1lSnrxNLXmtBPsElmKZ7BHxnEdPb0j5TPOUUsbIN6y0=,tag:ZIhcSQ/KcFxVgwEBEKQROQ==,type:str]",
"type": "ENC[AES256_GCM,data:mlB605EffP/z/51DC9e/sN/H1TQ=,iv:2IoGPBQ8+S9EuQlGQf+VS7S8jPJMEpZhcj8L916U8aE=,tag:nneXTFvpBXR3Nuy8y5c79Q==,type:str]",
"name": "ENC[AES256_GCM,data:dNgSPp0K6z9SRmwjWtM=,iv:DMMgcJAue9E0NyfSbNqFFKmW9FnG4BNUZEWjZFodJB8=,tag:CVMStRrxTcJnXosbvHHGlw==,type:str]",
"provider": "ENC[AES256_GCM,data:rhD3pZ6qNCV2jErPnJXt5c6vzpdkv5BY2ubhrXlMjPuAODusTqRDkK51+/F1+11oAvkl9B6/,iv:SPzhIQu7qZOaCNu0IMYMtKi9Um+b5BKaw6Lu9NA3tug=,tag:rbO0/EX8im0G50ta0hzmwQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:P0vfNMsJ+4abTpPgqQ==,iv:9HUz0IaH41/xZopsqAA/g2A145abrXa9H7o5pwLmIVI=,tag:E9xG9iiAPifVqRK+xm0IbQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:oA==,iv:EPjPNnxzr8mzS0pBnFEuJAL31oCGWSMTy2gxovJO6mg=,tag:4PaYo2px/aNCfrdrDVcxJQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:C7ROBVS/BRbX/yP2eQ==,iv:o6OMZeG0WWmRYcAovyHQNLLW9E5CxpTgFzkqugmj79M=,tag:VZCNmJwn52lieC1z1MPu5w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:mg==,iv:IB9usO/i7EBcVrIjIQ+anHZC5y7wKwQwBt7oc88+vKg=,tag:Cc1guJA2a8LsBgJHk5LIBQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:egmv,iv:F4s3mJ3n4T4VM/7DnCt1koAKopLUZZ7LvhTCOYDvzC8=,tag:gQs6pM0ai2EvYgBUXnVAVQ==,type:str]",
"managed-by": "ENC[AES256_GCM,data:co3OHvZQhrjYBGA7YGUXMuP8grjm,iv:L/DFPntsS7bwWvegH2mIHQbn2C41Y/Ps8lR2ZtQQVn8=,tag:YFHLvTZdxO2Pg1Wv4u10+g==,type:str]",
"resource-governance/custom-quota": "ENC[AES256_GCM,data:yTqR6Q==,iv:+POxJ3eVNLepicMafpK4iMo/YPO+rcowhi3a19p8Tyo=,tag:6QYJoc5QNRwoDyx44eVUAA==,type:str]",
"tier": "ENC[AES256_GCM,data:Dh4T8RE=,iv:O3zI5qV7B9IpO9JDdXHMFIBcuAn6giLiXjjkX8n0ijE=,tag:2vDbj7O+8sWM+VbqEIUR+g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:up5dDBzPIxwLBW9oxQ==,iv:AZ79fxYDKIDn/IcvFTl0Uerehs1WieTj5rESCVcujdE=,tag:EstkdS9dRmlTdzmlLlCCOQ==,type:str]",
"resource_version": "ENC[AES256_GCM,data:nSiqCzkYxDKN,iv:sXvGSWdxGe+nN4O8joDlVBHkcn7uP7/2T36KOP4Ncgs=,tag:EnhSiYHhbXfTPUrbatxqcw==,type:str]",
"uid": "ENC[AES256_GCM,data:qZab4RBlEY9GNSc3Ef8q1P99Xu2XuVZhlOsqzxUPrdqUTaHz,iv:L7GfWr+YZZxInvLrSz/QpbajZ8TNsxMGRf5n0v9v0q4=,tag:kwJcThX+UUt4W6rz2YRFBQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:DVMVlTA=,iv:dG4BrEZB9h95cwhzjJTMV8G/bpm9aXlWlrlrt22jwCE=,tag:zY0kf/eJD7R/QDiGCy4KTg==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:eg==,iv:NY06ZqBDKoooKU4HouqDVcBwjO57LGp6BC854DjAayI=,tag:kiQYgNSPTJN5iCRoLNMDXg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:nDo=,iv:QDb6qrGxQCM9EjTTuNez+ykxixzIKAlMl55j3KXYJUE=,tag:yR2dpOxFhkmxx4LNLVifLQ==,type:str]",
"kind": "ENC[AES256_GCM,data:DzH3iMoYrcnu,iv:Qhq7h72OMLqWyuWILanRdPx7aCEUlwbaCwIbyQEhlAI=,tag:Av/e9xslbH0ERLGs1JnKAQ==,type:str]",
"name": "ENC[AES256_GCM,data:9QqmyDeEIPFwvuN9cg==,iv:J3YM7TXgYnsa/owcxtGeL8IEReoyBkZpxNITIS70CBA=,tag:/TLPaRHHz+lONOAr6DhUCA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:S+NrQeOsI8o6ktpQVdiPX0SuLRuHrInRbMXPzwMnsekerhd/9xA43npbvMD2IWNSsymDYKO/9YhmjrxBBSxLuuKJQAOX3+ay6ROEMOLNG9gM1+SMEcrLDQ==,iv:mccatG+XJHdTh6K92I/nz+eEKyXwmzXyrqAwzrAZXhU=,tag:Uw8r+4e6QUm8iWWO+MXt+Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:6p5MmPujQMV3oVipgFOPyKTE2xAibXW5E/YRC/E0Gwk=,iv:QAR9mh3be3naFV5I/YpMSJk7OXtX8+4ekdy+l4F2P90=,tag:mWJuCLak5HE+Pu2h2uWkcA==,type:str]",
"ENC[AES256_GCM,data:9EGx4SGiXnUGuAVoDfgXHf5O,iv:+n5YxXPVCWeTG7AVt1Ja+vDYH7ukNTKsd+rL+c2uPaY=,tag:FGTk+q2cIrJV2tv4JCpwhA==,type:str]",
"ENC[AES256_GCM,data:cfo721uTdq4/vasN7wfzPzm/hRurLBZAMr8=,iv:Q53P9sRIKwj6Tjpr+2hbpsenzYGy372f6v3jQfO4XlM=,tag:aXEraR8IK2L7Us4T1ctJAw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:MhupmrDOGFc=,iv:zGwd1rMTIRha9dmXsQ/21HO7eSJVsUxtVHdcpJF8/O4=,tag:nPZdF4Dl5MBROKAsI+gL5g==,type:str]",
"schema_version": "ENC[AES256_GCM,data:jg==,iv://I3ZobCpN/LHHpGGKs7DH4jICzmcHRW1OstFoKMVp0=,tag:RqoWFS6tFV7muJo8eOwjFQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:StTWSIAE+es=,iv:wsTe3q6Li9j8bL/XA7FHlpsne1G946AWt4eGSvGIYGM=,tag:e4pwPUeK1FIWE3AhCrwIRA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:3w==,iv:I2P8MgTuxkaMiYMOoeTbBuaFy948KkoW9EofQfDm6sk=,tag:KTnN6Uv8OcMDIsloNezxfw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:EpLB,iv:p5zX8R07LqHL0wn9k8hOifjisawcovnTgW6R8smFpCE=,tag:j0ChnlrC0sgkkRj/JOS8xQ==,type:str]",
"managed-by": "ENC[AES256_GCM,data:qRGsqsGX773aOnrEd9BOWiLRtNPk,iv:G5WUTQvNv3/fm/zKQfraLqhpq1kmhdJfoU/Ua3ZzBcY=,tag:zlxh2A3Q5zeRtE7DZhAseQ==,type:str]",
"resource-governance/custom-quota": "ENC[AES256_GCM,data:NQ0Z/g==,iv:f2fx8QDSQAbJgKFY8QTTBPtpinQeZL1QJfyGjhhhIf8=,tag:elvhx+TWaRzXWtJlmbTNOQ==,type:str]",
"tier": "ENC[AES256_GCM,data:8nFOk2A=,iv:1yE9cc8OfgbphaxdMWIF2y00Z4MIVs18WAfTqj2cMnA=,tag:VeUNZtdTLOp8WAOZ5XXYWw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:7Ga40qPJ4a4=,iv:2nxChRd8DTwR0gKWNd0XV/b5/vKgPeM6e74+mwgaq6s=,tag:embSJnJJF2ygBws+moYyMA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:EV28KrYKPFMt,iv:MfmBFwThnkqo8c81K7zwlaFZRg0Lk3UmXSBFW6nL7GA=,tag:ka7Xfiw/xGpYaFN9syXLRw==,type:str]",
"uid": "ENC[AES256_GCM,data:iv9Q1o6TyXpK6kH5jQlGcLp3PD+MMq+todJiFBLOWN9B9tit,iv:L7xYjCijXBdJaj0ywgXHDIuT+PZaVWhFnXja6wmLEv0=,tag:LSknEnAQTKD5g7bGgEWLtg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:YuPc/jU=,iv:C+kM0G0Dw9C7vz4HtTvI/gFzjRcoTLJG90/yfwq2cDo=,tag:B+t7jEbeGucgpQjsNcTlsg==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:gA==,iv:GVXPA1jpaXFT+OX9gH60RTervGRTDThWWJTgPXNqrhU=,tag:/hL7n9BGYUut0xfb5tUfdg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:Bbo=,iv:Hy5HEzEZKJz77u+QNgQUi1Lcm96HKN1G8csjseWG7fk=,tag:6yxpxh6GIYvHA+qOVwwQdA==,type:str]",
"kind": "ENC[AES256_GCM,data:5cfGpxlGZMQX,iv:HlUer8RpGIpSrnCZOBhi2UT7Tt8F9WZtAXIFr9WnH4I=,tag:Hvrev+tQfj9xFqqIjYCkIg==,type:str]",
"name": "ENC[AES256_GCM,data:JT7WRrhifK4=,iv:6HbBw8rwGNNIrPEhZVY5VidpJIX4ll4MRnjjfn/nwOQ=,tag:h5dh/3O4n/hglUas4gtITQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:x1XaWIDA3UeAEtJwkc+0XbcqgD/mk5awpvHaDyid8nAJ9UIZXrTGyg/XgqmT7NWn0FNzFQAK8t6xuGJ+eGWnBSfw7iwjhXs3be7tt/6ZuCuQopfOQUVmJw==,iv:jNRG+HaUDWa1K4hsXdAtMr1gj+n0leQN+S+LJLQ1Ej0=,tag:rCWA6R7E+UBIIUaIAxnQ8w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:HRTD6PSls4b5t5t17KzYvf1S8Ts5Gd8Jx34uRph7hmc=,iv:dH5bArA9Qjy7pGkR8Z0DdDZUw0mBGiWxpyIvkKxxotU=,tag:6c3VEUONRkhTg/BS1D/iLw==,type:str]",
"ENC[AES256_GCM,data:C/5oUwiyQD1C3nkh+Hc2XUK5,iv:JPDMlZeBXGbganfhlwEzFcFSDGL3mTYPySUzxo4cb6k=,tag:s2ZoVLsa9L/Lv23HqBtHAA==,type:str]",
"ENC[AES256_GCM,data:EocjGPQn077I+HZqO4dVJS6v8O03loI7fgY=,iv:mX0FR5Fve97FzMn1SwVDL88hsQyaT7wGCFWWynw9+ow=,tag:QG1KZw+5Rvg6P0LafTjjIg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:Mv2rIlfprQ==,iv:V0LSo1ubqC1fqhL4Q1+1sfPCXzsruu+Eev/WocOhu6Y=,tag:ZUXkkS+9RN8gzKjdCVxY6w==,type:str]",
"type": "ENC[AES256_GCM,data:JK5xkYwzOxEh3WA4Qn9VwZtO85s=,iv:XC4ESyl2xP0j/FEj1YEJ0Prj8OBc/Mk+LCkya5jEank=,tag:HY05CCHhip24ELKKt6pb/A==,type:str]",
"name": "ENC[AES256_GCM,data:58uYYuE=,iv:n/d5iWrZ/oQdwFN4IxAQ6wMzZI4AzxEHPWM5Y/IF4EA=,tag:YANpT/toWqM6TljP7nps9A==,type:str]",
"provider": "ENC[AES256_GCM,data:K9HIgSjRS+RgbgY1Oo8mlJ0jJ+ZhJcjsagPJPIuxrvGQVTlG41FtVwXuOJmqEU65uxvZXqPi,iv:lYNYoHUDQIqhJNqbt8+eAo0BIN482n4qQU2t/6mhBJk=,tag:kC7y6VQdA4UrLIuP2nsybw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:4g==,iv:i7s1BfWGljQwMQpA1/NPkt+XDb63vVhNsjtMEyapRSc=,tag:OsHBN32/AkD1lv8YW8OcLQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:rymDBDw=,iv:v6jM4qq5jydMMdFAcUu3q4FPlNkrlZ3ID44YBkNvREY=,tag:pEJC6ThPaEAlbCUWZk7F9w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:bA==,iv:Uvt4HOfLVCMSGXXlfBtqWb6S8oYKifblElDLR59yQEY=,tag:5ahZZSmOowKMvqB09VppGA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"goldilocks.fairwinds.com/vpa-update-mode": "ENC[AES256_GCM,data:iSCI,iv:RsKXO4NvjmCnIcW2LC1JmwUxMcOl79BCvAG1cquApFY=,tag:WqZmKihuAa9UYWU0C3Ggjw==,type:str]",
"keel.sh/enrolled": "ENC[AES256_GCM,data:80bJVA==,iv:EUzJY97MBU1O2cd8+bYUB/gTdQCXUC+9qd8MPY1QNxU=,tag:CoxOVlEW/m0t/FYDPcXufw==,type:str]",
"tier": "ENC[AES256_GCM,data:A7fHL2Rs,iv:2xTAvoLWtw/cIkP//YfRCEQfgMJGy5UHZUq4qBmGcfw=,tag:hpTU71BW74cG3B7oYSlYwQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:NOUdLto=,iv:PZHCgiovFnO1D5Sevq1K1jppLRB+3NI9LCtqdNoVnHk=,tag:V2cgtmF3duIZkKMs3tX5Cw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:kzS+tqXatWV2,iv:fhXto/JLTuav2V3nIAs6jWw4eyPVtFRXux7aHsEVWhQ=,tag:w4YYHvGbp7hEKp9fPE4JiQ==,type:str]",
"uid": "ENC[AES256_GCM,data:zgh08r/wegPbqw3G+VclIOF27gWeMpnT1/FrQb4vuIgVMXI9,iv:Od/8bG3BSDkeo9X/JPmwF9tTJHa+dW2+aTaN9vBciOM=,tag:gdlWny+9l8Bh9DeyDtSy6g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"wait_for_default_service_account": "ENC[AES256_GCM,data:3AAwcos=,iv:DdR0Eixt5Ik8AqUx4HaxWqiS6SB+W6JhaGOqh+Eb6lE=,tag:wmXPQItc/h720vewXZVhVw==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:DA==,iv:NoJEB80vrEmupjIfjY8+2v4dYdlAbZoLMZH7TpH2A+A=,tag:uW1hAwYjWbJ5iePgvFdWUg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:HTM=,iv:e3k2O4hgzynPjPS6plLC23at2EmCuUY6GMyxLDMEGs8=,tag:TPvcb5FcbweeBEsVp9n9FA==,type:str]",
"kind": "ENC[AES256_GCM,data:hhoOn0XtADPL,iv:KaA3R0gbpUsOhS7laUDywFlJO6h/kn0X9gr4kzACGYs=,tag:+g3g/a/bwQ185gEDibT5Mg==,type:str]",
"name": "ENC[AES256_GCM,data:BTrrFXo=,iv:Ak2PRTLqgCxf+5kDidLpIX9Kci5CAw8sHbYlQr0Tf68=,tag:VrrVv1tU18QDRgNi32DCiA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:m/q44/Si5D1pHWI8mvZUElAIGoD2/tajx3bIEDr0i1o1DHftkBSeNp/a4Ril07rNu49fSCErtp4p4xup3HUMUykxv0+B1ITMxuVe3N4QLleQbG8aKndI9g==,iv:uvhIF1INRK+iW5YqunODqrP0jtmXuTlfYezmE2wnS1k=,tag:O2Q6/cQbr9InI4BvqeumdQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:l3mzLWToBw==,iv:qQsyxPdVnY55DwAHihLybfNWr83ciRVAwwPiUrjyEYA=,tag:O5olXYd1vOjc6IbEjSL6zw==,type:str]",
"type": "ENC[AES256_GCM,data:UsmrmPqzCvsnLAHVAlXY,iv:mHJ1zA8Oy+V1FXE91B+QcAoXTW0RXgyxpgaZYPrHRBk=,tag:uM/XMXQz2+n8qnndAiedfQ==,type:str]",
"name": "ENC[AES256_GCM,data:bPrh/gWewwvKWKFJHw==,iv:+xtWmAvQf8UnlzzBgCBYWcBgyrO8k8/gFJccXcOqZP4=,tag:5mQWubcW27GJDuku9fsOpg==,type:str]",
"provider": "ENC[AES256_GCM,data:u920CLUKZw7HcTwqmJFWyMw7gCVZckoBjJANOaJX1/aHeLPaR1IjGmd6h8ogFiq6zWe0+Kij,iv:vlIHABrDgzgkfEq3kTHO5wZMc3jrWHJovgQFA3Fs27o=,tag:5dCYD7GRdHgE0OEflU0Rrg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:RMB6+gAgOZevHnzwNw==,iv:BILIT5+bs2r+M6zpeAwh5L69HUZewkZNzjJRRhVz1SA=,tag:vT+vFx1LI9wJ2T1Z80SC/g==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Vw==,iv:XPEJQx5fsGsvr6uydxXw9cyun3llWUbxK6SZh6VLhq4=,tag:2nUa/uoJVGmhHOEmFVX9UQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:yID4dpqAalX9T20ESRLeNWNKIueXTxl2sFzBR6omNrp0rYvP,iv:hW20fMa07F6uxbm61UdYRqPZfU5bTkByvrJDM67o5BQ=,tag:f3E2X80v8I5wDRDn9B23qw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:tA==,iv:sFQjTFghdJQjhDpL3tBeGX4PLnT4gMQ/47BZQ43i7S8=,tag:BNzEmNkN/ei9AHK2R+A9NQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:Mvp83iiPABQzXRrltl7b9AJr9IvjXQ==,iv:JANY21YlSWIiy+KVeXjtiUdPGnbouWiuJFWhg0xXnis=,tag:6m+rUiyPJg5P7MmQ6WxdKg==,type:str]",
"namespace": "ENC[AES256_GCM,data:AZ2JDQQfyjqYwxrG5A==,iv:5fmpWXX2pXWO79rr2z1Bxo5ajGUC9MDtDs9ZsNAkbbE=,tag:KEyN5t8Z6cC43uGIHM7WWg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:oHJD2O2LAwbg,iv:O8XHT1bwRnWKHb8vmtyGIA74gxlqvG88C9zysenI0So=,tag:eISuONWCrxJiUh/GQaJ90g==,type:str]",
"uid": "ENC[AES256_GCM,data:GXcfNi699C6GxgWuQR/teoSVlSaU6G/hZwuokPqHByMUlPES,iv:mOdn7E4OuzTB2anbggAes3ePIDa38h6QRJ99HkbKxro=,tag:eZGk7tUIZONtUyDDtdMbeA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"rule": [
{
"api_groups": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:07Rbug==,iv:eIQiYsIRsONHBvgQaktCSjuC36NhCkzSTavd86juKcs=,tag:WBt3zK4WUoPkrabkt2N5DQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:g+DzqddhxvDrtWM=,iv:n63IXd4a+8jEe3g7HA4XUzbDqd4JXbNoOInqP6vLj9g=,tag:pJjAY+z0IqUKlKE4/L4btQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:hVBa,iv:dKBxpRXiMxobne+PqRK0jJy4BdHeEC0I8Ut+R3DzEYc=,tag:6cqkdJ6VATU9yRH3sOtiZA==,type:str]",
"ENC[AES256_GCM,data:YK0JnQ==,iv:D1C1SFmBRAyg1zN1FdC3eWkXue5U+XEVNkS/CJ5b5YA=,tag:4zn3vvDufVisUolPUjIMTA==,type:str]",
"ENC[AES256_GCM,data:K51QKhE=,iv:r+/8QFemQ/LxIgUX7ZFcxhGC+7FrklxDhcy5hynxI94=,tag:iBnVV0JVLjoOpr7WJwQEHA==,type:str]",
"ENC[AES256_GCM,data:ZhYkJ+J3,iv:QeZtUxTajpjplEOmw6RAo6IQPTj2b5B8uCpOl1RwUYo=,tag:2qyo2iR6tkW0PNlLZmP2bQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
""
],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:ofAx8A==,iv:xmYlyMUvZZ6bjyMxY7EFNyASda5hir7vvLo6vagrx5U=,tag:tbnxrI8wS/9e4E40mjh3SA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:2R0f,iv:5YoRdX4oNWct3jjZ0sL6ZaBvSLuGSNJNw0Z9IZ40QIE=,tag:/aoJag2ofo5XJbpmg2ICWQ==,type:str]",
"ENC[AES256_GCM,data:tJ6eRQ==,iv:mgHqe3Z32J53du8YZNb5IaKIR3od8prAFnCIA3734gE=,tag:8wUdtF4Ahysj2GAPcrGDuQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Zw==,iv:/3DPLICpznK0OMKSVNkQssDFdDUj76wEb4TYBH0e6Ok=,tag:sixM5zODCdVcXq4vCKd5ig==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:3OlMBJXBWOmYOTPdBCuwkSkpPMRrjvOAcOGSvw==,iv:F1EtT/mOfuc8j7GoPQzQ4sZxFb394sZmJoY3B2TVLio=,tag:VwfpMBDULsyBCv4Sk6NHJQ==,type:str]",
"kind": "ENC[AES256_GCM,data:56QBuw==,iv:JZohn2azJ/HfcjXzEaKimAVTAabj9BVpRKlsLMKTAmc=,tag:vxZmxc8YyXpkAPHF5hQtsA==,type:str]",
"name": "ENC[AES256_GCM,data:cVzrXxYlYOylm89lima11Y7nVsiROw==,iv:ammXcwgt39h14EpJ+wEdY8Jt2lfPsEdYw16xHJ4yz8o=,tag:yytRsma/RBhmjBNYHlxRYg==,type:str]",
"namespace": "ENC[AES256_GCM,data:IjAB+OceAcIL6DPivA==,iv:T7aDtB3OVGSRYydjR1OYFYVIxWrkqT6DUwdXSyybMt4=,tag:Gsz0aTcaB6Aeh0YiU4wVhw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:qhH30RiPjZYCAAsl07jeZnX5EZsZV63gSuxKdpcy0Ug=,iv:CoTG2UWdNUzGh8YZ4j+doCV6wm7ix7NIuBdrbnEyR3c=,tag:PpDyXSSEJL9hlUBzA3SQRg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:LY7UwwXrGqv0Aj5X9L6BAm0/Joevg8hg14rQMq2pduY=,iv:EIOw2sZyw2FnmaWblaZvoRoSaVELn5vx/m87lSQ+aFo=,tag:E8ZHvd3nalnWvfpcX7ZOHQ==,type:str]",
"ENC[AES256_GCM,data:vTCE6eEop/VPk6+f6TRZSw6m,iv:xTdRFE2BfJsbxyYcByXqotuSTQvDAfwzKaRYWAzp6WQ=,tag:6xFieC7L1hARJK4DJt628Q==,type:str]",
"ENC[AES256_GCM,data:8CSwsuRV1xsIRRPULkLg5Y7wSbl9/CttySpcIkAfv/fm7is=,iv:NZ56hrXHe6qzsqn/vmpZ5Nj6rRgxvQsRtXVLLf2R5c8=,tag:kVDyBvk/EAc8IhJwc4j0Lg==,type:str]",
"ENC[AES256_GCM,data:6rBT++cWozubp8a001q9maQilzm+LhaQfyk=,iv:iudL6Te2EUcUdpbyzAf4AHHnFgIjOjyp9cqn+7yGIoc=,tag:2ibHd5ReOqPCAqZT8xHt+A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:rnyW+ZMDW+Q=,iv:kpbCq3SJAqUwJCn9bY9w89li1+AcCuhvAbk/mZ4k63g=,tag:tsO7plNHHLbxUREnJWKZNg==,type:str]",
"schema_version": "ENC[AES256_GCM,data:CQ==,iv:9GrhgQyJ8If0pTiKTsCUjVT/ilLeKVdL0XMLed36fc0=,tag:3NBnWpPgwVD4TAqY9HHapQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:KrOMCL1uEYv4BbjnK1dy5bhUpdCzJANL+dw=,iv:2HQ3aSu8s8/8heADkVl5K+o32Skin53UZHz4tjG1wsM=,tag:q4hVZ54uh+BCcFD8tnzi2w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:Ww==,iv:dmQHj6Pjr3t6ha1yMRusJaNqWwBaikVE7RqXDDrKdKM=,tag:8eGnIC58eMndHS09ycnBsw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:opLzEdufov4YJGcupERMgWY=,iv:+vagoezAeDYxSzwtYTc1H2G03HpLVttQ6I28oPEcT58=,tag:MVvXzow6jxl8AT3WvHC/YQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:6snGeVTV96c=,iv:Ntn/80IooQB4C6LoJlNbPxD8184Yjs4W2DTr+KvVMWM=,tag:cFL1wNhDWthBbpYZojiqrw==,type:str]",
"resource_version": "ENC[AES256_GCM,data:81fJJKX8YEkq,iv:ywLyrDgo8OcsEcSTSfdM9XTjmn9afo9Z6QW8d0lJzMA=,tag:hDOYo57xo1gtVEi78wHOAw==,type:str]",
"uid": "ENC[AES256_GCM,data:pEHLHQxbUjTLEflJ5/o4IGXy3dUTrZTMfDsInza3Tsbeggyg,iv:3Y8uguMLzIvLtNztLTSdqGT2khQaowYVcYvU2Rb7kl0=,tag:ZxITIro+XRmZR5SX0uhgsg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"rule": [
{
"api_groups": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:xitM+A==,iv:P4Sb3STmeQn9w7c6W4SeyCATherrhUxGOO294VCrHPM=,tag:y6nN/ju0pY5G9Ugz2v0e7w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:lAJq3CpNfy7s+b0=,iv:Sc2SDAWO+CGbsLfYYzUpjhmBh/ga0xGlojEaHBUEZ8c=,tag:YICBUB1NqRaQ4sDHimyBtw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:dxbr,iv:XQZb20lz6dXGNQYhP/X14EPS3amcSsWNuALhXRvQle0=,tag:Yuqu7hZESs/MJ2kTyx+r8w==,type:str]",
"ENC[AES256_GCM,data:sTxdUA==,iv:UxNglXnyIN4i6sUw/vE7g9R1YhQavAH4X9GDUkkMmJo=,tag:hzZNrbdtViDJsdfh09ylng==,type:str]",
"ENC[AES256_GCM,data:ptbzA5k=,iv:pIP3+4xKFLbK9ds+gb28Lhwz/nRq3Zn1hHhbyZGolEE=,tag:GMmF+nmfGAS+zxbvhtnkYQ==,type:str]",
"ENC[AES256_GCM,data:++p+zQl6,iv:GlUsk+YPTG0vJ7UEQjC9s1aK5y7omQHO0dYEgxNfe1g=,tag:xs2h3Ll5JqZnwMRLN1xNZw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
"api_groups": [
""
],
"resource_names": [],
"resources": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:FAmgIA==,iv:GQbCRSQtabCMLTezsaPwINvLh19gcWmoUU6SMRxwkaM=,tag:0vPRmKuZp5M9Sd8Q7WMlmQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"verbs": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:qFYC,iv:SZF1RGls/VHXkc+T2Op+ZCPCNM/F3Sn/MNPXXfClZKE=,tag:tbCoqqDs5QQ0CszVmCJh9A==,type:str]",
"ENC[AES256_GCM,data:s1NMTA==,iv:29ZgwLnKBglLxybc/SCAGLpmohbiZ6DH9a0PwbwoVFw=,tag:9D50hIT1ZYpbjBe3Br9zvQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:XQ==,iv:e1XqPpUzqrSnw5P/CoSca5nRnfrL0zf2zRbYyjM+29Q=,tag:n2T9zbPfu14c2PjB/3mk5g==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:M2ohcln8imbKNGpuwj7Ihit071hJ31j4Bc9CbQ==,iv:NrYf7pJ37NtwVtMA3UutSsWFGJjSv8cNwGHfByIIuuk=,tag:S5EdaPAvWNIe2jGbi/w1cg==,type:str]",
"kind": "ENC[AES256_GCM,data:TxLwOg==,iv:ym8JPJMxqUTVCZN2xPVYVwkwQ2zetpcuPqNU86DwFfM=,tag:zPuye00F9XXY9bUXclR0RQ==,type:str]",
"name": "ENC[AES256_GCM,data:NltGi8/H1NJpXR1QaEvxTp0=,iv:PKB1xgrUFtRwBpIBAqehu8r/RjlPPJxI1w6WjxtKbOM=,tag:9WrpMc/DYgKXkffDlinLdQ==,type:str]",
"namespace": "ENC[AES256_GCM,data:Qyc6ypqwUPM=,iv:dnoOCM7agP0TCqtG4QfFBb9VEPhgmV57T6Vol1ijJjU=,tag:Qd0Z52sYX23xpw51vV2MyQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:x52sg/vsMgRa16i9CWBkVo1J0uuy/m9gqZRicO16AYw=,iv:avlXLc3Dmn8lhiR2UzSfYEMe0xGPqSqI8aTs5v3MO18=,tag:ck1XyZ8bs3BIyKiXX6qL1Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Y+RfAdjFG1wqnuSErndFHZdysnXImruXPQgzn7bZzuw=,iv:PzqmnE81s9um4XwfPJsREt1x9HgEbiKBs86O23lq1nw=,tag:X4Bv7XNpAOtUevY8M0EGJg==,type:str]",
"ENC[AES256_GCM,data:whHDtEc7//aaykEvPMezOJYo,iv:DkwKPQ7BB9r8AiPUiZNZNG5tPPcVOykFo7//K6R3/gk=,tag:XerkbbtAMlnPc63psFIecw==,type:str]",
"ENC[AES256_GCM,data:VmIHyJo5cGYgUzOOV5QQDHckVo6IUZ3iE2FPK+uBDIKwuec=,iv:oeE266s0gZCE1O7VrXA+2Qlu7nj/YzVPfdCg7CViO8U=,tag:oouh+zulxswqdw21D1Ry0g==,type:str]",
"ENC[AES256_GCM,data:jtf54Cm+3sdtqb7+3VfDi1EXCxMKLq1i4t4=,iv:RqgHr2BUirjg5yyb+wDLgV2MdGF7bQomaOoZFpXx83s=,tag:8GK5bilsF2KiAgQFYqcMlg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:rQHF1ViuLA==,iv:sP0Kj1Qr7hOMnoQDIC1U1trvMkF8FC5e+UfLj58UplY=,tag:0Jrm1l/fBwnrfcxwg6wbyA==,type:str]",
"type": "ENC[AES256_GCM,data:OR+DOst1bMMAfVM=,iv:wMmtXzsmV9Ej2sDmO04dMejdMxZsEDwhEoctdQ5z2Gg=,tag:y8M8dk/Te92L2b7KGcwlhw==,type:str]",
"name": "ENC[AES256_GCM,data:1qd2DQ==,iv:IfJJo41xX5p2PGtnFUuBvkQ0kz5IJmVXzPk2mRi5e4w=,tag:flhTuuVc9NK3J71JedSeUg==,type:str]",
"provider": "ENC[AES256_GCM,data:7X/ItQOepezlInaFOl5FMnEOuXoKyKYuLIu/3p35bL4J0bufvYZRzuqt6c6Bte2Qiw==,iv:coyDiX9qYfOTj41cfrluBdS4Zv9a8Kjy08V7Pm+Zn6c=,tag:J48gPy663Cb44vMzuSveZg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:JQ==,iv:1ucq1MXQXGvzP4R2O9xPDPgiWAML2FOwMl6cyWyxEAQ=,tag:iB7HCEJ6pctDhNqAkjEBaQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"description": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:A95yMg==,iv:KI4L1rZ3UTlUZrsUzs97QEEzVIDVmnIJt4h32ACkPf0=,tag:qv+mzBeofzxIMcnzjlkFPw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"local": null,
"namespace": null,
"options": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"file_path": "ENC[AES256_GCM,data:dAm5Jkj+dllVxfZhorwBWaSxewfgn89YaK+gaw==,iv:yseKI9k4nUJgNCiwAljT0t0G7/tBz77ILCh7PGeMd0I=,tag:tdZ0gJkrmmYwlWr+oKekdg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:WHdk2A==,iv:ttd2V/Oafjw/YDuixPeB6Dgj/RFrK6912vyPm7R8GkM=,tag:wxnudP3EZbTN51fRGWq/LA==,type:str]",
"type": "ENC[AES256_GCM,data:DI8hJg==,iv:OyIkQxRrb029im7f6o/7+RW+Q8rPlGjbDhPNvKl+2TE=,tag:ej5fUSbQoG6ohDJYwgTG7w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:ig==,iv:/AKoON8QgVWqxcLxgKrUfMYNGL1ttGdfwh8d03Q0Rvc=,tag:JOMdc0R6BI/foM+07eeCXQ==,type:float]",
"private": "ENC[AES256_GCM,data:O4VpMfjZJDk=,iv:+EeFzKNEs81N81Kc9HRVrqtpCML3tkk+PIvjARWAfP4=,tag:UTYiAskX2QbXQ7p0KgDBwg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:bZ47+PHRJs0bJ1PPINGGlOBE,iv:Cdp4ZA7FUWglSZVTGhejxhwdtWfgBU97EQmPIMQwaqs=,tag:KooBqilZNebOywCYpnT/1A==,type:str]",
"ENC[AES256_GCM,data:2TEW34uXH/NShMUxZ8y7tHI35HL71pEg81A=,iv:nvL8Q5mgD2/PI+bVY6kPwIk0CMksgnumh656R/Kau2U=,tag:NcFCz2BPkcZcj7oLtA18vQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:L+ASmcFeUA==,iv:L6jMFqXXUw6ak0dw/FfSuii38mYAEr2yu1zgxLGEj8o=,tag:TxcARoNzqjzVeyvpV7jkBw==,type:str]",
"type": "ENC[AES256_GCM,data:ZndS/dfErBvAH1ZVMToJJj1d,iv:3bgDMRP60oOuoAuyIEzncFNO++Iew5Cxzc9QlNU6O+M=,tag:lD1hr85UKaCLWsFZf0q6mA==,type:str]",
"name": "ENC[AES256_GCM,data:jF/C966X8fd5Sw==,iv:m13Qw3hcXTVI/trIu1Hl2mQsqK6537ZxmYMSLUQPF1Y=,tag:EdBO9SPTAYoF8C0hG/orxA==,type:str]",
"provider": "ENC[AES256_GCM,data:17+dgvXeUIxMUeOALC5ePo50qTppeW/K6LINjgVoEokBmo3ddIVhPFKXdGdUScUF2g==,iv:pTK0ZQWA9S725DdsftOHIL2C/TwaHT97qNhd4aw1PP8=,tag:ZZ+aGvKT2o8NrbaiK2bmwg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:8Q==,iv:2YkXyLsiwvnTa1qxesJ+4s2XseDZu/Ao7jFCF53lQhQ=,tag:azmQuMd7yKs03AyPScqIrA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"accessor": "ENC[AES256_GCM,data:da2OiRSXMH5kbXfeqnABX18/YyFh0DIS,iv:pN8s5/gvrfQm1/757yTNndiQBr62yCCewLpy5xGPRyA=,tag:lOTyBuCGQx5wKFdKaEy4fw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"description": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disable_remount": "ENC[AES256_GCM,data:9UUik9o=,iv:hfyxJ3Nu5szX17v266p1AiBr0GjH9qloTGN2dqyQ7e0=,tag:aiRBGsgrI4GlzhEVaMmYQA==,type:bool]",
"id": "ENC[AES256_GCM,data:TFhZilc1jVhPBw==,iv:QNWD96G4Qpy7wWPS9rez6qmdM8v+8V4PNRs2tuaSa54=,tag:RSqwqV3RYeM1UaUdbp3X7A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity_token_key": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"local": "ENC[AES256_GCM,data:UYulJxE=,iv:PcqPQOOwSeLs0zkV91iqrnO5mS2Ff+8UA6A7fhN+W5s=,tag:G0mFRtM098BLVrlxWHriwg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:e5774oAJ8/rekQ==,iv:WEg0phDkUHO+rvaLcxkfhUrO4tWOP6MnZzhRfavmerM=,tag:hGdxgCWu3QBO/XZaUbk92Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"tune": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:ihXZRQavLQNCog==,iv:qe3C3oi5XQ2lqobiTv7bq8H548ydrhsA2RNcZOrmDjw=,tag:mof3UHUdZYpnA1HuOKTv9Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:8Q==,iv:oAmE0nAigj4vkGwK1aGIRgv6NC+EWRoAR4GgUNv/Bh4=,tag:itE1o22RRPH+8Nyb7sFRKA==,type:float]",
"private": "ENC[AES256_GCM,data:/GxdKe9i4HvC20R3QVPbKBYM2CEtf4Vviu7aL2KEagY=,iv:1GCHrdi4y3VrHLRevaktRrVNMjjUE+4QcB654WHMo14=,tag:R5yA++Xm4E5SJWVh3578nQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:EuRxpcYvN+4VJsHolKg+ccas,iv:f83Id4Yw8t+LhzqPBuRpPK+SpHnYCeRjPd3zLWofidw=,tag:dAWn24YaUigxYHcEOy6qTQ==,type:str]",
"ENC[AES256_GCM,data:N6b+x2SPPxjkMCiiTLFlfR9pAf4uXPz02+4=,iv:SM1BXxlTV3gb/+JxLzx+WjaQGULbsACuniXxRXEkois=,tag:kJZ6fJdrNRn805K3q59u5g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:286r+yp9Aw==,iv:moBeGBtkwpEi9MfrcpBaKck4Quuyk21JP/WyX29aVKg=,tag:fshsXuPDwh+KWp/vim8y0w==,type:str]",
"type": "ENC[AES256_GCM,data:00zhWiA8DZKc1orWjdo2bt2w6LnwqZC7MfsxAeqtUInku0i8a5TMuQ==,iv:lVUi/2q4KFkQpSbSXtGSNEBjT/E7KEyN7GpCuyavuvs=,tag:m90q3B2zC1/Ua0Kpc6fESA==,type:str]",
"name": "ENC[AES256_GCM,data:7csoTFw=,iv:PVcMbV0IMR4nNSlyKrAGhhvP+aHBBn7Ctk9dclJyX/c=,tag:Ay1xfiKcLLDF/HrfGX0aZg==,type:str]",
"provider": "ENC[AES256_GCM,data:Uf0l9/JGmU+UoS2PZxZtB2VzXRvMJDhfst8hr/HIKY+VlE7tL3pYqoCgOJQYiauF/g==,iv:e5eRm3gXau1jLiBTh+avegiaMiXwWK5xs9HDSL3xKZ8=,tag:6cZGTtazGMpqCCtZLrvY8A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:jg==,iv:DIPnrRzOFp04gJMxQOQ7/FCrfrIAzQRYXaWLJZ5VO0U=,tag:aLHoaFchXLv5jz91IC5QVA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_roles": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:2r3ZA6b636KIo0DXwE98,iv:Md12lOQPkoHtpjCyTe90bLedIuGq3smpnIFEzu6NK/Y=,tag:Vxt2UJR8tWrX6CVKfwt54w==,type:str]",
"ENC[AES256_GCM,data:RTsKvU5FSbXfMjL2QSkj,iv:xP6F4rtQpi+EWrGMBUqPnnqHuhYuCHpEwS9xNEl4g1w=,tag:Wx77tK1ebN9nnzZG2jOKDQ==,type:str]",
"ENC[AES256_GCM,data:VbpvWWGn6c7pM5KB,iv:V3MQYdz3JmBmUiM2IICOkxSHyNRhKY0CofbW1e3ip58=,tag:KMRKnu4C5hVlzlKPClr7TQ==,type:str]",
"ENC[AES256_GCM,data:ipNAkcD+u5SshQSlGjKb,iv:Uk0xD/lQz/wECJuqe6/nIwVQjemKtPh43u0aH7VO+TY=,tag:KgNd9X0rd6Lsn04ZyanN/w==,type:str]",
"ENC[AES256_GCM,data:EWvuHzpM+g5kGKb4,iv:Z4OnIeYnTDJguvGCEIvcv7KXD0VrrslQDHw1a+Ta2gM=,tag:WrOSKt0YMY4V3f5CRK7r1Q==,type:str]",
"ENC[AES256_GCM,data:RzBYGCyflfFCXRbcQg==,iv:DjHsQNdabj1CrhQBnEiP0QkWBE+SvJuwKpoPMHSsk6g=,tag:G6pjXzfzrXBboPFyngbNAw==,type:str]",
"ENC[AES256_GCM,data:zurd4KXqWT5ZBg3ItigW8A==,iv:urVbnW3XQsnV+D1h6JyhQ8K3aPMa0qdX1OmQaONe5kI=,tag:kWFIo76V25uqjX76bT1nUA==,type:str]",
"ENC[AES256_GCM,data:pygFsHwTczWbS7Gg6g==,iv:vdLlES5kfTOKEGGJqlLY5MIKtpdmEmDw/F0SkOo2h4M=,tag:tBB4FfkBI1s2kEJ2ig5WkQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:iTtGWeEaz1w=,iv:lrNpRf85g+peDPnRucAAf+nqhBlofaX67vmPQOssE/Y=,tag:Q9VO5P3SSvJxIhnW4yBo4Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"cassandra": [],
"couchbase": [],
"data": {},
"disable_automated_rotation": null,
"elasticsearch": [],
"hana": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:k14G/O55aff8gk9A7CaylKULd7vW,iv:A0ORlUvR2xCTbXZnpY0APbTpaf14sAIVYhkIWrXssFM=,tag:UhMZBdt1ougVDa85Uzb4lQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"influxdb": [],
"mongodb": [],
"mongodbatlas": [],
"mssql": [],
"mysql": [
{
"auth_type": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"connection_url": "ENC[AES256_GCM,data:O7DanBiPO1N3DDBCfoaNhz8iTLPab/F2c3bopkQrjt+O4H9A1w/0cJ9FFDklEKeCYG0gSvXXKeRFxWbQds74b0/V,iv:53LgUyOyxjJ/kTmQWvmcrF8hWAJl0E1HGUd285AO+QA=,tag:T4kmhIZ3cLGC3zINFPaSqA==,type:str]",
"max_connection_lifetime": "ENC[AES256_GCM,data:MA==,iv:h/4rRUSq98obTQo+QO1FONu2Dc4XvVVAm/jv3nYbWHM=,tag:yKse8pI9uz8NlP4k7GXK3w==,type:float]",
"max_idle_connections": "ENC[AES256_GCM,data:ZA==,iv:ObZXLjlU2ItQsu1dNWOsy5o1JU5Cs1P/zGNcYWXkCOA=,tag:eJ1+PbDxVx5lD5Lq9tPqwQ==,type:float]",
"max_open_connections": "ENC[AES256_GCM,data:9w==,iv:CB6byh1fpHir+daZOvcn9lgyaP8+Qpyfq2PGxac1Fsc=,tag:8g/pMolDAGgMhVeP1Wuahg==,type:float]",
"password": "ENC[AES256_GCM,data:Sftqx5USEXJrSi7JA6z+4Gi8zOvvxhapO9VsJQ==,iv:R63A1yvS1OsMfmu9GKJc299S79iWFMqb1WJykpCAcjs=,tag:0/mWtW2qkR4C80v/p2IIlg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"service_account_json": "",
"tls_ca": "",
"tls_certificate_key": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:I6nnNg==,iv:+3bpDaZ7mAJIEdZ1nBqZOCILNUQ5X4JXlG/VXD614Mo=,tag:JyE6p+Hy8CBXjc+sP6yvbQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"username_template": ""
}
],
"mysql_aurora": [],
"mysql_legacy": [],
"mysql_rds": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:NZRaqm0=,iv:U72YbWtbgRthAqPJTRP1Vi1b5Qh/xEtBinMFcZlegSk=,tag:yR0Lg+r/azD1miyxr10jOQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"oracle": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"plugin_name": "ENC[AES256_GCM,data:eTkiMebihgTrIXPABOHUxkj2G5rB,iv:c2boqIiUFYZ20cC3dmdmLuMv/V86Su1X4ZUd1dd3LQw=,tag:ZBM3qZ1TalzKDnaIfowLFw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"postgresql": [],
"redis": [],
"redis_elasticache": [],
"redshift": [],
"root_rotation_statements": [],
"rotation_period": null,
"rotation_schedule": null,
"rotation_window": null,
"snowflake": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"verify_connection": "ENC[AES256_GCM,data:Us78Og==,iv:961/4+rlSv5DWj2ILzcO+EreMcJFEIVKq3LkVVhJFPk=,tag:9pX2mewiQJ670egtNwD5SA==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:D0IuD0SMYrk=,iv:/+YYzJgf3gqyR60mCN/Shctb6gTCIvzZpNpLVZKjDrk=,tag:yt1/3k42RAH7QxKle2OVUA==,type:str]",
"value": "ENC[AES256_GCM,data:B6I5rII=,iv:X/5DOJtkqHtVkKq6GjBG8tLLlWzCgFYHEgbwWmtXxxI=,tag:rx3mqvVo6ZK6GxNAM6n7Qw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:InHJaWs=,iv:vqEAbtcoCNFMMkGtbHO2exFUVTLxespL96zftoxtLmc=,tag:Bl6nEpw7z9p12LEq/ByDIw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:XA==,iv:z5a8n+B6ZydRk4maqAbEc/euFVbITswsBwu+CsH3Hi4=,tag:y2V53Cjt2+t1bJD/pcBG9Q==,type:float]",
"type": "ENC[AES256_GCM,data:xl1n83b+,iv:xHgMNaWBF68RqzvrybhW+/eG4mI9wGHB/La8xiQCDwQ=,tag:N7CotwMtIcU4UaajJqZZjA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:H5mTqLZ6EUY=,iv:OJ+kC2CvgRXStlpVwshI3xeiczR5xVN2WdAFmYfMO5A=,tag:wB3HCNJeymaoSdjYkq7zbw==,type:str]",
"value": "ENC[AES256_GCM,data:9dcbRiJ7TYU=,iv:cv/BVPJFUPncSF/vcdN7H9ZSn05agNi5PoUKps8LhH0=,tag:qIB6SztMsPnEdvu4rftXaw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:/F8heHHSo7c=,iv:JgkhQQaMA7wPkF5MvIpsHyKfBuXQ6e3E63OZsKbCLE4=,tag:EhnU49U5QRCiA6Q1aCfebg==,type:str]",
"value": "ENC[AES256_GCM,data:5Dd8vcE=,iv:hrACK6K+d83t7FNOh9JIOi1nsT9Y2INmgQ//2PX8PQ0=,tag:CjewOPZ4/jLIfEmEhLt+dA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:6O7xZMw=,iv:Wng+OaaE7wFS/vXYb5xGy9d5Rs4oUbbeJ/e5drr4nSQ=,tag:85vVePfdsoufNQBUmE/0XQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:jQ==,iv:dejIL8EdAwAWj1PP6AH8Q/RYp1MXns26NlzFfbgy2bU=,tag:1ALl9lDcIFRh4JOCljIpEQ==,type:float]",
"type": "ENC[AES256_GCM,data:QRTi+Jqf,iv:lgaJ4QY2N92sbwqo40uqLnOwK3IG0ry1ajXv//K6S0I=,tag:6HPZZNmt3HbWQFrPmH0pOw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:+VrGsD31tDU=,iv:wtduzj6hfdrkR09SbPpanMjwooFljUihcj1OqE3sE8Q=,tag:syrIKoDflVX/wzp6+TUi1Q==,type:str]",
"value": "ENC[AES256_GCM,data:52jmuF3T5Hb+72z2/qXv6XjUTYM=,iv:SYxlknNrsYFQe/3fBZ1q7fGWWCFGq0gr7iyry9D6LK0=,tag:AyS88bGSN2C3iK+dh/+TwQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:bLtVCKZlUmQ=,iv:umz7q7e7wEpkhuyrQHMx6iMguXp923ajVuOnFlsBtow=,tag:V84U1G0UGKhMYl8AebfbuA==,type:str]",
"value": "ENC[AES256_GCM,data:Rfnhj/4=,iv:I9uxHHogv+e+GSPB3uIcoRc4eJ6oU8P9ubLBLaAAvTI=,tag:0Z70dC5L/vpjoZsy2OnMtA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:2VH7tEc=,iv:O9DK0DSN4AH/hNwR3ZvhRz8b9dTll/5E5SejiR+ezU8=,tag:dVX/rcp/ceizJCuXDJZS3A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:cw==,iv:hw3xUQhv1IdSJxHPbLVklU258FrWgrZfPArNvE1N9pw=,tag:C6frpa+89/IEPJfEU2x8+w==,type:float]",
"type": "ENC[AES256_GCM,data:ihg2kDIu,iv:unM4GTPZmiFqovux5dodHGcf0eeQtc87wgwrWRz235c=,tag:OapJI/hTU4JqEehJfkoHqg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:vNFq7zWfJr4=,iv:5iiVNHSaylX/mjktA3SrS0b5t1TBuXXwVvXrSV+xWUU=,tag:f47EQaxjeUdKb7HiR7kGPQ==,type:str]",
"value": "ENC[AES256_GCM,data:BWojqs92FjyGNbkU1+65zZREOA==,iv:in4tlGsz6hGn2sQCW780yrB/YFh4jVMOPbB54tgkGO8=,tag:7GwgI6Q0+gVbllDSz9GsaQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Hw==,iv:oz4fPXOPsc367AGYw+A0JYFBQKaPsKh8wm1ogO+0Bo0=,tag:v4arWc8EwsUMQqRIqIefpg==,type:float]",
"private": "ENC[AES256_GCM,data:8jolQZhgii4=,iv:jTVLBM8NKzqpmsYJf83MOvdNFfZ8krrXAGhQ+lkqU3Y=,tag:inCX9xhdmDnwiSclUVVvSQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:asODBtI2caE0avWjPs6Y1oQ/j5hjePI+mv/SYOA=,iv:994RG1nSyGEW9soxDXzFY2vE//IWnWfwAk5Pa1LmriM=,tag:wDrNSPiM744X8+Zw9W0GWw==,type:str]",
"ENC[AES256_GCM,data:Y3Fh3O3MPzeW7k9FCwFCHyNE,iv:RnEcWTbI/M22+IGA13yTiTKtZrhvCNwXLmhfiQc2+zg=,tag:Rr0iYBxiFqQ/xHbvzFwTrQ==,type:str]",
"ENC[AES256_GCM,data:cj7n75eOQ7+QxsNw4Y5WS/gswppsUqoy51Q=,iv:PMEo3GMJB3mUIdpjAfcSBvUGvIWPAMIxZOHd0D+Wqtw=,tag:NqCk3GWl5uUjnECBNcGR1g==,type:str]",
"ENC[AES256_GCM,data:9eq0c40yG9tUJIppJil+YmQIzRo=,iv:GClx50vsg9AVB+XJ1diZcO2w7U3VuaaRX/SM+z9yaow=,tag:+O26DU5xl8o8ncbT5ZBuBQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:g9AbXBIhyQ==,iv:yg5DVBEpZD2+HG0lAtpWYAdOv2cKzkBLL5rcwNxzuJA=,tag:/1RDgAAwA2ad/GJSGzmAwQ==,type:str]",
"type": "ENC[AES256_GCM,data:pJf12BSnTWRTYpXRUzV2osi4K84AWO3e3KsJfzk4Cd+3TQCWf5iHYA==,iv:s0ud2skPirpdqgqjg6jTV2FuyUKqYrGR7FjUgD05sro=,tag:5S8ocj+zBTU83XvNcLHhbQ==,type:str]",
"name": "ENC[AES256_GCM,data:ot7Pey7ZGJreVQ==,iv:HMzqbHYyfhgUllZ0dH5XF33b/1+uQRn498mBrHpnasY=,tag:02/e59cyIIqp5yvlR7DQYg==,type:str]",
"provider": "ENC[AES256_GCM,data:tf5hLwAVn+xI7xHqVUsOscuO8nHtqpRcrmVaOhhScyPeifXZlixmCEw/SKDkLnxrrw==,iv:ySnpFZBEPpH2p/Xs+SXFJBOxRwtIVuaoZfMRbmvYIME=,tag:2HMHycVSL4M3XRoci/CCfg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:qw==,iv:8QnTAXIUbdVYnRfFFZBPlIbg85rtkqaqptR0f6ECopE=,tag:OgB6IRULpDy6Vqxp6xZEHA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_roles": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:288j9cZRARWqJg==,iv:YQqwMiuVavuqgGqr8lodj39TlaUqy6Hn68IvU7t3ztU=,tag:sIO9MRXRQdkIlRXM/Ycm2A==,type:str]",
"ENC[AES256_GCM,data:zz/KQUvNbKKj,iv:466gH2EpZ47DYYebG08sHghj7JS7sGBTqQiYghUK1xs=,tag:iClSfR1OgdLeZEzFs4pNIw==,type:str]",
"ENC[AES256_GCM,data:YxijRUhbsFehiVfZ5A==,iv:zNSCDd706asoQYKGP/7Z/NOISCC538HaPEGYC3Xb8pE=,tag:UJB22CybjnjkPR0CH0F8IQ==,type:str]",
"ENC[AES256_GCM,data:5sCCferO+i7I,iv:N/06qch7k1I33WYYut6GQi6DsPxC8Im2kXfddIhNnwY=,tag:p89389/8ZwS2JTOtFoDj3w==,type:str]",
"ENC[AES256_GCM,data:+UM2oXP/ZybVA+rYjw==,iv:QQPLCYFXE3G9qdPyVWUSVw1haYG51ddIdJYFFnrP1ls=,tag:03PuLAUrubo77pa7pWnZgQ==,type:str]",
"ENC[AES256_GCM,data:BuTrznbPzSQ5uolnWffHcg==,iv:jdFGsfQZT00Xe4BeZw1MYVZ71m7IHNSdybUAKqtTTVc=,tag:OiUWzKmh38fesm57/eWR+g==,type:str]",
"ENC[AES256_GCM,data:HPDvG3d8vrCKWXU8ZsJN2rkm,iv:cMWYgqfut8xvI1YBCPYkdvmp0B7yQgj2iPYjYGZp/60=,tag:1RW5D6FAzRxWVJD6ultaqQ==,type:str]",
"ENC[AES256_GCM,data:4/sPvX0fNe6kz5xQ0p4CSYI=,iv:ThmWDEet1iH4I7Q20J0o8rVtaMOCwqYNsHLBa4RBm4E=,tag:DY69vvKTibGVabuYx1q0+A==,type:str]",
"ENC[AES256_GCM,data:3035rhC5t5ftbvsOLQ==,iv:g+GsNxk9DW8qT+2Yp3rSMJHX2X6WnfIqTQ7gT++/AhE=,tag:xqNwO0kTBFbWn8YFAJHPdg==,type:str]",
"ENC[AES256_GCM,data:Rgt/WIIq1Ii+ILzm7kOCgqpPIA==,iv:n/d3fNwaj6c4fcS6tlNF7O1A+AdWPgs4HmrHc8uQYZE=,tag:3GsfNGtCuPBjYz/6dYR2hA==,type:str]",
"ENC[AES256_GCM,data:zhayMT+9hkIHAGntDGfv,iv:k3lcuks2S/EQoJnCiMkOnEEm0G6dwrbCin/GxHrmDA8=,tag:nax6xKe5MEcpVVKDvQVZ8g==,type:str]",
"ENC[AES256_GCM,data:Fwnt/tBV4VEK,iv:WCMX6SBSNrlbJd7nf0hpY7lGichQVzhRt0cE5XoXHrQ=,tag:G5/+Sh5eLhMkW02ISb9jzg==,type:str]",
"ENC[AES256_GCM,data:dcinSQ0ccQMTjI5u8eOZn6Mxeg==,iv:WssxwpjU3JEKTmf9Pjzmz6ELEPYm3+RBf8oCDKonCpM=,tag:79xUnlflqV9TPk/wTPwMbA==,type:str]",
"ENC[AES256_GCM,data:YJ9Ue96LQOAL0CibTWQ+gbsVdr+LBw==,iv:S1gXt7gB2ml8efDge70Yi7hqTReGzXDrh9OKN4H/Zv0=,tag:0wm7MFdy5qeL7bEYoT/YTw==,type:str]",
"ENC[AES256_GCM,data:PadEkF/yiUmJ,iv:27LxIky8WR5AIcvdIuChWFgNiztPTQibU2387o4CFeE=,tag:mcaNmX20TS7k7mVsaGK6Fg==,type:str]",
"ENC[AES256_GCM,data:E7Sr+Lo1+CU3v4K5KfcTfzwl,iv:kkotRmWhhjZJgH3CYnef+g+8p1bbXe4PK3RKQQI6yhE=,tag:TDXEvo+UYiWUS8r0jstOXw==,type:str]",
"ENC[AES256_GCM,data:fSuxR+0flENmuCNM7w==,iv:DmTAZLLghz8If5Uk0ci4Aai6+nWXXOdAl67Lj/X7IIU=,tag:YWcn0AyFKBUkt+8tYqbvLA==,type:str]",
"ENC[AES256_GCM,data:xjIxnom07/K7KlFQKav6Ifk=,iv:q6i5zVFf3BqYUld4CdegcLNwiiTQaN3mGQzgDWCuJjs=,tag:tP7LQx5JcJViftreq1miCw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:HUo7vHJoPEg=,iv:m/tZN43YyIMmz684k4r54NdyL1ULfXHXoozbrIsTqbQ=,tag:HI88uIuZA8jaixjX050giA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"cassandra": [],
"couchbase": [],
"data": {},
"disable_automated_rotation": null,
"elasticsearch": [],
"hana": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:A/3RORHnJigXQmkwVpgIvIYpjG0ITYq43UU=,iv:SDrvPDBFBzpi0UsF8I+aH53hmdAdG5zcl/w614xNv+g=,tag:qZz2bgGm48ST7YzeECSKLA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"influxdb": [],
"mongodb": [],
"mongodbatlas": [],
"mssql": [],
"mysql": [],
"mysql_aurora": [],
"mysql_legacy": [],
"mysql_rds": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:ylVKkjkxduuu7g==,iv:N0AzgCbiQo3XTJ3z5472MaSwiNjoee3TcavvlFNYU3o=,tag:TN41NuGce0Nm05KNV2G7xQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"oracle": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"plugin_name": "ENC[AES256_GCM,data:v54a4f3jeAjkcPSIdY78fyeS2sA6PxroBsI=,iv:276HW7r0hv2NIhrceOKuIbMeF5U9vqUIMnMRrhNueNs=,tag:1+3UOU40uZBMXHsb09h3YQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"postgresql": [
{
"auth_type": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"connection_url": "ENC[AES256_GCM,data:7KPgtIhf1vN93fd1zwiMB28bKfcu92aoLET2++QixE6q8WqGsAe8xZ5eDLP+2/YKQ8AVkdEl7gwqVP+o2LFx6imUUYHVSqAn6Mm76ojzRe+d8YNu94s0STIu41Lw8x21bqOubfY7yw==,iv:N/lsH/P37iY78CUzuNI15JflFiHZHLYykZbX8AHRtKo=,tag:nYo205EnRFr+pkMZVAutIg==,type:str]",
"disable_escaping": "ENC[AES256_GCM,data:cBS0EkY=,iv:suSRFtLIiyozBFrqYvyyM5Wb3wtpcoNlbHzFVR8kSjk=,tag:LWwKIWvPgD0KWkTOCjDDTA==,type:bool]",
"max_connection_lifetime": "ENC[AES256_GCM,data:BQ==,iv:2cZy7dwALnVkJtoeDbQ+T3NgsJsrzwKv0OTj6NJnw0E=,tag:R9I9goiHFdIN7Iw4z881ug==,type:float]",
"max_idle_connections": "ENC[AES256_GCM,data:aA==,iv:gyv7fnuX9aXPcDDvUVJf066C5XkYkTLeewF2Ojgoeec=,tag:buzpb/iZj9O4RQ3dwWUu4g==,type:float]",
"max_open_connections": "ENC[AES256_GCM,data:SA==,iv:3oN6tTKgi//iPCdccI6Fw5F5pELQi5SI1mwprPnnYkQ=,tag:uHqLJbtFroD7IFJYhxyfVg==,type:float]",
"password": "ENC[AES256_GCM,data:9c6B0a3udIU0PLBHI97sZMj4uYRFmQdxbthh1DXGh+MbkgELIEOePZAAI/8+kNYClhYNMV3Bi/sq2hoD1UiZmA==,iv:P9HCDsTqKcMIj4UrtkaG30wgLrUXvMeBdapgYyWaUbw=,tag:O9sW8d5VPwsJusLeUwEEVw==,type:str]",
"password_authentication": "ENC[AES256_GCM,data:D3H1RT/ePkw=,iv:r+wPTMWng3jtuRfDZbPST7IrwLB0gaBohqFwP0IvnbI=,tag:GgjuONc5X4H0DCH3I2v4aA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"private_key": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"self_managed": "ENC[AES256_GCM,data:wXak/Lc=,iv:jhSzGTkbjgNILT7JUMW2bPn79Y31mceqOdmzXk4ExhA=,tag:CpyfVuhpBN54iXFsLXH3Hg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"service_account_json": "",
"tls_ca": "",
"tls_certificate": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:28RO9awcQdA=,iv:xRowI1a4VYIN/Ix5AiVgks3Ttq3kOWzAS/jix/oqt6k=,tag:mw6diGAOTYmoWbx5+HRhCg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"username_template": ""
}
],
"redis": [],
"redis_elasticache": [],
"redshift": [],
"root_rotation_statements": [],
"rotation_period": null,
"rotation_schedule": null,
"rotation_window": null,
"snowflake": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"verify_connection": "ENC[AES256_GCM,data:gBkfCQ==,iv:RnqovZwYGCAk65ncYMb0fO9KW6EVbpEJktCFEKxEiV8=,tag:lpmN+Y0c7yz45DvjuYFlXw==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:+KekyQO/2S8=,iv:GgkDGdmnGVM5Xwxfg9m0G/J0QH+BnAeW7cAsUhQsvdU=,tag:DTanzomGhB1MTF4gWGtuNw==,type:str]",
"value": "ENC[AES256_GCM,data:0ndw/29p7R6ukg==,iv:hJCgvIh8GGUc6nCPCJnlp+oKVzzFSVTQC/xf+x8PowM=,tag:nHE7jehNHGumlaurmwVPQA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:9vmGqJo=,iv:Atr5syq4hekMQMRB5YnNMgIsjCjpj66k6cDW2z4JEhA=,tag:jpdRfzRgnFNQAlAedrb9lw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:3A==,iv:Rlmc10F60MRP7D219uXnc4zEJ+2E0wGe9Rvt5yGykEM=,tag:xJLNcdf276b22tM3ULHgDw==,type:float]",
"type": "ENC[AES256_GCM,data:v9nqOPkz,iv:U/ZkglumhIWLhEd1IX19vQPAQ5jJM3c47DsJYezF8i8=,tag:rMvteYOJYvd13opFW0xs6Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:7eApsCdPbfQ=,iv:AS8PcycU5EBvXEMryqwiqP8UhmnN7nfTl1LZuKNx0/s=,tag:2WHJnYvXk2wpOBJN0PiZXQ==,type:str]",
"value": "ENC[AES256_GCM,data:KsgjUn7RQPI=,iv:XIFv92nfFY9Kpch8ZnVGjBHz8HSCkvrqAIVfhebytes=,tag:0m+KONd47rzPt4eHlW5qwA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:wADo5uYouGQ=,iv:R5ILM8Scj04fhaOFApiY1fu/v9aKJ+/FNqRb4NDTrkY=,tag:VPYvUo6FJJHRyFUvuGJG+Q==,type:str]",
"value": "ENC[AES256_GCM,data:jKOfP6d+3GVgPw==,iv:TOMz7+afXxSKcLFh7QY6r1uF8L5cmQbLfhP11HNQjYQ=,tag:2xVDhck625xLBV3AKYdDHw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:M0JUyX0=,iv:4fbVSq7uxlRPjheolmP5y8TuSDfw1nEGPUjjdPDV4lY=,tag:AdtyagYaeVljSFsEPTRlaw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:sw==,iv:YeXs7sZXhR3NTr4YROM0/LSZKbu+lg2w/Z7xxrdIxPI=,tag:H0FZc87rM9+hCa3/YduGNw==,type:float]",
"type": "ENC[AES256_GCM,data:BjAsfKqF,iv:FI8b7MCID6seSnivyCXKiPaT0tlVzCc3Ucb22a059wM=,tag:X/EjU6H3zUGUYDyX+LykHA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:hNl4vjtAmU8=,iv:IFEw5CmYq+YmNtAgjHBWm8YWooqyLM9WFDBs1IAQw8M=,tag:6VYpkEFxW3BKCnO4qtGuEQ==,type:str]",
"value": "ENC[AES256_GCM,data:JSnYfoZ/HLps1N0=,iv:4ghr61ZOEyJ1slqDgJKXKFFJz2jN2QtYaEC3akqMh94=,tag:eDV8F4Eaut0fX5URh7l28g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:P8NgZRfREhU=,iv:gxm2dmdA4uT4aBf0j1aey//Yd8GPwhdNnlV2KFVdx3M=,tag:E1+YHwduHy3TFeTVwkfRXg==,type:str]",
"value": "ENC[AES256_GCM,data:+ta3+ccN2VD5rg==,iv:yBtZCsDyxKOWIc/VXheIHk5RbprCBORo3o5BV9H3xiI=,tag:eNrD32mzyEJwcmVIh6sBjQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:n6fQd7Q=,iv:p2ddg/nbKx844mVRMpx/0+iYgdPJE6CEAKcscTV7c4w=,tag:bUCJiKsMRyQsFDAIyYuvbg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:iQ==,iv:4gb8CfZErlwK1gqQosMnvCXpI0pZLUoCytD2oilq9z0=,tag:UPrhzG8+BIkjUtbJOhQKbg==,type:float]",
"type": "ENC[AES256_GCM,data:2CZABtKy,iv:9Hoj+Hr9esRIwL9TornMlRR1y95u4iFz1SKUeTGeYH4=,tag:nAuevtiMyxwHLDsICNf9hg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:mxNIQc2m4zg=,iv:NvHeyNlMwx3TezXU28NnOd8TzYCHSxH1he1paNkVT0s=,tag:aQv8X5xO4c8N5tTbGTY2Bw==,type:str]",
"value": "ENC[AES256_GCM,data:2y2AoQLSxR190tXiBLKMJvFHnzA=,iv:M/NONF5CnXbTk+V20XlpFmMjj0faj0n0K2zL+fNC/g4=,tag:93GRQDRe+B6WYAECCjWy3w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:XA==,iv:xVsjLCbUwXhEyaUIKzw5Z0UNQ67Qn4sScnOsqqQtEv8=,tag:MUwDKmzJiHRTuhRflE/nqg==,type:float]",
"private": "ENC[AES256_GCM,data:nhCOQ+jZWuo=,iv:BwnbCtBSj8TenPmX5v+fHWFlV/KQlhk0lM85Dyr84n4=,tag:IN1nwpCg2Lk8qF5+lP/gDg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:1oeaLTgr5HwOjPn6X/bzMr0Sh7qAygaWF79ndus=,iv:psUruVPdBHAi4N+cqX/sWuFDXmyZ1Vm4zUzc75yqAeA=,tag:PZU/rEw1hEnBPIorpzFfKQ==,type:str]",
"ENC[AES256_GCM,data:4UPS1K9r9prxijJAmnxOZUCH,iv:LH1dZbSFvB7DFrP3ku/Ny24c6bx7UpXj6nzYD0tHeQE=,tag:Bg3C9tAAPNbOa0QUcSaBjg==,type:str]",
"ENC[AES256_GCM,data:JLVJDDzOvGAhgrqNNtEI1wJ74s2kQ3SyBfE=,iv:J+vp3bJ36iehZFxEiPjFGWpdGCEhNV7WH2xr+dMa1mk=,tag:Red40LtuT7XfW5GKbjv4fg==,type:str]",
"ENC[AES256_GCM,data:oxvIpgJ3CxOlZFEFOOWqOpxOB5s=,iv:f1z/wEhXLYrV1PYDU329YTFneFQImjMlzD0ycAwYnSk=,tag:1eWQR+btcysgTpbdp9py3w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:QgcKnalwGg==,iv:rRYire3AUDuQw1uk1RgYaIlFsTmYwIhxJEwBZOgnL4s=,tag:2/Y2otORTeMGbZ/WJT2/JA==,type:str]",
"type": "ENC[AES256_GCM,data:SUAF+JdKphGTnbmeSkaCvbE/J51FWIEr0XMtV022rlIMyy3vsG0JkN4=,iv:pWH8wuMh2imxjZrDfSaj3Z6VhXBB408R41v7y5addKU=,tag:XXzJThlNmfDjjNC402Lj9A==,type:str]",
"name": "ENC[AES256_GCM,data:0V80exWH7znshfjs,iv:DCZrqLd5zzM4HHWbBq2GyF0iSg0GRUvPDcI3zrpWPvY=,tag:EYD08wZgRoyCBCnSD4SrmQ==,type:str]",
"provider": "ENC[AES256_GCM,data:rIOmRvTFkL3797I98N29eqR42QpH67b5k5DH85VSLm+eEXb+Uu3j4MWmGq1VwZ3DlA==,iv:8mBW7R8oNTqI7crRvshC2jfQDV5Q3X10J/oSEXdHp+k=,tag:FHbteiK/ILiPSxWfFD7jfQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Rg==,iv:GzCf5lWLzm50n3Wzao0p9IiMxpl/nN6O2XvzJVLkphs=,tag:RDrvPmQI1k+JSDHg0qb2Tg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:CzzO9fiAMhQ=,iv:xjb/uYVPl1L7dhqGm8gaKN3RCI+GSx31e8RebgJG3ho=,tag:5Gh1TSwx/sYTIqYe+OtGFQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:CUS07KQnwRY=,iv:qzUb/YfoRkJ4OrZHhhiLtqXD75Kpzi1kBo5m73Wgq2g=,tag:aw8i5PnfiBSmKA31XOlytQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:KnopDZQ=,iv:QGzrNPEUXtGcl/e0dc5oCzVHVpHSJhBOp1L3LmjMkJo=,tag:WuOlkQ5Kr7TnYOcfhazXHA==,type:str]",
"id": "ENC[AES256_GCM,data:KMMAiB8PB57aMPNUHxutkipi3d3ZGJ+W0DyO3vwIOL0yLg==,iv:cNhLPDOwfVAJAO5rjvq1B+SYsM8HbXeqE1GqN68ZwTk=,tag:el11wjfYp8FHvEG4oY1gTQ==,type:str]",
"name": "ENC[AES256_GCM,data:8J8Sii8paw/uRnrK,iv:RI2NGrzNW7kG3yJhLZn5QoIQkw5/Xz1DH3Cuks5zkiA=,tag:koheswvHeIO9ljwZqfD/ag==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:lqF9Goj1,iv:IzmRpw7+AWkacCt41LPfwJQFp8yLgvbn+0bd97XZj5Y=,tag:HPmH475MOUTXpLaY0+LkAw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:XQ==,iv:GWgo2OZkQxBnurT/sgsSN7jVdc0FGSr8lyAbBt5Mtsc=,tag:Kvrp/TzM6kOxXjK/1tgLhQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:s8akep9X,iv:cC+vm4YoSbUKbGbjo3ixNfGsm4+nJTfdu1aQuo2M5aM=,tag:Qyl3SQgLe7EdgNHjLx++eQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:E+hWttg7Ptc=,iv:P+KxApeu3xbcZaFGVIP9ikPzm2fcNsUkD71go6MwHOk=,tag:q6xEjmpqVJABiEqif3hI1g==,type:str]",
"value": "ENC[AES256_GCM,data:2MWZ2QcEp9dg7YSuePSuQyKcT6fX,iv:SSBKpSZnNq6JtL74X2X1j5QIX+Xb7kCxLelh6HXeD00=,tag:J7+Kz3WJXCUft//skh29Nw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:nQ==,iv:JnrQRkgJ/AsQtFruMWaNQueTSugKw7t6Yt0mj8l4Qy8=,tag:kIPUC5KbGe5YY/OKecGalg==,type:float]",
"private": "ENC[AES256_GCM,data:KYdsd61zLGw=,iv:FumcdSeCWKj3sP1bEfPxwSJUEq6gMAMall4OqHTqQao=,tag:tDsZPN9ASsQoFB39N4JozA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:lj/kHL84eX98hqNHy4C/lItkzNbD9Er4D3aDAYM=,iv:0NE8Fu+Km6LrG4EONNxUF6cIy+KbrXUaXuSFQuNosog=,tag:agfcP29M0rpSLTXh+0LgpQ==,type:str]",
"ENC[AES256_GCM,data:SsIeGPXzZ7Pgm7AxyOVW9QCq,iv:DPWBmWf7uYd/nDWpVwwv9yhE7Lyq92qQToFsK9DMxH8=,tag:G0TM64e9qxHG4h0I+VPNfw==,type:str]",
"ENC[AES256_GCM,data:crQyJo0OMAd5RN01zfEhsJLLRaMeYmP6Amo=,iv:tmVSsF+gx7pPO2080juj7d6JjLjV81KD6Q5Yxo4EemA=,tag:LrOP1eHfE8cqX6Lq/v1jmA==,type:str]",
"ENC[AES256_GCM,data:KyODaTB3+TpPe0EoVz6wRHHzhsULVnfkYKs+U4ivDLnGXypKGiMlEmVkqEQ6cQ==,iv:YwaDaXhRFd/48jydqXwTdotGspKNKVtUqEi3rafQNKM=,tag:2nEgKcn6NwAJFD+iKA1ynw==,type:str]",
"ENC[AES256_GCM,data:QfpkgKYoM99xhd/GZse9eaOAOcM=,iv:6yBvQmRkLXRjvWAefe+hs4rrtXq3KG+uwcBcH+NEz6s=,tag:ZetehiyD15sBbLhzNAaS6g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:cdnbaoiraA==,iv:dXCvYQ8FxwG3LAYkJ9xBFupx3vU7w9vpij2HIM3eQqs=,tag:a4/qnCNYqWDV2qPWuoT/gQ==,type:str]",
"type": "ENC[AES256_GCM,data:Pfl05C7roUoKdJFPLFifgyrcOqFkBQoZ+LSfuu22bsg9CZJ1sokOQZU=,iv:nII7R40ctjFzPd6mQ6NeqjtOG16rfNm9iiMCM6YzSEI=,tag:BWMyJRH5GdGtk8l8ldP5kQ==,type:str]",
"name": "ENC[AES256_GCM,data:Mr0UePWfyyAQxvGMuQ==,iv:eIJWcCTyI/lVC2uvOrf1KMdDYCy6ImaRNjeYDkH1R8c=,tag:3ysrn7Y9BbF/CZZWb2Z6/A==,type:str]",
"provider": "ENC[AES256_GCM,data:vlQ85K8LM1nLCFwPLCy1Yguzae1C0EHYwnpTsFrVb9HyAMuH7P9/RUtRZtM4zFuE9g==,iv:YgEVVjMPs//tsSUo19FVgXrIlatP3IV9DBKpXrziPLw=,tag:cY2UOGRCMvJ/ly/ST+LZTA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:YA==,iv:O87Btm7awTRo6v38bjeXGrN6YrhtFVcYVHB+BlJz+vk=,tag:tUKMgC/UVuEC4b/ZbxsTPg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:K/qoWeryZ98=,iv:9AkyM0NphRgkJ7a95suPkDSiHFuxBJ7hufyMlwcB1f8=,tag:ZN9sUXzz3ZAe9VOl/nOXAA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:DetE6zyOciY=,iv:cUnY6GB83L15PHfHzj9kcvyx5j0z30o9JY0iX+lLEec=,tag:fLBbLieM2GRFppRW3/3sZw==,type:str]",
"db_name": "ENC[AES256_GCM,data:q6PXzAk=,iv:WoHr3emAhziGS94b6T4t0BiMpW/iTB3d0n+Z/enEfcg=,tag:E0pv6Zb299oiE7eIoWDNyw==,type:str]",
"id": "ENC[AES256_GCM,data:MHsskJdLZyUDra1boEc7RSRS5ciFceEUYjYzf3Ekbs6q71w=,iv:03zy6jbvslp8xrIUwBtaRDKBy4OqxCsgT8VWMP+aoCQ=,tag:dn2Ls5BpoMYleUJW6Ue22A==,type:str]",
"name": "ENC[AES256_GCM,data:DUJv4fdmD+R4fkGJWg==,iv:53/ELVZnl8P3Ag0ksBAoE+SepRMuCA2WoH4WtGizxaU=,tag:U76RMvqrcKTBv6zNpd+tgA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:86znePQd,iv:0L+5qXe2k6OFzOVRjFbVODJw39pR19fCe8vZiYntY2Q=,tag:7p0rP5CbBTuC0qXkOgvDWg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Vg==,iv:evsihJH5cNon/9eS3nT/qHj9k1DSN9yEbBwhzb3BCME=,tag:RCDF4kO3EQE5WSNAU0mkCA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:+nZLrjOa8g==,iv:NIynsDl6NOP39kftjyc5rijXeA+3/7Aik2UpxI0MBHo=,tag:dQF04ZJBGGQu1pQUBF/uFQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:cz4U20nHm2w=,iv:E+wTweuWiZwOXofAD/nxYCu59D9juvokxjsF18lkehM=,tag:D+G4tdZHFb9HgAeSldrrlw==,type:str]",
"value": "ENC[AES256_GCM,data:+bMJft/YbX5IR9OjNWhOzfqy/kuy,iv:g/uo56yI2GwfPwcB49DMg48r6DCHPFe29rc6z7rGYhc=,tag:K+oLcxcmsfcHScEt1jTFFw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:xg==,iv:WKVlZqjqWVUnim4LsuFwcJZJGccotAL74zyznP4ONH4=,tag:u95Qrj5v3LLmJZuVkbHtmg==,type:float]",
"private": "ENC[AES256_GCM,data:q7apvtLC9rw=,iv:qS+LBCkbcSd3nzO4Y2IfgcSBWoSrid0DzPXvLBOZYlg=,tag:Hv43xzHfps95YjRJ5eMvdA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:nozHhgCfbo5fnkvzLf6JLhJa/Y3HwOcDVAFzfac=,iv:wDwKaML6UBi6zUZMRIXtFdlJSoPzp1vEmPKb0jy7NiM=,tag:FEGqCb2NghO9IpXfrBQC+w==,type:str]",
"ENC[AES256_GCM,data:ObNxlSi3Uc73mE1SseG2yRMn,iv:d4sI5ZCNLKH17GbTVtzoE/u0eWhWyTd2qKsCJBxwTIA=,tag:ZWGZmGghwvWALXFyz8IzIA==,type:str]",
"ENC[AES256_GCM,data:Ly1BUOXgniEzkG+ZreJnm7ESgr7jDJiBbao=,iv:VamqpkDKDM9Wg/An/drvc9nk8OOB8/GBojDBc14H6eI=,tag:6WYoncQIpi/EqXWtlIaSdQ==,type:str]",
"ENC[AES256_GCM,data:vj9Q+j3a7L0g/n3L3jCpMbb9id7MFc42LPg0e5XY8p1ApkalkgqWVluN4wVsGA==,iv:BMzhppenWNZN2jdVZdO3oSXn2wKIt6Ktpa7y7JgI+1A=,tag:c5jTGMEfh2F2lPPCcfbSHQ==,type:str]",
"ENC[AES256_GCM,data:1IKRN/Gqo8LCIwDzQ/lHUeK8Als=,iv:XcblWUlQ/EBpr0PGH+KDrDLo5iVLTiKjoxyZXcYYTg0=,tag:NidzB3P17+q2VWSSXmc0tw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:XET1U7r2Hw==,iv:ezbbttvEuLTCLVZmb+2ap5gNuYNM6KrcqgKV6hT9nJg=,tag:NLwR0IZeYjcV1k/0PeRICg==,type:str]",
"type": "ENC[AES256_GCM,data:6zgTFhUYMn4vnckZJAoczHp7HMnuicgHAvxBpGdlnojeN0sixrXIeNo=,iv:3+FURYa1Wls2caPbhVrdtM9P8N2T2sU50pTe5gYPX1o=,tag:gcLfNWILLOWM3MxTABwZ+w==,type:str]",
"name": "ENC[AES256_GCM,data:QxoBnSO10ikg6feblTV+,iv:tlnGHdta9f1eqddBTWIg3VYQztiqgt5OJwYxRQgXFUY=,tag:wL3H5cox26U1yH+Oi7imMA==,type:str]",
"provider": "ENC[AES256_GCM,data:K8VbDMEXTj/HeHXHGYgg8Ls0r1INaQfGQzXZd88u44k2X2ckK5KCUR/DGvNBCkQPcQ==,iv:spEl8OI0WZfQnOTtyvql1Gvqfvysnj9vt/VczjUR4NY=,tag:Dh8GKaqfHed1TRhufQ4Aiw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:3Q==,iv:Hy8ScoMSDfXpGmBd07RWgPK0aWXY4SvpOsDTKG2kL7A=,tag:aFws5Vs+alhG96iP5F9lCA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:ubyG1FzDhZ8=,iv:IQZ6QvT/tB+lf6HWwI4032TiPNOELeEf1tM5Mk5/Dvs=,tag:PSlV+aqOG2IO5qfz60rVPA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:IOlSofF8CTc=,iv:xu9q6JAR1H8IEaq7+fulhSiuZ4l529KsqBRebPNyjDE=,tag:OrxMLBoAMktQtZrZZ8Q+WQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:lSlyONg=,iv:pvF4f1Jmx5SQFUPKfOPKDx63Y1VANIy+RNi4lVr18Yg=,tag:f9c4FQtng8k81+NDC035gQ==,type:str]",
"id": "ENC[AES256_GCM,data:Kgfy/R8bya2MFUMxp88qFdkStI02fSUwnjb7CjuAbbZ4duWyVg==,iv:Stw69JFtqQquAxReUTgcbP6T+hvCA927ROgp3ydTa88=,tag:lyH35Pr61rB9gM4x/+R36g==,type:str]",
"name": "ENC[AES256_GCM,data:hnY9AnU4TzfeWChIoiJh,iv:4MKkf+ey0zzCoHtTJxQZPki9gRYI0ptkZmdJbE1EJDY=,tag:qtjmgulOgY6TMIvg//tIJA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:f2iVQBhV,iv:f4M1z1XyiWLj18vhc1xGl1Yupi7XI2CM6nUOJFVi0xE=,tag:DPKSycI9jbaldXHPWRlgTg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Og==,iv:K/Tt1i7Ll/v1Ti+Ac8NEgY65TImhWu+irSqTagw4108=,tag:6UqXqBWVJIlggpvnJmGcxA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:wHfrLsHPVJxu,iv:V2rlP4GpOrrtFeCQBtNhABgqBEhGPxyNyBorRTkOHSg=,tag:OzLexRCNyJuhD/JMdC0SsA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:i5ZcsNjqvZM=,iv:JYEX8ocK08IKg6nk03GsBlLIAnggPIbTU5DADUBR7ms=,tag:aTQxT4JvzkQjEDuJyg6inA==,type:str]",
"value": "ENC[AES256_GCM,data:MlxVwpVM0P6lCPitHD6T0amyPV5J,iv:oRZjf9BO6bBnBIOHY8cQpQrH+KtenQUpUAJNEwisaHg=,tag:eJsnqPkePxMvapuTjyNPng==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:OQ==,iv:bDa5L9md8n9/5+wnoF1UsttFHAJgknGOhq6PrE/qrXU=,tag:+oAgWLlpRlth6lPg9V0jdQ==,type:float]",
"private": "ENC[AES256_GCM,data:25GuNTaZlCc=,iv:XooT+HOS+NLu+/zoX8z77YnmdHFwx5XpRnS3tvgGEAs=,tag:U8PXsWfOQel9KKg+PIqAhQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:mz3nbNomueaBCeLFd0Ud/zD3xofNzE4ltJf2zvE=,iv:SbraeqyBe2gw7STMA04lCZ6/awMWzx6cbzx1IJtzdY0=,tag:lSQYkR4Vm8PkGJdrj3enVw==,type:str]",
"ENC[AES256_GCM,data:AsUl37yjB3XNY9uodjDN6Edp,iv:HwxKMJ0XLGpPs1RBIoO7UvVDCogbVX2wNaqfhMJxonM=,tag:OTckQD4m+upSi+xVCh6FVA==,type:str]",
"ENC[AES256_GCM,data:GGW8C2SAekDwiJIL7H6JB5820DpMrGIEyTU=,iv:GngT4RVUD+9wqi4WGmkbVJSNai16ehsHfYH6JujId1Y=,tag:BfVIGGSFhHRu6TRh8tiLEw==,type:str]",
"ENC[AES256_GCM,data:CsE8Z3y8E4g//Vk5wnyHVKOTBZMkR6pwhiKduEp3Af0X2/RGXM3ybmsEv7Ih8g==,iv:YNCFRZNr0fDD+JF2uofz+MYfKkevFSzRxnvMKZ9g+qo=,tag:5m8yhduGnA9YARZelqYCaw==,type:str]",
"ENC[AES256_GCM,data:90VuTbM32STCiBO6bpAt+gKk/o4=,iv:JSFnVmWWKndH2QTQ/QLurJLqmPH9GYl38ofulutxEX4=,tag:8ppfhE6ulOjaSBaF4B4Qow==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:Lzyma9paRw==,iv:zDGGSW+/Hs5rnk9XtUq6JxHXl4EF2VohuBxZnOx/b68=,tag:JjLlEnTowdKk+xSUGy1K2g==,type:str]",
"type": "ENC[AES256_GCM,data:32axqfdpSxqCPL/3V4tnubwTe3Udg6QPXj+ELspLQen7aM8nez9GrVY=,iv:nBGMirQ2UceCqDJu9ZxkvyuNAhK/3omgh/AUqPdG9cw=,tag:Hcibcdj1ELZww6zvM3EKuA==,type:str]",
"name": "ENC[AES256_GCM,data:SilurcwI0e9OQAy8Cg==,iv:ziXq2oW9qHga67uX/cjW+Gqo46eeCbOxLWWquG1uTsQ=,tag:78X2UGAJPEUHkIB4OadTmQ==,type:str]",
"provider": "ENC[AES256_GCM,data:NRCMuA7hnJhvEThgvibG99S4sNyvMzpzLkDd6BbQfco+/x7rBdfuTbVZr7xFlXvGwg==,iv:by4X958XbW/OZJUzMPUlYt7tZQ/+EaT1ThLiR6OsNxQ=,tag:lc+7uNY1wXpFhes0/WQBfw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Ow==,iv:b4IH7vsBxPS5om1sP7kaJHn6YeE6sfPID2yhPSU/XBk=,tag:R4oC/lUQSEWKTIVZ2Lim3Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:cnSCs7L6jQI=,iv:oRfQm4MhFQDXrNMzAhAyb45jj8JR04GBghbCen4+fZc=,tag:CcEjPyhSfnCeRacYm9770A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:w3Qc1SUplAo=,iv:wC55xYF6F0QrRWrGV2EdGr/B6VVAKh9GuaOCOi9xpUU=,tag:Aew+xuGZrBdPhwE4Bl2FWg==,type:str]",
"db_name": "ENC[AES256_GCM,data:3gGGI2k=,iv:+9dwv9TcF5OQqDekTw0+yB7HiVH+hXOS5ZrFOQcF3Mk=,tag:x37s3xJT28JEZM+CsnHxDQ==,type:str]",
"id": "ENC[AES256_GCM,data:3rGe1QRk5KqCQ0wRh/yHzh3EwGlmZEVlqOCBz53oJTY5JcY=,iv:JjZDBVsTv5jg2cvKVBa4MZ4L6spXvIkwG0aO+ceYftE=,tag:TwUUpfWggpYAt+bcJGGpGA==,type:str]",
"name": "ENC[AES256_GCM,data:pax0MjunsywQDl0Bxg==,iv:Ai17i6hPk5+I05OVWYVLBbDgPrNTdeq/QJz5q7IW/HQ=,tag:ITde6MlEUq7Lu+j2TVYvSw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:FxDuMPaR,iv:ZI2pCejN/sRwxqw4bIEqKderamPd5wd3QCQo/VlXFEA=,tag:lqrBo/OKwJl4snH7+Pmh5g==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:UQ==,iv:ggUdbYHuAjKxGHUhCqUG/igjcOHNcdVoDLT9LmTt1js=,tag:cgem4tAN8DRLo2KW+hFVdA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:MAQ9dnlpUg==,iv:Ss9IXc9zV5KuDHZj1lU7yiIVhi9WCCJ8v8obP6XDX4A=,tag:GCPXAfzQNgOnlLOcxDR43Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:qcUPgnxLrzo=,iv:pOrRRyaFpwh9XCpZi1BGPeEg1aQPiPZS2++uQ0Lztqc=,tag:q7FnKGwgDq9NiJOldkT2nA==,type:str]",
"value": "ENC[AES256_GCM,data:U4kG8OJz6BvgsDZH2gLy4A1mDHLd,iv:Ez1TIFPhNuXupJzIcaZTHE+BHXiPMFIvL1+9trrQM94=,tag:6rGgHDOd4Y0yJCc14z2rbQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:aA==,iv:bGfvskVgOzS0lto+smMwuIqhIdY5336+DKpKDT4xB3w=,tag:jbPZYBJhVeohAIaLTasr5w==,type:float]",
"private": "ENC[AES256_GCM,data:1R4j5H5rcXI=,iv:iWOC9CGUSs1ndaQNUBEhZNjKRV2qtWUfxVffe6L1tTg=,tag:XEe8sLbRmrCLdRVV1gW5RA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:kahKoJFqL3/C+vIR+vSJiBwBrN5ib9woGBwjbKI=,iv:CxyZkjPCDoK1CaOERkKCnPAtzBAPa+Gckeyr2m90+4M=,tag:pq0+Ao9AJ1xiC2tEiqYryw==,type:str]",
"ENC[AES256_GCM,data:qyOMH2e3u/Lrb7UsdrStBh2m,iv:BVg6Kqyq36YvmS8gE7wE2Vzr9ap+wUJa4NEryseZTJE=,tag:g2d75N61lz97RubLGL+RWw==,type:str]",
"ENC[AES256_GCM,data:eSEt4KHCKaVu7YzvOnNGmXNksE0fc2nmstA=,iv:ty56G9Z7z0Lw7zpnS7amZuA6UPj6TPZL4SRqIxp+jzQ=,tag:dj5bwKsDPPw2xIVDydIORQ==,type:str]",
"ENC[AES256_GCM,data:J8k3auWk6HRjfGgCVIDoZFMi+KPUcijzmTHImHtbvBwEnXWx5iev1yG0/G05sw==,iv:6WP9VcmlcYKdG1dnwQLZfdnHkuCPKDgaPtBfyZQwcvs=,tag:EuIIZbbhV+GF6dfDf84SzA==,type:str]",
"ENC[AES256_GCM,data:9xKij48+qsMBaCZol+aW3JhT09U=,iv:Bt99aTe6yZu15ByoQhnLBYI6C8vD1OG6e0moO9w11D0=,tag:GnN5E2ju3uTO771yhBpAiA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:e0N9aoafww==,iv:W4vUbZ42dvA3IIghAWAMhPiN40YdrjYIswgRkoxYpeg=,tag:UA+cZKHEdc/XIn231cd+Nw==,type:str]",
"type": "ENC[AES256_GCM,data:VLPDX5zL1NiwvIWUzjSSPXkOZwxlKL2GWPE65Ezst4MKjEBHN/iIP6c=,iv:IT0lHNvKRviPwgS2jChhdJ8+J5u4o3VAqU8o91MEUdE=,tag:bcZhRavT2c7c2eU3xwJO5g==,type:str]",
"name": "ENC[AES256_GCM,data:LSakF8+s1/XUcEbD,iv:1WyEvOrW68yZL1FmTx59LNRWuvLgDWZz2PsLFPljRqc=,tag:WFlA6HbGX4WqXDTzT6tnbg==,type:str]",
"provider": "ENC[AES256_GCM,data:K2uZfjE/Kysin4zDxy9vzJPjaUaqRxX7eINtNFDiz/gw81ADE93v/tkJGJlUZz6vBQ==,iv:tdFPF7pAvRnLaIqbXSCuLT7psmSHbod2uP2xMhbgYoQ=,tag:drcX4JCKr8C8IjMOxfg/Jw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:6A==,iv:xHSwxHEoO0rK8XAI2pK0Olu7L9A1APS4MaNf4El6hUA=,tag:lMow8WXmW5jxuX2kduiBhA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:NbNx5pZcFs0=,iv:D1IBG5wHS7GA1cEY/dx9DTxEidxdiOHUbEqvzqERzk8=,tag:cIwblzcvuqsfH43+AOyLhg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:8Z9wp7y+ros=,iv:cYPYmULeu/hLC7SSssvIzCNfm5r0bYTgg/dUUcgZ9bA=,tag:7B+zppsbhSTmJnRe1MIPPw==,type:str]",
"db_name": "ENC[AES256_GCM,data:cg2B2K8=,iv:7gHQygKhWVrWsnM3YKKbJ2HfffgI19yn1Et9byyy7EM=,tag:FsybqCHNx0w11/M6HOy0BA==,type:str]",
"id": "ENC[AES256_GCM,data:0TbAcnA9m9SjxY96zR253k0QCCMxTcZGNDdhKcRZW/6IQw==,iv:Y9JV+hI/V0fxuyd8SWLQJ/V4q5KjCZFCjEnzi6U8ZNY=,tag:/cwAedILkAP7xk0J3V0cig==,type:str]",
"name": "ENC[AES256_GCM,data:GhHa6FeK1HTNSaIF,iv:Spuz7SNSVn//erIiJ2oBx6rw0uDRK30mQSilMKGjIwo=,tag:ON73DBuQoLyzMZKprFE+fQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:Tdm9OTgZ,iv:toLrXCZSEYpj/RONTGZjKY9IeBV9ZKDb/B3uFapFNdY=,tag:OlLY8oUdqub24u/K+bNPpA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:mw==,iv:ffIZJ+aO421wn3hBrYl+AjIcpjkCr2mpeilsdMsFm8Y=,tag:Pw2eDBTjIqSi2K8HP05yxg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:On9Qd7FP,iv:lW4/+E2NL3W8x7G1anp2DpH7ORul4njdx61dQt0GUIY=,tag:GV8B+bJwYLH3v+Sl/pHAaQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:5cBGZOGsSqM=,iv:FR0xBp1BAE0enWNePrHRzfQQSaHFMZ7l22Tf1ybdNdA=,tag:5JcZhdvHg17+3C57OMDSGQ==,type:str]",
"value": "ENC[AES256_GCM,data:Pa7yXBF6tWgGjXPOBSSwWJpno71q,iv:BzMMxzStYTRwYpRNlHPc8qdn5SrJCFDE8YCvrrcyOdY=,tag:AEhglwHGsJo4ecLi3DyHEw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Dw==,iv:yark7vcnjOcvAegbS6wjrLHIdTHOog1grY2BLggK3K4=,tag:4mlWLnYBdpYVH1EnC25DOg==,type:float]",
"private": "ENC[AES256_GCM,data:r85wbhKFF5I=,iv:rwyLkwlz+rCNOKMv9/iyiMxp0gtHEUMwdOdhOU3d0Vw=,tag:T/RImqfAmbRlq2EzhlRQFA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:xkhHHNnqOMc6QNWF/x4kZBVdb2noeAHk9PfycV8=,iv:mvdhf47hhRMwXMo774wES+4CQIoXCzsKHZOZLm26tfw=,tag:GempaDLy80KCdHrxfxO/Bw==,type:str]",
"ENC[AES256_GCM,data:vwYCzG+aonQIytmONpw1NTd5,iv:jvB7UR7RnHRdZ7LM65IIklDBsUKUO/9CvjIgvc//i7I=,tag:5VLSWtEKuyxwO1dKsLY5rg==,type:str]",
"ENC[AES256_GCM,data:9Ow7xYth/plfQUlvUGGA4mkAeI2pRMfTtxY=,iv:74Jh9aKPK0L4F/CTDk6X/G0SALvlx9aUg5p3OTYa3Iw=,tag:4/9lIfqvRq+kbWGaf/jt0A==,type:str]",
"ENC[AES256_GCM,data:sYykW/c++th71DNd9oHjpnbm/XV5u46JVoXeFWAaBEaEw71tmQnfpgv1kZPJRg==,iv:v/f+DCaSPJxKYcLK8eyaP9D1mH8oxl5DhCYV7+cBB7E=,tag:lGLo3sGelh54GKXVrXRRbw==,type:str]",
"ENC[AES256_GCM,data:rCEja1Om8kPQ3+/GNunENv/DOyE=,iv:vjSTBUiKS5fAFs8kYv6rqOOAONszz/KCqfz5UUEaHZg=,tag:+iqkwcf9wFTf7blFLiNQzg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:P33DEKWU9A==,iv:lC6W7yxHP1LoyR+O1MdBRqmHUx+Q7jBd5A5Y4FLfYAQ=,tag:kB6/JK6xQvKEuDnKcaz4Ig==,type:str]",
"type": "ENC[AES256_GCM,data:yuOaehwVySa3k28W38mICswU6TxC3frSYqP7WTIXSVdUXG6Zcn+D958=,iv:61Y80OGB1ci7ZgUGUgmC14vNZqy7uoQr5qTi8sOKTCU=,tag:45+ZvqjROsu3ymneP46uBA==,type:str]",
"name": "ENC[AES256_GCM,data:wKEETNZpx4s+QTKcsf9N,iv:EKp+d18tgXf6ra3EqVxkASWMElDXJyhG8glk9GcQxig=,tag:aQ1axpA+MuzBFVEsnT+8xQ==,type:str]",
"provider": "ENC[AES256_GCM,data:AQRuduxzY35lTqfMbkp7APX9qNXaDxgNokin+KfyiSHgPMfhIjYXlIUz2sKWjodAxQ==,iv:/Z6QCp953CnNXy8z7Jr51RABIaPO/xkgdgNxYlbG/Hg=,tag:IonsiNTdyLww6GotjMZVCA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:QQ==,iv:7l8WCmyzq2cSj6XiAj2ComMkl2ltNWHG7xexUrgPDLU=,tag:pU4b015dSgW5eUWqQ7oJng==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:tKYHZV1sVe8=,iv:paU8FUbRN6p+M6LyerOPeH0PhXUCTFXiDI8lNId3eQM=,tag:RvRJPntvBCD5xYwBwq6X2Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:O1EHDd/x+4g=,iv:D6VnI3qtxbnpx+6z8PU/EKiVrHYIWaHwcqeGVhv/KkM=,tag:tppdA36QPZtBQAUG3fFWkg==,type:str]",
"db_name": "ENC[AES256_GCM,data:b7Ms2b4=,iv:6yOTHg6CfEdnyHJpf4LtDL14KVsdhvsCfmwKoWVt2dk=,tag:RqaUHztDYBlEBy3moAwBQg==,type:str]",
"id": "ENC[AES256_GCM,data:/VHWRHuxx2PsEhLQtdeiiHcfC/hwarX1WA//wlDOsfacdNqETA==,iv:Z4H1mzATUeoKrLYcwLPARAr6d/ZKlO4G6HUtf465+Pw=,tag:9UaQxHUG2+6kqlpDM5NSxA==,type:str]",
"name": "ENC[AES256_GCM,data:1GgGlSXyjQuLH8we/6DL,iv:P0OEtFTRtI8r61HvOsNhVMm4MnnF9tteFQWL/d4cRe4=,tag:y3bipa1V0thyFllNyouqIg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:iZPv3XV+,iv:7gHQ8903SyYPVT/7bqfAaN7hda3ES65dQ49DiY3iODU=,tag:uV2CRdZviepryy990x2xug==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:qg==,iv:ecqJ7zrbSx+KZgMWwFbDzh+ADsxqB1KG85onq5+KwaU=,tag:7am6LM6vgIsRDXODX7tySg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:r8JplevLlfTS,iv:/rNAi4ZVKsY8tlxr1L66YpkMvnIj/E+p9FeMG3B6OBY=,tag:7JCd5HDTKYhRhzttsjS+UA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:NzYo94cCX/I=,iv:K2xQc2M42FIDuIauRAOazZ7NcenyHqktPIt89fMzOvg=,tag:xeh6RMDYAXBRiu5XQdATnA==,type:str]",
"value": "ENC[AES256_GCM,data:HoHa2hat858ekHPZMCMhR7MIJ8e1,iv:pPbURRZ7237JENTaBWU+xaKbVaqkIIi51d6394hBtXg=,tag:ZY418xj+ngMznnTzHQBGZA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:sQ==,iv:TfriP3Phm1bYfB+NQQxmjqNkP2msoCeZ1j++PyKShiE=,tag:fk8nY5AEgLlwKZqGusaJvg==,type:float]",
"private": "ENC[AES256_GCM,data:dF+VszIIO9c=,iv:nLnPha9y7LBdbMQPOXovMH0RaaHDYu5ifYpLzFqlC8A=,tag:O3bfiaUwXlEuRn17BwEhyQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:PM/IN0vbW6bxnLFLq3LlIVymMijwGWD7ShfOfIw=,iv:u4w3x2yVSi3OhthF5Zmx011xufV71NKudlMrj3Lm82M=,tag:slQ8HAR9VPiTYvIlv/d8kg==,type:str]",
"ENC[AES256_GCM,data:wiLVzxAiGO17CaxpvkEDpxzp,iv:DxPFcJxa4p2ThLFT9COAKUvwEg8qoqo8D21uEgLuY8U=,tag:dOG+VI7ce3Scy5LXqJDZHA==,type:str]",
"ENC[AES256_GCM,data:LiED3iA2LHmWS9zg0190QSMThtl2zGimn84=,iv:AKi3uY7sAeLw/ZuRdLXuJ+VfY31P6pM99g1nlnvkpmg=,tag:BEgKOnVwgOoXoPjrArbQrg==,type:str]",
"ENC[AES256_GCM,data:8zsB0gtAvpbvewrediTsnggrvjgJL4i5aWm0+mScX49WoX3tJ+77sDI977HkhQ==,iv:VbDFxmE6hzpjXiNOHMx7xX2Jj7Awzu56vSjKpi/Dsvs=,tag:ubqOnWahukL+ULqRHC/ohg==,type:str]",
"ENC[AES256_GCM,data:F1qOy3Rv/k/MS7AJgdDrhT7ANeo=,iv:aI225lgPybyO9TIgj8mg1aC1j8jMwcp/tgLghwADKy8=,tag:xyw0gqUJCFIVGfaLILl0Ug==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:TqI3FfMp7A==,iv:am5y64ilOG6tDQ+QoEioTkOmJHMNjnDxx2GyuCE8UAo=,tag:YiRUAtdXKcKRPwWtsFRHQw==,type:str]",
"type": "ENC[AES256_GCM,data:OthW+u6QTLFNKbzHcaNT7Pqj/hMSxdQ6gQsK0QnHpr6FIp63p/gcWf8=,iv:ybvli84g87+vflqwD1+zY9aXLipp6UGFBsemjMTzEqI=,tag:CMStCt5mBT5FYbHh+sEBIg==,type:str]",
"name": "ENC[AES256_GCM,data:ebUoQDsrKp8nV3y3m43DJQ==,iv:lUO1N7y/Pkl9QStoW6HUHBNjgcgb0JZKDl2ODt9EKcw=,tag:IEr45uIVRgfOkfpkJlQSOQ==,type:str]",
"provider": "ENC[AES256_GCM,data:tkw4K9UEzSUW9xuY5D3Gva+x++aPIIy1gm7R30torAWz/09CvHcEM4sopoIz64Ay+A==,iv:eXTEQXh9SCmSHobclBvMek5LnEES4KtyL+0JmBBQrvQ=,tag:UQugXdcutHyBPQ0XcrQM0A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:TA==,iv:A0N0nQ9Sln343JPNI0mJykXuAHFuMfRDd7vSEz2vALo=,tag:gf9GUYFVzrODFtolp1m2+A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:lr2oGnVNOLs=,iv:txvB0sz8WgagdQ163gsZ7A6+R+GnBfZkOQdWeP7QYuw=,tag:9GljyYbrxt2RmaX8yn3BFA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:RBOEiv94ItU=,iv:PDhr5t5EIIdOU9RWIXyLxPY2QJ5ZWzT0ZMGVUslunVk=,tag:/HpxfvWBaE71ijoBp6BodQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:pFoFWQE=,iv:fvWShkKQ7tEHUYL4+DDSYHgZDSEHf69LEPd4slj9k10=,tag:00tIaqQSb59Kmnqfh4/78A==,type:str]",
"id": "ENC[AES256_GCM,data:HRz3bV25U73V3DM0mcowhO8tR9bx3nfB7shF/vAkBaSN8UdWouw=,iv:6drFLfqcatzdnrmssoqKZH8HeAuiTGNKhvDIOe3jDW0=,tag:MxHGKTFZlN5EWtAycTRQHQ==,type:str]",
"name": "ENC[AES256_GCM,data:0/g+I5ryEJepWoyDNZTeOg==,iv:rY5FCnTPsrCTafsyFuVfFmWbHHSVsGhRxlnhEAHLWns=,tag:8EDFhsi5r7yGF2XOPx1aXg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:befFLOD8,iv:ObzU/NIT1/M1FsuDWqCagESC+B9XosBpYtVhaAedDb8=,tag:MFeVtUxUPIE3u1JegCpNjA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:RA==,iv:5lJ4PTR8/Br5NbWuPdpPF+NsTRUPQcK1jVccfPa1H2s=,tag:ec+On0BDzyfJYE0MJCQeHQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:N0pfltjnmcwbNA==,iv:HRtqq5MYrth2fxFSXM/1kqZDKcU0VuHXNgQfZ5i2mz8=,tag:dF0W1B7M3WQoU3WI0iOCMw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:SCNtr6w6srM=,iv:Y0bhVPpKXuhn2fJCJ3e+tpdjgXQUY89h4KjJ36zcrnM=,tag:gAxIewKtVuWvQ3bjk4ZXaw==,type:str]",
"value": "ENC[AES256_GCM,data:v75CGsToY0otPvZiGZBKvcKL9qfu,iv:kGCWSKiUkJjbtPVW28e9vX0L3aGGggeoDCYNax3q+bg=,tag:J30c4uZSVs8binZ1UvjEqw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:bw==,iv:chmJrhHltiMJ44obTpoxDrRwNsEJrihDuL+hL8Znjpw=,tag:Z8bjl0oNEu+yqdl8PPkPgA==,type:float]",
"private": "ENC[AES256_GCM,data:GgfpoQo2Yy0=,iv:5g1QCTcaD+jXPkrV2uQtQxKpJaeVXAKmFqHw8jjIMrA=,tag:uHcxlPks97YEmJoe+aN+tg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:4d8h6qUWqwU3jpODwsV0S7BhYOtu2xh/Drq7PIo=,iv:QnXtfnYM7EMiOIT0axty/vBLBpj05CfbCrlyGoYQgZk=,tag:QBEVtmEQpYxuRuFLGHGhtg==,type:str]",
"ENC[AES256_GCM,data:QFLOmwzkIzxZXfTKMaIibeyW,iv:z7kTex2hMM+lCaYryxwRPG3mH6U0wChCSzelM5RJvKk=,tag:xonKzI1x+jhkn3q6PxpU7Q==,type:str]",
"ENC[AES256_GCM,data:phDrIL/TaBprhgDCPkPrvR/yKf9W6mpxm5o=,iv:w3ijmfTjp+EYs3/OJ0gZc8RM7RMIksXGuyialtlanAg=,tag:ChNlTflpNAeQUyhCuf5FHQ==,type:str]",
"ENC[AES256_GCM,data:YzVuK0igBZ7erdUKAVAiz3t6CHu3SjWJoRn2C+DTQ9QFsGnikVVtBqVaCGwSVA==,iv:UnmQiGp0F5qYr+XQe8PmjFBO8KcHK9/EOZJlKSu7SIc=,tag:4/lsYfzJesIv+70an3Q7Ow==,type:str]",
"ENC[AES256_GCM,data:Oa+OhPn/Wc2vvtgduuEk9N/pXVY=,iv:AUMn/NRg+nRgeKFXifUkxb3CvH9FXGmr5dGw1oiutFU=,tag:ypWNFFqb96dJMaSvt/SuUA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:78oBg2XTUw==,iv:r6oikQb2wMmDH1IzDK/uM5O8iFM81WnllGweWkVngEo=,tag:yFodxOgTfNlKAhyRqSigiA==,type:str]",
"type": "ENC[AES256_GCM,data:bv5NFp7SNexeYOILLJvNFs4Dn8/3w+SCIMpTKnplv8HI278JGjAoFv8=,iv:F1EL6XSMUe0VuhSBtQOq0jYkub6eeGr9saY4SK1VZsk=,tag:OlziRCTGb9uIfSzRh8Gu8Q==,type:str]",
"name": "ENC[AES256_GCM,data:ilYs/zcEgbVQ+0qGGS8O,iv:tcRATXwqXBzpXD2p4UqAa+pmxZj3RlgiX5Fo6X0NM7w=,tag:GLopIJmrmOCHt3SM4IVAKA==,type:str]",
"provider": "ENC[AES256_GCM,data:MY++AqUsFBMlnQcB+zXP3F82tAFPqjvwDkSmxq5Ld5JoHI8DN4LriaHB5DuVK+MVTA==,iv:CfozykeKIaXVvS8BU3Gjl2301AwagVlJGuPVL5PAyn4=,tag:v5l4+V0KTJbpY01x89jevg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Pw==,iv:K+PjnST4sEaslKHv3qEHt9S9MGE6K7iXUKJpILvESJ4=,tag:VUcz1zYvS9IdmfLj33ZF4Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:aahSthCaIIQ=,iv:R67BXISoztk29mkPw8/rzZnF03KRUgcUnbDsZWMY3Qg=,tag:VxCebIKfhitaiik+caj+Lw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:27YkcUSXs0w=,iv:5+YnnnzCYqnydmr5zIP4CMOMKM+Jd1NtUONwlGnAwk0=,tag:a3yfL8qnhTJxeMVsbDgADg==,type:str]",
"db_name": "ENC[AES256_GCM,data:8oOb1FE=,iv:hfjllB/iytXga2nNmW5LumL2L29nXvurmMD7iZnTqjc=,tag:v9abtY4/0PIIalqLZ64U9w==,type:str]",
"id": "ENC[AES256_GCM,data:PVS+WM61LlKKFlz4DlklPa+eXyQdacO+7HG7iVnKhNvBNu3XWQ==,iv:nbddW6OMnB7SqUI/CARSt732doSUcU8aOonTNBjya0Y=,tag:q7qSBEE2n2mmZoUKBjwR5g==,type:str]",
"name": "ENC[AES256_GCM,data:WFIhFlYE01DOHaOpLCGi,iv:Y6Sm3JjJf4NHgbhE570NGscYO0aF8uDJ94HkWEe3/Ts=,tag:7MP/60f9VnpgjBvOWUVacw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:z5LYsEK4,iv:XOz4pCKbKxE3zpJQC8/ssiFaVBY1/jZQ2BAI1mImiHs=,tag:oX+8EM9TORJsk54sHbGtXg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:4Q==,iv:dMqdWxC/WJF/i5XZoS9aROYiOJUvL7TLHsLictM4tiI=,tag:ri1aR5G13AqI66sK2P2SDA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:D5GubB5FDWuM,iv:u5ISxBBGXFeg62HlRNG4gEURfhRwoUt4tXdawpd1G+U=,tag:BYaQRiaCiVm1PxIbFD5zsQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:XURm1GZSvz4=,iv:rGnX1t38yXmmbg3trOngw07GgAKGiUpqfG6VG++9BJU=,tag:4XgncZYS522ZvkChpJYM5Q==,type:str]",
"value": "ENC[AES256_GCM,data:CCN5ZYizi2tJNa7ydnDzPpd0vfXx,iv:9F5o0ji6CXz8F5NV6Q+rcJ2Wj37IEoltUpXFOQae+UQ=,tag:hrdn8EPOFYPs8ltGT9i0ew==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:QA==,iv:rkfZasZGsmTzY09efipGe2lrIECAecCqCqNf45R1PSw=,tag:5Ngq6TeZbq6O4v9F4oca3g==,type:float]",
"private": "ENC[AES256_GCM,data:E1/t0ypcilM=,iv:u7CZZ/qOUSAnmU1KWzFBRUufIuhMmNgn0mO8HFedYhg=,tag:cGmAoeKjPfurE8QF/VupDQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:1Q+aSuse1Nzmbouk5MLzzaS1iHuzTWwEF/yjfwM=,iv:7mOHP7d11pFYWsgCy/+JHoim+vpzGV+WqhLjIJ+SQP0=,tag:o02vl9vRoqqGXj31WAaNFQ==,type:str]",
"ENC[AES256_GCM,data:Lj5rWkh6dm99yK1zOIlLDt14,iv:2F1ThLIl9JYLw9fwLt7hPLHg/Pz8C1yISE+P5nZdfq4=,tag:wPWczhmHQWPWxZ+Ri1Eg/Q==,type:str]",
"ENC[AES256_GCM,data:NxlPpUxMDpe0RH0fp+HOKdO+oIyzvBLRP18=,iv:ilpYoWaJ9kBXDYMCO5IXJCzBVDQQhV//c0e8n96krbU=,tag:MMkXX7gOkawKn62z0R1cLQ==,type:str]",
"ENC[AES256_GCM,data:J3h7m06xsaEajP0XwuJB4PM/1EsYLVUulJM930uQ3sMEebu9qI2jCFHbD/dupA==,iv:LQI8yQN97tiEPV7YC77e19aPuBxQKoRP0U4LLUH9Ep8=,tag:UYGVcxvtNI6zJaMr96MSrA==,type:str]",
"ENC[AES256_GCM,data:2tzI2CBgx5KBICrhoExWPeioQDc=,iv:I9MdglkePyui5Msk0vqRM8sqLVzWA8mGXmPwWYu38mA=,tag:kloW9JTGMRyHOpj/cH5jwg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:WdJKc4dVRA==,iv:L2wRWqdngUX60DVj5v41rETL0fjnRvNtHC1DYQ0+mD4=,tag:oLunA+K2N4WvfyxeYZCXyg==,type:str]",
"type": "ENC[AES256_GCM,data:gWrMrPGHx5q8QrLZN6zH7InoRI5cnTJ3vr/QfMTYtmlmD1oMcHiPR8Q=,iv://AmUEA50obfJiCW9ewEBsFq3HJk/riI61uzTKUDPAg=,tag:j7/DkfdSfOcA1VicWRgY2Q==,type:str]",
"name": "ENC[AES256_GCM,data:jnsRjDRQw9ed,iv:Z5p8/CcRXlYXDwI4oAjOjNhp/IkUev5RgEmauK4anO4=,tag:wR/kNJSYPuvO3cKTD140hg==,type:str]",
"provider": "ENC[AES256_GCM,data:zpQNCuYtC2cq3J13BRv/KCIQyLaN8r9uN3B/P6bWrj6FQOkRZehJ6BSA3x9B8bk2tA==,iv:Od4SfCCTFzrM4DaOzgGxdTm4djC6vIGTZL8O3XSmArM=,tag:G8S27/Su+aXKcPo0NVguOg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:DA==,iv:fmaRHMZiXQXpcr9sVhyo/MajCmU8YKz8C5XVpVukvk4=,tag:YeKwsHFSHwywK+GeZ3ntzA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:OpEXXAzwY+k=,iv:EQqYdEjAcWDySeoBqySes7d3Bgn1Wjg+f76Jsw3ht1c=,tag:X1CuFMOugWyFhaqn4l43jg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:t7lOaGb9pR8=,iv:GOEigyKMe2mKmU2K7Wgi6DwHF1DVmEqk8RQ5IF8DYck=,tag:QYy+1Sv+C8bOG507zhKMeA==,type:str]",
"db_name": "ENC[AES256_GCM,data:WZf3gfxxxV8HFg==,iv:egcHSkUZYuAixIh3vZr4fZemwXEM1z0LKgyO/9FjKPU=,tag:LAnexjjLK7SAA6/reWEdeg==,type:str]",
"id": "ENC[AES256_GCM,data:TvlGmpTg6mQl8oQhqCz/OrAhAcjGCqvrXyu12nUKXQ==,iv:1AzDQe/d2XDdWCkqLKt3vm72z+bOuqpZg6oJnWEbJN4=,tag:QINo4KeCIVAD/252m43lyw==,type:str]",
"name": "ENC[AES256_GCM,data:1N77407zHL2l,iv:kcR/MFbmtgepxGKGNPThz5pL+GhZAoSotZY/rzahbH8=,tag:3vKd7uC6g7ltO4AeEXD0Uw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:yDvEkr+d,iv:6lREvwu6G6LqyfMe9cqkYw5ajXbxJ7X83Y0Xo/h180I=,tag:wbAC8NkU2tLvnZBNGdbihw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:oQ==,iv:riKhEekiMW6Ql4uQTbCR5nOJxdqVKqsVhET2ZCaDOd4=,tag:R+C7gG+W3nKBRkCWg8d6Zw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:E57ZcgC7,iv:RSek28pHilvKV9yxb/S7TRCUQ46u01d8wa97R2N4qAk=,tag:xvbc5JjW8p6fyuwyTQHfvg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:5zpEjuOS4z4=,iv:EXRXrDUW5FjphcZ9ojZeldlF8xxBZTcKiiY3AisYDuk=,tag:2BNWU6G90pvM7kKtVkS2pA==,type:str]",
"value": "ENC[AES256_GCM,data:xAauhHIRRho1vXp19QqjtqH0Udop,iv:MrBLUo20APtBChidVYPH3SwNIkg7wgAcv5Mj9ZBNBzQ=,tag:KvbZhO+kUTekdyjdklJ83g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:rA==,iv:BxZHEriRrLO/ZuzqVHiR0ruOhgXDEeUZD6FaenLhrKg=,tag:S7fzkGdmc23iFEUbj/d93A==,type:float]",
"private": "ENC[AES256_GCM,data:IwyYQdpH4bU=,iv:+ghMrsVzFsjPXpEKfgQXbVL/0BUG0IRk3HMbOXbq2XE=,tag:FrGACo4AHl7jcBSsgVmzVQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Kyiz4JzlmG/pcBDWfB+eZ0TxlIA3IppqWP/Uhhg=,iv:AAFEmxIeMjri9YKzrY4podQvbsCsBiQi9UJDzZGTf+U=,tag:IAj+oALG+ApUdG4vNIwwEQ==,type:str]",
"ENC[AES256_GCM,data:lC38IkjpNfhp0x36vhyMTvDu,iv:VZwowomh5XayNlwjEqL97saWnl5M+55YBbvNccWuRyM=,tag:r8eI4RvWVLZOvZdXGHeEig==,type:str]",
"ENC[AES256_GCM,data:8Wr0ovJjfcsIG0kdoSw0gioA6vTugbOSIn0=,iv:fWO+U7KaroG16kCDhGgj1NVLJsNvXg1VJj2+JOwcSDk=,tag:rPMrgreTwSEVSLDSCynTmw==,type:str]",
"ENC[AES256_GCM,data:GlcIhN7mLb45VKnxDlLtJaa9tyoAs+MT9piklslgz5ZruQuSltYk3XtTnQX3I99aS1aU,iv:qeU0UrFp7Nsr3ox5YGTEP+WV1qGs4KSE3FVN32WYB3M=,tag:lMiC/Xd2n++MtFRdnuDwoA==,type:str]",
"ENC[AES256_GCM,data:H5j5jnDUCzqz5gfetSiP9sJW8NQ=,iv:/UfkkM+bUte1jXhgQ5LyTAWE3Fcac4n2NW+tP3ttHcc=,tag:8izcuuugn6XXbV/UturWpg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:8h62ph6+Uw==,iv:rryrJmhdDBSs8CZkF77N34kM2La3Ywr4cDhJ9VTEIDg=,tag:Hd8hFjXT77utHfZsbslLgQ==,type:str]",
"type": "ENC[AES256_GCM,data:YhC3FkDA2Fn4qdQ7YtsNAEQemrUMAS44+fGxHR4+Fa4kNna90qD5Ra0=,iv:U9cuDNFQaTHh3+rUchG+9WQGSS7Y3EYHFsLsbQ7vryA=,tag:YYmXksO4+8yRhU28lCoTeg==,type:str]",
"name": "ENC[AES256_GCM,data:VMM7VV9tFiKHBUXSbgT0lA==,iv:mCAj+3JnKt5FS8rVCCxKg7fW+90GJGQgwNVf5IlPg78=,tag:P8QxY+GfpkRLZZQeyJF1RA==,type:str]",
"provider": "ENC[AES256_GCM,data:SVcAjuIyGraEmhKfregm5yFmKmvhVaD6F+qNJ25aiOT8jde1hr0r1C1anjt7V+IQHQ==,iv:f9/5X1EQY5Fpzw7D37lIocreSjD51S12TRQPXFCHfNA=,tag:2Td1CueMkUPwB6P5RivCvw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:zQ==,iv:CEWLRRSF86A2Wy7FfzNLn9Rtg+dPwZUehvEntLFtecs=,tag:Odo2lS1wn2/kNqu06O/ZUw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:slNagp8qrxE=,iv:jcGkApE11El3l3gsJ5JuTths6EbpF/i7NOVwM+NiBK8=,tag:sIS6ro2rzv9DG2ftJurQdQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:w5hYVR9KgEM=,iv:F2ahoOtzxMsI/Libk7+UfxvScvffPfArO+SXyypir38=,tag:Gkf9mmWHH8mdFzli3upO8A==,type:str]",
"db_name": "ENC[AES256_GCM,data:aysWcfi51gTU5g==,iv:oT1/yOKJDfyCeBlAlR42ZTii4D7czvV1LJ433fdmbwY=,tag:ahtm6tRJl+zk2ECXjaRmKg==,type:str]",
"id": "ENC[AES256_GCM,data:Z9LyLkaWTrU7a9J1gDm59we26yAfW4Bt0uZ0Sdy6hGWs1pYEYwI=,iv:MDxMVgRKv0Vi7d3dimpeqKIExJug4Re7t90amD0x1O8=,tag:c/kAsgSHkc+due84Fe7SqQ==,type:str]",
"name": "ENC[AES256_GCM,data:QwRNE4UjFG7+DiAmQKEZsA==,iv:sfNPcHgwDbINeHO1FsywcJIElLzJfsINkluapNUgSyw=,tag:0Wbiml69b4qK2qW2xSKMfw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:rD/+RVoX,iv:M95/oxqg1AidVGb6O0mNOcAStt2JnoD0AO0NCioHYRg=,tag:q62OSxAMKfAF/oWN9xmslQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Qw==,iv:BJWTHt1u51l6abn+N6bgIZyVpiaoL4oCqVsX2f0sTlk=,tag:Iir/+6Oe80ApZXzcEKIRiA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:Ejkt3KK+vr7mjt6oNg==,iv:hH1fB8yImt/PmPOaEPxL4lnhOAil1E5A77GVHH18FjU=,tag:YThxSfNK1NZMIcSsAebgTQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:Xl0B0TteqgQ=,iv:H8YLLnB81tl1F9alRLuqnmAnG1mF20HatTt7spkFE0g=,tag:VM/1FhPh7Ehp90VPDe8E0A==,type:str]",
"value": "ENC[AES256_GCM,data:UItropAofvfCvrO7oVFhqPzS6Wqh,iv:sufGggIOhFsovwuQXhRlVdpeqs3Z4TGfOeyzikwtCsc=,tag:2KplTcjn3xaJrUAgEumwaA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:dQ==,iv:CbQQzyOmz/qGKboybY/qZ94QwMC9aZR4h0Czfg3HNSc=,tag:lUg/prIaEQY3in45Bv+XBg==,type:float]",
"private": "ENC[AES256_GCM,data:IcbrdS3+EKo=,iv:RvUIwl3Rb+86QF9POHJBg9J/uKfTIrkEmS2EQilg+fo=,tag:nc8Yk6TH+P3m4uFhFuqRpQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:gYpzpaNptZrFF6v1lN2DggduY+lP587JW9m2Rp8=,iv:PRmIdeHvBj9wJt2Gsw6s/tYNlu22+IXznEixUufCsRs=,tag:WHbHSWtFnZc+/feSz8jLdw==,type:str]",
"ENC[AES256_GCM,data:LmBfcksO3E3ZCWrn91CU33pe,iv:ePPrEc1nQn//7d7838Zoa0Hr9bR4bR86jTVla+oFkdg=,tag:2t1uDIGUjngPoCQJCt9Dfg==,type:str]",
"ENC[AES256_GCM,data:w5eXZfTysqvnbuSQfoLNHEMQb2XNcI0EdUM=,iv:GmIj+vEyfi+Ms2gi5uQ1hNrk7GbO+FNzmsZYSeDGgMQ=,tag:TMxYYE1TUKt3EI7fujboog==,type:str]",
"ENC[AES256_GCM,data:TumIBNh0JbTK9iUfYfHOseuFAnosVx/cWxeRxU9ZGrQksV6Ix19+xMWNC+BqkaUr1AIM,iv:Um43hLHRV8Wex3uzQec4oneCKzJL6mu8a/lokuXXzhI=,tag:pLi1gsE/TvMj0CEWG5x9XQ==,type:str]",
"ENC[AES256_GCM,data:3aqJ8lmEBGDJerPbeR3uinJYPSY=,iv:ZohZdWFtrDe0IizLAy4wNwkshmoCnZwnBDT7fpDVRbs=,tag:h+CBebTo3DtQnXtJYTvYSg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:gledjPud4Q==,iv:/Wla1ejLXo/LwI9MX7tcxlxEeGJOnX1u8CwU7OK//mI=,tag:8t+v7PE3+9lu2jhPWeUJkg==,type:str]",
"type": "ENC[AES256_GCM,data:yGnUnT/jFDY9IxkoxYpOHUaa6lfl+mpyQCzaXBNji+ttJT++BYUh6C4=,iv:OjaJD+sh2O8tJRhOy0zTLsEMzmqFe16aKP9suwe938I=,tag:LIGqfFthgOc75wMJP1EqTg==,type:str]",
"name": "ENC[AES256_GCM,data:UcywBHkJBnoyHmOhOdlG,iv:eqzpXVeBODdRBOiAC6rr62dSYIvRysuz48GV18zybPY=,tag:LFaossAShZIPd8vDCTJFGw==,type:str]",
"provider": "ENC[AES256_GCM,data:W0+lzBnhJiK21FX2xYkEzc6WiK0q122IGW5lxGd6FPjyYX0fhy6X5CKCPmmWx2u1oQ==,iv:R9I2rTtGlO3tbtw4Cb9SuYa3THzAiA5oDJLqnQsDN50=,tag:S2W/Xa07W6UZ5dT6H0rTRQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:iw==,iv:1mFnv+6UCceXnXyK7YI8xA5hDmkPQQd1gNwrNdg2/5M=,tag:JIl3vcF3+qqEFByKHIYbcw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:zjrpn3CmJRk=,iv:ofWVhgyz8k8AmjFqUt1OaRAUV1l03JRnq8ABAFCQg7Y=,tag:Xd3/XS5f/O8QlYor1MxD4A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:Q4QVOhMjLDY=,iv:xrTQMu9zjB/FTU6dg6BCm/Q+wgeKRW4wZ+5xXmYnoxI=,tag:TGcNqceS2IWj4hNvJi5xdw==,type:str]",
"db_name": "ENC[AES256_GCM,data:3VQ9mYuMrcIcEg==,iv:0T3UjE7W9HT4qL5UurORcDgmEvV+4ZTnWbAKYXt/+jo=,tag:HiwK6rfFeM289grHupPzLQ==,type:str]",
"id": "ENC[AES256_GCM,data:DyKQQ+cv8P7tYefCgY3D6JNfWltVQxQuCazbnr5H9BXVNEnwJQ==,iv:mY8Q5b+zgnGpmdQGGuRiRRJgGWED07Z5wxexUliWsbw=,tag:57caX6B/L0T093G0AOclqA==,type:str]",
"name": "ENC[AES256_GCM,data:tVR2ZanOi3SrTwhLSJs5,iv:hKvVNy9xFHZ79ByoDXMwU/OvjWeQF5SaX2qugI48Y+w=,tag:9qrVHAXgwNqn2YE8EYDu6Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:DMKPE/cj,iv:4UzwIdh3wzbTrWXyPSapfvFDrhT9Er0I0HvvTY478SU=,tag:cSDzIgwIHQehxvJxTEK6yw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:uw==,iv:zLUyEgMHItj5CiYmeRDsjZxFko4Qu9Aq7w6Naws1CL4=,tag:0Y1QSjvM/DBYGV5cNJNxpQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:x+M5dbehH3lhvHvr,iv:3Cvo4iqHb+Pg5aYkmq7HJIgJmDaOOh+AHAyALk2Blbo=,tag:h2ZN0jcGROymqq09wwEEcw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:DwiQwnEVzrU=,iv:Q2mSvDB5n2O03rqhmoXC1kVnxG97gURmNdoW7rnqdhU=,tag:lyWsVQ9AS2S08Gq56z/CCw==,type:str]",
"value": "ENC[AES256_GCM,data:UqfjjoqXYIZnRwhf5Zx8XAr6svKH,iv:MoOGhLlkm1uqv0NpZtV5cNgQX7TVqq9C4GgISfFB44I=,tag:0a8Sd63aMJqbhMoRYvTqWw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:zw==,iv:wwxXRLgnkM66AfudjT+z+031XoVeTZvP5kwcKyV6v6Y=,tag:N7FTRmkJeWdi0rxpFhBwhA==,type:float]",
"private": "ENC[AES256_GCM,data:7TZ012xq6KQ=,iv:VSCbGRcImZF5rHWuFizmztSPJm4QfU16Ry3xsZs9p9w=,tag:PFewnwSyei/y9b35cvDqFA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:UmI+Awlvx6+4vb6QUL8lzOIUyGL1GDsYJ2ghgLY=,iv:+UnB6MdY3rXxpu6QoJzISMkfGrWblkbahTZVw6jrR+U=,tag:BVCMFOHKqzyWDml3he3NFw==,type:str]",
"ENC[AES256_GCM,data:oy8yVmW92PkqDfzx+0ePN+pn,iv:huDpttoaMxHHlWHt1oi5rTn+QlDx4AkBdj7uzBtmVwM=,tag:D6JhMdJJmrwRIlwojywXLA==,type:str]",
"ENC[AES256_GCM,data:edZR0LQUS/o+B5I5bQAkMIhkeh5RiQaPTvc=,iv:HkvCbEa+ZmwXCTgMaalL0psvwoIX2MTcnmRoTW049dk=,tag:BVFNDthLgVg8Ll+v4iw9iQ==,type:str]",
"ENC[AES256_GCM,data:yvHr/eIhASd46QJAAxQq6W+V4ovQXySUyxYyl9T7wdUyZ+e43y7mnT4rQtNXwke17oO1,iv:Md8z7aUB+Njh7I3YOBI1z4d3bJJbR6qWqiTakcnDFYY=,tag:9a1hAacbV/ZwvybNN/FaFw==,type:str]",
"ENC[AES256_GCM,data:tZWJ+qo8NgWc19XYcoYneYesCD4=,iv:ZfizKgv5ty3VzdvI/ukVfLo9vsf2a1mqd+m3A4FC9II=,tag:c7/1UHgiFjEn7AnFrAiBlw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:8jk8oWcMxg==,iv:5qzjOTwZ8+QKLvl9KBZ1zmB4JrR8gQHo3GNY81ShHpg=,tag:/twR2ap4Ipf+0LDPITj3bg==,type:str]",
"type": "ENC[AES256_GCM,data:2QyfT265mQgsg2ClhMGtEnRoh5bsqmmn3s+7LP97PrD/bwjpsofT4/w=,iv:83rf8sNamvrJNubNjHqroISuj0anQspj0e4SJnq5aFg=,tag:ltrbwZFK+X/3TvmFOO2r7w==,type:str]",
"name": "ENC[AES256_GCM,data:9pacjy3zNfiHmOeLML4/PoE=,iv:EfEow7s5Bg5z8AK9siYG9LrQlUH7SGRlULYX1pKBPwI=,tag:7Lvk/FEmSkkHfqDQqfjh0w==,type:str]",
"provider": "ENC[AES256_GCM,data:YdmqwlYWMb8x1H0Bg4eTrRXLrosQ9qRluHG9/S6F0p9FhyJJ3iWY9Je4NR9uZxrDIQ==,iv:aW7JCwJwPm9CQb4i2W/oogKr872tAqRmMLzFwpOUJDw=,tag:RmV2xEFl2eEJzxD6Dmxdaw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:0g==,iv:SmJmV59fWp20fHe0L9aIMDwwGVDPQXxA7IXbYMLRxAI=,tag:ELZVdH5NbRhmipOAWKC/ig==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:I7kvebOLsis=,iv:iRazaMTvg6m31f2qcE8hckzdQp5QSEllkQV9fcMVA9Q=,tag:z9koQ2J5JWMVOKfesl9KcQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:qykprLjrdEA=,iv:9k1zrpVLpZNtrGXxWEpBABKW0VDI9kMfZfkM+rD9q0M=,tag:TAPyIWyW/9pIqC7wVRmlqg==,type:str]",
"db_name": "ENC[AES256_GCM,data:AjjkAHfjeKWa5g==,iv:+dwzU6xYEHTpcCORRJwK4DH095zp6KbNr1M850Ke2rc=,tag:jvajoeg7+E4IlxS0pCm3wg==,type:str]",
"id": "ENC[AES256_GCM,data:g1QtOUxX8dayx6+a+grr+MIzZN6N9jUEfXWlEeHw9X5CC5ZmFSuM,iv:g2KqQRWVwYhG0iUPykKE9vSOufsJ5M3yX4k2Ylx2d4Y=,tag:MXgvBUA1dvalwRQfiAy1og==,type:str]",
"name": "ENC[AES256_GCM,data:9GAnpsANXIUN3qa96khYz0E=,iv:GvyR9LyTfJjZeqbK1Ly4+LBY1FIHj5dqLhSLnovlZbY=,tag:xBdHWOqXytL3ZGnDI7RliQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:Je3wANvp,iv:e4NsibrLLRleRKSJ8melgw0m8llagrzOl6sHSAjdMMo=,tag:GLL5WxBwz+RuHP92rE7K2A==,type:float]",
"rotation_schedule": "",
"rotation_statements": null,
"rotation_window": "ENC[AES256_GCM,data:eg==,iv:2JAkcjQnwNhVNqTBy5v7vOHTnW4USkxSYifkWjrYG18=,tag:ZY4mKvw9FHw/LstbCIr7dQ==,type:float]",
"self_managed_password": null,
"skip_import_rotation": null,
"username": "ENC[AES256_GCM,data:xBzhhj90tNrMbYy7uhk=,iv:rc7HOhb72EO1D6JWYZ1dfk/axMgoBL3XhZR7RqRwauw=,tag:E3U78rmu5to1ILfXzSYDKg==,type:str]"
},
"sensitive_attributes": [
[
{
"type": "ENC[AES256_GCM,data:aGy9IpAKRLE=,iv:ia/WK8UIxoTfc2fjN35ioXYmT5z46XFDqcJCrums8mk=,tag:1hgy4C8r4Q1edFN/CRQV2A==,type:str]",
"value": "ENC[AES256_GCM,data:ay1xHN8Rb1lDmKuwcKQDUqqDCb28,iv:j88NLaV2/ao2eZslIj/M0fnNFGkmqSZ2C+y7iQQL4KA=,tag:GcfzSYDccAq3eeB9NZnQBw==,type:str]"
}
]
],
"identity_schema_version": "ENC[AES256_GCM,data:kA==,iv:JVERgWQCC2Umbpg+1jpUMj2FTLoBfZVqc0TSCURT/Y0=,tag:1ZdCnaG6tqs7Wq5/CPstwg==,type:float]",
"private": "ENC[AES256_GCM,data:vQD/7ePQd/4=,iv:zOtDXzwih/VYolLW4BnWEy3YfFB1Fypw5W3sTo2hF/g=,tag:EJzUPmWa0Xf3hkDeEj7luQ==,type:str]",
"dependencies": [
"ENC[AES256_GCM,data:vOIKr5cQMzWMXHateYVtdLUxHrsQ/sgb/m6kRBQ=,iv:AFr9jUBiy26Vh7YtbDVXZLX1WB3t5DgX6Ghheq+a3wg=,tag:sjmxaDLWFiyQXot7iEP/uA==,type:str]",
"ENC[AES256_GCM,data:aGAjYwg7U708GtteHayoD69P,iv:98P7xzMGR+OYQJmmNq2eN2reIxZwnvYOEqnHTgID6vA=,tag:Qz7sfcqp4xmCCVq1esNGWQ==,type:str]",
"ENC[AES256_GCM,data:xg+pibI4EPuivdCvWTL2riA1VfI7Np50ANE=,iv:rfjUkzYXWKwgIimkWTNTEMxF2Yu3obJk8ocQZ0UP4C4=,tag:0dOwt3J9uBFuXck3fACAgA==,type:str]",
"ENC[AES256_GCM,data:/rOccPQunlm1vxREaP5Tvg0A5fLAmP3Zrqd0p/w2xw1zqUQbUR8D3NGmlP5d2nMWsOD7,iv:AH/smjAtaQRId3spiBiqp+xs9RPiElaDlG7/pTkeA8o=,tag:n1P0zCo8gKOHj9MLh/tXVg==,type:str]",
"ENC[AES256_GCM,data:nqq7k0gtIojhdpojMNjamKciLm8=,iv:U+5DbhTbQYcHnf9LkQ2tRZCxHGfPlYYr7/a7aH9ogw8=,tag:KZe18Ajxi2wumlaIh0vdzg==,type:str]"
]
}
]
},
{
"mode": "ENC[AES256_GCM,data:3AAz3peMyw==,iv:XZFNHtpZrYgq5ydVKclyzQpMLIemr+N0X4EEaG9X5OA=,tag:oRTrk58T8LXMdp6KB0Jjwg==,type:str]",
"type": "ENC[AES256_GCM,data:mjn0fxKX+Vq3fy+rel8aGs8T6P2FPfVtgygbQBK334uvYuNF2kcIQn0=,iv:ClxUU3n+ql/ibEpHZgrAaLIjenqWsvEStMYGMBnP/aY=,tag:gz+K/FixI7kENBqGA0RLgA==,type:str]",
"name": "ENC[AES256_GCM,data:udR1vPe73Lv8,iv:iki+drzeJkKisqyX5LiHgmZ1hBjWpqA7ceHU5M0ybcY=,tag:xJ6IkeCjwK6MArHSsqpAxg==,type:str]",
"provider": "ENC[AES256_GCM,data:DuevRSMEwle/Bkkrwvz2jRVUCm+3BonyT1KkW5yJhTkgZsorZLvYFAaOLqNYR4KlQw==,iv:tFayMV/2D4/mReQn+x6wLwTETbJi2cv3SNDjLcIV7BM=,tag:v+gJfW4e3vruF2pykDseiQ==,type:str]",
"instances": [
{
"schema_version": "ENC[AES256_GCM,data:zg==,iv:0LV7bSDD5Z/MtYeRacPYPGGbj9idp4v4wYvGAzMqDHo=,tag:g7KkcG+mqCaZLPFAQJ6GRQ==,type:float]",
"attributes": {
"backend": "ENC[AES256_GCM,data:d0hoEK+2ntA=,iv:z14k28Xoy4/j1+WV0kIuO8w/3Tpzb+oVs49b8iK2eFI=,tag:XxdLASxrmkf0bM+lZyt6gA==,type:str]",
"credential_config": null,
"credential_type": "ENC[AES256_GCM,data:bZI35KyER8U=,iv:Tmckq8zUPF95RJkGYSszVj0tfWJr0Ogo/OYF+hDSrPQ=,tag:rDVSH9O1fRXkJ27Oeu+rmw==,type:str]",
"db_name": "ENC[AES256_GCM,data:r/7henUAmvovlA==,iv:C7uSGLuEaxjCoKoDPqzWixB5jXRMzhBJAJnjX/5ga3s=,tag:niwWE4zw2O03j4mnamKVPg==,type:str]",
"id": "ENC[AES256_GCM,data:+zQGoidO/78GE3VI6JoVzfZPPFf8I3smb9TjpzT26Q==,iv:rXwH6+j2AB3+v+iUoiSweTXd/sC/WU1vMFxxRkNko3g=,tag:e9XMZlTOk6jV14A5+6l0dw==,type:str]",
"name": "ENC[AES256_GCM,data:xk13DvNjfmOe,iv:pl8hVxIdoGREyy6cRAlNlmu37l7TVJul0TAa9BrJ/b0=,tag:WmJIBgyUm+1jUnYHWI9A7g==,type:str]",
"namespace": null,
"rotation_period": "ENC[AES256_GCM,data:mLRhp2nk,iv:UttZUVKsmeIwYrFiZx0kVfq89r5hOTV8bd3wxq351fw=,tag:t48l5yHy/8BpTxdM/dzWGw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:0g==,iv:Ps3cjbuNmSzYZWWz8V5jRM7JZRrg8g7owxoH9Rs2J1E=,tag:abN3Vv8BQr3wbHEgypka3Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:/h8Bmym7,iv:TsIddcQqFqWs7POotGl1yexZdD41kW7FiEPHzsl6DdU=,tag:ZVOahbZN6HhzfEFHTYPdZg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:RjaNVXLJ3WE=,iv:+FtwZHhbFyJqc+S9AADM/OZ+ciF+hAapVtG8yrkaRxU=,tag:1PCFyaYJ8+V9Zx3k1fXF5A==,type:str]",
"value": "ENC[AES256_GCM,data:5aFPkvO/mqRmHpRXC7TU90YQ2qC9,iv:zezk24IBgPZv4K/ELg+fb4X+59AfYP+IK3yklMWPWpk=,tag:i7lCUefSCLu4VRPrnh/HoQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:3w==,iv:6D2xXNXmVyGMiWXZwkIz4l2Zp9WaVybTpMrhfVea3AU=,tag:9WWnjU4IhIor7Yjx+3JeJA==,type:float]",
"private": "ENC[AES256_GCM,data:6/vmHFsZNgI=,iv:ceEz588GI7+jcQigis/ArapxpWVFI5CkEt9YaOA5Ge8=,tag:k/4TKWwfKxim5NkZ9EZ43g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:DJmiW80gyyOQS9C8hl1stsH7THyEEDysVBhXlgg=,iv:iHauVkkbUqawbVSN1b0rReIYaamH0873ARCEdekYbC8=,tag:rB7iPL5WTScI1Dt6ONU0vA==,type:str]",
"ENC[AES256_GCM,data:HGA1JWJFQftZlGCeIU+FFC8O,iv:uX5kNXxkcYVY/l4ynLd2TZG6Dl3EdRKIplDluVL/S4Q=,tag:lx+FGy6UvnVomGUgRpXbaQ==,type:str]",
"ENC[AES256_GCM,data:oXTDkBdTCXijTa7/udw9G/ZAFZtySjH3dHU=,iv:uQwcpg7raw7Gpe+lkzBYjn8nBFlKuj9zcqu+nzk3VwQ=,tag:m89vyDdSp502hrFENq1xDw==,type:str]",
"ENC[AES256_GCM,data:C3aHEBmn4OqT38MNjftqgsaKHRTgza0oz3/Cpy/5t3gzlt2kC+/FM8TwrRrkiPueWzcq,iv:Ro03KYmaIZWKY3qqBIvUab7fYMh0hGvOZ6FTR4A4nZ4=,tag:K0GxyoIaikc6lpY0yHFthA==,type:str]",
"ENC[AES256_GCM,data:niYmPlvgEl8xI4htaYc6edVihgk=,iv:qLZ8Yb9aOs4BdJxSaImFdnOC+BjASmmzCC2rcV1rOVQ=,tag:TwyjEQ8xKIVLI0hW1mF96w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:pdhkt2x+QA==,iv:32g8VN1Q08MJ9akeY0HkKthcADeKJ69a3RD5N7jBqoI=,tag:3AU4S7fx34bmazH/p6erag==,type:str]",
"type": "ENC[AES256_GCM,data:OBu1vsO9ZiOWOH3DglAkUGgRGxUHd4eUjoqBwWGJK/0QibmDHvXhD2s=,iv:0jZsAOrrADNr0TiUIlCiTkWk82NcF+lx+jiA3HRF7QA=,tag:k8lg1ibTmU/uC0HnEEDJfw==,type:str]",
"name": "ENC[AES256_GCM,data:Yu0E32vpn7CadVS5dzBbqNZ6pA==,iv:v0xq3NYEXKe5uKsPlmQxZtpkhJXc1vFwGgfWnBJvV6M=,tag:J/fHHlt6QDeoHbObCyqRKw==,type:str]",
"provider": "ENC[AES256_GCM,data:sQ1naGy3C1DfnBzyNnHZhPbb2G7ZBh3iWpH6Rc0QU45GxEa10zzdFnK7TNmusngefg==,iv:DEBpb3RCPS++5BHg2zEXBrPzgjuwtw3vMbQ/5rScG6w=,tag:qWn0b0c12mNy/c9yXpKFFw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:eQ==,iv:458m/tEZXiM8PxTVfNgG0R+CRHVmJncHj01pzOCQJeY=,tag:J+mb83DuLPRoFdcRLVCj2Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:K9oE6f5X8m4=,iv:uDkHYGvfhGsKuBMzWklK4gIJr3LAUblZvSgNIkm0OJg=,tag:kOFMBY/4gjLdT3pxH+PXFQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:7gm8SfOKRA4=,iv:NAxqYpFRBAH5YHhjDjm2vjl07+qpRhMrsz6aMCwarOQ=,tag:UE4u5PzDZI9XJasXmziC2Q==,type:str]",
"db_name": "ENC[AES256_GCM,data:nKGhuL7XUIerbw==,iv:68R3Wnf2pIyO9D5YsMockd0BSX5rlS7WjTZPernNYOo=,tag:UwJynANfjlPIbD7a0gMQyw==,type:str]",
"id": "ENC[AES256_GCM,data:bD3mLjHXEVpjS01B+oYD4cqtVuzTGmpe/y1atZGKyX2O0k0xJtHFR6w=,iv:5KY2L8uSZl8BnUjcTmUelRKRGTW97sQ7L5WdgYNRh5Q=,tag:/tDTdUZ4RLHhdsi88fPC3A==,type:str]",
"name": "ENC[AES256_GCM,data:QVppjY6Bwlz2YyFlYrxkQdwChg==,iv:BwkOBXPSUXt5YhoP2de2STLqca5tR1dQ35epf8O7NxQ=,tag:U6LJ3giJkz/lsW/DWTUy9w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:9ATASea2,iv:iSaLR5bblnpkY9sdll+y0/xUjTyd5oCgmpZt9s20EzQ=,tag:xa/+MW8XM7zv65je/8UppQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:wg==,iv:0SZeq+mYrXwrxnyv5IB0RjMxyyoLWFoS3764nrV11/Y=,tag:p+DU58XPgKs42G41aNTS8Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:/I7yXkyAHwNdF1Ve06p6Ew==,iv:kIyBXO5w1tBKD5CqsB+yf3VDFKGvJ7a65k0WUdT2Eeg=,tag:2PxmUo7nV8BPmUKU87depA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:t+WCwRIeEAQ=,iv:KuQuwupOUZeLED5PvgOhrNnvmuLqkpL5EJTianiuiVY=,tag:76XVMfgewtWSOUsuFbzpWQ==,type:str]",
"value": "ENC[AES256_GCM,data:K7pzn6sNmCu0hAzq5JmAmUuSFygc,iv:lcscW7UQcXzHBJYgIx8PVO/PHQG6QeGZRU1wi+Usuzk=,tag:o3iiX9GmAcHYX5y4OSi07Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:0g==,iv:RbGhF1mBD5u2KasLAgaStn+n6NSkPHYd6smZxthdS54=,tag:hlNcxWe0aetlvpd0zV3A3w==,type:float]",
"private": "ENC[AES256_GCM,data:I7gbQf0zEr0=,iv:qilYnnpb6AKKXeuK1JzIxmCuyhEnfjDCKCJ5RDtJ2PA=,tag:Fml49x7h6Zky9dsbk0O9Pw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Fr4z/HFJQBH3JsoDfXnvV7MmPd0igoSp+5WyAzo=,iv:K7fQpymUPPzorW4Ge8oQlpJbVbyR3AZ0kxxNrV9vIIA=,tag:A1fRbWPy6jMH6Slc+mdGRA==,type:str]",
"ENC[AES256_GCM,data:lr8uE+xluuvHRKyvTnNPv0sG,iv:6adNolFkqibsLp2KiySi/QEnpirkzUXuZJSmstBGAAg=,tag:IHQS9kk7uo43sKvbKCTVmA==,type:str]",
"ENC[AES256_GCM,data:iQvtVVVr6iCx64ULMeO4Icw+wSAaN5GGD54=,iv:QSEZsA1wYZkL/jI4bKtQMEFSdmNMlNCZAYZGkx30BrU=,tag:I8pUZ3CIiywq4Q2fzhDhig==,type:str]",
"ENC[AES256_GCM,data:Wril64SuO3i0itbTEuqn8ivkM+cAwPrPTbyV/A8/BjYPz+8wlw8lu2PR1L8BRjmkMxRB,iv:0ITPiHZpmHIIn4xZqdsVLl9r3wdgERBAvI34vpslwIU=,tag:Fe7JPz4hTWiGIS70jXNPFQ==,type:str]",
"ENC[AES256_GCM,data:H89Tv+6WfREYF+H1JDF1slZku7Q=,iv:jr+k9etOXiIkpF+mZkOpPG6RpeNoqlcYL9F/HhieHHw=,tag:E63P+6EMm8NdU4sWF10pTA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:3z2TIyLSiA==,iv:+NnQxDjqTwgmvRivb7NSyIaNvuxPv0HA0B1fC/4X+VU=,tag:HShZ3m83cSSof0TRjgLb/A==,type:str]",
"type": "ENC[AES256_GCM,data:rp+e7LjK58rNHAdb0BpGd1k8Z8s8WzOutVKP+bjRtXZ2Pdl5ouenVws=,iv:tcIf4RJXYsVfq6qB6eTEQ7lKs1LZ4vJRveD6OLbfhVo=,tag:5ZZu95qxBQuNwgz1nsjMEA==,type:str]",
"name": "ENC[AES256_GCM,data:uxsYnRdCOp7NYCZyBQ==,iv:QWsEzAqORPKl+pNreKwGmVJm7iKQv6NZUfSego37Rsg=,tag:oe97RFCL6w6uFGurrOkm3g==,type:str]",
"provider": "ENC[AES256_GCM,data:r/uShEEXKT11FrPffRlKmaAShiNM7M0Cm4BBTK5JP36J+f9nOKDD3V04orxjML1KGg==,iv:mtZnJ/MamTdHX4atBHgbcnYRh331zWfo/hq+yFDemIg=,tag:iXjGQsMFdAWtVqfK6BX8fg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Bw==,iv:ey1zQYFcyZUoRxuwp9m2eiv3LgcYlhoqLiqP7T5w6OE=,tag:zWi1qMP6p7TIPjCRW9IS+Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:EiwI3DFwBgk=,iv:z7QEIlv0XpMQvIxzrtjEk01QOYH1veCPA229A9w/uNQ=,tag:/by4aM1GBRBugH9vQJwXBg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:bMF4CsOnA9I=,iv:fkEwOzY0tmdXKHlCb0pZ//EmU1upXzdMRfnUyOO4FbU=,tag:0iD46GoTTZYmfs7ZH48+QA==,type:str]",
"db_name": "ENC[AES256_GCM,data:tWUAPgkl8jtUUg==,iv:cxUoYp2jIEB6tbgaiahpnAn9Z3uHgj8o1ArCtTEo4AU=,tag:3TlRQhvrmIJtrN2+VNHdZw==,type:str]",
"id": "ENC[AES256_GCM,data:1eTEw1Apw+IOqEeuT9uUsWpfmjWOBTlhzJvl8sacKb+st4c=,iv:xKguvWXGgFAla/gzit7hHUrfASXT49FrG+o5tOPUJXQ=,tag:QF7Ur2tZcwC47Qh9mBac+Q==,type:str]",
"name": "ENC[AES256_GCM,data:EueMzDGtMNQOcamp3Q==,iv:KdeOfG1jyYQ0atZnMzhgnqS8t2ayasz9LfclkDMsIf8=,tag:2IX5+y7JbJL7hgabBbfQhg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:nVJLRpu/,iv:TR6FVQV4QLME/JPon/VmBs4tKxfM7SbJn+wvrhaI0Ho=,tag:ePXGxmr0YzQVzfY9T3eRwA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Gg==,iv:e3SVfCDY0pSTcb0lBtwM2nhYnIAdlD3I4BnH/vSS8sI=,tag:nW/vtPVU0xtiFIpwDjrAGA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:MTSSVlHiDoXFIQ==,iv:94+ltP2J/S8YgNVIWS2dFkuZmoxOGj9BwIHkiZZ1FsY=,tag:p6R/Zl9OPT3mNOq5nI6ZCg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:WWGi1CTMxR8=,iv:MYWZKPt99WRAhSdMjbxg2xR2EDO9OdsW1qU4SfmNZuU=,tag:GAaB9cVbwQe8dtovj4SkWw==,type:str]",
"value": "ENC[AES256_GCM,data:ETFW/wn8ngkLL55ZpaBKwZcW1JSW,iv:0GeCq0fr+3PWwVdFb1ptzn7cnFYkfTKR18aUvqkC3p8=,tag:n6dRI0Ob0Dv3C0BG6YLxIw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:cw==,iv:0EnWIiqP8lXvR3YICZf28Z3bgtqYF+4mItxGohWb0lU=,tag:DtKpurvWChgw7uzxoQ88Dw==,type:float]",
"private": "ENC[AES256_GCM,data:d7fSGnch11E=,iv:lLkXrFlF5zuEl64ENRHyF7NcjZNpkvf3yyNcHKJC1lg=,tag:IJ5UfS6dg4P0G0VkGvbkdg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:s30EJp87nU4TALXj2N4NYA6ZLUuLSPw48TK6xL4=,iv:I9Z41q1W5FGXuzepJ83LaqUy3UzaCEkkGc4oWlAskuY=,tag:DNIYmrBZFMgK5tfS8FZyLg==,type:str]",
"ENC[AES256_GCM,data:ODGloBUWeGWwUNv5Ll4+5IA3,iv:01WEmYxWefJd8nNsPbeIDvGKTN2JosvuWoJ2Zjfbe4A=,tag:7A6QR7pk7VNl3sLyRAQXTA==,type:str]",
"ENC[AES256_GCM,data:tTYpir9ow99glE4Yz43/v6QrHppunGdvGTg=,iv:z1U0UChPtOWQ0hJQb2P/chxt6Q6BVYXkodsdEZ0vwmk=,tag:eewsk5cIl7tvY48FT9AEZg==,type:str]",
"ENC[AES256_GCM,data:AniKo1CDFTOi917KO7u1cWwQxsPLYiPzosfHd/0eacUUcmS5iVLYtBHGzEwvTPGJZhDZ,iv:Hrp9gzSPU9N/b5WVR2T3k76Y0vDANkw+xKKO/xxh7UA=,tag:onIayA/FUbQtOimqpWGqIg==,type:str]",
"ENC[AES256_GCM,data:LAqRS6sUO3tL2mb+2Qigz1IBGRU=,iv:pJcFegFurkiU7SJRrHjc0JJ1B5kuN6oWKljGYK1HXXg=,tag:niFBB0kvL1VoFAduJB/r4w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:+MpXth/pMA==,iv:MFuSytn0IOnm1jyAhbrmSGNMeOnLRePD+ZX76vwEGKM=,tag:zBhqZIJSQjY5lgYbNm4PAw==,type:str]",
"type": "ENC[AES256_GCM,data:0GIB9W903TOye8iqgIfor9vjS7sCeBttwchv2JhuXpcZoeXzsVPvA3M=,iv:jXRHQa7JYI805C6IfMXQgwb9rvUP6Cp6LU86MxWrhVc=,tag:gcu5iPX429eWh6fmvptl3Q==,type:str]",
"name": "ENC[AES256_GCM,data:8mFpLusX0wKNj4YEGA==,iv:7c/3TGF7BWGQeO36HqdofDphF7mYQvh545uTiZ2Fwo4=,tag:cqMvVVLTLo3iHMuekxZzAA==,type:str]",
"provider": "ENC[AES256_GCM,data:yCTXsne1y8LZHVJxMtzPuqlufqaBk2vLZtgim9h6vNGlH6smGebVqzbIegP2tG0t2g==,iv:Y9ZZhKpQmruBa7j4ls9QfvxNnpVk6+ENGjOC6XUk7pM=,tag:9iE3HQs6gYkfYTt8ef09Fg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:6Q==,iv:2g+cVq7O0EullODfuyc7e/R3o3QhsDVgjbVcc2NrzpQ=,tag:ai5MMgO+ymUY/dNcO6zC4A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:mSy3ymUTPZk=,iv:EXoHXHXRpi7KdOODQ4Syxp9TAUpU8zGwY/ojFkmb59M=,tag:QqiGhI/nbuewwhIi3jgFKQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:qwHIhPdnB+I=,iv:aFuR9rq/I53Ph7BYMF8XTToyMHfdLov0J8MdcugtBxE=,tag:3YaoC4ts2Nq6keQExhlj5g==,type:str]",
"db_name": "ENC[AES256_GCM,data:nIebcX5LzRg2GA==,iv:fq9x3/iY60UHodkFbx7ZM/WjuXaL0WQYhMPV0efggeQ=,tag:buqsQjMzLVmkn9t5oz4r1A==,type:str]",
"id": "ENC[AES256_GCM,data:PYnwqe+cTw0MsvboJWzFRR8fi6oOEm5fEbKBTxNL7dY8/NY=,iv:ccaEvE36Ap/I/XMemH2svqfxmUWgiqLtPxz0f8pajLw=,tag:iw3R55+MnKFPDCToR5Da4w==,type:str]",
"name": "ENC[AES256_GCM,data:kOjs7Tev0fx+gpBftQ==,iv:V1hD6VkmFrf1Gvd3PZ4vkLUdI+j1yfLChZZgXgw3HGc=,tag:i7d8rzVkqk7s8Zd/o17xYg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:2CPynSyl,iv:/X5YM0Km7gDFoAhDnn0zw6nCq69k3I/C22DlFqCp+l8=,tag:/k0PKCtrP0fSDPd7ykoGiQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:1w==,iv:TCgE3s5mVJniq9oONLkUPvOpjNr8dR91Kylzs51OjV8=,tag:J0cfyh8GViaMrS5tYWBY+w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:6AtaXBZ3y8Xmfg==,iv:i0rL8QvCFCEsfkOk8YLNB5Z0mls69l94XTwScqjovFI=,tag:fmQTqofbICrf6MAzztAPrg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:QvUutJRVKhI=,iv:cUndoyivO+ML2IAkQO8nDuuObON0Oyzd7P2R7aSYq/A=,tag:e8B9jib6jTAk5UhN+vjy5w==,type:str]",
"value": "ENC[AES256_GCM,data:e1olVSb4uTQqs6VafotP0wE6d+CX,iv:ER7iZ6TJ7demcuKyqrkmya0zKDOe4/J7cUaZ2sdtDHY=,tag:5yC5N1sASa2icKBRqUPcEQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:pg==,iv:iKiCh2rlehmagnOjzvq7+eWsRRrK1d70eMH61NbORH4=,tag:AZjRx+kT3pSIuuDeps4I9g==,type:float]",
"private": "ENC[AES256_GCM,data:u33RPuv71Ko=,iv:onuXrTo8vzJwqEAygEtzQO4nxoJAKZRz+YLKu+8j7SY=,tag:qhS/WezOX5bfcyI77m/F0A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:FAFqiMlNuIKRhE4SkKaSw1tVToiDz+NxBXa8vz4=,iv:/k+QcAr49nwWKxBYVItYA3uHICaJEGYPdQEYffROV54=,tag:wmk7xZpBphruIdcqOX+dcw==,type:str]",
"ENC[AES256_GCM,data:5Yyp7N4h7PrCwvZsatKhp5PC,iv:s0OxMmEXijPcJQFzGXi9DQDVljK0lrCWSbtJfpsuwbA=,tag:gA55xU4RuwIRi9U/I2PyRg==,type:str]",
"ENC[AES256_GCM,data:ZF/c9N17kXunk0BeHquH4+UcEmkILRXKg9U=,iv:bZsiAPl38cSq+pFiLjhq+QpKMS8sAZkXEx3x7WxSPYg=,tag:7/hRBfgX9T33VdKF1D9dQw==,type:str]",
"ENC[AES256_GCM,data:NiKhtNeVOA0RfRSPlwBrXuREPc8/e3/CJ+0C4GfchAtLpyng3Ev6Enegazz3UjYsWORT,iv:HdA49jAWEeUYgsian1YwaGp26DSOZ37EMiEhvIlWyWg=,tag:oG5CKDTs9l22lyk6b24hHA==,type:str]",
"ENC[AES256_GCM,data:N9kFUWamxHiOCwOhz98znL8B0qA=,iv:No98AVVBOobPiQv4MEY6SDzRk3+ZuhBcdECT8nyb2bs=,tag:X4vlBoAGKxb8R6WBSBKWhA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:StCM7PMBPw==,iv:lzxe9SqBetjbuduF+dtzTTqJ2qmorwmkYKjRWbquMRQ=,tag:jeWYHR1FfacJDN+Xt8Yn/w==,type:str]",
"type": "ENC[AES256_GCM,data:i9bEJF4DOvsfII0Ak3EYb5lqqMK3XxHEDjF/LqsYj5109sH8wkSW0aQ=,iv:v2xITFY0Z7TYZMrghFpTTm5lWbkzSJZnlooT5AAg9+M=,tag:o+I5xavmDT5+Qj7GWu3b5Q==,type:str]",
"name": "ENC[AES256_GCM,data:rUX8tB3QX6qSkyoAfdnqRrOs,iv:EdCWjJ6+YLWf4I02zRlqmkhTIPKG9kqa/hAktUg8o7M=,tag:xEe7kbWRxoUHEcJkx1IVqw==,type:str]",
"provider": "ENC[AES256_GCM,data:RnkpQzHU8DF5PDmuEtURxzHhY4sc5q+ZeJjHmvkck1cOMGN8gC8OLZ3teunGIQ8rDQ==,iv:qIro/BxAk4rmOzRmUN+EQ251Cd40ZsFQ2kIelF/5l0U=,tag:tJi2/Ety7DrAB7m0W7z4Sw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Mg==,iv:fUl0Ret0DQ6Fqj92R8THoTM4ti0hGvpIplpI6d7OEUA=,tag:HUBjljyQw5bEJv7gST7B3Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:3MciN8gKAQ8=,iv:suw0IxTigyqwjMdX4RRKQpl/DO4eZ/bIajVJgAFTywo=,tag:GR9tlK51fYTHRWUgSwIuZQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:vQCn02U32B0=,iv:x4rf4mkFf7AjUiJ6+YkqJzYJs5eTp8AUdtavr6i4xaM=,tag:s3yGM4XxeebXibZHHV7iIQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:guuc0LEvfF1Gyw==,iv:qYiQW4+Mj32ck+lwfM5Z/4MuNcNIeajP/ol8ZTQTuh0=,tag:0SbHF9dh4Db5kqPM0AaVtg==,type:str]",
"id": "ENC[AES256_GCM,data:mqwwIHaTYCZpasY/dvMy+TcqKwdfWm03NCi5q1jEi69/2zmbY6ts5A==,iv:YlJWRgYMO0hnVgOKJriC6en/+65Dzl4SuK+DDA99im4=,tag:ko8Zr8eYikEUNNG/9dbjtw==,type:str]",
"name": "ENC[AES256_GCM,data:RNC3vNm6kLwDCycL197NXZ70,iv:6BiyTWZSlN4g+vMZnJ6A4XBJaIZtgaoppegvUPODYUk=,tag:HCvDo335t2lyKsYWjgVbPA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:N9pqj2/h,iv:5uXksWZi75XTZZaifw+oEU9mJzhC/F2O919pLAdozF0=,tag:UkXPyt5071NtOBbKgI7Tvw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:oA==,iv:MQPCml5p/j5VqXTORkgLjgwutdYR9koDH73dfYT0gqA=,tag:p3uEuZJr1/vh5y18P6fmSQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:mp83yHIGlH/iGvsMZ/H+,iv:wdBEafcStbQLlX5y09DhTgAPdlJXpEE4HGvmMdcetS8=,tag:03n8IPmxXlDrTwrdWNkJ5w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:wWTrEXwo1kc=,iv:w4Q9stQtoywvKx76lx8eEz794ZT8sYgwH4fFM2e3NEU=,tag:91JbD5fN1gFXnVobeWmH4A==,type:str]",
"value": "ENC[AES256_GCM,data:5pHMvRMtrYLxV1PaemnWGQSEWeA+,iv:PNXrz3Hx+iWQ8NLJJ2XTGTnsNGiVhXepK0jJy45cYDE=,tag:3ALDu2QgHsy59Yzmafl3GA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Sw==,iv:jMvSMftduBMYX3VDrdOiHsnDQd4wsjQcZG7R8fQIPrY=,tag:/Hz6sThZvrBuP9tNPKlMgg==,type:float]",
"private": "ENC[AES256_GCM,data:FASPHN8Lic0=,iv:/+N67qyeA5CosVbyRgjrteHR4dwpXCfc3/K8HuZ/jnM=,tag:T8tghaVJXGA8XRjtMeyu1w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:bNuOGtXE4K6d+XWmEffy3t+Ego6SNCqB4rorzxk=,iv:VJklnw3JPA838mf7Fpa66PN2PqKEb8JCOX+lhnw75+o=,tag:KnlRaxQ3/bf9MpUA7gQkaQ==,type:str]",
"ENC[AES256_GCM,data:5F+MFIgU0twb18USE5/t1hJb,iv:nC/ITxsOUS8g0ugpHftQwzAxRtzLogjtPTBLg9AzRxQ=,tag:IP1trkr/O1hiHgVLD+TX0w==,type:str]",
"ENC[AES256_GCM,data:WythRZGs8UPt/vQW1rYlSCuok6mnRwyLk+w=,iv:tK6RFeLphvCrkzCFTSr88TGP6WpxPX6HJ1ErFjFRsrU=,tag:3j3zoKNYNGYPoQkow/gbjA==,type:str]",
"ENC[AES256_GCM,data:nEUY83XNfQTUa14Q7UbTqCMHJZS1/tsDKG2LiKr9ufND+0WuRzNQLjh4rdpAJOoFyZ0k,iv:T/OsULB/GKTPC8g1hPVmVLwfXGbngwLV7InQlOWDh6E=,tag:Sc+R2sVJ2e3fsDpo22dDgQ==,type:str]",
"ENC[AES256_GCM,data:hr8MplLCYVunupDrnN1n7pnjWF4=,iv:BX/iJnWG5eOHme6vfhLoz+VZainE4VOVuAkJoOFOTTc=,tag:70+6iZp0du4WGnGvEZIfhw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:zlksTmI1zA==,iv:HHduAHaAJM1YuwBesULLCU+ncBZKNQmi1HOawa+OnlE=,tag:WCwrIHezXeZTyll2BRYiZQ==,type:str]",
"type": "ENC[AES256_GCM,data:J0HaaM4cIohqMYzxDtSdnU6O+7FzQjW8LutEww3/URa1tnMktJNGShU=,iv:TWKOCSQvBA4VkPBF2QSXr4oLk8ZxoTNE9vPex6f4+5Q=,tag:RL//iYp9esM5wNIunJxlTg==,type:str]",
"name": "ENC[AES256_GCM,data:clRn8GgGfgf5jFEoIa+OKsY=,iv:0h+BFoANGHqoUKwG3g/zRCCsJxV0udS2FSmRVQehvp0=,tag:2O2ZZQgzve6MZof5sn7bdA==,type:str]",
"provider": "ENC[AES256_GCM,data:UFCsRHPzxGos+v2ajuMBycaqCErBCi8JSyVUSBQZjoxX4+6D6O+i60qRtqGR+57zYQ==,iv:R6aC6dKEFlCw43lXmrQw5UMD++6WBA9EOPqdp+2YcuA=,tag:46vxLWOn2yMs6laZFRvDHg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:5w==,iv:ETh41mtuAE6x7gmhCmuxSq4km+oNUm5iKBD5gpG3K+E=,tag:9nKcOhNTwMb1vo8YDBvUFA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:/oCHKpn3T3c=,iv:SmmuqbF6lmtA0/q/5Cq/lOTrofqZvmQHuk2NxcrLB5Q=,tag:IcVe7uPJhu4pWU2uu4WXOg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:udSII0sMdZI=,iv:GWaff+jUUkev+fUcpcCSS/T6cNwqp1iv57lajqcsG4s=,tag:xi2KKjQTP4Zq4zQNLQVxSg==,type:str]",
"db_name": "ENC[AES256_GCM,data:XwBcieAgMOnHQw==,iv:tFXjhgfRng+pQpGXLB9xsc9m9B2rIj1O8hWY54joszU=,tag:x22LhRckmhJluUs79U/o2w==,type:str]",
"id": "ENC[AES256_GCM,data:Yhd+AFNNn93MCTiMVI7KOBpu98w4bYYPRdvPgV7BpRphzpy16GP4,iv:qvQvZ064fTYfKT42jIBv7b0zsYPYUo8k9rzGHT1zY0E=,tag:8LczDz8eSOKnyLHgMlTGcA==,type:str]",
"name": "ENC[AES256_GCM,data:bc7Twisuey+64DHJMWNBEaA=,iv:PmvNWGJPaIXCQl3CBXTWsgL+2j5udjPbHLjt6yrvcRI=,tag:+NgYgRtNYjrDgvXRVwdC3w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:bfJHC1D/,iv:A8JAScaDIh3oE/X/701nHOxamVVKu1fGXN2UPAVuwCY=,tag:jrfrplyQcSOBFHRrAEEfpQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Dw==,iv:g2c1gBGdnVZ2/99gYVgOO2t5tgS5yk8XYngiSWMA62g=,tag:iC0/jaQ6nRrRZOYeYj6P2w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:r7obVoil6OJLBjXO1M8=,iv:1UjTI3H77J38zsOV+kbH8hHxkGdDs0vG0h9KdB1YOfY=,tag:2oArES+eQQurlqkALj8lBg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:9fAwx8etTEY=,iv:Z2weN7LrpaFP7AKhdKexttDtKkNaCbu5elvt0CmxwMA=,tag:18F5EfSfhFlqCQt8LmRWxA==,type:str]",
"value": "ENC[AES256_GCM,data:nFdTACQ1fCIhQPMmbYikH3TzFjOv,iv:b0sRNSnUYkX+9DNo1p9wZU02nQVmcqbBzGhcGWpBhSA=,tag:7zLQJteh2vTeSvRl9R2ykA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:wg==,iv:L3zi+vJOWM0+u4iQD/Hxogk8XyMW7ZVAysdDVyrO6sw=,tag:Jjdy8XrkxXCrR25lUqVPZg==,type:float]",
"private": "ENC[AES256_GCM,data:jnu+30nt5QE=,iv:bcr9GaQwMQwoPkA8jr7X4NrRVJQ+iWz3Mqnmgv+upKc=,tag:V9iOFnYyJ3rb6TbtIFDRaA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:8A63TIU458h4ocSk7casGWqgh1NtGgu2renAIU8=,iv:T7xj1GEnSzvg3fMDwxed4nQTr1/482qDrnqKg0L4tFo=,tag:ss9TTPDj+WrVQWCHgCBdfw==,type:str]",
"ENC[AES256_GCM,data:NP+lLpB+ePatgOWxMUsRLHLA,iv:yXqQNp9S4GKcxy877/blXeOZ8+4TP1/JjSh/hqMQOIU=,tag:TjBPl4kdiSW1BKzzJ5W3YA==,type:str]",
"ENC[AES256_GCM,data:8qSplXnWg6LAoGla/mHJ+nldP7GgLi0dRkc=,iv:A+B251FMPdRNKeZyxpZuUM4fyXaJEqRlfQ4/Gy0wNOw=,tag:RaHAJEICmZTTdRd5vX6eGA==,type:str]",
"ENC[AES256_GCM,data:OJOl9F6saHd/kwSXbN7uQhHCcK9RGrTGTaYBi+w0HFIbhVQAiYb9HGzYD4DY+uQ/oMeh,iv:TwOJg2o2WucM/WaYnRWPmVtBaHaKMeQLCCAbjHTfzpQ=,tag:hnDq92Aydy3n6zrvHlnq0Q==,type:str]",
"ENC[AES256_GCM,data:/5Rm24K/ONjmTpcV/kZLZ8q4rwk=,iv:RE6tN/YY1em8drrzUEQdajn0Clr38HNhZapSBuc7YG8=,tag:XlDw2xGKvzJHKSAoe0h2pg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:wvOte1xPhg==,iv:UG/mXWpZ+xNXSDJs21h8gshW/ZATC086c83sRvZQMZk=,tag:/hTu/J+DS+s9tYox4PHGTg==,type:str]",
"type": "ENC[AES256_GCM,data:UjK5HDWkIp6WLKC69BYrOpR/WKVE7jDy9GK8+4MW/q+FbFQ2ktW04dg=,iv:ysq3EJWxRQGkZnO/ElRoYu06Nvdowwz14bt9i10K6zw=,tag:jf2gcbBraxMx5E3v89ET6g==,type:str]",
"name": "ENC[AES256_GCM,data:KUU4a08GNkrX,iv:n//SYZUKVX7dgwGpcA/sczYmYCiMDbL2EQvDpPl4ev8=,tag:JOONdac+Xa7nyl63lYO/wg==,type:str]",
"provider": "ENC[AES256_GCM,data:o8g5y/tyVhET3s2p6/GUf82OJRP08oWNIPq3On54BU4fMGwS0IILeqNt/dtE2cqBtQ==,iv:xkrH+BvCm52Sugy4r/q6JYc62WXmnLeL5D7XUoB3bAg=,tag:lxPk9uA6q9vYZm5/J/xtzA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:cQ==,iv:q28rQc4wufQ31nPAB1IMxJGxCHfFABxHrNw6tRjCCZE=,tag:qdOOMW6KW2XgtDN51UvRSA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:RBxrFlMr0t0=,iv:hQqvGyHM7npn8ZDlra1Gs6dD98VsuNGAyUDKHHdxn4A=,tag:jiYBbRyDIc5EpKQdmsUwrA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:fJMdttc9ELI=,iv:fnlBXlVixsuio1y1bYe+nT7LuWwaFbOTxOjQe4+z0Uk=,tag:2EEUyiwHv1KBtIhnpUPJPQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:iiVnuDw+AAkiXw==,iv:DfWMqZq0PfXvhNoQzuJ5R6jzL8FIVX7gRtghy/rWE+I=,tag:/QAPPc3sY7VY17sIk26XtQ==,type:str]",
"id": "ENC[AES256_GCM,data:uPy2mYQDABpU2ZEZSbRrOZbkfsBubaI2d68U/N7dyw==,iv:FDCsUk/O5Y3n5qdp6B+ztOGyToCi9WqZt9y0HBxVM0E=,tag:LgbOvr+tePzO9rrU0tYjgw==,type:str]",
"name": "ENC[AES256_GCM,data:cPQLF0sS0w0v,iv:fv9RWZy9c7SonIN5g4MXZVTIuA1yvw2x+mgqEcgLmyI=,tag:henzvXwwINVtS5L/cNyAlA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:wlTMIxb1,iv:IcEC9oZ6uEZpm3eNauAhs14zT9hx3gntkVIHzuSHVSY=,tag:C5rT0VNr3h09XyVXqEihDw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:0Q==,iv:JYFJKHdOW2n+MUD9MpStKntQGxF35EnjkhU2aq82ItA=,tag:fxAy52qrTwc+4xMRfWgo5Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:FbBBO9Wz,iv:jrPslY9RfIh8MZ/6c1ktQHZYsKFUbsMs82PI1cKR5TY=,tag:n6y1JEd5lnrSq/51Hyt2mg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:W/YDPXnVfUo=,iv:aEOaOH4phIgZMEBCndmuEAGFWpb4GB4RD8RJjNl/dZQ=,tag:j4f48O2IdkuLXYmx/ea6JQ==,type:str]",
"value": "ENC[AES256_GCM,data:FK9TAtnQe+THN7f/DP+4j1H4zVqQ,iv:vRNL894rb+EhEDoneriSMDnkH/e+teyb+wtPN5G54ic=,tag:r4EbyN7CxhVI/sHGUKRSUQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Zw==,iv:tUyDTwYc8BLkanWW2oxkfve5zoxA5Ra7rC0jNN2K7PM=,tag:PC6U1e5XM1ePeislCvpqRQ==,type:float]",
"private": "ENC[AES256_GCM,data:+m4to72R+vc=,iv:E+nuUoFy7aM+lcnzeqGYySGHVGS4L3nK/CXuxhtW0eM=,tag:5hWqiRZCjJObtvvwuhjpEg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:OIqFThdP4/6JIowmwEn7lMjAThPyrAXzQRTtNWI=,iv:U/CBiqmrQKbeDYxq4MGqhUBp+suzFUD0kiJTx25vXIs=,tag:GWLW/R1/rFjeqEl2SglBig==,type:str]",
"ENC[AES256_GCM,data:bYo1Wkq2YkVf7GoeV1u7221z,iv:/XSEKMiNF17oVTJcAGciDCDKCqlBzjvcD69vP6CUnIs=,tag:8zwKj5n5pO8FJUyt3UbYjw==,type:str]",
"ENC[AES256_GCM,data:Rx8VX9d75DDeIDHUiimiJV0+ga4DGs2J31o=,iv:7Vg4kbsj/g8MYw8MPh98YIo+Qi7ph+VytSjWE/bJ9Zw=,tag:/GuIHn4K5L/01AxpR2fYeQ==,type:str]",
"ENC[AES256_GCM,data:/9XYL/UZzd2TtT1huKi0hAe5L2Cqg3AxpWYS+oyyZmdGBzzX09qOA0l3RIIU6wtMX/5t,iv:Rsdi5lmVnzv6shHDqGy+J2lDOF9YZrrhJ3Hn0WhSmas=,tag:ZJwgMyfRVdxmkMmEN95Zyg==,type:str]",
"ENC[AES256_GCM,data:juZwKtBnlalRkUTkBSaiLFFtcj4=,iv:XhMmmzuzoV/p29vxKCHDA1wEIm5oy/Gb3UQX12wouaQ=,tag:6Kg3TIUpmWTGMZuVmiu7Dw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:PGQA7jXNYA==,iv:aANls6gNrER1s5Tna0xhYvM+Fcv3AgyqIDExzDLqmmg=,tag:9sdG/OaoGItGCGScOwa4DQ==,type:str]",
"type": "ENC[AES256_GCM,data:GRil+5lr4LyJFoufvuD5paqfRyfqfjusNa/ZnV0423wNhmZKHXaJ3mo=,iv:3+MJqr4UjxCl0T/AcVORe/DhdEzaj6vbWlAUMBzYQ9w=,tag:2/hB0MpHB65lEF4gaHWgZA==,type:str]",
"name": "ENC[AES256_GCM,data:SjfbBGlwu/QG673vKHFPu1X6p3epSw==,iv:DE0k04H2JTsCVOekENwLXT0FhqatcpgHVEEqBNpIHXc=,tag:bsZ/e1R6fmQyYwRWNWoBgg==,type:str]",
"provider": "ENC[AES256_GCM,data:tjCyYYE64tZBKWJHJOgme1W6aJcFWHg5t8Sx2Q7kkHwVBWDZCATrYP/+svgaXyYocQ==,iv:VQEMB1PoTlCLOMKePkH/ryBkZQDTcsxqUb3BVyNyWL8=,tag:av0nwcgLI6zhZWGzaYrLvA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:cg==,iv:j1vz8qOrWSz1/EVs35a38ru2fC7GyJ8kHtJ5umPTogM=,tag:hm2St5Ox2+k4HrxAIPE0/A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:tMwbOZPreT8=,iv:VyZ/6FaXS0i+9ULe6hdR5M3mZElLuRuD4GGkMxE37x4=,tag:v+pYNSjz4R179IsPtwpvpQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:sLlVSbJHmv8=,iv:woAkHDHXcaYaagX2ye3eTI+iZjkt6A8QVx8pFyu12Mk=,tag:6TlJILsOxLOBPljg1elhWQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:J0BxPwQTuz6NSg==,iv:y+qEiGDw3Smm2gTSZA+t4NF1MGUfXo7UUPvyuOOCgc8=,tag:2KDRcC7eAHdXOh+DiKlfUA==,type:str]",
"id": "ENC[AES256_GCM,data:LnoRjyUC3W7B2ZyrRc4xzerGtIkQJrC1xmtXlijToZguSeiKZUEtb81w9No=,iv:uXORvw1HBhARVBm/UPPh7E/MCn8nrrXViuad3qPLRI8=,tag:Yq2SvJGh/Eg8qK8V0znPbQ==,type:str]",
"name": "ENC[AES256_GCM,data:FqykOrfUP2V22FcZ9jaYEA7fFfg73w==,iv:P2wsN7SWLQGauSNQZjbJ93SHp7Ji0gP/ecJ6poAESwE=,tag:QFlR5HZBvC5QsMk5F2SDjg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:As5uwTPa,iv:dbfpH/0iHAmAWyCxTmzrn6tzQYCER6XK+54XxudFGFg=,tag:cJOc5EAo0IU2vC95mkvYfQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:yw==,iv:kFy3PngblfHqInN3K5N3P7jJqZiP5ikEXkpMrvJf7ss=,tag:ptUa9vXNULB2rNWx7RS1dA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:m/+g1uJ6MTdRZ1Nd4y6oDoT4Lw==,iv:alqw2rqGBn4JcY24tYkkBCRL0w1jk6bNWNaYMjbZQvU=,tag:VJms8cV199oaVJH9QIPVLg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:S3yKhkgi4zc=,iv:MeC8VABF1XEPQ+TG4TmSHzcoD7YkJT0/1WYSKNKMB4A=,tag:Lq8bJNwgYlSMvnfORHmCMQ==,type:str]",
"value": "ENC[AES256_GCM,data:s4jtcoHnW6aD2e9hvqHuSerrBCJk,iv:9YuWetwiIGjDubg7NJDRMqgdNDDU8wiZ9Yr6m5IfyAE=,tag:hctzRUKp6q8Ro0q3gyv3nA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:cw==,iv:Yf+vgneH71DsGs1iHbTsriv7eYBOnv+O4SE6nWHDh+I=,tag:briQdsCwsMfTEhhHw/zPeg==,type:float]",
"private": "ENC[AES256_GCM,data:1phG5eK+EAg=,iv:8fC5Yb3yf8yJp6dcJ2kUq9mzptEEuXDbOxdygOTLzw8=,tag:xPWTUWL/0A6mt3oVUklIxQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:lHVPsCbTn94FSxGgJZ2wsvXq8OJP5uTSHu8CZTM=,iv:WIZ6AYY6DIjWs7Z7mrVQm/AjuYXQ1i48XxglzavV2KA=,tag:cgaa/SljBHaLzwhg/tECfA==,type:str]",
"ENC[AES256_GCM,data:RD7KjAi3MSOMWwu1UV9dOnw+,iv:nfaZmNdyEpBCwOvWjWZBSpQtM5U7J7QLEXnsL6dTGmQ=,tag:bKwEKQo8VgoSFOuY63B1CA==,type:str]",
"ENC[AES256_GCM,data:HbsvTmg9Nk1Ml+d8M9o56UvsOFOmMeEg1sA=,iv:y2VnoRFftn738vF0w0WI4Q26bxhboQKrrRhoy0IEtIA=,tag:1lqcNTRqfrHZbuVlfz824w==,type:str]",
"ENC[AES256_GCM,data:ku1AuOad8URKaf2fv0lGG0o6919vVmv9feS7hHkMzpXIijiDfCEeMauc7Ky5q8xsLrVN,iv:xalWESLcBdGR/3POnMVWmzkQx0Yo+7MwfLVLIzHnHb4=,tag:g4EcjDXG6nDvQgpD06boBg==,type:str]",
"ENC[AES256_GCM,data:FhcAbYwRbMLmtcSR8xowKN8gD5k=,iv:Bo5NdXImeVWhF5WtJoQKdIOn7DxsD6Y9JUliolIp7Kc=,tag:V6X+vX8O6vkxN7W1Vt1/zg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:bwem/+RScg==,iv:ERSW6xb3RZx4Y3i/mVmtWONP1AuLOkS/2Yk4o8dhhh4=,tag:CbJoR0mQAJbo6hiUsprhmw==,type:str]",
"type": "ENC[AES256_GCM,data:1fbu4Bv+T6cLcOvsap0m6RMTjigXGjEz7gPNO5htq0uD5/PMh4wc62E=,iv:gLtNVBXLsSgYM+kmOw2dE2rw6v5m+yCvnHZH4AWI3dc=,tag:JHQTuJc3Q23iyn/jVW7xJA==,type:str]",
"name": "ENC[AES256_GCM,data:FlJKEQjfjKpmtmZQ7w==,iv:jIJSr4rcE6jTjOhcBNNPiPLQn1bKzwxuamnpan2EJM8=,tag:ZGhg/JCsImWD8K12CFO6tA==,type:str]",
"provider": "ENC[AES256_GCM,data:g8Vb3oclBjpDSVw5sPVkB4U4XUH/s89m7uuI7O2BrioMWUDAk5NZUeF3KRXhQplv9g==,iv:rsaEBlFDsgOb/FokxcEhu3FCMtDM88BDmBlw3S4cqqs=,tag:Ri4k3l+caYXoYs9s/hCMsQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Jg==,iv:7beLzvKAfEB4v1FtZD8MsiFqZKwZvZT4BRikMmcycqM=,tag:YG2bCWJXJeOYe4sMGUniuw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:EVLJ6o0CRNU=,iv:VF2Uhkg1YV4Q3bdF+dEzukOkAs7QPFTL4f/urGivKF4=,tag:XculIezkwWUXZGKl7vCbHg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:wxBI2yd4xlI=,iv:nN/LypCzFqvgkTsOcW3uVzQZO4d5Y/azYKih1eR7Giw=,tag:w9oUFCARS+YWwbOXf1ZzeA==,type:str]",
"db_name": "ENC[AES256_GCM,data:xkTJjta2rdGrmA==,iv:hlNHMV2h7kKTC6YH7w/hQfGxm56ff+Xvd1R54B8fS3I=,tag:HX11mBAqKpdc9+fbLwINHA==,type:str]",
"id": "ENC[AES256_GCM,data:siqgLpdjcYBsIpsJeNadYZSSBk54D9hcTQYNDdNEvDlgM4g=,iv:6sbvTPe/NVSsa+0oNe+xucD34A/BAKCRvJQ+jACI0Yk=,tag:KnW3LPJBuKZqPF9q1bw86A==,type:str]",
"name": "ENC[AES256_GCM,data:Qtr89Q7gr4DqX9hy4A==,iv:EMuU1sC2KH1T2FWepqLPxh9NJ290kRllYYJ46JaXCrA=,tag:weVE+rcdJmpDP5s8UbsdSA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:kGjklpwO,iv:BWSY23taRDuBuoaxIpdfN3m0gDNxmfzpyf9d2bsADmI=,tag:8beGoreHc3FR0igIDUeDFw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Cg==,iv:+sajUEv0X+rOubVAg/PPdHZw0qoYhxHL+vMnqHPgc+c=,tag:Lb1K7RjActuetN9Voip+XQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:YWCqZMu0cU6EzQ==,iv:HVpFGFhCjpwBCPW48mqEXPXUwTLXnT3/dgyahgqt5zY=,tag:2nROzq+HDQrJ2N0PhFMlNQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:bhbqoLocVS4=,iv:1BNx0JiQQSqvXHkxvjqD3wOCnF1NtHCSW7/mJB5ajKE=,tag:u8eH9vkW7eMOTBtytL6fEA==,type:str]",
"value": "ENC[AES256_GCM,data:PXBgpnMGW73OBMmbARD64f3DXh0G,iv:E4X6WXtmZU5Tm32RA23KM+IuPgbwnf+trLZSW87fMKQ=,tag:0NHexgPy1gReDDLmLcSP6w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:4w==,iv:ab3SoupbLx9f16fMNN72CmzZUxihUsruNMDqpK13tj0=,tag:oflJXpZIgWVBE8rqGaUr5A==,type:float]",
"private": "ENC[AES256_GCM,data:+5o6nXMMFrV8JhHzkAnTNLgBKKDjJVJDzWD9/W3Odx4=,iv:7E4w1If6ooR336Y9OtbcTskWy3bBeZik50d5XQcJscg=,tag:zX+x6GcSkiE17TWGsRmi1A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:I5WXxKzWRYYuy4QUHTGW34bcqXpwI6ovmDUQfTE=,iv:bVughFtEfT4q7G76WzhfizssuDwLdcVW2fuGclJgLQE=,tag:Av0fKVoXhCMcLw3P2ob3WQ==,type:str]",
"ENC[AES256_GCM,data:9Wg5pJ0o/Zbq4IEMYZdDjW10,iv:LVps4eDTkU8eNXK0Clk4HYdTkOCRk6lFsyNEmJbRhUE=,tag:jqR/RtEql3Xf5U308lzwJQ==,type:str]",
"ENC[AES256_GCM,data:rZZ50dtCw+hg5gcUFbwAhzsBaqM4BycvMHk=,iv:Y83quh8g7yhTkhmfrJhpfVHu1YEgvT/rrYE8p3p2Hok=,tag:SKNPKXf01/n0keyJsoxVsQ==,type:str]",
"ENC[AES256_GCM,data:mfDhwBMYKDVNe4NAeJDKi5SXdMznY4J8YmKWMSSDThb9nxw1TZeLCvSSVt8LCwU+YtSp,iv:OTT39iCwrP+JO3LOTLDGhndo7bqGmcZymBVU1p3Hfks=,tag:C0/lmzKZe8mOzVr/xacE/g==,type:str]",
"ENC[AES256_GCM,data:/dMU/a6opCJmsTs3GjKLPbPmHyw=,iv:VhkULZ4/f3AC12olvl72Zc+mZXq/HEgpwOT0pOMdVTQ=,tag:GVhT1uaOywa+PJXYoBjVTw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:OpY5soSNmQ==,iv:2/ILZBBA0bGCBhnw1fTE8k/yXzJKWI92bot9OeKINdk=,tag:3Fw8dV3oulywgvGxWbxDSQ==,type:str]",
"type": "ENC[AES256_GCM,data:lmWGmUUSJszNvcJqPBOPYpSsk0OtkzUL6hOBwHnhewkTGbbHRlN0uXM=,iv:guplavqfo+BsHTHF2zv0gEbRz1mbogLlQ0YJQo8RZrw=,tag:9cWUsLYb7VlHSFDSCyb9uw==,type:str]",
"name": "ENC[AES256_GCM,data:sxcOoceDBhUbBi+alBmB06hf,iv:inTZ07dJ5vLMXAGLH5f/2Aq2jpti85Tzk3wxns2LQMg=,tag:7CkINPtemNm+a+XVlaTi1A==,type:str]",
"provider": "ENC[AES256_GCM,data:YtwSNAkLSb+k/naf/bDJOlff/xuwJwX/cChio4eLI5+7uaIIUSA1jddF25jgpYo3+Q==,iv:vK5jXUtnSy2y/5CcnEzlxRmhMPZJM1qOWdysPy/ImsE=,tag:7loShaCpHelHvfT9z1p/CQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:/A==,iv:/uc7skaL2kjk8lUk18oEQ+RNpoWPgniMAqd90DOlEz8=,tag:nczIiLUgJFY0+qWHHX2OXQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:SrFmjXdFBec=,iv:FX0GfJWsvojMOk3EQJzX5mQsI69ybK2VrGRCQzAbTu4=,tag:VhpwMhCTQsrSx6kon0XcTw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:+ADHUp2Hoco=,iv:CRJi/TmQOzfAwVd8SyUhvEfXHBxs9jfB2fqcvRNKnBw=,tag:nnVsuBzHz00yIdJhGZIl6Q==,type:str]",
"db_name": "ENC[AES256_GCM,data:pkM+kxfzWxatmQ==,iv:0mc6MRPZJWEhTfzbc5eM4HGI+ht0Uqm6JEETD5LQ+Lc=,tag:8cgTzcGzRjZ/2Buqi5WBHQ==,type:str]",
"id": "ENC[AES256_GCM,data:se42/G+vaixgVMyR7TJngbdmok66Du8zyhtok1dYYNFyuAOEowvhDQ==,iv:w0hOpQ5ZL32XaLhYqAUH8CXXADmxDFd+JeY23rvX87s=,tag:5U9+Bro3+KHa8hhu7f6J7g==,type:str]",
"name": "ENC[AES256_GCM,data:CZpsNo8Hgzu5MS0M1ooSbc8P,iv:acAX1eKmCGbXGn3sRJa6eVaUSHsvONIVnN0qSL33Ixc=,tag:vuCDA7P34+SgIE4saoufxg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:wQDdFrYB,iv:1Q9EXyMSgCUghPuz1YJBiafaHMgwMLhoweX/jFe8Ub8=,tag:9SSJAsd9GSNrPrNvFrNMdw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:Xw==,iv:zD2fhdNacb8zX6k6ZPYWNGbun1nBvI6rHigJmqvPuvE=,tag:5qcQhWhVBNfEnRgCaI7vDg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:WS3X83tYRD+XtbxrytGC,iv:Oq9n4vLtvjUzh3Y5RhANz9w9vTmP68XEGspVXkhjkho=,tag:EdBeXnUfoc9Knjxtxcw3Cg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:Gv8hcLcE8Gc=,iv:FTILC3lL6b2Pifq8zjiFwE+at2SU+Ib9DKAW9Y91dKA=,tag:c7VXPsZNGDEA0dcuFyvxIw==,type:str]",
"value": "ENC[AES256_GCM,data:WQIdI4Bm/vxvteZbBTKdnt4tiq4v,iv:FKIJNESixppJaGdlgBow1OcwaO5OkRwUZjYSLOx6UXs=,tag:Pb7+dGfh2GXTaYrAxhDZnw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:lw==,iv:oW3Lp0RBAfGGOHA7ugfHZvV2P7OsggrbGarya9Lc3Wo=,tag:gfFIoXouBLkdMwjt/HAatg==,type:float]",
"private": "ENC[AES256_GCM,data:QYQHnts3RPs=,iv:uZXV+vqO5NRaJY/iCtZ2fm3pmMsk7m8dLtO+RY++7z0=,tag:rUSkgYiXcXUiuh9u0PKmcA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Fex93wk2yiQhQ+KhcrLcSi9ogcmh0C6+q3yN/j4=,iv:iGHQ/9hssGUjGdWDCN6cwhbXyLkX6LCcfNAAC4tfZso=,tag:9wwALkqO8bF1mLr+P0TA7A==,type:str]",
"ENC[AES256_GCM,data:/tIdWtwIlvx1bPezADbdN1XH,iv:SExQiWC98SZ+uKxESVn2d1gyau8L+zVP3CUdxLYF21E=,tag:Tjev28xMOXF4vQVAbku+GQ==,type:str]",
"ENC[AES256_GCM,data:/ZxMQ/64sQFIy8hzCxAyUwDLmORqiO9mj58=,iv:Qhq33t22Xsovioe9EiYADEcbF4K64zejLpOKVYOeXtQ=,tag:dbZMa2DC9DjYpSCWint2fg==,type:str]",
"ENC[AES256_GCM,data:b9z4LDND6QrB7H/UTUgaCXLrIDyRIfgGtrTE+19YDADhEuRUGGkI85F2URwWzJkCeUHM,iv:8QW84veZYbBNqLyPTrwgHATh+nFjT6SgHiopzvwpFr4=,tag:kaSp10bzuNa1WQEYxi3kWg==,type:str]",
"ENC[AES256_GCM,data:79r/s4iFadVz/jJOE4pPTudSZwY=,iv:axmmqakUTIsY8Vr4Bje6VweJLLrgi8ArlvL+2Rkh77k=,tag:8JjM13NseQkUhuIlPmrjxQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:Mk5Lpl9tng==,iv:Ivs2kuYJY1a1PFKUOnSpSB0kHC+7THBgReUlf9NUhEA=,tag:CNII441CLhyDMkVFE51kAQ==,type:str]",
"type": "ENC[AES256_GCM,data:ch5XFtlQzRh71qVdjpT9VAnjoCxw65gV0Hapk+qG+9qNojEJSjgdt2o=,iv:H+ll3cEzUrSoc8fSjGpiAg+cxON3igwVdF5py3nNzM4=,tag:f28IeKtiua6K2/QYiftyAg==,type:str]",
"name": "ENC[AES256_GCM,data:ecQ+3xRUqXAuOA==,iv:yTFRB0l7PCxBnC98761EuKIPpD26lm3m1oZWfD2hBHs=,tag:iKmcH9vC8Qn8GntXWTTAiw==,type:str]",
"provider": "ENC[AES256_GCM,data:U1aTuA2PhIiIJCEFZt8D3xsg4Ld9CluDhVChcdH+lwNjHnA8iNwsrbilknP/2dmVHg==,iv:B7gxiB90BE83jX1zSMR4ZCmc+zvutDeD56wwRgYAUoU=,tag:VKgMfTYatSx6+pZ9YVoZmQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:TA==,iv:l1cztd8RSS7L78zP3X4LLSet3CLUyzzCEyZnhIbiatM=,tag:fux4DiDNoe/A38HKAxeW+w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:l6PwmUW4ewc=,iv:Cg0HF8Ih4maU057RYWGwK/59wlr+cmzUxOXI+0v0Ukw=,tag:bbEe7PCILoFR7g4MKP+izA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:D7yLkiFqa4A=,iv:sna6/63dyM6CWTQOre15eDwK5nBgYiy4CjCAHHsCAtk=,tag:7DcIHRqRcY1IyXwQ7bfCYQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:YhmnQfDnsYerNQ==,iv:zIfJT6AFKyXmoYz3ZR+Uwt7u/WZuiVrtvTTvWHaeQdk=,tag:ou3DyE7LA6mXzEceHocs/Q==,type:str]",
"id": "ENC[AES256_GCM,data:OY1y5xsRWa+NU3HRiYD3WQKHEnpFrjfDFThWan9Tn8M=,iv:1Q2NA0u5znIRDC1U4rwWYxABxwMfrFAV3g8n+S7RXbo=,tag:PEJbkIpk4DYF1E9/Hu8X1Q==,type:str]",
"name": "ENC[AES256_GCM,data:ckwUuP2uMijONg==,iv:X/byOvsbQjRkRVBmcr8XoDzQPsxtQ1lXPtj/9EFtmj8=,tag:pGEuxCZERraRxiMcF46DEg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:eJT5v7JV,iv:m3xhrGH9NxORHXFPump8gkmMMQRk1P8fQcRUtIySTzc=,tag:6EIVYho9zoUjCqMmtxqxaA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:8g==,iv:QZVG39wPxVahLNGtqs11YG+deijM5bnCGIV4ATW+y48=,tag:j0sjCXWlkeR11vo7YtkfMw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:dit8m+FS6Q==,iv:PCqG0TWJTSgP5FJVKQ08C2PCnintXq6QvY7mW85zCws=,tag:ugNNc/aAV73iGiVc+C+QmQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:+NtYac37WPg=,iv:O9glezvH6apHz2pw9qi097RSZrQx3NnxhJWwFviFGBI=,tag:QHD1BG6lhig3RTtLLuvNOA==,type:str]",
"value": "ENC[AES256_GCM,data:ZPrgzmRsjhSG6MGauU2ZqUqV5Qd8,iv:w/tWIAnPPk50jGrhOHAAZr8uO+SYWGTCSedrMf1fK9k=,tag:9EkaMO7NUfwNPEndEx9L+w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:VQ==,iv:kLlLsKXuQeMKikIqHVr74qasynIEnZxOBD2jqm7CnHI=,tag:PNzn/5XhpdIX6Pw3wO2/EQ==,type:float]",
"private": "ENC[AES256_GCM,data:1ITEy2+0wLY=,iv:TVxzAYSfgeAJJ9/k3AulxVRMwAyb3W9GEuB1XlM0FX0=,tag:YJJ6d+H8jnkoe09O/eDN5A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:RKX59rxpx4BfScewwKex0fvNVgpKNw7Z6/I/kaM=,iv:yQEOc4FoP68hedOsLxlkfEmprlpqb9m8BJqf5dxe9fE=,tag:RTZ09DgV2cZZtetUZq6eVQ==,type:str]",
"ENC[AES256_GCM,data:yAnEex1vJYa8LvwkfkxAir77,iv:wqCpOwIXpRyEKgUSClrTYtVwEWzSQQhx/+UhWEmH6rc=,tag:zB+gMqVkLWXDT/KNPFqf6g==,type:str]",
"ENC[AES256_GCM,data:w1DSm9W8I+eAtC52lGVoCcLpABdyePCVZwc=,iv:T7Dqr26DpJ3sau+KGcw+OFoWZC/zalxM2MA9nG/dRYA=,tag:rKefhnk2Mg5yxHirKrf8ew==,type:str]",
"ENC[AES256_GCM,data:Flzawr/x/ySgxex449r1YBAtSLsSq7A8j+T3onCFRWfn4wTZYYwttDSpTRAG1qI7fp8L,iv:qpUyFOd/G/htEtrW9/aN22WtfwzS17gTg6wBpKUEmGw=,tag:dSsrf69RWbIPWrRsQ6XxiA==,type:str]",
"ENC[AES256_GCM,data:hEweqpOpfCHkohDNWMZTmWRg81A=,iv:uxHEZt5aS++e0MOFAzO5ewm109DEdO355Yb6mvOr3SQ=,tag:sf5F5NhELlmE9EdOPHurpA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:SYSpPf1LxA==,iv:x0c2c9LEoRqKWXyJOlxxfspqM/Ax/0zzNZds5ViaPEg=,tag:HH4VVmdH6nsObEcE/Mx7Xg==,type:str]",
"type": "ENC[AES256_GCM,data:pnxefyESC6gzgT9Dbr4wXLk4xz2BR1H3nucPZLMTB45OkJGmlJ6pfZw=,iv:jeqUttKljvVL7x+jUl9yCwCEtp9IkcVJojkPPd3AMD0=,tag:UvDI4/hkSV3yWYXOSD+HFA==,type:str]",
"name": "ENC[AES256_GCM,data:WC1esVZOJiwN,iv:UnsHpy8NcXViAanTa8BtEx22UQqlZ2umGouNYzLVNvs=,tag:uldmGuVAMLtMBvPz92kmiw==,type:str]",
"provider": "ENC[AES256_GCM,data:4hALGJLO+whJZeNWJghukxoxvW1xaSDlzDmh7KWdJcNkefSgVNg+OdxSoD8SzGXSgg==,iv:pF+ZuN/YPl3Ve3Zo/2GTplD09S6LN+QKHAYSy9heNjw=,tag:83791YbvIjrovHKPn7FIMQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:2A==,iv:EKHPlr2eE1qL1nNSMcrcn/l3aTuK8lakiGR9xKQK98w=,tag:DlknkIa6GpTpt8xiUFiN+Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:JDklQW448sM=,iv:KcdnMgbqL+CI9ibaH/3rzOl5mNO5XkNnrb8DCTH8xWU=,tag:o2s6nHSr3FZt+s7ZAKcALA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:LeTQypf5Jxk=,iv:Bcw74m/hpKDnK6iapR5q3IXyYWd82H024yk+W7Tn3w8=,tag:wlKrAfirO+Gz4iwHJCNHJQ==,type:str]",
"db_name": "ENC[AES256_GCM,data:Wwkgobajt5yMYg==,iv:yryzZWAg7xRHsXENkaSce3xJBkTssanNJ4fE/nyHNVc=,tag:W9UwzM/8TEPvZO62wfyC7A==,type:str]",
"id": "ENC[AES256_GCM,data:UgfOI3ru/oTFahm66XQ0yqCTKftYV1R0KGBCiSaAoQ==,iv:u/ce9lMV9Coo79CmYrEMbzyIHY1VqLMDwIseHoLPzsg=,tag:ziuceVX5mZz/OoiCI/rJRQ==,type:str]",
"name": "ENC[AES256_GCM,data:gN8Pp3pTPKBo,iv:Yrz/bxi3w5MnOYH8jDJRrGDAA5rINMOH+YA016hI8dY=,tag:aM09JajfjTd5bUZLpZuhyw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:JRQUoGLQ,iv:lbyaASlZUNCEIuUjmMDwJHAdNV2Li67SOu/0AE9KO2w=,tag:h4A2xMrsrlR2Yvkt1qnZeA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:ZQ==,iv:p0aDdT3ldRu7tfmG10Hu4t63KgF4OCB+yBl7dsFD8Fo=,tag:OHeR8++JqHbI0P5/VJ5RGw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:BQeOZ7db,iv:WJ9nXwJnMvEn8liXSY6rI+sRY6KU3Lh2nRZweh9Fal0=,tag:tITwbooV3u+bquZ8ROS6jw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:4v+9u9YNuWI=,iv:JYyRf3QPW6ygejmHIIDqCN66sOnZVy8LAFJKQwEhb2I=,tag:aaat7V21T41wJC0ezIQN6Q==,type:str]",
"value": "ENC[AES256_GCM,data:keS6r/ppZZwHQmJ02yFN/LrjdaiD,iv:KjEFCmautAmP4o4T6T519lXOG4gp1EvRWGKtEunyKqI=,tag:y2+mjQAampfuHQnBLPMFoQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:nw==,iv:u4kmoN6yQ3iy37M+fg8quNFt62DFjHowAfiuaCKACD0=,tag:kI15CbgJCpoTksXsXaG63Q==,type:float]",
"private": "ENC[AES256_GCM,data:ain/8xORpoo=,iv:BBsBKOy8NAjLO6Cyc+z2CG5+qgoW6gphdGueF49MP8A=,tag:Nv63MBGqMkF2C5H5YRPEGQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:60TuaJi0dc6g4qMI2TChqbRa1xZjgbcLrQq6xXY=,iv:eCrcuH5ILmTBpg+rBlizWVPtS8GMf41ZMzEK3ZfsiuM=,tag:jnt4ms/KOt1F2M/p0KJn9A==,type:str]",
"ENC[AES256_GCM,data:WVEas1JmwzE6kZ2QQsACSREJ,iv:l6sKsOO72BgZ+b8pUyqpC6+2utqxDKOVAyUaUyib1Nk=,tag:ARmVujPmAfNMs+dhITK/vQ==,type:str]",
"ENC[AES256_GCM,data:0WZwSxkSwcQHld2tAKLYoTAVs9wGF0hpLDY=,iv:0WQEIMIyjRV2eeoq9RtyPMEKvuJ8p3XOI3xpD3OzmJE=,tag:EEo/6kFslB8tGp2l/B77jA==,type:str]",
"ENC[AES256_GCM,data:mNm11VKaxmpfQ0ZJYjpAgLibsmc+Z3pgxbabPtoXq7FLRFv4nOUXm0tD8+PrJUw/oO6D,iv:bfGDjhGEWg+7+Lzkklci2LqsRLYzZQwrXvcYDOAfxtI=,tag:VA71n/rYByLZrpwxAXjl3Q==,type:str]",
"ENC[AES256_GCM,data:XuuCvMyIvrE45+76SrUqdKbIyHA=,iv:03Lqd0cS4u4HVywKWg3yTJQn8Gjs3UndQlK+vtfX8Lo=,tag:kGvwj3I4mA4OIApmRLYwXQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:JoYRneBU/A==,iv:UDEdjV6zAshf5G+IT8AIZ4u9p9LKYeKvnecgZWsMPHE=,tag:7N1WxWLC7XQJ/J9yAjDNrQ==,type:str]",
"type": "ENC[AES256_GCM,data:6kRzaHvGG7SOsxCSsl70wrtOJFlHT8i8NrIdaeI9dwkMCOVa+TQAzcY=,iv:Glll5XpjLzfKdw0jMPi0z4gHbReksKFl3WHqjXcNPJI=,tag:6pzFbkFlNLR1fROM3tl93g==,type:str]",
"name": "ENC[AES256_GCM,data:DRK4WTMp+kFKw5Gb/SO0shwVkg==,iv:ENlUyodhLnN9aLS2JdyzPFLpRjSPuQy/W//zCF4FjlA=,tag:463jYhfHTvWF6yYOmRb/1A==,type:str]",
"provider": "ENC[AES256_GCM,data:VCs5JWAPy4cf71yT84S/0pksKTuc3Fdj9VrhktvN5IyBQ9JET+ZPzPeKW6NJ1a0/lg==,iv:dtevaAM42Qv0FHWlDewAxVRyjimn2+LQpTGShaqIfRc=,tag:tewlQmU0zxA6/BOokOJbVw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:4g==,iv:WFgLLZE9yBi3f5Dfli/UoMhhIV8axyJgc7vGs87gA7A=,tag:PNcF6jYIb5ESybbG4HZQTQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:JEYQjmhNVQM=,iv:c+Zmk6g5/fh79K43fBeNO3MvVGt6W74VOjJ1pBB3Cog=,tag:WzGF2e9R3nKnU5cRRvh9sQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:lECK05u/K/A=,iv:kyrACxNoTK9D2u7zWF1Xpt7T05jXbGUEM+4BcBkVfIo=,tag:esUMAT5nM01vdwv//3MMkg==,type:str]",
"db_name": "ENC[AES256_GCM,data:013E/+MqBTAYZA==,iv:i48PKSrZJ4kcBMMnzI9L8fM/TZY3CAa6ZkVPekVvjj4=,tag:daBS80QwNWz1EYNnJ7Jy9w==,type:str]",
"id": "ENC[AES256_GCM,data:PIPI5YXo0snKcranEVybgPmjD5VEKh0COAwAJamh0+HZfaRXYbRHuv8=,iv:nwItjceQcRz2psrYLWxsS/uNAmaF7PCbkCYQHCgYvjY=,tag:IdqmMWNOAhxbTEIb1B5vcw==,type:str]",
"name": "ENC[AES256_GCM,data:bS2R3QxVmVuJZE1ZT5CKSNEQ3A==,iv:NCqUrVi87fbKmJTt00Oo41VsXmVpJk2goh/woDtewZQ=,tag:FbwHQSs/m8ZnSZMWUPiprA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:fz6MTT3w,iv:DyJM5E+VPSjxPN4QN1xYToQGt1z9rSVPrb7FyU2UxPQ=,tag:DkZdjBccb8M/rFI2BjmzGw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:mA==,iv:ZgJw0zvfj8cjtuwN8tlNRie/sTZjTbFM3HzF2yXXg+o=,tag:73h91/bbqJkVegaEzYEG4w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:BQ0+zlYM/CL1OTFtipIj1A==,iv:86120BVUULKDze4QlKij7KJ7U9wmZKPANfqlGwZ9rxQ=,tag:mMbJ7xOw/3In7YaN7g3E2w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:yk4+oNeGSRU=,iv:MxaK+qL3wx31krDybd++amoGM6iMAkr77+/fFUwJ1OE=,tag:i9qbJYTvouDDFB8vFij6WA==,type:str]",
"value": "ENC[AES256_GCM,data:y9HXSIUIhA3wJ7XNPgpFUIY4iezK,iv:tj+CTXG6my18LaHMeM4N5vmQbCCRH+DrEtoEyNpPB4I=,tag:lRLx/cOcxysvH0+oTJX/kA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:yg==,iv:tnPQp4T0ZACoQN2K4P1ZllK59cbb9XgFUBnpnB2zutw=,tag:Q9ukHqW4pTjG0fPyDJM4/w==,type:float]",
"private": "ENC[AES256_GCM,data:whKuCzCgTaA=,iv:4x+uao2KUcA5lVVPVbYECrz72AalTwJDFcnWC1n5NIQ=,tag:ZWotj1C3E6HFsp+U/a0zdA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:F+kQad33opQk0OuhV7AfTSpXm835DYcafLhQx3o=,iv:vxkAlWWURBsPG0xnVLYwmaltcGNJvBqz2sfcg2dJ6Yg=,tag:afMfkfe+CcnXGYzXHrYopw==,type:str]",
"ENC[AES256_GCM,data:oDrS8PGdrpqYqUMIUWpO1sVZ,iv:rIZQK4sulyooS9X4atz5+Gv+yLaDpkyi7jQYTYlbVkQ=,tag:x0r4KiEz5wDIZv92NRhMkg==,type:str]",
"ENC[AES256_GCM,data:tdIkZmyMi7ZIERwC3fz3WrfkjjLbzfNOysg=,iv:vToMAXuDfIxlKhsvwDYiNgecXAc8DdCEh9YxJhZ7L3c=,tag:TLbLHixV1+6Af7wRKlht4g==,type:str]",
"ENC[AES256_GCM,data:L0y1ZqGyoG8p401tJUBQ5+zDSmO7Q+a21zl61BgCOXAkW7kS2rf5XNz+31yXcSjn9Dv3,iv:6Cm2TzTW2mENsaZS47w9bv1HKDUaK9kD9Fw/2XRUwdo=,tag:xp0KuSwPFJOj7eo5NOx+6w==,type:str]",
"ENC[AES256_GCM,data:7l+ldtwyrx46ePE6K935dUks8jE=,iv:UsNx9hddCpAGi+NST/aA0W1ZhJ4MKauAfVxuxU0RCfQ=,tag:NJwAjtBS4wclLQugOL0VwQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:dzryo7U8Mw==,iv:JDANRzlxC1p3p9hYZ6wV0/w+Hts/jFx3hujUf5WFh/w=,tag:+0kvbG6g/8OLyefZXeS33A==,type:str]",
"type": "ENC[AES256_GCM,data:KxC+51CUXV2OD1yk2whUuHC0I8XUCWB9IinGCJ23t5+Y9UnXuxXVKpE=,iv:IfktKLhhzAGTzhC7YUknpnSStRm/tH3LLvLCp2xYdhE=,tag:/37uYok7jI/geHoVh1iLZQ==,type:str]",
"name": "ENC[AES256_GCM,data:stlpH5qleba78PMIFw==,iv:0+6xjWIsyKnDFh3zlBTy17UPNndUFQShxN3zpXBRVU4=,tag:66l3byhYMgIkaTArW9QnUw==,type:str]",
"provider": "ENC[AES256_GCM,data:YNXmXnR6zrxTxuuALHf8feCRzm6jiK39JI/CxabE/IbkGSej+EgsKdTx+ww6/vJ3+g==,iv:Lk+mRH3Gpfeffgv2PmxxNCq5gTdhhw7fEUqy49ksUcQ=,tag:tz4gFq7ugSJNDh/Jm+HZyA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:mA==,iv:B2oBlGpqPkjGNbRWFzU6slFu9dEiJFPBVUP8/F6Ifb0=,tag:/INslc3cJ2EMNRGae2SjQQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:/K98Ri6LRNI=,iv:A+MCplvsCXyUzfjnenmHS5ZzrxEnuR7z2/bRMlMaZiw=,tag:IEvWhbjl8nYzATnWhG+m2Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"credential_config": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"credential_type": "ENC[AES256_GCM,data:XfoSvwTL+ig=,iv:RhcwMYGiEX7cpUBQJE4//lEQctnLoTZmncuUmVDG5Jo=,tag:i/r5o5FCHWaGp3RWtTbcag==,type:str]",
"db_name": "ENC[AES256_GCM,data:fekXADELcQP0KA==,iv:7ZZCcFeWZM3DnqyXXOSz6tKpRTrw+1MfzRwBFUSTye8=,tag:xfvdVLTJ0rXRu6ImoLfIpQ==,type:str]",
"id": "ENC[AES256_GCM,data:xDzOUv95Hl6dt5/VvRvqYA694Pn5aqQSi0Ir/cyy7SVdVsU=,iv:ZnKxMJLK8QO2zPAsxU/9Yc1J4I2uvse2vtOfCF8afYA=,tag:mHL2viRomR2iiaBBvFiQ8g==,type:str]",
"name": "ENC[AES256_GCM,data:9W9NapG49WCpNNRjXQ==,iv:HABJO2KHKyY37F3aM+Y29yjBdSCnVBB+kRo6Wec19cc=,tag:L9JHPJJmvbHNs0mXr96/ug==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_period": "ENC[AES256_GCM,data:x6+29y08,iv:S/Ey77KVlLFh2o0qt8NKAynCfGyPqB7WeTNNHurk7X8=,tag:SC9WHV4H8El1rJgCWubPVg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rotation_schedule": "",
"rotation_statements": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"rotation_window": "ENC[AES256_GCM,data:CQ==,iv:WsvExzQ7pk0jt8w0lXlcwAlUSh+sNRFSWvdw5xiY6Xw=,tag:BpdEgvIcXxcMMDAjPRfCdA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"self_managed_password": null,
"skip_import_rotation": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"username": "ENC[AES256_GCM,data:PtXALjZRci5VpQ==,iv:D5MQb5bPlPTiMxHhIGFvrTKk/5ljWSf454sxom0D68E=,tag:98aMSTyBvO1GXDyq0CA+Ew==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:9M+RYkrNNps=,iv:31NcnTTp2f/PlXRm6FGJ1qymlPL5Zmn87RUbkU6/a1o=,tag:gdyu3u3Gx/TR7B2B30JVXQ==,type:str]",
"value": "ENC[AES256_GCM,data:0FQMQLRWmrDLz/1uEIWcj+ll3ZJi,iv:mKCPGf/R3KPgf807T1CNgWMKag+hWuqLKorPQ8faYCU=,tag:iut8AYTzDMB3w/15qIYEBA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:4g==,iv:Jgo/d44ESzRWpLv6fI/YuK7EA2h60j0X76OHOCQLFlE=,tag:LKelLxwJD7VKS8rg/TbGxg==,type:float]",
"private": "ENC[AES256_GCM,data:ACZ0xdWREoE=,iv:7KuZZivN08enlTTG5tpEy9u9iCQIRgnz4si7fMwoAMc=,tag:KZ5eXDvlUysr1prrngO9AA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:jUL8I7aKevn/uE3TooQ5DwjoUGCrnoDi7Q6qqbI=,iv:cGkhQh6eWbCTi3QOixfjN3fg8FeYfbYzh+A6E9iYOHQ=,tag:kOZwELVHflEDvpzUJSGH3g==,type:str]",
"ENC[AES256_GCM,data:Lq9ZTBnOSZOLnxDrxawlWJKa,iv:lUPdTh4lJVTXtJ8C63kv/V3Yxqi/eV/uhidWRUpdcAA=,tag:C/8/7ZD0oa43+zuaXGoDNg==,type:str]",
"ENC[AES256_GCM,data:U/zwZTN05UFCrYCFGV3/Z10Vq7IupDBXbfM=,iv:T1VZTQpBdmtyjbUW1KFu3r/hGDi2/eJq6OwhV4JUvGY=,tag:SCLIHFWuXB9kjNSWcX5+dQ==,type:str]",
"ENC[AES256_GCM,data:Ures+Jd3RgcGwLlJxIK9j8r+7fgTPWtlOjdB57ZFJ3Akq9QfYJC/sgkaTjWdLleas9+/,iv:kC7bWBD1hPHP7Eb1pC9grLv4jkqjRxLQO63KsxAmCW0=,tag:dVMaRofCKjvnPjHb2cJ52Q==,type:str]",
"ENC[AES256_GCM,data:FmMVnUmKqrYuzIlfgp4lvxM8DJg=,iv:LA5aSqDz2Vqa70RS+j07ykYwN+yrgJLcmhYgbh8aJXY=,tag:dWdmkINoJ1j+b5wf4Bu8Lw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:Py/4F4otIw==,iv:1NgGlMn83TEXfzU7n9X7Km0U9X1dDT4SydEJqbJuO80=,tag:OifUKODoOg87CEZNLDItRA==,type:str]",
"type": "ENC[AES256_GCM,data:OOWo0mgkUDRhhwsQS9kUXHKOSaAN,iv:8/WqYrHewRlwGCBJ6Ku0wjmy2ijTA0tuyDqcqG3s0c4=,tag:O9ExkcnO473Drd/etnkwxQ==,type:str]",
"name": "ENC[AES256_GCM,data:+ab6fX4bbgfYKF1UbCvY,iv:De2kA5/FOBewcDp+xSeH91izFsGtz0+eHOC6ZKslbyU=,tag:ljHMwvX9kMxnLiRqKylyYA==,type:str]",
"provider": "ENC[AES256_GCM,data:B4LucgyvP/U2ZQ+ghKJ8ZNakd/saw04IPXqYwIRIBnJVVlsbLF6NkQsaHiM/tKryog==,iv:rguijOgS+ZvtwSFu4xdupo00afz5XAqRWUJxBD7KnOs=,tag:sVMzM8U5HkbKlQx1EW/piw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:esbonA==,iv:/RvIZrX25UERS9LP9eqnZtbvfIFSL0U1ZjVYcWkbxgY=,tag:njunRusXkruwkEVHmokKcQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:5g==,iv:wtyafWycXivHsikbv77mL5RJo1xd5cnGEOgRPAsS27E=,tag:1dYZqrSzQyJ2mtY8LXrltA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disabled": "ENC[AES256_GCM,data:u57sy0A=,iv:XW6iygsFYBsgRPC21yTuxI89DFAcbLcpgfhwhMGMyzg=,tag:TJ9U+YrvDVusS0LCFQ8MoQ==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"external_policies": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:o70cIv1aVavw5jFiSA2jqEj3qqfk0M4r+WReHFyhReEdEAG6,iv:KUH59gSbmbERKt50rf+Kxd1kqC0tVlhX1kwuAreQRJM=,tag:d0hPNMkNjApCykGg97dFpQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:ust81g==,iv:2l34aNwIkZN54Lqh965tOfi/GxePql5nEynRGnvg0kY=,tag:VtQqp3UOoavVeLFEeQB0ig==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:qtZXHVoNsB5fSxvhaCWY75sjuBU=,iv:cekY2UvIhSmSr1bTg3qHtmZcFmbtJbJezvlpOg9Pt5w=,tag:NARjY9D2U/iuP6CYej8P4A==,type:str]",
"ENC[AES256_GCM,data:OYlbHrMyYDHrLsMaFM0=,iv:Akx8lcBrGhbN8oixtrPo5Zsr7OCO+urD7e8R785sK18=,tag:s5+riWTa3J6atNA8Kcu92g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:DQ==,iv:Yh1jEiUtO9d/rNeD0csFl8e3oL/6f5r3MonytpdYJ1s=,tag:/TBnguhBxrO4/gBRbT2UJQ==,type:float]",
"private": "ENC[AES256_GCM,data:8BLXgWURjWRFg2hsNV78IxTqcUhbbE1oYpeeDdw17zU=,iv:eGOpmtPqw3rqzLFKGYeSsT5hlVpTPNJLCeLjitftqBw=,tag:1fzV16xoYJsaWJBcRFZeXQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:JQNdYvbCiQtltsH+2/I0xwQbzo7+gJoyC+rRmh+emUM=,iv:ajJ1kDp1q+dl6XEoXwV+oVKPlYL9G4kVG+VIx3IFd1c=,tag:8Fe0E68Bt23aO03jClgCaQ==,type:str]",
"ENC[AES256_GCM,data:Vxt5DIPgEp8+vRXNUzfVCvTt,iv:da/1i4h3dD9mEwCh+XtskpuJeK/vx3PTt7ZE4DFd0MQ=,tag:aCscjnGbmzn0/coFF34RSQ==,type:str]",
"ENC[AES256_GCM,data:mABRJp0E2zLiZ8aULlBafVFzUNmHOviLEls=,iv:t3/t//KbC7dEWG158zjcY4YBrdAN4kTj3cY9ovX6Lho=,tag:AwdkLuYvkI8Ts68tWfRMkg==,type:str]",
"ENC[AES256_GCM,data:dhKURfGccIXe4vlIuqVc9mAhuSawBCryHINPyg==,iv:u3QMJ1Up/TOi31o/DxX7gxI+eb8AyYO8YHBxLIIsQBU=,tag:6F9/dTqtgSpWnnZUqqY5sw==,type:str]",
"ENC[AES256_GCM,data:TxqrXL4eH4yxppi7hk+43OYHzfRtaw==,iv:pQjcM//nR5igkaYseW4Hl2LfXVCZUM8ziUbpU02YaXA=,tag:KOdWdafGm4ub2+K1AZI/GQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:kgVRNilfzcc=,iv:jJ+u9v1xYmcQVCBLA1DU19EaIjBuuur1xsO1w3UX5qw=,tag:sPF5fBwIxtzsJ2AKNpvM+g==,type:str]",
"schema_version": "ENC[AES256_GCM,data:mg==,iv:WKyjaFE8nZ68D4Q73MJbQ6qqkM7Dy/jm1Dj03AiK/0o=,tag:dDNG3k/wnQrw+9YkZsT6RQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disabled": "ENC[AES256_GCM,data:T3FB2k0=,iv:p5+jPjpoN6JKC0eJmcbLf7arxl+aZWxa77PVO0i3oiY=,tag:J21V9xO1qg5so0tIb3zokg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"external_policies": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:wItIgJxikZI0xPaqjVXXbzBxrahLyPvS2KoWoUXy9jIwPiVX,iv:/fT7GvrKwhN+atwUIn/vW3ZgKH/HPgQcT+UCKwLIk94=,tag:hqLnIzbaXZ5LZtwkhyhAjA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:XSd48BV2riw=,iv:kOFsscc4npR0w2TNBkawxMAPEoxGcce2QHB+5z0VJwM=,tag:FAIFzz5tpDo680QL8RY6cg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:NEZbarUYwI7d0Nb5kPrurfkZETrEqdEs,iv:R26/wSWPN0OI0JS1evSk/FbO+a8gZpZ1s+zGhH8mVo0=,tag://7Se/x38p2hFYfrzGO97g==,type:str]",
"ENC[AES256_GCM,data:mipdl2E2JEQJ+XFSms7g2VoP,iv:SfLRNsTevIxtycBjdy+Xyxi52ZIM3J4Y5xLNfa0yGTs=,tag:r4V7GRzFYwemi4v8xiK5yw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Ag==,iv:8Ni3ZrgUtWUfm1nw0vat00oStsMdfhXHvi7Y6GHEjVw=,tag:kRkYFBMU6S2EyAxoEO5Z8w==,type:float]",
"private": "ENC[AES256_GCM,data:Zvsqo6tF6fWHOPpPOLq4zUl1vPEYvcdTbZYM5x0rYkY=,iv:0/KXu8BAygqOWg9uHXiP1f1qLG1HeN7Dmb0K3i7pTBY=,tag:Rg1MGd7ambKcHqm5l6kLkg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Ih5trulPQPugNg1Sct3xCiDEttOm43lC9ADuaiEQZv0=,iv:yc3KiP/oXTCIRZ8SvyW40ib5yvjDA5j4iVQjSaC9DHk=,tag:PEwmoejASKMKegnEmz4XdQ==,type:str]",
"ENC[AES256_GCM,data:zXvYok0UKe45E4xC74Qq6tyg,iv:HmT1RsY0Wif5YE1ylGVjJ46QoAdFlozdP/6mw0B1rO8=,tag:tYSiWHALn+ukubwFuv/fDQ==,type:str]",
"ENC[AES256_GCM,data:MQ2n0c5cGsOFGS3P4tzigAEmTH1uTxLxPFs=,iv:Zhu/3crBOsxQvrVIlALghMOF4LK7lQq00lmGsRWia9U=,tag:S6ijF5mKKuRw4PU3dEddFw==,type:str]",
"ENC[AES256_GCM,data:DV2k3ZkdwYw0MyYSXKatj5NCyckC7iXDzSifyw==,iv:Fm+OjJSMDIpo1WlZwp823fCFaUmt/nHwerJJz/pkqBM=,tag:uH7SANehsi1iVtZHZ+4zuQ==,type:str]",
"ENC[AES256_GCM,data:Zc3CwnBGwraX5LQFvjBJ2e4lS8R8wQ==,iv:6HO4mHaDAK1aNSCqKq6fVv1txPsQJHaXxeZXcqLNu+Y=,tag:meUt7qh+c1p0oUNQYmEqIw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:/mn5ToyKHA==,iv:/sC2NLlf/+5k30gDJZlbNLk9nTWR8NyzFykob73R2F8=,tag:o1j7hF32IU4fuDWOGxnfVQ==,type:str]",
"type": "ENC[AES256_GCM,data:PANLCvFRqV3H7qOKskvEBA4v5RmY4Ms/La55,iv:m+kIDPqhmFKOtHyPrwFsnBwodbViuOw0rk5rVEURaCM=,tag:mBFbnygHwKT+ziMTg1/mrA==,type:str]",
"name": "ENC[AES256_GCM,data:K8W9/ZN9nITCzI+3D/4V,iv:Istyu9Xu1ydMph5uK7mGTld8P9MalrHnG4mlyCS21Yk=,tag:6+V1OA2Gttq93RFGMGD06A==,type:str]",
"provider": "ENC[AES256_GCM,data:VqdIgkRvwHvRl6D4JP7SQ+7G13O1ZWRk7zD3XCvANyb3XvL50kOy45oV+AzFVl9Kiw==,iv:UlxOYE54F8Lk7sgYuOT/e2Wp7BOGB7wDrKX9AsjQLnU=,tag:iZswwykjP3PXox6IpNsksA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:/S9j9Q==,iv:vTp9q8uZ91DC9m9dITHMQu98Mf57d7hHa4E1WtVYEGk=,tag:CGAGvVlkfsTfTNjBXvS6IQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:UQ==,iv:wyri+PUGrxL8VMUJeVZYEnBXKSfx2jfmU7kFE/9911Q=,tag:0tj8M0vPNJP7NUe+4ciXEw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"canonical_id": "ENC[AES256_GCM,data:IHVPVzcMeHsF8kOhGfL9qZh7vBs6YiKmrLSwUtPsRFIgQ2+S,iv:LBbc3elqeavEswpT7yj/jJICufXbGMAQSTGIr3A9bhg=,tag:wuL5fCeqqMwSkntznGTlCQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"custom_metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:OhZ3eNHuMAp90qtmGQ+Ry+5d8qEspDRtB9yqeNuKToel3X1X,iv:mY1Cc+YzmEyS94zXSlS2/fg8GbJTP/0J/yL0MWFpWX4=,tag:2d6NZn2vH8K1l3wbwZOJxw==,type:str]",
"mount_accessor": "ENC[AES256_GCM,data:dceVYlinwx0C2YyUDihFDP0d,iv:oAhJV3JRxUb8yNYxi1vxsulY/3jKJF38Med/42/8LKE=,tag:LTvXpRiSFcJfv7ID3q/6pw==,type:str]",
"name": "ENC[AES256_GCM,data:eTShFDTfa4mPsCDaXPNu1gXDW2s0,iv:v9y6/TP19gB6l1c9L9vfmXq/zCIwn7/sirROSRrw4dY=,tag:QsNqeMNcSyG4fMHK6/+nJw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:BA==,iv:XoE5UuO4Ijleup2xrVRUddekiH3+aUFcrzruWXKS6mE=,tag:1PJkq64sbPOYlFybgxU4+Q==,type:float]",
"private": "ENC[AES256_GCM,data:I5RJdGuDPNhHg8+EO2Vf7t6WSMvDJLb2OCqEVUSMRdw=,iv:pGsDLjAxLXtQj7Sk5zgXjuybdMngkNid5WZvWAsWJlk=,tag:nfYhCjLwe7//2P0gyJHBDA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:01fIxRGsyEIts1uEHt1tJI5kk6/pu6rLXeA3UMGuqwQ=,iv:x4X7JsnjeQimFsKH3gjVo4+C4QQeTN1TSQKfeR7RI7I=,tag:jnRzyVdiVwAD6c0QzfkLig==,type:str]",
"ENC[AES256_GCM,data:alg5VEeko7JDB2oduoId1vlmFXu3zCq+10iNktA=,iv:C6erU17VgHU/mx6KBGCuR4SvSvBZAIkxkb/0ucQWwxE=,tag:N8teTdOdJbuQwguW4NkYoQ==,type:str]",
"ENC[AES256_GCM,data:P6vOSzVAP/4p8ef30nTyWL1h,iv:DSJeuaqzv2+1JX2PHlosM2LbP4UQ5nMFep2m486KEiA=,tag:wipkyu9I07f8KKftI1UobQ==,type:str]",
"ENC[AES256_GCM,data:zYKx+yKaoD7BmuUZie55GD32Q8NkPUffNhE=,iv:hV3KnzvjhQETZNZriDZj7ErHsQWTQv8cNRtDVCokBqI=,tag:aB6N44+SFYPzALWIcARg3w==,type:str]",
"ENC[AES256_GCM,data:/KvgERLUilk1uA2mDavc1asCRt9Xlt448xdB/Arh4bMshj2KDA==,iv:D+yFELb84Z3vWAovGjSTeh2QKiR4JsVPO9XLyXLPBds=,tag:QMMnY+KL1yuwA4lfm55szg==,type:str]",
"ENC[AES256_GCM,data:w0pP0c/mdkb0Td1qcZwPQBSIaDBN222ImKUE,iv:DVS5sE5XZBkGeUY6Zl9ze9dXKWyeK+7X9Gkl+QxPD8A=,tag:l1heGZYFVaM8ij63s2Z1Rg==,type:str]",
"ENC[AES256_GCM,data:PaGXVxbaRF07TZNY+b46ZkFhsKQMi0oXMfXCcg==,iv:/vk+H2HVKg8c8QFqMFyCGX6EIx8V2LfvZ6XmAs4yvEs=,tag:e6tiUSrWv0kiUCgmMAImXw==,type:str]",
"ENC[AES256_GCM,data:OdN6XOI8jeYbMSJQ2mzNPV2S4zAgcQ==,iv:AWuxt7YDEBtPSrabsZcnXmpGkS8waIeIMqs0k4A6u+Y=,tag:Mxfsqnnkv7/0A5zrrjElsw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:9CPlXZJjHmM=,iv:O+AIZmwCn8X2Gprj8+IsIpFH7n5qSSXOXZ/6hvSwxI4=,tag:xXDxImuhSyEeYvtwPi2mrg==,type:str]",
"schema_version": "ENC[AES256_GCM,data:rw==,iv:1O13X6wXsnHO2yOvxev+1jwPoSvrhNoZ+WQOqHljFVg=,tag:QwbhllEY+C+8tK5HtIg9LQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"canonical_id": "ENC[AES256_GCM,data:kLnoOCVMsb8Zcgp6eYeDNLDiKCL7ezaoDMJza+Bde72aGpKT,iv:C2EPHbN5/mMpMicGZkO+advp2Zsjp4LhoJMjgm2vv8E=,tag:nYtgIF7PDp4SwGhrWeZcpQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"custom_metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:FqLT85Z799LFVtWUIkMZ1GCGN2nJS42LWpgrwaY9DO5l0RfG,iv:KCyk2kjF7CSgKCVN31e8LbPTkZbEXF/5aIyaivnvHm8=,tag:fJOJyaNUEtazCUSmeoD+PA==,type:str]",
"mount_accessor": "ENC[AES256_GCM,data:JoY9AXbhMTgypKua7juCulXL,iv:xFs+PCuoNQfRvE1+GM/mPxruwpGM2sOMLHGoMi28PD4=,tag:N2HSH+DIGu64e5Mm0wrhqg==,type:str]",
"name": "ENC[AES256_GCM,data:dT/xSmI7zUWqgxUtFrg6ZZpT,iv:uVyCBQNP1ytl7Oona3jl70y8u4dhKRrPn++hYRvGlEE=,tag:NkUkjBTb0rhmW/FM6qzD9g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:oQ==,iv:46MUQ+21HjNNuQf2UuOcwASzPjYr9I2Ekeb7cxZDvGY=,tag:vWyiwjlJePP6Q0vY5r3azw==,type:float]",
"private": "ENC[AES256_GCM,data:l3veREiUl0k=,iv:rjKumZBYFTLvuz7x2WJ5Fmnx4oX4xXZN3sq9NjTuNII=,tag:D2B7UEt4us0Pbtl6R7yoyQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:XVB/vbGVAqfIXc1FeFamhH5/CI7SlIAtQ2G6fGGwECA=,iv:Gz3fCZvfOmqMu2910oj5m/9ueilrbG/efrFij66sMnU=,tag:BCmFI1ev/sNgzaJ/knumJw==,type:str]",
"ENC[AES256_GCM,data:P21tozTo8U57K5Iz0O76ID+hVyS6gZiyAWwOevE=,iv:gIpYoI+VmDcl4z8iZJdkHcXV70VEN8VJGNtonlGSAgI=,tag:fbIauUpRVcOPJO9QwrWbXA==,type:str]",
"ENC[AES256_GCM,data:LkBQd47PMejfiCzZZbY+XDr7,iv:/P5ZSHLiHD03LxyypigpwnuFk9jdctyWpenJ6P0r1yk=,tag:jRk8DO7zilYEBzYGg2nXLg==,type:str]",
"ENC[AES256_GCM,data:JSOLnSfDJVEEW/uqcY89cqCrw5uwKpu/qhs=,iv:OggcpMNny/uIDgCdl3ggtBFezWTyyispigR/zGUNipk=,tag:D6TwCWflEkSmbKC3cImf1Q==,type:str]",
"ENC[AES256_GCM,data:34Ex2v0dK2B002psUz7MTK819LFgcoJFh8ftgzRrAol9blU0wA==,iv:8MO/o+R7R6wqPfKWX1Lcd6mAxskfn/9D1fTbLpn2+bM=,tag:pyYG+2eYY4MLx/TYuSDF4w==,type:str]",
"ENC[AES256_GCM,data:/gw7gO5up+250F06yD5ukuA1BmP0TP2FICzm,iv:L9iejSNxA6NgJVmuzaxg6hXQfsodiVrXXt+iA6k53eQ=,tag:Tm1KpDHWHfBg6ITRLEhmiw==,type:str]",
"ENC[AES256_GCM,data:C1YDrcZ+ejWDKAi9v8GOmulRKNbNaj5zE9h06g==,iv:8JmDaSxV7ArC3sHMQ0Z4e2saF9tko6evp/kJGqLqow4=,tag:FroW1AN18AHACkVouOEcMw==,type:str]",
"ENC[AES256_GCM,data:J8EzcC4GL8c20at2VZRwjq7cH4BJ8Q==,iv:4mS1T7Rss9+KgdgJemxvT8BFgbCF2cedHpcZIcri5/I=,tag:ms8UFlfXR5ANO58aklK8qg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:hr+lkBOohg==,iv:mcv+wlEVULTTf/lhIxgjDopd2sAtCPN6sr7p7etcjY0=,tag:zlUGclkq09vwSHPSF0Wu6Q==,type:str]",
"type": "ENC[AES256_GCM,data:8CG51oKZ7dRW+Fuo/47+BxKMfgA=,iv:peddkK/AQD4WgDN5rm1Pyz36XGowfymeY3o4uPtJ8bA=,tag:qNCZ15aCYy0dEPbW/DtIuw==,type:str]",
"name": "ENC[AES256_GCM,data:4+bT1ggJ,iv:bTO2puDGI4woNxeOXu7L1jyBM5ZZLrdHVG2fZE8yhfQ=,tag:5mRHj2IPo7moimCQLyZdkw==,type:str]",
"provider": "ENC[AES256_GCM,data:wKirg0QKs9CfVAQbjHACsIOReYfxTNiRPda/ZF7QJuCkbbnDYpwgEqzzlu6Qa9rUOw==,iv:LlG5HjmCP3piPUPJPqrHMDBcn/7DzTuVOha9y9fH2pA=,tag:B6Rps9Q7jhdcCnEdGKc8Tw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:qg==,iv:urq+ifyHWDi8m2ESpqdQ+mkbQ5G3VtmHYg36dZTbai4=,tag:sMvwjGoqEzqOjqQxMWb53w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"external_member_entity_ids": "ENC[AES256_GCM,data:8yVbrsk=,iv:/RSnygQ552LLobyzF8s2nwLSQR2DiHZ0zkT6Vff/xEc=,tag:OQZv+fxS6g3K/SGWt2ZYVA==,type:bool]",
"external_member_group_ids": "ENC[AES256_GCM,data:f4qyHCc=,iv:G418K3zvhK2k81cshCOfZeXX8ETDtsL6EEd5uhLS5nA=,tag:huGEVUJNLR5okq2BEgD1Ag==,type:bool]",
"external_policies": "ENC[AES256_GCM,data:UO8j5jA=,iv:BRrGRupiGVo4OhBAlhg5QyIZKz/X11dbtpdEDoFQcVs=,tag:rErQPCCk2pbN8eSj1hmC7Q==,type:bool]",
"id": "ENC[AES256_GCM,data:K2cH9f3btuuHDtFZEx6LdM9tJkSaW8G4lNpxD0Xr231iEHbi,iv:DysITc/RsX9xjG9Pc+bRVFahBAk7kfG/dpBKDx4kjf0=,tag:9yWHEMz37RDMyYQXBqmFHg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"member_entity_ids": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:3Ejh8/2g4e4z/j2Yge63IOvNNuAZyLSFeiRJTqPK66WReyyM,iv:pV8TxxZt845anKrDapnoESZL8w3uu0/XaWfvvmUs5Fk=,tag:W6syMaED2mZAtMZS7N985g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"member_group_ids": [],
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:Qx5c2dlN8KJFqGsrIEhIUw==,iv:DMfa7X9WBSOxthVDGElXxCkGjzzkGkdRBg2DxSHQO00=,tag:d0VhnueFpfzTDaaT6lA8uA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:lOArN4phZKY5Yw==,iv:PWIW/XVqtwqI6ZJxvgQTAmlfOEtvov1Ew5cC1qPG+JA=,tag:/o2kedtyvoFGk3My5mhGzQ==,type:str]",
"ENC[AES256_GCM,data:XZ4rDDeQn4/uQjU=,iv:M1gdA/rdBYD2E23r04MlJXI3AvwGeRewildZ8PakWd4=,tag:J9gukgEGkjTFp7eZ987G4g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:HWTt0imddsQ=,iv:Hqmi7/OP6K1c+AhRAnp7UjrgBgnbwdX8O5xs1NbtLs4=,tag:OUSz0OqcLmdDuLtKo5pskw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:PA==,iv:6ccuci4Xy+4y49tF6a+Jy5TpH9oibvEP3YIQXE+LdEU=,tag:MP42UtqkfBBhQqKYYEdxOA==,type:float]",
"private": "ENC[AES256_GCM,data:ctroFCXQx9hdqqjrL+IBAIzVlev9fRXPmFtzhTmN+9Q=,iv:Y0AhP037CrwSUjQS/0SxvlmRfrw/v05IYOhvFKTSghQ=,tag:UBQFTCxTw5RjSeNJ7RgwxA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:kKdHwupo0X2cumX9vDXDt93E,iv:Fdp35bl2H0qWkdfArw5z7lv/OP2Olv8MiFsOUmSj7pA=,tag:rUTO1sjRLjXiQQ4AC8CIpA==,type:str]",
"ENC[AES256_GCM,data:16slRp4kBwE39Zftw12JknwmOoMO2gE=,iv:0dvVd0AhtF0ldTilJxqTV14CDWtPfvRFVEPnfaA61c0=,tag:cxX5YXdW5hPFVjC7WWEzgg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:QjgvWTTleg==,iv:RF9cYqQQB0DmbF2ajG4BLAE+4OWJ5U6okJqKngBB1BA=,tag:Lj4UoNro6HKLU2ouDwdWLQ==,type:str]",
"type": "ENC[AES256_GCM,data:gDJK72TuFO2cJwwAtQjLYFtpuJ0=,iv:CivU9PiIM/skOuSsIONAoB5zUsELDdVsGqVZ3yjZpnQ=,tag:pIVqgtivy66HbDUvy4skHw==,type:str]",
"name": "ENC[AES256_GCM,data:MNOCZb/LXeQ/,iv:IiEANQLaBMkqEJ/prfyU3mPTNKpNkutm68GdVwM9wW4=,tag:J982jJAxRBmlVaZuZe+RDw==,type:str]",
"provider": "ENC[AES256_GCM,data:XSZwiwS2ZtAkJ2UA5ddqqk4fwdQTAEgzAfVL2knh4vTE7W5M9+AdE4xT9BoXU5jemQ==,iv:Vmzh+krypaVPwc1jPDB72PGrMX4VGdFd3lMv8VUjxSc=,tag:Gz3l9ab01o/EiqUShV0qHg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:8AOG4A==,iv:acKFxNJmDy3zutETy1DD/b3M5nQsJp937aq2PTL7iCo=,tag:475+gujqVJUqyxiSonUS2w==,type:str]",
"schema_version": "ENC[AES256_GCM,data:eQ==,iv:E0AamG2Aysgk/cQC2fd/qXe9xAz2kegtEzuOsiv/boI=,tag:sUEMyPPqt5pK1yMZVBltHg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"external_member_entity_ids": null,
"external_member_group_ids": null,
"external_policies": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:x27Rj1eIjygehUcCldDvkPlLgN55Ei+xKZlbVUFtD3rijHP5,iv:6RB7TY8RBEPjQ+R4Q38wVXT07L6b/NGjmCsjBj+xRJ0=,tag:x+h3cdMqFaqqNUeguEPjRA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"member_entity_ids": [],
"member_group_ids": [],
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:p+4ncVAa4msx,iv:uV3rV5/iVdbt7iRZCn0jNo9rdksloKUH16ntRNe3NOs=,tag:ZKprzOr1Ei3hcW90QbgpoA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:YPvzwt2hWIhFKGO5sy0=,iv:w+p1niMsZjB1xwzEFQGsHB2gwVawXuA6rmjpN2uwzXU=,tag:DL9YmJ4YiEU5HgDb6v66/w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:MWwE6d9ipvg=,iv:hSwKtrI4puw3WvdC3cv7jxCDtzJhcL8cQhH8ek+qlAA=,tag:zQtV9NsRPb0nBCs547A9vg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:qA==,iv:oF33+yIEDNwSCXT39A74GYxsb76VBZd/fkpbyEHPGcY=,tag:nUSLyddPP5SuHru3T7EAzA==,type:float]",
"private": "ENC[AES256_GCM,data:ljyEw3VTzZrM8i4WXQfzPu4gMUO4P/7WA9hOjuj8c7I=,iv:l1zgoUu9IEHqAZsQKRUSGdz2X60JE0tgFm5SVOGlnhA=,tag:bs2T1F0cQstV4pYG+7Qg9A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:IvJT2rl6LjwSVJFc1nYrOBEWEM8JKBFb3fzYgI1iNCQ=,iv:mW1IZ8eeoesw9jl6plZdn7+O0fcB+0liwflxbHjPnLk=,tag:mg+Dih/+f3d82/NIVLEyyw==,type:str]",
"ENC[AES256_GCM,data:eivwOcbm/fRxnPwwRGCTqFsl,iv:oehUGxM08JgP4uA9HNUdZzK/x5Y1f+BhfOp/cFQotok=,tag:IacT7CA9ufrZO7rVaBzL7A==,type:str]",
"ENC[AES256_GCM,data:z1uYVujMjhO88O7N6YL57sAGXX4hRtYtW1U=,iv:7rid7E+CZfY0AIGsdy2cv3MjojpHmPmz42eKzyuxgrk=,tag:D3UPFGiec0DP7vv3elg6IQ==,type:str]",
"ENC[AES256_GCM,data:DTe8KYKWh6UK7Hx3/TRpkr13FRstiw==,iv:PWUj5MuFvMLMqTmnMmULwVcCfrjKlcK7Bp0sMM18dLw=,tag:WJRfcbvQKimRr7BTEvxcrg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:3F0LD3roTW4=,iv:ukdsn7uOox3cUCFy10l/eUb6FPeQgh9GIkmaZMjPv2Y=,tag:FntLZcJtdW8FLK+xJh0Ybw==,type:str]",
"schema_version": "ENC[AES256_GCM,data:/Q==,iv:6btB98juBDWLJGLqvnHSrHgjrHL7lbVCbLFfbFEK/n4=,tag:K5NXpNJY4YyHgcla90x5pA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"external_member_entity_ids": null,
"external_member_group_ids": null,
"external_policies": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:zYBIHbAsw+f8799rFvufno8mnruwvn4WmzD+LGkx+q25DV9x,iv:34cOKtoygYr3/Qi2pAyTvk2feBSbIydaYXhah9nvWDw=,tag:LLlDaIkgGQFlONsHUgiwTg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"member_entity_ids": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:R5EhcfZtH6oPD7B878/zuAp4HbVOniF5j/6MHOY50/SKMKLN,iv:uRBzHxeJb2DSM04vWRLNWE1su/iUhsuOiupD4HSCovI=,tag:44iGHXQAIB2AE1Y33CoHJA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"member_group_ids": [],
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:vV/RVipDdSBsTc1DeQ==,iv:afXL/44jpKgrzDOorGCEPFuAIjKUD3ScS/gvHaBtQkw=,tag:FW6yl44U64+Nvg36Di3uDQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:y91hhb3DlH/+0Ck1S0s8sZod,iv:q/i/eD+VbI1xLoGtt1YdG2ctCVMgySvb538WZBFVfoU=,tag:D+2OtDvqgIixpLw+kKydUQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:8OaK+QUBBRI=,iv:mtgFvlUcuXn0QIGFf8lYLsUS9CRcQkEzwobfvsCtxS4=,tag:1dT5NzmoHCFobUFtAq+0Sg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:zA==,iv:6PkMrgkcfHrDGQtme2i0dzZOUw3X0/OZsXOKFndywLs=,tag:vhaxy78syKSgGvGgMvJf3Q==,type:float]",
"private": "ENC[AES256_GCM,data:txaEC9Zq2/a4WHuQT77Y/Bg3uyvnS5Bav/96YQXfWjM=,iv:Aa29pjRJddq6hJb+Z3Wjj9YOsO1zHO9DsVFuvoTxWRM=,tag:BNXjbR7rmvJYwKhRde3EoQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:qFCcYckX5bKdg8kg9O5wnCUgP+FXegKOXLNoUmy+vPw=,iv:RrrTR1sGhgFMUavH2WYZZm93o+aiXBPyD9HsIpkSa1E=,tag:wRxA0H9HCZEWmVlHBufMBg==,type:str]",
"ENC[AES256_GCM,data:UpID4AJXeVpH44gT/PeuD3aP,iv:MyOdy9vShzmZo4wPvk44g6FyroevXxRGHkrRcP02kI4=,tag:YHy2vzuiorkI09hZf5Hsrg==,type:str]",
"ENC[AES256_GCM,data:PJ8CNX0o+NyTwnze6Muw0AtXxt6aYy0LJ6A=,iv:zhaIpdwM4CwPKu5R6y2d/nQzZJpHkj9l0LRZaa2H54s=,tag:ufNZzLRaSDYvoYTcGXtNgA==,type:str]",
"ENC[AES256_GCM,data:0/LSna0sQ2JS1r0T0z4q+MUsF8Lnhw==,iv:DkgoWsG4Q65+2thO1lAkpEcs3iT26+jH7mK5OpExLcI=,tag:LIzqcuB8MYt/zrIijVBrWA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:/m26sZdSNg==,iv:2x9hzk5JM89h9dE4nyWCP+YbrDhe7c+0ixnkZ2uVYxQ=,tag:Ot2NKUnmIm2cGobgHPJsRQ==,type:str]",
"type": "ENC[AES256_GCM,data:q5RtbMlzHq3rE1wW6PhPSvUdyvkLTnKjyP4=,iv:hziTQTV+MdsiqP3CtV2dF1aWWZiwQsbp475TU9Fk6cM=,tag:QZZttRVHVyDuVW/kTMMEHQ==,type:str]",
"name": "ENC[AES256_GCM,data:ZAbWyPUg,iv:NIk85rHx/hmo4rsY3opUVDp9wPj1S2r/QoT3FLU2HuE=,tag:DEty9US5B9TE99jf/FRQ1g==,type:str]",
"provider": "ENC[AES256_GCM,data:O9oI7mJbw4HlGtFyZesajtFFFG/2j/AzCNr8kDBDSarc2leasrAXoBlLyhHIzWyTeA==,iv:IO0bG0y4RjtFzaB5VxxjoKXgT/P6hKQy4fR588+qJLc=,tag:fwzB37n1KE0zjng4akB3hQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:3w==,iv:nNiWxdcjF+45/CfzwTTPZ+SdBWxibtGi9BE3turU3F8=,tag:aSVU9N8p2U2EC3hWWkMQMQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"canonical_id": "ENC[AES256_GCM,data:U/I+g7iM/tdMc462oLUErMY6avlNv2FMPxD/uQlYGMgthYdU,iv:R3w+W6x0QY0aJQGjD53YNc4WsoZasZe57vhOnTHXB8c=,tag:LKz65w+GWnj2q+vLkGsnTA==,type:str]",
"id": "ENC[AES256_GCM,data:cL/ED+2LrMruy5RX1L0vTDEwfiPmKhR/sWVqWTCMHz/W30BZ,iv:fqrLB3OrehNWUjZdogEiBr7+EgAcz6nspuMZR/neD5k=,tag:zfwg639IlSd3dqd3tMYOUg==,type:str]",
"mount_accessor": "ENC[AES256_GCM,data:nkaRa6e2mvr4SFtlH3w2l+tA,iv:sQC534czVDFdjWPYD+8a5YS+xqH7RB75NgC5xSrsWLo=,tag:MC+iJtVYlLVxe5Jjxvizpw==,type:str]",
"name": "ENC[AES256_GCM,data:nGusLu48MJPbGgaY1E5zqg==,iv:jPPg+L64nlhiR6dqIm/1WabJO75BWPioPbw0KUSwBSQ=,tag:flyRrEyDbj4/sKkmCjpcCQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:yQ==,iv:BRXOW4JmfxbXM+6it+oDrVMgwnx/KFzIPNjMDjFYvq4=,tag:vYsbYiGrLZ3Du6kpQi4egw==,type:float]",
"private": "ENC[AES256_GCM,data:wYoED0Y8KKA=,iv:PAHkspRUZSI+H1WR1jLqvdYE8UodUE+qdWb1sSr541c=,tag:Lae9wwUqndws3SeHi2Jzjg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:iNbBfi8WXFe+irQ4z9nUvcuxUdRcXd4eSQkLnjQ=,iv:MRWf7/uYSGy6+sJn3U70vSpZH0VP0ikdKaO6gKJi1NU=,tag:rJd6w3X1j67tymCvdWT78A==,type:str]",
"ENC[AES256_GCM,data:+sj/GD/WLHReqm05MPOqTOe7,iv:wFhfE/D8YvjquCR3xlgMHfO1aQ1tgkOUfXUzY7AuZFI=,tag:aU3StHFG/GLtnrXVJwMB6w==,type:str]",
"ENC[AES256_GCM,data:Q3idAgv8wih2hd+X4dW38JhnfjOF3GF7F34=,iv:SZ1usYPZld46LNp7ZzFCZLFQmFOjbLvtUFWDKczd6mI=,tag:iRS4JwxTcW0lc9h1EVn6ew==,type:str]",
"ENC[AES256_GCM,data:oDHcgOi9SxC37/ZSEsu9FkbOOmTuqPTufbyw,iv:zEVBuSqdjE/S50la7CLco4LnNXSX6eXXsrIyxqwudW0=,tag:xa28OUvGQzazv3mABcpY5A==,type:str]",
"ENC[AES256_GCM,data:P/YxZd5ZZsRzSTkzhOlY3iOq1FwEBm4Yhg+l,iv:SUuCSrUwvjynno2uxNiBfzlh697EzDZDCieinR9svfM=,tag:AS6Zvu+7MYGVLysUHDQJZQ==,type:str]",
"ENC[AES256_GCM,data:LxZp/g8JoJQg1LGYoqeE+jAU,iv:x9FQsmaAs+1BX/NF6KzUcG5eXV6B+UcVOL0UNJOmCJM=,tag:ns1GnscR5ogPVLLRkh+3Mw==,type:str]",
"ENC[AES256_GCM,data:4UvkmmaiLacD9Lf9gzDljOjnusZ0yU8=,iv:g6xOL3ADEfVBJOCn5+vjUhNUgYZpRXzq2bWnW8bXyeE=,tag:NXKU1HJv8VnpurJGF1wcRw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:94Idfid6Rg==,iv:t4RaX/F9s9aWOYVL9v5Od3IBQz2mV4StE5HemuzJUlw=,tag:CSIlNmNcrC24t1L7kLF8FA==,type:str]",
"type": "ENC[AES256_GCM,data:u7uDroe4h4u9lBQAlA4BlZnV7z8FuNdxSQo=,iv:Iz7GOKrgqpGD2ZQToFjLyDiubxOPe+1St9Wy1qm+kKw=,tag:5x473CKFByHVC5yv3eKGoQ==,type:str]",
"name": "ENC[AES256_GCM,data:lAj+g8zktQHp,iv:SGlTw0OhwQtgsSmL9PFUx7QfCOPsmdY3/iH6HM1jmws=,tag:X+fitRDHjGyFIpb30H/Aog==,type:str]",
"provider": "ENC[AES256_GCM,data:KcHarg3RU2tTCVs/VI8smql9IIFWBQTEXrgDjwlZGlaoIGw69a/kgRr7gPZ0autg/w==,iv:plCssqk+jN/hnI5hI2RBejgeukIqFdFvZeXkxbCaPms=,tag:Evi65Pz/ToYwfQc8KJF9UQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:deDu6A==,iv:pFeAzyZoVWllQYksUu7g4Mw8iFc1nqWip0CKiIrtcT4=,tag:urdq4a7DB59qhjSYs9Wd7w==,type:str]",
"schema_version": "ENC[AES256_GCM,data:xA==,iv:77anpSzX6E0XLO20n4CYvGFpyQvgpz7jeUinmJ7dQh4=,tag:2WvBnztb+R1M0d6sNi35+w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"canonical_id": "ENC[AES256_GCM,data:xCcwyawjxvbPiGQ3fieKxhVBrCveDcIaytl86cZde5GKGciR,iv:eBu9T9k5vrCEsClYk8yc5Az1fUZf83XgylP7y5b6G0w=,tag:yFQlqcYFZLN9CVS7B01ODw==,type:str]",
"id": "ENC[AES256_GCM,data:A+DivTbq6Zx8gk64Eu1mZunV8gVXjdjz0IAeLbaCv+XFhzwB,iv:IQceNxjoHxDzYTGiwbxKZ0LqRtFk0j6JU9HWYskqe+Y=,tag:zCtXFmas4Q9Nrn2fHRQbCw==,type:str]",
"mount_accessor": "ENC[AES256_GCM,data:Wsm4K/GCVBgz//eARfqs9A9V,iv:KDXUaCaF4/r7kvPlNUUC743U9j95c69bEIBYKvQpa84=,tag:h//AA7kQD6J9Ax3KwjgzQw==,type:str]",
"name": "ENC[AES256_GCM,data:P7rUNafvCL2d,iv:+1Up8IWpCmkYc1qxoPssqo00JT40WE582qtHWCYh/TU=,tag:ZpHejf7AKjOhC34lX0mNNA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:dw==,iv:29hl6D2lEZvf5+CUuSUCUnbH0BTYsW9moXJ5zNPybwA=,tag:vK26DR9Al68QZXP318ENoA==,type:float]",
"private": "ENC[AES256_GCM,data:tuagYu1hllBHouUMLO42Vrz7H7h+b3ehIM8USaDTfH4=,iv:Wt9cgeGdFPYAaoGepnCJI6qEYB/B+1x3Zas2t/lUarQ=,tag:r9zHV+ggY/cswpJ/YEgwEg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:iuPIiGdSqlTRBxqrIV6Pk5EsFf16qgYlWBI+K+DRMuk=,iv:UIacw2ZaWXh6m/sx00gD1iRF5VxZcyrBvtr18jHfytI=,tag:f0YEn3DdEfUGopZ1seZiXA==,type:str]",
"ENC[AES256_GCM,data:dW1t+AOvmrs2SJk2tpBxLFezWs7sP7JcTdPCWRE=,iv:wt3Zsti5Ows8pcfmFADN3FSft93K9NRqQOT4Z3tjMVc=,tag:IBrzifxMgn3bIvX5lO9bdQ==,type:str]",
"ENC[AES256_GCM,data:h/aSszsgcRK8kaumhNfPSEnE,iv:NWwpt1vvzN4kbEd1YKEXxUqf8CFnGvhkeWxd+b1WMNY=,tag:6U+8zPvtDjmAFad5FOnhVA==,type:str]",
"ENC[AES256_GCM,data:zGrtUq9L57zoEMmeqY0pn5CBnPsHirnCU4o=,iv:UK+y+K04O1+2hxdM/cjqWv8GYlVS9NUXEuiFGRGgAC0=,tag:o47+Kvere8CzNn+Yh15iVQ==,type:str]",
"ENC[AES256_GCM,data:qfAT4nl6rnT7LI+mPW1Pr7A2fEIerHbM7xg5ug8o,iv:KUADxKzQEodvNKn6M4HO/sA657HdamlzAt1K54tpLls=,tag:DtoN7QGssjVR3gG3b973OQ==,type:str]",
"ENC[AES256_GCM,data:LpH/pj6bJ2vEtOYiFumGjP3hGdIubymmLwsR,iv:5cQ2JjZfUWBFXM2Lh2EMEOm/PxBWp+rp0RobKV7CPqI=,tag:0n8EWerUw4auTksiIz/5HA==,type:str]",
"ENC[AES256_GCM,data:ComLjDmHJuJMP42CVYiD5SBDG8/v8w==,iv:0p7iOcknDqPvi69sUf6VfnWTqRBZkTYAHrBc2H9DZyo=,tag:I4afjiXlgsi+PwNkpNOajA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:DeKzRY+doWw=,iv:9R2EGl+kTxlaNK4XmgJ6xRLqT3ELM2nwED86prhrXxE=,tag:1seD1P8MdNNYkJ1t0i057Q==,type:str]",
"schema_version": "ENC[AES256_GCM,data:sQ==,iv:c1iNyP+FDOP8qiANRWV+DDt0x4UMxsFOqO2gdY9k98s=,tag:K6+jTfD/CyuXC9/rhJNJlg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"canonical_id": "ENC[AES256_GCM,data:G22YvKCDlcEwZUFpSk3LRpYfiK7tskx09ajSY9IW43F8t170,iv:GcfBkKgXzTdeJVU+7EzbCuazZQsKlleLX027asH1ILs=,tag:KStSQfydxaLnZ9ARSSeO1Q==,type:str]",
"id": "ENC[AES256_GCM,data:NmssmdP2a4Bv/24lgaxh3fzqi9vY32MijleW/Pvex9KzwEWB,iv:ifQjF7lPMF/Fba+44mR5onUcndDeAq6p2wSQGup9F3c=,tag:c6xueq/w40pjjS/12h2XcA==,type:str]",
"mount_accessor": "ENC[AES256_GCM,data:fM+S6rbuSRfeEvrwgwRSrgCl,iv:L+klYVDGX2CyjHY1SpEcP/XeLsw4DzJIFArohhZS+BQ=,tag:qdO8hSFYaQAlGyW4rUG3Zg==,type:str]",
"name": "ENC[AES256_GCM,data:gnmZZP51dt2yrAj3RA==,iv:PqMb8ho+g0BdnifEV71yUE3H110s9McNamvm0pPpZII=,tag:785JSGUCtSUO+ejCFOCckA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:VQ==,iv:qycX8IYDfmUyGoYi0klfn1Zr1N7LY72m+UEhfpbB7Xs=,tag:okoRq6yhwwnBzsbnBKwPeA==,type:float]",
"private": "ENC[AES256_GCM,data:qlrGt2OVs4k=,iv:jTsvdLLKmMwBI/ixj3vBaEi2/YMSkl3lUkFhYF342S0=,tag:RcuCbcxJFaK7UY3cVkQz/w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:cScrlAFamLNYsLVALu1ftCs7WxMzW2SKpDwJNmZYGOw=,iv:KOkLr1aDREJUUVMFvEvNBY/ykeqO7dEx7O1aMwZyvmo=,tag:EYv0KMp9wqZ+sG9Dd7e30Q==,type:str]",
"ENC[AES256_GCM,data:+vULIoo/nLxnlwzYBGMWFgNVENB4o9CP/b4SSFg=,iv:BeCRSBwFOZ3vxz1RTOlH9FoWUIfMPbFbNCqKFhJ/FIY=,tag:TOuN8UXz+ZPaM3zZhSVf3g==,type:str]",
"ENC[AES256_GCM,data:NJNrQPuc8R/NyP2al2VrS+28,iv:4BSiifZ8cjNhIRJgxqwlwNIWfIPcL9jegZXp6ZZNa28=,tag:MiF43qWP72UEi+RjWFtPXA==,type:str]",
"ENC[AES256_GCM,data:LkvOVMCpxnLRn1wrzXseTJ6T/tzjpyBe+Rk=,iv:nJccnhGHwTMjL4MBCuHrzkWfaDaAHmnFGb9jSlvAfD0=,tag:Ix/CnZRNdcrlTi7zJsIx5Q==,type:str]",
"ENC[AES256_GCM,data:9KvOzXEIaAlb44jHXfdwXXOBRFrrICdK/aHBUf5+,iv:+kxGqsenEN8UpD+y11vV0oqqlLi1pbSg/xyUH696oLE=,tag:4D0QorcngENPFCH1nXkRDg==,type:str]",
"ENC[AES256_GCM,data:NOIWlZ/5STOjFXOwd2tKuiP1bF6sD3tjyaty,iv:8T5C7MeZobxjAigH56M/glG91aiyZQ1DLNSpbdv3mE4=,tag:y1dJBMMtvrepLHp+JmM7NA==,type:str]",
"ENC[AES256_GCM,data:HTYPohz0Gkxymrrld4MJjt5EKrKBJw==,iv:ScJRmMX02SErltaoe+4xFu5kBco7Klwe0La2oxpXzZs=,tag:VHJEvkWRSEvo3DS7yKKAMQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:pmTFReM+JA==,iv:fT1dcvTraZyrVyY8qgbIJMK654xC4xO6ixSevMI7x0Q=,tag:+bf83psksYwSN62x33j8bg==,type:str]",
"type": "ENC[AES256_GCM,data:brRVuHw8Sc1i3ntaB9P0RHacSS+CRQ==,iv:Y671NiC8ev6xeh9jPX2kkBQc/FOMZtnrETy8BEZt8Gw=,tag:KSugiSBbqi8DgV/TaAljow==,type:str]",
"name": "ENC[AES256_GCM,data:fl08YA==,iv:A3/A+ukNfA0HugLr8CZRWFlFEFFZjtPFehp5+MK7P2k=,tag:3V110Mc1SyqnTOdOqPvX6g==,type:str]",
"provider": "ENC[AES256_GCM,data:JSkAWCzBl5OLr4dLp9t8WWl4stQV3tfGwgzYbLf/TsLZXaBvNm1sAS40koQyFEB3EA==,iv:kc0ZYjys7CpZGePiHPLbWLQr/bF71fjO3I3qHEWw+sE=,tag:Fk/iXXVdF2tSw9eke+RQ8Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:jA==,iv:v8KinD8kVr7FcfnUHAIvlwT0umWwTDdms/GkOD4cCTk=,tag:tLngcA9bSYax8DitA6k8Dw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"accessor": "ENC[AES256_GCM,data:IG7ybbbwK6Idmlt/HBJb8WLj,iv:ErPOySLHxSY93iWupBSOrqqEnFusQQS7VS+V0ILlJbI=,tag:4DG8aO7M0SxUjL81ckLUNg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_issuer": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"default_role": "ENC[AES256_GCM,data:uwk02ZMmJQ==,iv:i26FP9EGAk5thmFDyM+fguopunYfLWZT0pv5M6MemS0=,tag:VGHEJbfFLiavSFQTjE3YAw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"description": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disable_remount": "ENC[AES256_GCM,data:QVdTBFw=,iv:GQ1OMIaidcaNwWbUJY742nPkrO5c8+qCA3l4J1lQpkE=,tag:oCPc9Hc273oF7fewny8CyQ==,type:bool]",
"id": "ENC[AES256_GCM,data:ZC6ZZw==,iv:SjyLeSggk6f3DZlr1nMgJ0eDIa8QqLdich7QswcqCWk=,tag:p1PqTio8zyKhkaIz1eST+Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"jwks_ca_pem": "",
"jwks_url": "",
"jwt_supported_algs": [],
"jwt_validation_pubkeys": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"local": "ENC[AES256_GCM,data:2vsox7E=,iv:JWYjM65OPDb8c2FvNk6e/8+ikqvAhmkCauVxHDaxeY4=,tag:76tC+P9hJwxLJjs7mRU3aA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"namespace_in_state": "ENC[AES256_GCM,data:a4+s/Q==,iv:ymH6HPsGekDrB/pp1cwP3cEiUl9aHxGKY0u7lKRZpyY=,tag:x3VmQlxpVZ8Z1F3ZvE7G0Q==,type:bool]",
"oidc_client_id": "ENC[AES256_GCM,data:l9qr1bmPIjoKtJ5ojm0pn7ekjfxClt7BgHviamg+6PgRW7sseU3Gpg==,iv:ZDjehPh/armrgfGn2H0wYLG6lBw/Blfjblg9oZMhlpI=,tag:07JoR9f7qIGXcEwWL5I4Ag==,type:str]",
"oidc_client_secret": "ENC[AES256_GCM,data:P/uueEnExZL59D2o0IZaLh8EGUSPaFRPNo897VLB62Ck4hzt6VQNXLp6++cmClZoSGA4hezGWfr2U0tXSdqPzpAS69TMk1G3evtqQMCEtClCJb3iHS6iVHJkaX7W8zxhJbg3kyytRPRYjR0ZtTex6f3Bac5v/lZF3a6+hu05BJE=,iv:36EB7FxH3X17VG9TJEbcET/YcVGld+SbVDzEB4I6faU=,tag:pdd9JG9rBPa7tw2isqwbeQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"oidc_discovery_ca_pem": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"oidc_discovery_url": "ENC[AES256_GCM,data:AnDWR7BnxPNebZpHEC+oPSsYZQxAIRYS/PwDLSJqMpYmgp6dd0POgFtuZE2OlfGxIJJQuth8,iv:b4FJ04uGqIHC5OJWjdEP+NTa6xrIdzhVaHAt0cF2yQU=,tag:OBTRI3SNJC3RMXuktE7HAA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"oidc_response_mode": "",
"oidc_response_types": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:7+EuJg==,iv:7TuIbFbGwypfgV19oIDKlbpey06F2zaLnyHSr6YrXAk=,tag:1MDEbLSr7nv8XBRz8GZtwg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"provider_config": {},
"tune": [
{
"allowed_response_headers": [],
"audit_non_hmac_request_keys": [],
"audit_non_hmac_response_keys": [],
"default_lease_ttl": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"listing_visibility": "ENC[AES256_GCM,data:PpZzYOyS,iv:E+ZvIWkrUMDN24h+XXWJVXlkxHQUVqyKcPdU+wGmFUM=,tag:G5gsx56NW29ahyios7wN1w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"max_lease_ttl": "",
"passthrough_request_headers": [],
"token_type": ""
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:fSyEVg==,iv:05tKxUsRNdctP02oRZsVzs9RPd7jsJ5VsErVhK+vxCU=,tag:kcJ8Us/Kq05ACF0HMwqDYw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:OIIMKVTF8j8=,iv:5MfJxKc90l3kZdHrWbcHnHKh89iGQWPb+TY8+h+p7QQ=,tag:7dG/PXiRbNIQWZZZPnWdIw==,type:str]",
"value": "ENC[AES256_GCM,data:KfrvPYOQkwV7AqwrQ4E=,iv:6GPEK4JWK9nmfx3L5hhmO/U+iE4+8dlyQIWx4znTW+I=,tag:nrgWvwyhOZsjcivwHLG8hw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:dtXNWpo1gtc=,iv:LklCy9kpQ0RDa5i82qwR/H1LIP6iiO/IFz7HCGnas1M=,tag:0+tCeZInuqlvOz4CmmochA==,type:str]",
"value": "ENC[AES256_GCM,data:Pq2hfMTRJi0YQrMy58N9wICP,iv:BjavV7iOoKJpwbFhVU2GJ2dEM1jpObM9YuHxXeurcy0=,tag:Spmmlh6WcQGlaXhC0yzYoA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:jg==,iv:uC95iNdxABElYWl4LpwHQ4Gu8RQHIsrz9BLKgOKrBv8=,tag:P6bXQVG5Nb8rh2AcLS8bow==,type:float]",
"private": "ENC[AES256_GCM,data:6NEbiZWyl1EXDPPhOFBMMiunZULYBJvLtYKMOJ88hcQ=,iv:RAym65MlwDV/LyHPpPOrt6Z8EVtAXCVvtdaCgkBjqqk=,tag:mmuVdD6Ln+eUkdFUu9ohtg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:ZP21AsNsBHVFOg2r1hINtyunWR1hh30/hcHs1nY=,iv:2LspZJI7rsnbCENIqov2lfeZCif2eLfwGM4v83gODoA=,tag:n6duClaBflc4cG34D3kfkw==,type:str]",
"ENC[AES256_GCM,data:ZvEfI7VkbKWhxdzNOFnbetsE,iv:bqL0Rq7AKyiP4bHAJvxFsuxe3gR5zweaYeKfxXK54wY=,tag:SgxF3sJ5dJMUhPBDibGTew==,type:str]",
"ENC[AES256_GCM,data:mmA5CCAHPiAT8S3IWskVX4L9cuJ1G6sQAN4=,iv:JC3D/6/hP3PkZ6ar2j86GcjV7zix2unlS0ik/Nhm3gw=,tag:xAa7ML5dH+N5sDuaFNXFaw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:8q5tLwHE9w==,iv:xANqT8gya++LDbDQSvTaUvRNJg56YXX+PUiAflmGI1U=,tag:Tp/4hgGAFA0Sk0D5X+XHfQ==,type:str]",
"type": "ENC[AES256_GCM,data:hSiZLK+bTPDp41WS7qijru1jGcud6w/SP7yH,iv:+ZKuNMXPxzMg5fMSUzjSkJ26eL8J/vEEujG0XzP5uMw=,tag:cq1624mAFpnN03sfXepnqw==,type:str]",
"name": "ENC[AES256_GCM,data:qUrHDNVWng==,iv:XmBO5wyDiCYZZEvaGx7vQ7x9tyD1EZ00u5095rydcMY=,tag:VnRI/5cyz5Swm6io2vkBrA==,type:str]",
"provider": "ENC[AES256_GCM,data:zRruIwT72ydCzdWi/OS6zi8wSQS5HvZJ6WgNmIryJ00xrCqM0BABL7TsNrawmK6XpA==,iv:FJKJuA0c8/OfDfDZQyoq3rwK1J0fsirgWEIkK1ymjnY=,tag:u8l7sgUg+t/5F9ZzU5bAJA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:JQ==,iv:tnXUOsZIoAFWgefGMK+KtDDLMqFlBtGg+5GGaGG/NUo=,tag:K3cYpUFGxsrnJQVOLQsa9w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_redirect_uris": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:aLbBpVnfc47ctyFA2a5s8alVX8OWReuVQYhsxMegkKX8ipE=,iv:E6N3i8bTQkU5dlgbB+//Av6Wvu6c90KTjaEMH9oC2M8=,tag:zvuDdtoqbR2TXuH9FnDnUg==,type:str]",
"ENC[AES256_GCM,data:rCuxhS/AmeW3EULE6TcR1WyYWmLhQBxdHiP12jMvc1Ddu6sgjpwd0DZqOOssu+oB9drxJnBewuKWhgd27Rc=,iv:YWTUbZF49/0mc3iU0g4zZBCTGki9Avs1xCod2Pn4A3I=,tag:lmg1YubOgEFj9fzL769RRA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:0AWnRA==,iv:5dWHBXex2nFqzdQTOJy1DFsFtJLPQVGAewtGe2BjaEI=,tag:9HKULsWDlyjljShPARgFxQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_audiences": [],
"bound_claims": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"bound_claims_type": "ENC[AES256_GCM,data:WTD9sc23,iv:MuhsQrM0isf80n9Exi/k1EZCjFUZfEA+5hW1P09wPk8=,tag:443rTj5sophxAg5NUdxbOw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_subject": "",
"claim_mappings": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"clock_skew_leeway": "ENC[AES256_GCM,data:sQ==,iv:9TZF92wdQm3b659YbVmxfKV+CrWlpc1T2CKOUqXcwbI=,tag:mPSZaZjm9UrArr6vd76gEQ==,type:float]",
"disable_bound_claims_parsing": "ENC[AES256_GCM,data:pWfEFJ4=,iv:K7Ijp8LiEpVHqV4swsaRmivVI5oXNSri8Yon1Ip41ak=,tag:wcOAxezEmnUklsqXz1eMvA==,type:bool]",
"expiration_leeway": "ENC[AES256_GCM,data:dw==,iv:W2aAxPl2qmgx8mr1ZpqE0yIq6k6w7xtBjym1OhCSmjI=,tag:bj9vwG8wp+dmUznFZV6lfA==,type:float]",
"groups_claim": "ENC[AES256_GCM,data:A2drXv8A,iv:1vdNl7BXbDZVDXcMFIoJ16wndS3f1PHkhC/n1VG3nzQ=,tag:cTdpqB5tKKxl2eWY5LJ0MA==,type:str]",
"id": "ENC[AES256_GCM,data:5lxSPoabgCEbJCxu5+VIBNYgSQSE6g==,iv:IBVUM1evC9CvpSUZO/r6SDhfgguIHkciKyhW3fvRpMo=,tag:k67ARD8jOSZLMKM78XZXgA==,type:str]",
"max_age": "ENC[AES256_GCM,data:2A==,iv:WIs1WZkF5f17DouscbHDuCTWfoFimAtSJbOc1RWpgRo=,tag:hXyw+0VrZGI0izEz3RZ/+Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"not_before_leeway": "ENC[AES256_GCM,data:4w==,iv:DkeMhWbeRqR97sGyD494FGPf3O6OY0RMLoROE5Isdg0=,tag:IdxaeF5sXvAzrCTce3wO5Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"oidc_scopes": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:fDYTytU=,iv:Tquw4UGyODHnenDsofVmt4q6y0ZwxzwVhXp6BcAndgg=,tag:mwaOT5fPynLLrkMFNSeT2g==,type:str]",
"ENC[AES256_GCM,data:HPO192DM,iv:tzKDpcYcvmFLjbmc6JxMREfrcmBwB30bh9YJHw4ibAE=,tag:RCrb7hH4YthJfNdc8Evykg==,type:str]",
"ENC[AES256_GCM,data:VsavHJGtDQ==,iv:GRUV975fv6kcnBpBf/Ht+QXLJW0n7hHRzzcBf40xeeA=,tag:a3F7+e3q2C0K0unuJBJpYw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:MoU76DLr0g==,iv:WqfUbRcSA9n9noSOsWp70gKrhExvABtXCBsYqEyxMWs=,tag:CO1szLD9HqKb0ZAvnWooJg==,type:str]",
"role_type": "ENC[AES256_GCM,data:B+dqZg==,iv:OE1h0y+JretDde76o/eQ+Yqs9EuiI2dNlWM8EqGxCzM=,tag:/RIDOAGwSU+YP6w0I/4v0w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:5g==,iv:jGPPpbb+cS1PDcrNYs/ivqanAEFY8QOuHEyQuzMW/EE=,tag:rVewSpd7Sj8E28kl3ixjpQ==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:hd0m2RPW,iv:gT4JcHm4n3BEt4Z6eAEsqKZ8x1ucqRq6AHElSj0LSg0=,tag:yyr4vxADPARUb1PGv9LzQQ==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:49hYr0o=,iv:M6bS8kjOC/FIKUmHvvK9NgA5BJ6/03vEhKuHJp+RYlQ=,tag:zV8GhWgTV6Qg8rxXs+GLHg==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:AQ==,iv:zCB9TYpa6D6tWFoyt4UrH5Uajf4N4vR5q7J858BiGpk=,tag:7K9scTgB1nWLRZChNAcHHg==,type:float]",
"token_period": "ENC[AES256_GCM,data:Gg==,iv:5bwjgZCR3942a5yt7wfKwmznZEBS6aVRhG8tQSH8BoQ=,tag:9H0O2TqLp7v1jY7OdvibSw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:E3pUg3zs6Q==,iv:xZ4b+L9n3YRvKOCZv6skXAUd43S/BaFkEugsJIa/uYA=,tag:Au2tnVLY9gCJ0u9VRcsA9A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:l3amEoIT,iv:Xv5/awla6/q3n91l3TuYMBIawi0UAu8bpabWfEnnKEU=,tag:dMU+4aOIrOW8oWBfyKNRTw==,type:float]",
"token_type": "ENC[AES256_GCM,data:BD1y9Eep3g==,iv:ft+7MpAvlh4YRKlmZMsZnZQEXSTJm5GtQv8H8vPXwt8=,tag:bFs1ojQxKh2ZagWo1BcmWw==,type:str]",
"user_claim": "ENC[AES256_GCM,data:l0WttGI=,iv:BxViQbH7GykMmisWpt6jeev9QFZGxyp5UP/vlFwyQ0g=,tag:Ki/W+XlDrXfiTMaqdneN0A==,type:str]",
"user_claim_json_pointer": "ENC[AES256_GCM,data:APziELc=,iv:8ilO1QhEnoEb+cFTF0VLSS0DVCN6mSiHSWT4of8n9BA=,tag:DSs1tlK0PG0T2QFKRYgjRw==,type:bool]",
"verbose_oidc_logging": "ENC[AES256_GCM,data:dfCW2cc=,iv:B8bOB/qLo2Xromib8alV+GyTjgbDanVm8UM6FNWVofw=,tag:1iEszSh7CLeX4Eg+Z3aWQg==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:SQ==,iv:FkXOsj4CKDGiIvZP+bUEyQ84/Dcr/pWcvHkdDVlOuEM=,tag:k4FgZEWt+c6w25u9caKGWw==,type:float]",
"private": "ENC[AES256_GCM,data:Y/9X2h8TsrY=,iv:Fn/Wk5EZNL/DXTc1rxFVa1jFgposPqxDVSymF4Ux6qc=,tag:Ig9+1HRXS0pPo68lNb2cWw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:QF1y2KDWShzdb1rVQt+mDXWaeXfyUKIMdZ+NAHs=,iv:1LY9jxQ9SMnXl9aKz/EK6L2kCkMTPQM5Aodg8wTMfCg=,tag:LXEGN6J8a6U2kBONjXUWgw==,type:str]",
"ENC[AES256_GCM,data:acAxkdrTvvKLZh7fBld3liA5,iv:oSlVrAozk7p9Lrmv5eG3uUdq/NYM2dJtSRITa2OjugQ=,tag:mq2Rmd42wqDbav4aSUo5WA==,type:str]",
"ENC[AES256_GCM,data:YlGmKkV/CUuUrCOy663Rn9YPUvaxk+KVXc8=,iv:+esl/DWwSFX3uXjQvCYQJRIVjIT78TTIx1WDPNZ5/uk=,tag:CblzQ0lMx+T9IRYWBDbnkQ==,type:str]",
"ENC[AES256_GCM,data:58BzY5ozx1yR1dSvYvgwKVG7pe2B/Q3bi7Pg,iv:QOH1QKdDFU7R2DQxCZa25Y8nb0PpaLv8BcobU2DiNMY=,tag:XlSWlv8tpiqqdE/XwQi6hA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:IkNF18cRGg==,iv:cQKathRYj3QyccNOP1m6wOCPp43j7uknGvWteYW+NDk=,tag:MY4lajHA4vxSyUq+0EdTlw==,type:str]",
"type": "ENC[AES256_GCM,data:9Ffi+cFdL/XxpoJpcfHvmndPiGMGMmisknQCjX4UA+yJ+qZD,iv:h2NuppRz8GjLHtnxqmI6p9C92WMH0bKOlqtYom/fca4=,tag:00PE1uc+0vWxvvWET3vqSQ==,type:str]",
"name": "ENC[AES256_GCM,data:oxV2,iv:xkywJFVB9ke9ySOCAJijqPnthX3/RBt2WhAIN5aG5is=,tag:T69lTL0DZNOqIN2WHAxYmQ==,type:str]",
"provider": "ENC[AES256_GCM,data:41iu8KXHWprCqYjRz1E31JCANExRD3jw+NnE5zsmbv9MB2b2THCQHopHUl776H+/Qg==,iv:rbEaVpcuYKCup7ErXM348w5C+TFNtvKegzzjGyU2ecA=,tag:JGjR9dhF3J3cy8hPi3+9sg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Kw==,iv:eZL+8uEcKzToh/o22QzeU9hmbZHLRqfboArv9KvBhBc=,tag:HyZk1Y7T/IwknGhqsDwU0w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:ZwMoPGu1n2GuVg==,iv:w4ZYifI8GR68gzQOIu5/64UYg+kGz5lM4OtmALk4rvg=,tag:pyp5VEPm7HrW0IwjJzk+iQ==,type:str]",
"disable_iss_validation": "ENC[AES256_GCM,data:ODmybeQ=,iv:aQ25pZTtyL9Bl1CALYlRkxR8Z3p08xlUenVaJluHrL0=,tag:EmS2IF9LZ/6gmvwOk2Wwlw==,type:bool]",
"disable_local_ca_jwt": "ENC[AES256_GCM,data:d2zBOCU=,iv:sumljUKdLwg20sSyp5dX4Zxa7q0RRL6FIbFyB1zyXu0=,tag:Urya32sp7X1PuSsRNFhOTQ==,type:bool]",
"id": "ENC[AES256_GCM,data:GlJ5G0faJYAqDNISs5nlOKQhNSOu6A==,iv:S2lSjKw8cSZ+JcxYcoAaWB/rgJI1lDJgjKWWivZ50Gk=,tag:rDMzSWRb00BcjG3JRI7hBQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"issuer": "",
"kubernetes_ca_cert": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"kubernetes_host": "ENC[AES256_GCM,data:nyqLrEftm+LZD96EIYjkGo1DcjRGVnq0siZniK01,iv:jz3QTROq4nNKj2sOLFTd3RNlxH0LezXwV3l5E8ltTws=,tag:EFti7wLBWvbAfuxa4tkksQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"pem_keys": [],
"token_reviewer_jwt": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"use_annotations_as_alias_metadata": "ENC[AES256_GCM,data:6cGsylU=,iv:OXCvayy+ciNyvwzU9JwyhViXYJ2LQ2skRx0jLaAaoF8=,tag:JtZUTR1hLMrs968XCGYV+g==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:Re7Vx/iJotc=,iv:WhumteNPIOsAxQHAmzx0/IRnscQ8D3SG1ZSKUHr4s0A=,tag:iwyoTUXKpQT6X41cfIPHOw==,type:str]",
"value": "ENC[AES256_GCM,data:c9Luv4x5QEBOpAPWsqFJCVMI,iv:nuO2pwu1YF3OwYQPSWbB4T/etDRSKoq7YCm2AvqqmaM=,tag:uweBEcC6GwBebD0gRJin1A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Sw==,iv:OMQspzyGL09kKeiSXi3Uwy+/00gjjtrU5JDoaJDPDfY=,tag:IJaOT60jCtCHssyO1Wwvmg==,type:float]",
"private": "ENC[AES256_GCM,data:dVWahQF7bek=,iv:HecfqSG5Gho1tqyJNblUIxGc7tkSdGvP1RU+ZxETcqA=,tag:wEbotkk/YSd1wK5KbqJaMQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:XWe0ai+Xy7yA9iUZzgFXNnXs,iv:+hXf+9VTQLSOaMC8pHq8tfv0e8uSPIn9xraBbhN9IiA=,tag:BegWgdL8JDvSJYTI0/Zclg==,type:str]",
"ENC[AES256_GCM,data:aEaIV4bKkGSCxwZPSieVUW8ErA8JbpQ1G04=,iv:XEIDyk0j7yPViQ+MyLdBnBrdjy8txY4iLJ5erEck7GQ=,tag:gBmWHxWiTVO9bqdR2UafOA==,type:str]",
"ENC[AES256_GCM,data:S03MxyaqACiHNUkCEakXpTFBkVHetoeSnJn29fY=,iv:RBb+BXENUjeLS001yLHXuYsopzTkEgYDAfnrV+xQoKE=,tag:AZKby1pPIUE0mgS+DKrUqA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:yZ5AM95Q5A==,iv:ofvGVf0W7/YXTnu0JFs5ZlSOGaARoVpNfQwruD/AbRo=,tag:LHAuihxP9D9o1t7lm5k9IA==,type:str]",
"type": "ENC[AES256_GCM,data:tKkPDNsq43XVdqs6CVF4kT0kAucVwbUceeMO2gQLh072Eg==,iv:KGCbGh8BQo/VOXOIBDegwflh61YccfxiZRAXz5eArEw=,tag:yXc6EiFBgjkF0mmkhbaSYg==,type:str]",
"name": "ENC[AES256_GCM,data:k4s=,iv:aag5bnSKJI8VfKZcgjyzLIqUcUOlRxvEkGveHdBvrAQ=,tag:34RyCir5d91Jdgu+Dp8Tsw==,type:str]",
"provider": "ENC[AES256_GCM,data:qwN3KxyG6ubP/Wfp+AdENG/UjCO77G4wjawYvnw0dkYlPwQdqhwRowL3GnjcfY0oPQ==,iv:C5cozCB9nvKSXBf+Xw10M0mp5CYi4U5ZQ1rS257NrZw=,tag:ger5ds7sjs905vPbF99fQQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:ew==,iv:mKetwBnX242tzPdda9xt6ZvOXqXzU8VaUuuVLqHDOHM=,tag:G4Ql5Hb1eSCQvh38EEkETQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alias_name_source": "ENC[AES256_GCM,data:m1RipkElfjh0+dB1ojGOa8JR,iv:c9RQ/WA9Nz6dfk4Hk3l0SVm45INKOk9+dHlyniPGvyo=,tag:deJUHL4bpiQx5vgkrCFz8g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"audience": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:4J8kxxI5AsXbog==,iv:cJy+utSGGaZkg5OTSFBZpfeDhiq+5zi/032m7Fs9Uew=,tag:zQeVK91ILUA6ZG3NwWq+6Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_service_account_names": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:N8jG02cCtw==,iv:C3ivRE0eDLoqXBCYpdYIxPvQL8J2vYgmzLp0OdJYw5s=,tag:ATRunsSbZMt9uZjXQladNw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"bound_service_account_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:nL2i5V2jtJFp+Q==,iv:uQOGVfSy25oRX4fpVGKlIxuOKOjmGfCLoUso42/AZNU=,tag:zN4LFBGeV/vHi72722Etkw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:8lxWu/1eJIky7UdwQscQUeb6fxe5DGs=,iv:FjIEeeF9vNG3D+v8Yc4m12LTqYN7F15sq2DNvk/9LiE=,tag:i0PTazZxAVwrr13RlMdvTg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:BLI=,iv:Owtw3oFJG+RzWvYVXx298sNpwzuexAF21i1SDf82aj8=,tag:pIGvXDYo9zEi0RTlq2yKCQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:GA==,iv:lDWys4XYWvJjLc+orCQRY7xwaSLiv8CidPiTcV3z3Rc=,tag:cgeSB5VPWZtx2m6b4dcV+w==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:4Q==,iv:WlKyguquILKIZFZ7TpluzfwHxFOCxoFxb5vdOwSPBEw=,tag:k+LCra7yoXIuJGdy1IJowA==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:7VNwLmw=,iv:W22vbrr1TX3OematZ/NZ7PlBaoyi6vq4u2OkmRuxCe0=,tag:00SJYhreOFa7hGHAp1eT8A==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:Tg==,iv:vuG8eSlGSsbPxkSglzHPpHV14fVj9RdyuZzTCL5PDCs=,tag:+eb8ULViTmWwtzQnnI8Pzw==,type:float]",
"token_period": "ENC[AES256_GCM,data:wylE/I7z,iv:5M+5Y/8gymXdwjbOLjqohGGkrPoSTfjcvYWJGSRsmvQ=,tag:J8TgaD059mm6NloPqrUsQw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Baw=,iv:Rc3rju116RrfpZgUaE7lcFpG/xfbKzmvZUHJ+5dA3fU=,tag:q3QlbohuQYGfCkd9BOf3Rw==,type:str]",
"ENC[AES256_GCM,data:ZK6ACK9BGqUHU0pPvD9w,iv:uoY2a4bsoByBfa5cYXtAS026L6wLWajLqnIbUOGosIg=,tag:PnEOFdqKR4V3bUfTCU9LXQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:NwM+ZXyO,iv:Xm5CKUVP/p9uV9/07CJt6qH/32EKNlO2FO9kTAvsQXE=,tag:xOUqqazEfi+L94pHMyKrwA==,type:float]",
"token_type": "ENC[AES256_GCM,data:8Cu+73cItA==,iv:XFtnHuALCcTCbwWb8Dv3u1OQInGwYwuLT0qEKuQOCdM=,tag:wj/kNHXiHEJa3AF6Mtst7w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:SA==,iv:G7hupP+fHrXExb2nOd2o2oAngqX8uHkpnBn3hpCItrQ=,tag:GrS6dveerENhePUiGGtFnA==,type:float]",
"private": "ENC[AES256_GCM,data:CXYHZR8seig=,iv:n0PB7F3rr8ku6cmN6GFyrh/Q2XrtPhjEWzwYebAFuOI=,tag:CypDLa+Bd9jmkC144TbTcQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:96shubUUD24i20I2AJCfxbvK,iv:Fe3G3h8yWm2F68LuAuykP565TelEAmWsLslhKSuVrdk=,tag:hgSP8ErxNEWYg11/lqYtmA==,type:str]",
"ENC[AES256_GCM,data:kOV/vNLj/BgF/hN0fve5Rl8flNmTyCrcpoM=,iv:SdYp7Mw82LhAxIiC/wF2kfGrWuMInpBpdvtyHvYoDd8=,tag:R23DyM5hM3DG/sw/kylSxA==,type:str]",
"ENC[AES256_GCM,data:DKlff3jZlTmFIjPcOSzc8tqQHVeIkEClX3WCxVE=,iv:m5irq1b2ttBr3DO57wSAtPr465vW2mKgNGE/orKQBZc=,tag:WoeGpnIwFaznHCroxN2FIQ==,type:str]",
"ENC[AES256_GCM,data:QRPH1+5tDT605WLZrBTt,iv:jUUfvFkQBWdNr2aVEEbIA6b5OGEW40kRhtvmYQlgR0Y=,tag:WFdclx1FJcPYa7QrC89IfQ==,type:str]",
"ENC[AES256_GCM,data:NzkdCcSnT6HYGTIELX7oayO0aZFALXPY1pKyXw==,iv:MtrMfPJjBzuRUfV2nnA/VroC2VXVXmRJeb8gOIddFJY=,tag:kMCBoMyWJcROBpvHM57lpg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:azL7jjUDcw==,iv:9hCP7B3gijmiGq3wu7BLeWxALap5wI6JyNreFTrT/d0=,tag:XdwrJS8k8yxH0YbKJe8ZGQ==,type:str]",
"type": "ENC[AES256_GCM,data:ezMVaG6nPTjaQbofYpFvXkAN/3UAw7ysfK/4VrZtKv+bYQ==,iv:C5h2M58g3dQUo+Zh65KcSuVPVTRwrTnNfil7XOUGm44=,tag:cnxDy/e5GVorcKJL0ZZgxw==,type:str]",
"name": "ENC[AES256_GCM,data:qLtj,iv:YKbx44ZBNpw8ndulq+gR6cZo64SQMkDlGssZCx8HS2g=,tag:xM/dqUW3EN/WFpOMWpcvWQ==,type:str]",
"provider": "ENC[AES256_GCM,data:oYubfdBVUnMH8Ojn1nPaZyksNQKu0j77nJW07zt55HDSjXkPVvt2la+NMludoxbQ+A==,iv:1yeCkw2SOUhpzkJgHkV+Kt0mLzzLxRK7Ky9A6uZHSvs=,tag:JwlZ6Ercjg3XoeMWek22ww==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:WQ==,iv:dh6oQWa12xxkBFDFABsGGtgjR7VC6IfE60fDc0eDGRg=,tag:EpOFXEHnfHjTfEJG7zO1cg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alias_name_source": "ENC[AES256_GCM,data:tfhUqZVfFrkNq4Q92VVDjcXV,iv:a3Ynj8nPg2s0BawGAlmSDJF7F43B/TA3XCZrScFzIZo=,tag:8QFU8Z0VUxjw3KaZDLVJcQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"audience": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:361ztpBa7G1JRQ==,iv:nAwJ8k/xN3H6uiuVkE8E2tYfNsj6OCAa0vOaFWrDRvQ=,tag:k0R2CjTtCP+go+RXbZkWUg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_service_account_names": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:5VVyY6IybQQwpyitIUitVg==,iv:VLTFwOVFvQM5VT/XMf2Lt1J54hjDpI8Qj0cPPNLOHGU=,tag:JqO9za4fKZaQ/OQJOg/5NA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"bound_service_account_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:O+ZQaUOnbRWM+fJ9CwpfWA==,iv:cWQW2neeeUdz2JEkhynaZvWQ10/fOduIpuR8LxI8LB0=,tag:lrmtHIB9pKYoV/Om0V1cGQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:pvQ1jj+DM3/T/BDTxAWWRAZ+wopFpVPg,iv:YWhj42GW7mbEWz6/2I+J6T5xbha4VKjVhCFrwy7dcJk=,tag:9G8XnZdsU1l86VK/5qpqtw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:66mM,iv:e+0IyfgDPLiESgmV3nX0xpLj/3Oqnd/QHaTw6ZAnesQ=,tag:Y9j9SGHoiP+IHuKn9jj1fg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:pA==,iv:u9QimAoqXVn4vyj937YfaVUEXZOCEKN/KUFCfkc/9Sc=,tag:Wrpxy8BVmOWBxLwTzp7lwg==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:0w==,iv:H/r1iFnOjMVQaJY+pjL2J7ernXrsMjmFEXIpXRGlv04=,tag:p6NaQEgkUNkEGi5MupsycA==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:2WMXI1I=,iv:Aumal0xp9/F63EUzvOxbJGV3mWeadL6ZziuS5e2l3vg=,tag:smJ1jFNxi2MtV17+qy+fUw==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:aQ==,iv:fg6/XZ7KBhsHjBcjL2wrrrH85ZRZQgYy1cjx27aCerI=,tag:9UdIB8lsKpNNkVYQneVRcA==,type:float]",
"token_period": "ENC[AES256_GCM,data:ztdTNk1E,iv:BgIpNm8Dz2qxu8QxU0dLaotWViVLLAbNELxCoQK/Ojw=,tag:LXTRovkyT0wd+bB92m1t7Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:oQvbAgO8EpJRBg==,iv:uHSX/3pkkf5dQ91c/og8ggiMb8bQjpoV8UnmaBuISq0=,tag:xbjSoPFC+VmErdAxFcEfAA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:gloLDMKK,iv:uMqo1qvzwdwq9MgNWhOnZG1T0urWRoA5RGikiCB0w20=,tag:g4JQtDeJignXEENTwUAJhQ==,type:float]",
"token_type": "ENC[AES256_GCM,data:CTPkwO21aw==,iv:s4E0OuobWMofo4/X4n/pLjN949KUhvD+xGRyWS1fWv0=,tag:FHyn4UWl1dvMFDdhy/tQZA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:2Q==,iv:X92EVoTYBfOVe0W5X0NX3ZP/yx062kL1N+58foKUALE=,tag:Cj8IXvNiRBkFDXSPb9q2aA==,type:float]",
"private": "ENC[AES256_GCM,data:BAKYNjaZgDI=,iv:E48wjI3q0Lyl9Jf4fU/HFOfPQwq04zNqcBgLj7UEcv4=,tag:XFwDBV8nOcAeSSdc0YEybw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:HuYSJ6bhHti72ijmMoowEgwo,iv:dbltpAXFYck2WAUbsvkwWs2dP1GfrNh7yn5CFKveQR8=,tag:xZaI/GUNSTXTKDEiA7NJpw==,type:str]",
"ENC[AES256_GCM,data:x5VI1vR3gI449UQuET+5+l6O2iy4xBEeWfw=,iv:xBoDHBgnrCOVRlXsK7wcXVVV5BiwfRp2t1ruJVLH3iU=,tag:Ttw8jRoI98d+blH88OkJPw==,type:str]",
"ENC[AES256_GCM,data:k7YEQkPPGVd01REAk94u79UXutG9bOZYvF5wDwI=,iv:tsaZdXOqut7+Sgnz8OTnqWqa3SvNIpd5tvEs3l8MbGA=,tag:5m5zTr3eplIspYzw6GnOKA==,type:str]",
"ENC[AES256_GCM,data:CoRQFlaQHM/mYsnIqSnffrFc2kSlflY=,iv:HWWD4CtzXZp4+hWcM6y7qU7CC5DdG9fh2G/NThTs6z8=,tag:JaBj515AHOgVP8DgjER8aQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:D8TioO5BvA==,iv:vvIdNzOM2vX93GoJgv8tnRDyUruI9yQ229mi74P/UFo=,tag:zz5lYo/IGmF8o6JptvO5HQ==,type:str]",
"type": "ENC[AES256_GCM,data:d8999YO1meC8EXh6wN6UcajdLq2SWCtwvJ48en89mHt8gQ==,iv:BU+aQ+ps/niPeHJay2HtiQhSWG1MNXyA7axwiK0V8lg=,tag:L++KJeA8N+SecDzP98fc6w==,type:str]",
"name": "ENC[AES256_GCM,data:D426DaoJDLo=,iv:Ccxrl8Fk2nTavZePzOgmIfnl9GRwS9lFrq6dfwbW3Yo=,tag:VXRV8o7yv5W5gZAOIrHaAQ==,type:str]",
"provider": "ENC[AES256_GCM,data:buJp4LRosqFME/i5r69aoIoMQd9dlAoCP2yFA50glO+erBvZnRg9tH/QBxv4n/AC+Q==,iv:l7ON44ojJqJsgcG4p5cAmAiFy60/Ih5xHhIALWFRXK0=,tag:Znm9BWevhCLd8nADxj3r9g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:2Q==,iv:Y3Foj4VapuGn/qjwqyKAJedvCIdQUnOLxIo2en5MnrM=,tag:kud9zrpsv/RRcOGFcbXTkw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alias_name_source": "ENC[AES256_GCM,data:X+N8jNcSbnsdVulHlXnVuUit,iv:0q75oAKxGcMr2Fi/Q3Elu0GbPCrqI4++RvvZwZ4+frU=,tag:bvNSR+zlI0B3xR4HfhRN/Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"audience": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:LWEya0D49+MDtw==,iv:R9FKDu7JNtNtmczi+ZEVYOABCmr6h9A3SwTZbB67/jk=,tag:hXMbUHD1eNhTLX7QyZEijg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_service_account_names": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:CCzYFKzZNyA=,iv:KyEsp+dvg2CzVlxsETzb/Lr24c1Si3xiUf+8E3IJbgU=,tag:8Rd0YhTIBTUbC+XTe4Gmvg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"bound_service_account_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:iQ5/69JQOvQ=,iv:3q2TcGNPsyiVXxaUDT2SA8AWcR7RMuR9tRyscCS7D6g=,tag:xLt4RqixEYbRvVeJh/MJcQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:TEJuxDxVw8fSiS7ONafF6Ql/+u0kRuAad2EolSE=,iv:OtIiHt5jJkt65KKAkM1uElfJVaJqnju6lG2yLYgW1mE=,tag:B6sC2kKckmlw1iKeW9huhQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:/trwCPeflW0=,iv:+j3BzEXnGmY+/dmu7kRvYcH+gII6pduFALrCefaMU7Y=,tag:N6hcaqb8oO/+/6cDNSPsBA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:MA==,iv:csQsFYMGWUS1KHtwp8gC/UBBj2+bpcyZ3CqusLmLk8Q=,tag:KnMNXgD8t2TdCEGSlT2Exg==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:+A==,iv:jjQdPJM4RhSIBcejMlYH2EDaujem2hk62HoHtlG5mz4=,tag:OlFh77rs9SMr4vu49zR0+Q==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:g7fImC8=,iv:C89k1A9V5eSggkkIlvJIApJK+Xp1iGxII8AxhxQe7sg=,tag:rXvhGdnXnJDXIAPM28NbvQ==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:+A==,iv:3riG32IgtWB+8Q7ORDefc3rrkgQ1DDy99wYcJ/59J1Y=,tag:jS3qyQnSlf4nhxBxoquHow==,type:float]",
"token_period": "ENC[AES256_GCM,data:v5OQQnVM,iv:YhX2ZQ41vgObrckpZtXzWxCZxdFxwnHymokBiucjt1U=,tag:UHkfXmIqoH/pk1mkOCWn8Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:+Q/wsHKPfTU7XhmX,iv:EPRka/5QFixPxgPveUZP0BhMw6sZFHRc85nate4j2Rc=,tag:Ay7o1LDXUrnwlxUmM+jdaw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:ZYLfdUDH,iv:nP9bh9BUNubYH6qCii6ZfeP5gDKP1gBe3sgZhV7N7co=,tag:jBfiCHKPhe33DPq9C5cX3Q==,type:float]",
"token_type": "ENC[AES256_GCM,data:TXwXZX4moA==,iv:GHZqUfbuE35tZhpKIwGNRbO7A3ExLjw2aPTqstjiH+c=,tag:cuPbSzpjdv9pckZGkebIXA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:5g==,iv:Vm6ON3oQ6BVnv5AvtkpPF9ex9DPMBMTWYhQHpsuOyoI=,tag:tOf3f4e8z2Vltu9llG/JAA==,type:float]",
"private": "ENC[AES256_GCM,data:fXfoSSoy8MI=,iv:9Ea0J9FGzC5WVHp9ZV/aITlUxfyNfGTbQcf6KDeby3o=,tag:NTtfMtm8Kj3F3tzZ8UQp4Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:UOq3K5OERf/JX3RVmi7zECDe,iv:p/ERQmsyC9VHorJrmXKFJJ5IZ1+PJtbjQKRKsePZONM=,tag:pbR2m4LUkXQDuwV2HzeUXA==,type:str]",
"ENC[AES256_GCM,data:8kzK7yRt5lUDkfuD3AtaBKGZJDa2sAxvj60=,iv:jNe5iHOH2yXpU6XjwPK/wS2YZwLegG9YQUkVAfN4jR0=,tag:3Fz2N6Cn3TdCuehIMSrj9g==,type:str]",
"ENC[AES256_GCM,data:dZS4FKophXHgwRBnz4eeoFOzYL+EQAtWHSdNqFY=,iv:k67dVCE1z+ksdPgTtRQeYpKUXaw6M7j/imIFloUF7Cw=,tag:iCBzFAyM9R4yMW+IK3aztA==,type:str]",
"ENC[AES256_GCM,data:XMjpjU7HsFwnovM/rADJCFfYV7H5mURhvw==,iv:hTAuXkJjhFFttG4oK26nGA2HnfKhJIdAIIEFEcXtfa8=,tag:A2WdwNyNFWfHMmgqAdND5Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:9t3joE7hxQ==,iv:I4xx9sMB8x25W9rED4qZgGoZsSI9HjOWIhZqz2l/go4=,tag:bbj7UwdWCbex+eQOvepeng==,type:str]",
"type": "ENC[AES256_GCM,data:B/MVjIVcO05RPwCR+q6Csk4D/9Qg9GxM8upgZkZBuyZf3A==,iv:j07opa3xW94eG0gPEFR4G3bn0wpAkhGJ1qVsBARSiic=,tag:L99LUAmsLJog14nVjs1GbQ==,type:str]",
"name": "ENC[AES256_GCM,data:8cPHFjvpQeU1kfCJePo5,iv:M+Y4z9eG7jZ5C+Wfv3jhsCeMf9ywZPflTM2BHpn67KU=,tag:zx7pfXG9pk/0aIdkWYGZtw==,type:str]",
"provider": "ENC[AES256_GCM,data:NNh5ifrOwi86UQWWHXu/YjLOzabOTDWtDaLoY8egiNxtrem32ovDSzsLNXloYAOpNg==,iv:dB22mH1AKmpqk4EL5XtpSL7hyMuavF6RibURSBRhQUE=,tag:GFKkRXpuj5+Pf+J79QFBUA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:BQ==,iv:+Ghj3hCchZoSxAcUFM3LEiMvKqZjVavVlkAi2ulHwk8=,tag:0ZL3JXALw8qstG2y8Urv7Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alias_name_source": "ENC[AES256_GCM,data:VuEYvhGuy1cPbfPdmWSRwi79,iv:isnSkt6/JqQNHB9u6eiKcHftT4NTYC2DE7vHtZ5Ihyg=,tag:i/7aoNh6WdYrEQuY1ZMbTw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"audience": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:90/Fi9FgWkscLg==,iv:rI/vSgkyTX6lhfGHpZ/0cAD3jTzOf0hLwcF/EqLgdsQ=,tag:Q3BzPP/Kl0RZpVhMQ5wOzg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_service_account_names": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:olNP9cquIgLlxn3e,iv:Zs10gWRc7LssxjNWdTdPdjjyis0Aw5E/D80JlVBXmZ0=,tag:LP76Dw1vjygahUbpQy62GQ==,type:str]",
"ENC[AES256_GCM,data:ts4x2/0htQ==,iv:LyH7FCcEl3kVTu6onwm4rxHxQikMXcfgTcZhMJ0ltYA=,tag:9yU3gtxKeqRntowu9bZehA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"bound_service_account_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Gn9TnFvFi8FDxwRv,iv:52R3zLa2M7tmH2lCykg7295KNL3Py6gHmNfAyW0+OQg=,tag:HxZ/5GsRMYs9A1k1UAMW6w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:DbC6aXbdGvyWUkBs2YzxvKcL54+4QjyZQWKTv+E9kttvrhZ9,iv:27ezPZNc3+OSOyOOVjfuiphxRM7nRm+mECvLGWYyrMQ=,tag:GcLUeNhQgf5Nj2C1EaVs7g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:05AURXDiNGcGW03LYImg,iv:7ACHpTRuUPi9YBeT6bJsirTn8ck7tCi4nyV3XfDAwXQ=,tag:s/iOQf1PX32Gv2iJO8ckzw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:Qg==,iv:ERZst9qKzZ3hYL4QJotRz0a4BvbJQRJEATg0DtfbSQs=,tag:42uSPhX7BKyTHV6KNwKbcw==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:6w==,iv:wOh6P5CwbgoL3lCLCSuExTmRzT5ULXgfTRINuVvnda8=,tag:Nou6/66FseBkFggsl9XHng==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:AjL5/Fc=,iv:hzB9YVTSOXlpsimMXGu3NydDqoP0JdaAPWAKk1rzJyQ=,tag:Fj2AcqCokvVDQy3jdl5qXw==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:3w==,iv:NnLNuyZLdqn5+r58aTXDVw1VVe2cXSLWN/rd92XaVBo=,tag:KHD93HXJjY06o3x364LE3A==,type:float]",
"token_period": "ENC[AES256_GCM,data:8yMZzeXN,iv:+Fik83fcXreICWwZveT9fHGI7UMe8FDSSi/P7bbxzQ8=,tag:fTqgAy0YX6gKlkAT69m5Vg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Ykm+aXIJ+FXqUfWrQ39O,iv:4karlRm1TPMJm3buNER8lz2mwaYZNXvbuU94qJx/bd4=,tag:Htqv5d6gFxmRRxDf6PRKGw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:BfQicWY8,iv:ofJn2keeZZQaYHYaRLmqCPJUctVhKr6N5o5eAAbrsb0=,tag:6TNUvK84k/Lus5pOx8jFgw==,type:float]",
"token_type": "ENC[AES256_GCM,data:gcPYB0KNyQ==,iv:oEAajMORw1ID1DCyGreHjVYV4jNX7u9yHr/puEBfxuU=,tag:MAaEY+R4TP7ChcdNUADfFA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:/Q==,iv:T8LvwdXcuA1x4gNrXSyfY7EUl0pyQj4XKbZwon6OMPg=,tag:ZcTGstOXb4/HrWOpuw+NtA==,type:float]",
"private": "ENC[AES256_GCM,data:kexWHvtJWJ0=,iv:Uxovg0/B8gLkctgMFw25sTpkivaf/Z6UCk1mzPwYqhA=,tag:UeaAR4ae8P2SUXggjC8KCw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:IMef2SkAt/qzIcl5xXwsozlP,iv:hDvQzGPJo77YrJKDCP/0iiiitsSYyVv3L/GrUip8C/8=,tag:VcbiqFcBINtknuJkBuovYw==,type:str]",
"ENC[AES256_GCM,data:pvkfjWBrkFN+C+MF5yLPFnIbr5ycRTLeq4I=,iv:2Kw9/cFVfaYTgQc+w9tk5UbsXyvrqfir07kBZcgdcxY=,tag:NiBMv/4z57B9ThtXXhGkgA==,type:str]",
"ENC[AES256_GCM,data:2ytObMM+Ku0TWTSR8FzbZFPrBAMw2LR2nmOwx6Y=,iv:hIgH1+FnvsKV7w0nvdloXPw8CvUTQCcplLPnAszr3lI=,tag:d0Jy82cgqEDVWjJOCPWK3A==,type:str]",
"ENC[AES256_GCM,data:GMQMyp3uUiMJ/oAF3lN5M7iNe3OPLjmrpxU5dA==,iv:UQiV2Mev1zWDbC3spkwV2sU1MUemQgHMnoZfxyAMoeQ=,tag:sEjx2ybY+g0k6zXqrgDnLQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:lI8vWq/2dw==,iv:monM3+VuvohOX4wjr8TOv+c+uSPgJQeKF+kfAi298u8=,tag:xAJhsgc7fbFk80GI3updpg==,type:str]",
"type": "ENC[AES256_GCM,data:r2xreZmU+zy9Ov8SfnrvzUEGUatR2zvhCEkIj64yotn7Ww==,iv:GxngBxBzfC8kHtU1beFgT789X0MbbVTTcc0nuBOabAA=,tag:FfT40UiqaMUqqBnmnNqnwg==,type:str]",
"name": "ENC[AES256_GCM,data:5HfQjEeNGt2eDudm2Q+S,iv:mST4/V1g958fEH9giGk14T8BRHNLjAEupt2OI0B0C2Q=,tag:Jx05RLsfZwGjkm/Ld5/MSQ==,type:str]",
"provider": "ENC[AES256_GCM,data:iGF8cpv3q7pvH3lCAgix8ezMHugJmEgjVnyzNAkfje+7ovfy0grttMwQ4+6Vxj4Dfw==,iv:LNt7fQ8JeCJHjw8bKmvsHM8z2WAYtRj3lvdTpMxXzO4=,tag:RO/ayZ5IakB46NEkhwlfJQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:gQ==,iv:MUWTq17TUTrv69VzIm3zB7Y38G0yWsgYEFaGCAAtK2A=,tag:IvErWEuN9nOm2jEKqbzJLg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"alias_name_source": "ENC[AES256_GCM,data:x2hnryRFtVsPPn5n3Mxw9u2q,iv:mTmJTTUC1hQyOHMBU9SZDPQCdqKavurnL/nLVnCks/w=,tag:wtetlqSmbmapyjtDYf8ayw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"audience": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:55v60Nz37XAXBg==,iv:BueL7nQTgbrE4i9aAgaKBSNZ3Qq80QfTIT97uSs9pQ4=,tag:76WTwsvBhs0dGSg13dBaOw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"bound_service_account_names": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Iwmnpw+l8A==,iv:VBTUoAAWsHYpI5ZsYm5naUo/0AMeR1B8pmWAvTYyvmg=,tag:tSvWOVnP0O/tQxR6LqgidQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"bound_service_account_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:6aDF3EdkAZVcCQ==,iv:stWtuskHxtBR1wHGORwmj+d11oe/LR09pLMqjFRe+uc=,tag:q0hhc30hTsylWriXD2HYoQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:gvDmMiANB34bfpffareRauO0RZ8a1gjJ0LJa58Vs+/0Ce9qY,iv:8nYDwCuImlYxEd71t1/TRUWs27zroNJqMW3CmG6HK2U=,tag:Jr2hxsRAsNXQ+By7KVCETA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"role_name": "ENC[AES256_GCM,data:Z9r4M5vHphUjzK10D9WN,iv:i1+kPQz9KeO+jhV7FT40O2MZPHltPJhf+Nb6ZcKu8jY=,tag:K0tXhnnx+tRqtcJt1odTaw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_bound_cidrs": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_explicit_max_ttl": "ENC[AES256_GCM,data:8g==,iv:pyfJ9zpg3ftq41DcI5wbhaSpaGETg2XalN08TFeEkJk=,tag:WvwKyL5T8+uJUdHUxwH4vg==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:Zg==,iv:+1bNcc0HoGPLiY8lge8Vp0HamcmyGtN3qzv6z9ejXJ4=,tag:Qp3webCLSsfgEI0Sk7LoSw==,type:float]",
"token_no_default_policy": "ENC[AES256_GCM,data:GcFFrbs=,iv:7c4urLYIXNAL3VXiEnIq1s8+gy4pPKIKtAdbZ8QL2tQ=,tag:Ct7lZt+/KGOm7F/XhMu/xA==,type:bool]",
"token_num_uses": "ENC[AES256_GCM,data:QA==,iv:GZ7AfaZGYy0HvgcKz/QFjqX89yMfFmPQqpl2Y7Ptu1E=,tag:TRHnM+dXF/355V5ArMSWTQ==,type:float]",
"token_period": "ENC[AES256_GCM,data:01oNer4t,iv:HTJkBPAxcuQc1wx1rpYt1svUWCJc0UDuNUVztChyYb4=,tag:7gSHy+mI7k0UfANin1l2Sg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"token_policies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:opEY36HIE8j/PWtRP6F2,iv:Br0EhcI7Ohn3S+cL6KVsksCIVSxSDBaVYvTYXS5WejQ=,tag:wf6c7L5llVDo1dHSZpg2GQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_ttl": "ENC[AES256_GCM,data:wd7BJzKM,iv:SLtfocjNounrVRSBYV2/rROuu+Utaasb+kGRT0btimc=,tag:NN3cvphK5S/LMBgWGO4Ypw==,type:float]",
"token_type": "ENC[AES256_GCM,data:HOMDufhIVw==,iv:JsQaZ2yQvCuOy4DOSUMDKL/3QLD6ISovvgHEWDy3OyE=,tag:CnT8F24kBy4M9nVKh/fNTw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:uA==,iv:ZEQhnzP0g2oyQ4vuetvAuIx4VXjv5EwDs4STpfpV/gQ=,tag:JaP/6SSBaBTXG4WwiltP/A==,type:float]",
"private": "ENC[AES256_GCM,data:O7qoD4/yNbM=,iv:8q2KTl1iLPiMDJ95IgZP/nREAvKInRIt0v7Dv63J38c=,tag:P8c3WT7sr7stXRw7vchfQA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Cck9G1Onew4SgwNHR5Ij/K+p,iv:mjTJ4quqfrJME0O1dpxeYR+iiKLRHrcT/TbSgc0VTqQ=,tag:E3bfqSNo80sKcldUur1b/A==,type:str]",
"ENC[AES256_GCM,data:CyCNdLMIvnSop+ZzqF/4o1+RccQqg5XMi1o=,iv:X0pJrBN30szD7HDrx49alktcgJhIM7xMRzL9nr/aGyQ=,tag:4YJzsOsMGVc7fqv6ydPnmw==,type:str]",
"ENC[AES256_GCM,data:Qppf9VcF5EZIhIBBwo/1k8RDzzCeZOWVCD/H+NI=,iv:HZoXklPRSXSKVZ8aq+KSc4X2n8p45YhGbAzm3XneU1I=,tag:K50bnco2RbtCZQCzV8ctVA==,type:str]",
"ENC[AES256_GCM,data:6+576JxTXsBBBH53Sny24/3wIBUn+YcDlXHu4w==,iv:MEW/Tv84Rs+uaFS4+tiZYgHXt3OyS/ExzvWoptcDXFk=,tag:2efcAh7tp+lFZUK4TkGbGw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:g3hOPQ27Sg==,iv:t5kSYQJa67qePrkX1eyzjeHND3VNEsGe9kVJF+gR0i0=,tag:XAqFvc+5rsmzMQMHdulsWQ==,type:str]",
"type": "ENC[AES256_GCM,data:2AlIqX4GuYj1XY5DDa1H6zwzicP/drxRQQmPKXw6HQ==,iv:UoPqVhhvkhRhSmqMAQxP9RKgOF2fS38LUf+ndWP1JSo=,tag:gLjcq1UV8LqUsB1vZjAuew==,type:str]",
"name": "ENC[AES256_GCM,data:rmdW,iv:vVZREnMZi0dkbHgoGpbQaGxgZM9GunrMv23PEE9KA5c=,tag:ENTciKk9fDyv7+CKYtsqcg==,type:str]",
"provider": "ENC[AES256_GCM,data:b0AxRL3uBpt577gzMRiVULDC42MhRhCdt18u84N6a9zreOBFZsl3aaVLzGJ1v7ql5A==,iv:JF3jTWMhdliiyFuXla2a6z2sVvMKLZqxj4FstS/J+CE=,tag:VhP7ViZEF5LEaa006U5PJA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Rg==,iv:LUXXZnfmJ8n7PEvsnSIrZReeZBl3oGi1HEjPtAWwv6E=,tag:/gnZ0sfZjwWZ4k4/ppFpmQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"accessor": "ENC[AES256_GCM,data:BdZnkYH60GY/yyOVd9ZlTsLhbQ==,iv:NiOHpBv9JlhnttPsaupmGAI0I3qhJCl90r3ht9mlQKU=,tag:/hV3jBErtzrb1eAMa8Krqg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"allowed_managed_keys": [],
"allowed_response_headers": [],
"audit_non_hmac_request_keys": [],
"audit_non_hmac_response_keys": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"default_lease_ttl_seconds": "ENC[AES256_GCM,data:IA==,iv:zFdpSojebn2+HqdBcy6ho7plBQJdDj8Oh613Ev4iBzI=,tag:1gSisZMrACxuFjZ2lp5Ihw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"delegated_auth_accessors": null,
"description": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"disable_local_ca_jwt": "ENC[AES256_GCM,data:QGJr25U=,iv:HR6l9VW5BUOQiWBMyidMQXB5JiPhcnGDC7TT8dJy+mQ=,tag:eEW2MvqrKQIKFebjpBymOA==,type:bool]",
"external_entropy_access": "ENC[AES256_GCM,data:0MhvAqU=,iv:xb7sGJ6Q+XEk/oESj7M97MY0YjaAqIXl3SXSg4rgMiY=,tag:bp0o3NE1NOWd9A44+yajQw==,type:bool]",
"id": "ENC[AES256_GCM,data:WCqF5dW7PAP30g==,iv:WCBOenKfqwE09oBbDlL7u3mdAbDwfsjhZFSizdjpkBQ=,tag:8Sk8RAa4GmxMdN/08aEF9g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity_token_key": "",
"kubernetes_ca_cert": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"kubernetes_host": "ENC[AES256_GCM,data:psXVjqYgH/BLji3yBmCTjKUC7/q95ibCsjtqeRHE,iv:CbPz0WxO1/Y4M90AZYH+zUEFHmwmACptv+lwZHA0f8U=,tag:b3zRi6R1s7tArDzRDfVtDw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"listing_visibility": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"local": "ENC[AES256_GCM,data:bUyoJ1A=,iv:oW/KD31qZ6rRCkB8CZoWvkURSYfNL4fx+NgEZlIGJXs=,tag:Hw/iI6gFw/NxobpHoamDNA==,type:bool]",
"max_lease_ttl_seconds": "ENC[AES256_GCM,data:Dw==,iv:ZgTYK092MhO8oPNjte2Qr8zXYo/WDFJnVqqJ+joNElg=,tag:StYFlnAPgNpP5LMlRALt4A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"options": {},
"passthrough_request_headers": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:3r7XyZ71gHhQnw==,iv:pemp0OZMFEOoiK5Ej3MiL5lTQQnhNRqFqhYxoVvva+Q=,tag:zGeLlMRxlgc4luCH/XqNTQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"plugin_version": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"seal_wrap": "ENC[AES256_GCM,data:Baj/fEY=,iv:/wcmBv1aVdyd/eplVVL684h0rsUJEIIdMbhkrh4rZRQ=,tag:tpehFr6jZgqelV8GEuqekA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"service_account_jwt": null
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:eFOjU6y/Uo8=,iv:/mpIJzzHXuwf329MXJRC4rmlEB7bd56Dc8SeoreLqnA=,tag:kue92W1QMzPfFyhgbcddYw==,type:str]",
"value": "ENC[AES256_GCM,data:mvgygN8tLLz3lFLIKH1/jd/1JA==,iv:AKSunE6dhg0bF6E7eFTDNLFLeUk075HCRLngP0IsD/U=,tag:SDo2WHCF8x1OeqhQ3vf/0A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:gg==,iv:+qRKebfpyq7Ha9NnuXJR6bBm8eS5joMbWQfwyuuIBic=,tag:2ZNspgEAXpqE4hja0+uqRQ==,type:float]",
"private": "ENC[AES256_GCM,data:dkks2TtF4sc=,iv:Oe7skFbPJ25hU7kWaQPWN97E4nkT8uCKLCGQ3zmHNXA=,tag:HsK0XIPCOYdJDl7h5lwqQg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:32oJbWUSL1/bCSLVfwZfDhxV,iv:PBYvTDcWoyHLxyStM/iJOYRv3daqwBTqeLmhWYDOY84=,tag:hAcoFitFp8LpkAQHgCp0ZA==,type:str]",
"ENC[AES256_GCM,data:WzvC8AlY98JZ5mBp1lMImwjSeDHXWd9TvMk=,iv:Dsr1G1UKT1t/5ZSM+s0SH6Ercjvhol6EDs1Fc7XE1P4=,tag:zT9kBSXoWeMrBT9etQmAlQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:qZnI0s0jBA==,iv:4NMc5Uf620DoBgqGpSscZJa8NkzoWr5gsBhIFlKDpGA=,tag:Icl0EjAgEJ//jqwdtvo9Hw==,type:str]",
"type": "ENC[AES256_GCM,data:y+FLq9EM1LjIh13Qgl0OGVF+2WKmMcKfiry+sMcb+XY2sgzR,iv:Zi8jtC6MxE7psu2AnxuGNIfV8URjc4/6eBppvLj3f18=,tag:M4z1fDXhpurAf7fKo19vCg==,type:str]",
"name": "ENC[AES256_GCM,data:dplgl1ZutmbbQ3o=,iv:cIFK282BpxSsQnOZtpUDWyAs1czqIZAZiuMhvaG+RnA=,tag:4ZOjMp0Rvln1Ws49tGbPcA==,type:str]",
"provider": "ENC[AES256_GCM,data:lqdvfgmuZyBpBFCBOGa+XY0f3Wp866jP/KOju1xTJSNsKxBlbwxWI/9Wr6pWF7DTJw==,iv:YaQ2Tfo1q8I20g4MvKkeZJZDkXWQUQpUTcTZR+pwZk0=,tag:b2iPasvHEkGiObpvzIKRtQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Gw==,iv:9Ufq9RILRUpu/PqG32we97V7EOCU/frigfJONh7KccM=,tag:vfYP3Ze5T3J4tkyESamIqw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:2w==,iv:kK/BBMaDZm3KRTA1Ew2OIVjkxv7VG23FMp+lD9KB9Cs=,tag:n/QoHiXarLbafDiodCqzQA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:2/cMY/C3lqkIMw==,iv:gfcM3N1YhpdYYNLMdP/HUbTupL6ACogGLFxrhbppBno=,tag:zwP3An55Ckejnd/kQvoW1g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:zCkQH2uAwNyrYpFo+P0LzpqxnmZQV/ON5YbxAw==,iv:yJspOwqVCfQGqKdLnD9E1XKYdiGrlM9ebg3vs55BBuY=,tag:zkpLEbJ5tmTR563eO6KCXg==,type:str]",
"kubernetes_role_name": "ENC[AES256_GCM,data:V6jHfJZ1PWmf0qg=,iv:fyHEiX0RZt7NstZv6IGRhQIYXVr8Iz13Dn6qw7Rz/KM=,tag:/UvfV+GAqI5DRkwkUf05cQ==,type:str]",
"kubernetes_role_type": "ENC[AES256_GCM,data:iuOvMYTeiKa/UWk=,iv:VITMXM/DAVPkuGEnMUijWE5E2VYSL6HZHGJy61n8hgU=,tag:W0dt6G01XFO35PvnHTrZsg==,type:str]",
"name": "ENC[AES256_GCM,data:I7+TkySSAG65gzA=,iv:BL/D5lVIp1LlQnUOEcI0YwXZmDF8anj41bdHU22i7h8=,tag:Ou9RG/gbPN0IXTCSoUp6Vw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
"service_account_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_default_ttl": "ENC[AES256_GCM,data:L6Ujog==,iv:UQeu/ye8V6dqycD/dYnEygOriV/ueyzCbxdVuDrPEs8=,tag:caX1vZSMB4f9UF+jJZH0/w==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:VhKM9w==,iv:rj8paB50Q65pgJ/Q4LNYDTmzU70lmoR6MFeMGNrweno=,tag:Sncr9rGxxGT05HAzXIf8oA==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:tA==,iv:50Pdvf/1wfFqXT3/7ZPI5xms0IxymH3E17Aytx8miXU=,tag:hb7kf12NQxjdVQqrX/QLiQ==,type:float]",
"private": "ENC[AES256_GCM,data:qeMtY1lYny8=,iv:BVUJ1N5R58uKxuLp/KBsz9CBjMyB3RK9g71iVcVu81c=,tag:pM1imgdr2tBWlnw9yOTvMA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:eULm7NJwHb6IThvOGjjMAQSA,iv:vfd8suVq2EgTMQ+4q33kkmWvBbxyNyXa7ik3MCYoJjY=,tag:UFfr93rTHBGAfpTXGUL6dg==,type:str]",
"ENC[AES256_GCM,data:+nqnSY744fc7JmCkbYd2oDK1Lw4UUpnBW65nKQlUqGAVtC4=,iv:ZpleCiwXdNwZpo9hGg//2p2WZ2tnu7z4LxwHRlHfNGk=,tag:740HLUe/UYCvevustWDGyA==,type:str]",
"ENC[AES256_GCM,data:jt5JCc4svdoSGKN7kUJX34zCzBp4QzpKPyw=,iv:/wEapGAF1Qn0kk02o0BqANFZ/RR5GWboVBQE0ClONTE=,tag:pvulZljUyYUDUXz7coo7bw==,type:str]",
"ENC[AES256_GCM,data:Gw68l25lmRzkYOdKCndaIPr615EMnevXnf/qGu4ghpiF4/Q=,iv:WUeF2gCkeyFLKM3DeFt6deXN1mVJ85dIDgwnj1HYbdQ=,tag:D/VYZBjEhq4yPxLsMdTQaA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:gF1m0UlOng==,iv:8Ruen51xD6m3Tm7MEoB/X/UngHGTh8ZdjpUm31SNYmw=,tag:pTy/hoUM4Ll0BM+BZladbw==,type:str]",
"type": "ENC[AES256_GCM,data:TKBKIuKXwGwUvF/y/V4BK17tiGBKpsQMlB+W3xi1JpdwKV9g,iv:WGc/7RSap230JybiuDmm7g0a+e0Hn3DhSKty5Hw9Mgk=,tag:/xXlr/sIc1JalNS4N2qi4g==,type:str]",
"name": "ENC[AES256_GCM,data:Z/nRppoQYz8o3yBe0YZx,iv:T+0siMPV4tQezulO3Rmw73j502Jn3+u7hPVkvlrfilE=,tag:wUZadkcZWt0xXPfJ05d/AQ==,type:str]",
"provider": "ENC[AES256_GCM,data:o477AC149OoKfl2bTshIhXBHh29JuYgzjNeTgVAfmvZWt9q9vDGMIwdQLVBYFh9tXg==,iv:/puNKm/qRrMBTArmj7JRcX2feh8q+ETWaNyPEFVLErk=,tag:wLjNxuFQy3XGAXYGRwtOUg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Pw==,iv:UpO61WbEzFCoK/vN5fh1ea6/8R8CwzVmCpoHg+b8km4=,tag:C+Ec0WuGJYl86en0dXCdww==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:whwEVm0jrgeD49p8u8e6JEqYTOw=,iv:Df1FpaqqRi0yJyeOqxCgFp3BntWb5JDhuGt8UKBTKBo=,tag:sbK+1KDLCBO19LOCG17gPA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:P5YmqQ1PdwY00g==,iv:R34RUwlxMRPhjCOxbR3sgDTTSkt+8Y2fnZfX2kwvt+M=,tag:2G0PDcNs2WGzj0xjs0nUZg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:5hIEwJJzaQR6AlgJIWWN+DsnPqoC3KRRs4l/OnWYuKk=,iv:/VDr4FiYqiZL/+ZUZe9S6Hl7dXp7Ul3AIMZROZ+S1ac=,tag:NXTQZVTPO0jQKOjsWMSF/w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"kubernetes_role_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"kubernetes_role_type": "ENC[AES256_GCM,data:n5AuQQ==,iv:XA16ZyO4GR6jH9h4L5R9c6LWmAPVTrgieo61DW7Sm50=,tag:WTGuCGJxjVBOWz+qtTNC3w==,type:str]",
"name": "ENC[AES256_GCM,data:vB/FQl5l65K7fSi2VjuH,iv:/0dWRpdD62rckitWuJZgph3GcHcUOOEXpWyT5Qvztpo=,tag:Tr+EdgYzp5DfuRW2OcpjeA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"service_account_name": "ENC[AES256_GCM,data:nhGCDAOHloCFv7lVC9CTEYEAWnk=,iv:dlXd0Do2+pKLAq14/5YxilFZL94buTafTCu2TDY2ChY=,tag:XcZqjMZUfJx3aqFnGZoN1Q==,type:str]",
"token_default_ttl": "ENC[AES256_GCM,data:3zI/hQ==,iv:R/LLAbHV3jDPyLFUB/estBnjFkIMWhFYilWYHLqOnQE=,tag:JlsfzdFfgvNgN/+42Bw+JQ==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:D8z7i9g=,iv:8EzwO4VaqzseKovlHNNTBTFpsymOK3+dVJLIU1XqXWc=,tag:2y6h/w4cwm0Ga+iLV+5ydA==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:zQ==,iv:bsy5iYkrWuri7pO42kkofcY552oMgMz2Y3tWIMhjCo4=,tag:QG5R+ZiLnaj5IBCuISdKyA==,type:float]",
"private": "ENC[AES256_GCM,data:Vh9KvxLrJSA=,iv:iOVi3Yhz7w6WSNCvIpOyqQIYJYvziUXeGIaFjrbN+6g=,tag:mHJtGfsLCvxrcShKt0XV9Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Tp8mr6O5/kMh4dMhvQYYwtxi,iv:3Y7vVBeNhH5nM8UBIiguyN2KATaiJkKhRdvT06P0WhI=,tag:2lkrcz3tgrRiej8XY9y6Ng==,type:str]",
"ENC[AES256_GCM,data:ImcYjkMMifxsIzD+5zyjVm+GvCn2tbYel9Y=,iv:MyaK85ii4r/jrX8INNbkHzwf1iwNzVZuelHj78SQmjU=,tag:8VNvZbz62XoG+xbNX3NJEg==,type:str]",
"ENC[AES256_GCM,data:/KUdso8nJkDunf9bSfFqaJlxa+G2a5MBpgT/cacrkrANGI4=,iv:SHLPAze7d+W3Ii4rJzXdW/RNXMGux8KhA/pTsJ3Jur0=,tag:nEomz9gRc+hRSVLvKtZ0Vw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:gf1JR8KnuA==,iv:i5kaKgmP7zWmiJqehuE2pMvI2Qr3ty2vYgVgT9z1zuk=,tag:rup5aKnRgjEDMhCkZsQsHQ==,type:str]",
"type": "ENC[AES256_GCM,data:nbWJBQXb5yRxSweLD37+hsvMFzhWilXLpasKnOSvSScndiK/,iv:y8tjAkQ7r2dk11guXqSTzkowR8/4z9qAxD8eUo4ir9I=,tag:F3+3S3J00xhDYLKWjdMIdw==,type:str]",
"name": "ENC[AES256_GCM,data:xiuVP1qHaHEZbEw=,iv:Nogs4peq39BtoPKTiPviF/UHUU6BbnV5/LKcr0S5F9U=,tag:GQEmYUYgVaK7SbC+z6ZgIw==,type:str]",
"provider": "ENC[AES256_GCM,data:yq3Z6M6lwjhSHB8cyRxsFtTKyNkeNGee6BgqUF2PREBVjl1gRSr+AECSIUy3DN8ikA==,iv:iJO9SinU2tj0Jsv5MyAnc8U8ks4pPd/iFnNV07WV4Tc=,tag:oBs+jLxKffxdjQtN7W9MOw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:ag==,iv:k/evLgDjNDZxQyABZ1gnPGVMZHJCEPrarU+oNUaKv6c=,tag:kp8HB3q7UKG8cd3uVQ0AFw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:Rw==,iv:v11JJ6r9R2C8Nj/Udq86T1b3DzuDXkXeNonVEgKgb4Y=,tag:ZxJ2Z5yXQ7AoPLS+bbS6jw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:URjHTGLONRflLA==,iv:+S0lcg08B1tbrGdaHHHJYITBuEsZeozvmkmI1Y0OORA=,tag:rCkWjdEsI74dUeifJMmxnw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:b0auw6U9Ms0VWr6v4ClbfCnyBUeqY5PVy7wkyA==,iv:RiHRsfr12/d+xcbuLk5PKHlWfCjFIdprdcLPG44eYFM=,tag:Tnha27jo3DsZlIsfnHklTw==,type:str]",
"kubernetes_role_name": "ENC[AES256_GCM,data:if9nik6AnhxxjOd9/Q==,iv:5PxSuGGKe6WeWEe1GvZ2kKQi+C9Y3xxKGHw30rWu4d4=,tag:07oE3PC++3eGS2ZTZ1XJJQ==,type:str]",
"kubernetes_role_type": "ENC[AES256_GCM,data:tC1cIPlPYYHDZcM=,iv:KEUtcia2/vYy5hE/OXyG/S5a6YSYrcf/cLTE/+M4M5s=,tag:nCR1sniSp3SeRCvmD6Coyw==,type:str]",
"name": "ENC[AES256_GCM,data:ZwvyzDTa3BBzaPY=,iv:6Q9uUBsNSSKgY9uQ7xpwl432ZJIOz3PY+GA3OhJFF6g=,tag:JJaoz4MUwHMaYB0D08gALQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
"service_account_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_default_ttl": "ENC[AES256_GCM,data:Jw8KOg==,iv:OAmsnpBF2avClvB8uPJ5IWBesfqRRkNTH9nh1IJtxsc=,tag:AXcNpXx1kkV0A1l8ThfOwA==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:4KS/tO0=,iv:DYVG7PeWugeYREBnvsDr+A+K76yhks2N0IDWxQRBOnA=,tag:OhGuWcBLH2+7Ca3jyb+5sg==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Bg==,iv:pYQwKm+OurkT16NgBkGTfpWc62U7NW0U+FM3EsHagCw=,tag:3UhLSIYIJJc0n8Zu5C4v4w==,type:float]",
"private": "ENC[AES256_GCM,data:5Y3CBxI0pKw=,iv:T21pS4qP1ExJT6l37klrJ9ConiVKbGtLugA34Xtd+04=,tag:+d7XE/1AWClmnJDpdeRG8Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:bBRyF/Byh2Gv8wuYUTXALjzU,iv:PLIBJt5Awy+pGSafrzdV62rAsJ0gfncvDVKc0TpHEHU=,tag:9jnyewwnb1EHqF96eVN5HA==,type:str]",
"ENC[AES256_GCM,data:s1OVydoEXbcS+jCdpXRFD/vcQD3HelBicYE=,iv:WHNQcDDuHEzj+XnY6Vw59j4WpsKiqvpC/ZTM8BbYqSU=,tag:50VZYKKrTwVl71wcG3jn5g==,type:str]",
"ENC[AES256_GCM,data:3MGshXy3AxgK5Oy5YVeQ68S6BV9oN6B8IkD+RHzuGxTZRZY=,iv:ZgcUT+uOkJH5Z1AAgVDbLYl7Szv6h0OmaOZ7d7GQ2Vc=,tag:PYatmmHrIVDTso9cUJeyWw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:aVOISNaUfA==,iv:aZHc3vMFK4KPQt2cu+n5e38xevGEsKaq+Llvtb98kno=,tag:KtX3U+iD1oDb5pB/omhZPQ==,type:str]",
"type": "ENC[AES256_GCM,data:7Fs3/xsn5Y8qz+dTBb0gf4tmdKaCDrU0uINnisISO8+OCrxP,iv:g14fD4bfa+3netf2PwLF3qWdgOtcczXOCSL9+f9LRIo=,tag:EWhas0Tk5r+99hSv/AS45Q==,type:str]",
"name": "ENC[AES256_GCM,data:JK+mQYAx4kg=,iv:wv8MHjBNIyePXOTOD+bUsRJPZgsyvV4FIJtC5QuZwcI=,tag:Vd8e2pxvz5Vjpwd5BK9h2w==,type:str]",
"provider": "ENC[AES256_GCM,data:d91vT47wSlLDJgOzxT/UuxTxBY3fNNWA0lYJv7zJqZ8V8OjLGFBW0Ay54bMklNvuxg==,iv:L/ASz1nXuajsQPYDsTMExAz8sbBKRNALQGb1KKMtVkE=,tag:EgTAoUzdtM05i2PpW37GNw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Tg==,iv:+IQtjOdNwU6SkvCK+f1oqySv99AAfU90Swy8tpVL464=,tag:oqhoc9O5zx3eVQqP87bFEg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:cQ==,iv:fR9OXi6wwCqiOUHf+Zaem/vnhPMyU/dXBCyX7Ka8GtM=,tag:x0CbUAiJFLY4FM0S0LcAVw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:oFGI32xAMhW12g==,iv:dqCg2sd8PRGyJwBOh3SIXZUt9xCGT0LqaoMa6F8fN1c=,tag:QjZm/BMJ3Err0iz8ArpOXQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:L8WPknFnlcrutlJi0IYmLjVVgYNcINFacQ==,iv:nGqmFeaz48x1ha0CWrlYzSSQTPxFtdIH83qbkTPxcqM=,tag:1oyY+HGFCvN4m8zjteb43g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"kubernetes_role_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"kubernetes_role_type": "ENC[AES256_GCM,data:/khOyA==,iv:rXYtWsR7RAHJGVJQV6HXakpy2TQ5O5cdbFxpw1WVT7A=,tag:8ZB/MjWW53A0kTCsOR8V2w==,type:str]",
"name": "ENC[AES256_GCM,data:q6jKtvL5e6k=,iv:TFTHc1zevX5DBsiPCcr5zQEpQMuB+DOyPjj0V1BoAq0=,tag:eVEc0m2r5lHZ9fCFVA3srw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"service_account_name": "ENC[AES256_GCM,data:pCEnZTSsrmY=,iv:CjHttn8gcOIsvYNPF+3WM81kGAGlKtlwYW70K5glMH0=,tag:MMSZeAUxrsom1Wy1ogurCQ==,type:str]",
"token_default_ttl": "ENC[AES256_GCM,data:717jIg==,iv:A6DlVZvP2II4yAYNaAMeAB06pypstd5d3T3GmesR9ic=,tag:A/6Er3qnEWF9YKFNhcP8jA==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:skRcCug=,iv:1Pp/9476ZQiOFif/wsCjkFkU4jg1iOfDZzwJaFP5Wjc=,tag:BescGcew15sYmSFS3CDZug==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:8g==,iv:KHcB9/YZTU+D2KiScEQRze0nIdkAxh4Tnm7jAkLeXzI=,tag:vFsc4uGYSYQNHCdRtahSGg==,type:float]",
"private": "ENC[AES256_GCM,data:UaiacOqGzmM=,iv:zqOxJE1rUA/odlOsFihinifS/TS9XzNryrI1oRmj94Y=,tag:utqW4hQOta6MISwKmxs0Pg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:QuZOva18lEskgUBxPKdp9QIS,iv:URiATxc3sWaL2qvP8my7mUXHv5KDMLF4rEz0HY9b2rs=,tag:CNU5JUos6/DiqPz9+IyhjQ==,type:str]",
"ENC[AES256_GCM,data:HucHwc+y2EMgQcWO5ovGNo9P/qs0wC3qx8Q=,iv:SWXR6elywKyqoWONF2IS4wOcYgeHyUIrZQTch9WkpYg=,tag:WMRJfMsBUubvG4njIBqcLQ==,type:str]",
"ENC[AES256_GCM,data:VWylfthQWTjBt5ubWgHsWV6KTuEjUbbbRMCQIH61B+McYls=,iv:9QbiVRl7vi1sX9Tlpp/5hQLZOHSABxf3dscec2SZg2I=,tag:iw4IkneBl0qezzJm9qUtpA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:J7cusUxybQ==,iv:MWQ4o71SsSfTIHH80GUkinH10X/GOXgkJnle13Q1nV0=,tag:JCmN1ylg+niEtDccWikTMw==,type:str]",
"type": "ENC[AES256_GCM,data:nWAZmyuZq4uY4GvoakGPJ+zN5Kdj30LzP7LjQ9W+Cdh8x+2S,iv:lhY5UhcqRDVdBWPGwNVHa4dfg3aa90b9weujFK8z8EA=,tag:YvnYyKpJCXqGIALTnqw5+A==,type:str]",
"name": "ENC[AES256_GCM,data:demQ4E3Ns5qK6Cg0PQ==,iv:O18d9m8P3xeGmjsTJHH2TwrD3USjZHtj9HF9LDERlz8=,tag:p13+Ve0tepfL9u15xOHfbA==,type:str]",
"provider": "ENC[AES256_GCM,data:A7qMwhkVxkOu5rp7nkUv2DvD76sXmie2FOgMfXENqVZ0rGCNZGXgQYOtnSGP0+IjYw==,iv:7awS0cSvFWsewuh/uha35K+8Lw1j6yxFxgCwoPCI6BY=,tag:kqR7jbDWDaz2ILJWnXIMvQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:VTvioUY9uWuWQKPqkg==,iv:pjnZOJIVj4y573MNruMWvFW6Y4qoY2X75TaEqKP0+xA=,tag:yzDxHwMYTRGkHR+W12uixA==,type:str]",
"schema_version": "ENC[AES256_GCM,data:2g==,iv:sSC0HKerAV+7tqOe6icGe/9pBpQtHlwIWau8mDKdVqE=,tag:J0OgSAXVNPY04dq1Xfh4Kw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:1lz4zSQvi7zXWyyMNw==,iv:Qa6QURQhzsNzcSpe6l6SRGA4QlZLAmqWZmmwbZJY0bw=,tag:u+Siy97ojA/dgz1FWwy6+A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:3ke38VT9L8YA/Q==,iv:zinacOGxhxFYzstORyJV9+n2RMQEaJq5PW0cNAxjYtA=,tag:vnzX9XplEyjNLlEzcNG5IQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:rJ9aENn9KzcPhukM1JP0UeuGtO01ePrvMUq3eiDsgqDmXcjupEcG,iv:iqSsYQeGD+LtHHucn0kit4L4LQ0EgWunyTCyzatwmWA=,tag:SMQ2oDnmQsMPqkQQ2GNW7A==,type:str]",
"kubernetes_role_name": "ENC[AES256_GCM,data:+Olbq1bkN68OsUnEDqUc+kuiMmo/5Q==,iv:98qGfdkCOsLTT5PX0TpPklaKnBgno/K9HGIXuFoZS7g=,tag:/zPFyAAkt9QVftMoy0CBow==,type:str]",
"kubernetes_role_type": "ENC[AES256_GCM,data:oYs8ag==,iv:3ee5lQJ6Q58qbSmaU8ZEx6xxRc7Diq7u7PPScS8Kwdw=,tag:oCBOMdDiRoUWVA5UjAEV1g==,type:str]",
"name": "ENC[AES256_GCM,data:KFFWLdstCufHx+DuvLLJSli36q64sw==,iv:XHzZaoWakAc0+GilnXQOXWNGRad6I8cYuCJX8Vy6Q4A=,tag:sCvon7daRSMwkYf9QtvD3A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
"service_account_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_default_ttl": "ENC[AES256_GCM,data:LMYBSA==,iv:AQcRylGF5qoU3mknz3yytsqyY1ZsCPTu90eKBROGUME=,tag:zpAMCMK/ViRGCPOgcwVCfw==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:7wH5sA==,iv:oH6UrmztSnM5T2/rgFEVSr611yy+qANJL9gV0OjQTuw=,tag:m8Lhe9yIx87iX92RAtr7vw==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:gg==,iv:49nxqPCxfr/YiUaFCX/I4fUueSAwiZcsD+O702/5yDM=,tag:eYidpMUckRgc4CpkyuQA1Q==,type:float]",
"private": "ENC[AES256_GCM,data:uMIHit3B+Os=,iv:WjuUuET351mSlihrksd25urggj8FSLRdBNiaGXC+mP8=,tag:vl2H1Gaq20KAMNn5GCYYmg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:5i+sDTl+1xOIF6K+pIyogdR9PDjA2RvceP3bakkjLPM=,iv:vfcr531pEP/TmOCvlh7AhutTuHG7FI+djOUE9RjJA1s=,tag:NzRjiijo8PN7Grt+OqlsgQ==,type:str]",
"ENC[AES256_GCM,data:TfyGN02R39pDemNs6eqCGe//,iv:SSQ03z5IpABjG5FyFrOgAWd0nvbnA2XLcHVo7sjm0Sk=,tag:7GZvtM/kXeqt4SRyTr3K4A==,type:str]",
"ENC[AES256_GCM,data:nHnO4V+vW9XCpVeZsg3xb+fqYlxp25xpXFJGqPHVszZ3Mbk=,iv:BHP12vYRmGPGZvr0ztv0/xjpJ4vXeGw1Cg84K9RwRTo=,tag:F4cESN6eEZg82aLKxXnvbg==,type:str]",
"ENC[AES256_GCM,data:RuWWg6Wx5OG2QXqVlyXn3IgSoE0kJUIs7sU=,iv:452WIcOgbFXEIXbt2+/iA4qoE958YdcDCCXGmC5oUkk=,tag:YzpHGiXwXRnSdSIvW33KXg==,type:str]",
"ENC[AES256_GCM,data:/w1BTM/cEA2ZvqBvvIPZh6icdxWsRs0lmTAGgTs=,iv:lu0f/tm+TRD4BE4blihUg8+zY1iL7ML50o24eDj0eFY=,tag:Rm2wJLN1NSGGTB1db3eAYQ==,type:str]",
"ENC[AES256_GCM,data:V/yr7AbG96z+9m6DMz9fvAVCrl6iGguGcXKiWY/Xdg0ja9c=,iv:wBEFWZhvVWrbTE/pMREqt7ZZ7roJjkB2cvxRcBoGy+8=,tag:scwsplNskCyZoD3VenWlrg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:FaZ1Auiwckw=,iv:q0kaTMj66+zSWImClw2r884vDkq5LcaavN7Xlt3cUy0=,tag:9QiUfi7HVHV+UrfMCDUEuw==,type:str]",
"schema_version": "ENC[AES256_GCM,data:IA==,iv:/9tvgA9W2eDGAMTcUv2IxI2SaRiN1WC6bx3on8t8qzA=,tag:PAg09xAEuI2Bp/X0+jrAaw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"allowed_kubernetes_namespace_selector": "",
"allowed_kubernetes_namespaces": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:fPFHGjRO+Hs=,iv:ljLfyedO6CjOsVa3rlfzSfrUCQuw8AhmCRK+kJO3pnw=,tag:/sNFjwTY5SLvFerX215/2g==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"backend": "ENC[AES256_GCM,data:zW2f7EwH5JsyJQ==,iv:5NiFR+tcXOFcrpEgY6iWwAksxZBScLvtee964zI87K8=,tag:X21hf14CIgj91zymrmv6eg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"extra_annotations": {},
"extra_labels": {},
"generated_role_rules": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:ekJcWHoU24RWwCLBHUi2RPRzV7Tf8efwggRsYxEjW2Oi0Q==,iv:lOK9hK+YVgLlLxY+fkbh/1d80Fjq/2SS89pwW8skH/Q=,tag:p/KFS33VLSfPa9ZzXRZxUA==,type:str]",
"kubernetes_role_name": "ENC[AES256_GCM,data:aeuD0WIrV+MMk4gIMkr3p2Q=,iv:iwZufkttSz7JqrT6+Z05kXhIEPOjQpVyRi34OhcXVlQ=,tag:6Gza1y92efZ/TJWlw7eP7A==,type:str]",
"kubernetes_role_type": "ENC[AES256_GCM,data:zbHS3w==,iv:gO7y6Lumj5CjTPS/L0vNuafk5nV18FENQF+BE5eum4M=,tag:n0itniFjdAfB1SG/AI6X3Q==,type:str]",
"name": "ENC[AES256_GCM,data:3859+7LeO89R42e1Nxw7E+o=,iv:jIn337PZupB+yOu8eE2WUZRQFnQHMJQaAPagVlbVOWk=,tag:sHTNmQ4o5I85oumYWPh23g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"name_template": "",
"namespace": null,
"service_account_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"token_default_ttl": "ENC[AES256_GCM,data:9OalKg==,iv:YGqwkmBA0ILcqn52kKfwBrfCszPmFZBU6Tf7cEoQe9M=,tag:bztFSv9ef3ctLeWmOT82aA==,type:float]",
"token_max_ttl": "ENC[AES256_GCM,data:xgG8aA==,iv:u6O7p+Clukh0kpLAMqUrQRfhoy5SCMjnE2Tpf9M8W88=,tag:6jNBkOjfLfMI2aGjYH+fNw==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Gg==,iv:Hozt8+wANnOM/ZcEw3D3wd+yeyqGrmgqYefREmPb/Pk=,tag:VcxGgqGZDST06EYSXobBVw==,type:float]",
"private": "ENC[AES256_GCM,data:KMqG4MwKJf8=,iv:/LZXF9icU6TPafwf+mkyAWF9TK7hPu+InygeD0z2CSU=,tag:sUZRe8VD2O5LgFvIpoGarw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:JbeTW88uno044hfbLXgxVUSJNApXXcVxA6wMvJuBYDE=,iv:GAeX+5aujU89qbNAudtpfHfujyrTyOafdhXMmr8qww0=,tag:OZgAWQCbk77AoqLp1GrecA==,type:str]",
"ENC[AES256_GCM,data:lnTm7kRizWtoK3YhUhaNTW31,iv:Yx2nWCsP4sG0+kRCC1uNNyY6bRSA8aC71skxQ9fTJjk=,tag:RpKbLt7DFZveXpiuNSk05Q==,type:str]",
"ENC[AES256_GCM,data:SJHnsV3Jp7/5BpnG8B6e1w/Zry4zmHyJ3wLwifOOzi1qxUI=,iv:p/eq5PKtn945ZMoTrU8RK1fB9fgkb0Y+Q4Tli6IHc3A=,tag:Azki6sQb4eUBR9LIT/BKBw==,type:str]",
"ENC[AES256_GCM,data:SN3ZTvr3xBIsHkmBiYiTk7/Hn04AaY2bvZ0=,iv:eO82H9pEkN3Bg+aeBvgd17nd8E3AkXpJIPuwKcY7qFM=,tag:KbL6Q3eQcqu/dTpHJg86OQ==,type:str]",
"ENC[AES256_GCM,data:nSLRJBapDoFim3o5SGRgzwUVgjYezlJ2tPIu5Lk=,iv:3TDv+IMfRClxtuCVvaIZWT0fJrZ29CVKhBd4kS4WHa0=,tag:p55oXiVLq2FexYAusfSmnQ==,type:str]",
"ENC[AES256_GCM,data:mA+mnBuht8XeIDUCGf4urCyCdIy1cn0KG2Nshq2EW492mn8=,iv:ERuRNmxGPj8DfHXFrt9oGtcjrZ1nAnYfxu0fXNSp144=,tag:m7O80Iq4Q/6YiR+EU9hxFg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:xuvhcYf3NQ==,iv:IwQZGn3Zk3ozLvUiJ37bazmJsYXjBGBmuIWszw6fc8M=,tag:irXfZOq3qBYWyW5RhldSBQ==,type:str]",
"type": "ENC[AES256_GCM,data:xJtazngYiNKKBmE=,iv:PKcso/BxjjTNMB7fMojWB1CCm0WcsrJUETuwol6XUVA=,tag:0m6EjQCKgCUQz0aCtmoQKQ==,type:str]",
"name": "ENC[AES256_GCM,data:+9UOHXWX5lk=,iv:V2kK/zeMYTmZ+thf8uKReg/MWGs4EITpPGoeKihKUUU=,tag:lOGmwjV3deEyrmRV3w7K6Q==,type:str]",
"provider": "ENC[AES256_GCM,data:6TERn3QDOmtmIKxMrGsoES3NDcPejCAN20CR6XniagfjgcUB1qKdsX2nCxK0t2QEeQ==,iv:IC3faZGOps6p0lP+PU65FhBReJyfpTybvCSDGhsmk0g=,tag:X3/6uoXSXRUwoinZmHwNGQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:PQ==,iv:P9/UrxLZq2BJ7cHwvw28WLhVHip54FmkJF1BA/tNLT4=,tag:6jKSWwwBfoIDO757oZuA6Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"accessor": "ENC[AES256_GCM,data:8RXj0v5EyUUTTkk7JI2OKK0=,iv:JfILSH9qjaipBPqKcoWjgy8ebfnSbdr0T0vKteXTw00=,tag:oGZ9Cs7/qghs8W7W60uraA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"allowed_managed_keys": [],
"allowed_response_headers": [],
"audit_non_hmac_request_keys": [],
"audit_non_hmac_response_keys": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"default_lease_ttl_seconds": "ENC[AES256_GCM,data:3g==,iv:lIwmLzXzttcxlK6z8l0WKX4q0hjVlE9wgQlyn2TKft4=,tag:TA7kAnujSKEDtWTJyzC0YA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"delegated_auth_accessors": null,
"description": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"external_entropy_access": "ENC[AES256_GCM,data:ioedD6U=,iv:FPAwaZEXDzZjSugDm60/3740MSTn8J1Qe/jN0cUIrz4=,tag:qv3s+0S6AWcks7X0hR/GfA==,type:bool]",
"id": "ENC[AES256_GCM,data:LHHodxwnmws=,iv:wbsCwU+k/ZBWAiXcTuh+8o4nbYVBg7ID7V0CPZgI7Pg=,tag:1Ar6q+ADRJZhjck7z5d+xA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity_token_key": "",
"listing_visibility": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"local": "ENC[AES256_GCM,data:NT4QqrM=,iv:DLRkHhtPZNChEVYd6OyhDGtifJhBLQqYYVMbDegyGbE=,tag:puJwaPPKEITAc3FlHAfeQw==,type:bool]",
"max_lease_ttl_seconds": "ENC[AES256_GCM,data:dA==,iv:zFZk5ZTBe0IDi8BTH3enKhKQqc6OJ+W6Bxxu6VLACuU=,tag:iIZpO83KzFaJg/0YDCdEBA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"options": {},
"passthrough_request_headers": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:rcOSeJHuvOY=,iv:BBWFQOcsuQ5ung2ihqLXT9ra6LbPhDcRduSNUhoNQK4=,tag:Dx7kF7QjRhMBULHR6RqpRA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"plugin_version": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"seal_wrap": "ENC[AES256_GCM,data:5MAlQ7c=,iv:2fQgdAegbGljOFRmFJr0TovU4psgcAyGtH6M/WxgDjQ=,tag:iH982BGu9ICsu7v5u5Ng1Q==,type:bool]",
"type": "ENC[AES256_GCM,data:tWOYhsfvbl8=,iv:iumi1Njrw3aTE1BBpp+8yjdPL+6n/JkHpbDD8Hn0kWk=,tag:xv72mndTbHeUDjtegDddDQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Eg==,iv:bEqOfDDU9NPBUDgiW5UWWTAYYH3y6xGvfRiA1MRRMNI=,tag:AtsnkjB45g5b0Dym5p+mUA==,type:float]",
"private": "ENC[AES256_GCM,data:39x75ChB8tQ=,iv:3kx+Ii3UsOxCTNBI6m9PkCoaDsjjEkAd7Jxqvt6U+8w=,tag:iy8yRWRIL+oxqANPJCngRw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:PuAPgRTTtrl+YQ80AhfByaKr,iv:LP17XSISR029xZ5MQvsmHPU9mZqzw0yT8+X/NoTTLb8=,tag:qaGKaHWHwYAHbCGKYpTV+Q==,type:str]",
"ENC[AES256_GCM,data:ya8zQmh0GFqzsPTGUoUHkPRhwkOejykV3Do=,iv:1R0Vw/RW2kAUwW79WOuhPBptyIopoZ3MOg+Vw3Iqsog=,tag:wmsPmBl+xRqbRltd0wATUg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:dG8PtaWIzg==,iv:323LwuujCn4ByzJh/6zje5FTfCYCoEO7zalYhUFd6to=,tag:tqZFJUtT6A4fldgESK58nA==,type:str]",
"type": "ENC[AES256_GCM,data:NYPdCFInzlLYIe8=,iv:m02Y/8dWnIaZ2UsTLiUPYsmtXCOwQieTMnracg/+FyY=,tag:yokn+sPSk7OXco44yxsMCA==,type:str]",
"name": "ENC[AES256_GCM,data:oTHO+966+g==,iv:4v+yWlA0vz3yU7h4HoiCEkElJfuVlqqXxCu0MMY+N04=,tag:v3lqsSfa9Kj3jBiwz+TiBg==,type:str]",
"provider": "ENC[AES256_GCM,data:QvyMr6nzS61l90/fSfLYne2xvYkUeITueK9Yze5tGkYb+GyP5zGBexSog1hTZzTRRQ==,iv:J4UYsGAzCS19Kb0syFqwJzD+a2qhg1QYA+xUWNWLOwA=,tag:Kf5AfA7sNMpCT5sIptHqKQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Jg==,iv:CHiFwsTz+FhNAbPHGC5i2Bl95ydTI8tQnuHYSZHPGNw=,tag:f4Zjlr46WVh5VfKnS8/JVw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"accessor": "ENC[AES256_GCM,data:rDVRIZrVwd62w89gGy2dsQ==,iv:/aXlg4ifMhWCiq/SDXhmSPJsNfsvL+0rQXTHzvcW/74=,tag:IVUKrg8/Pc/44rB1aW9+gQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"allowed_managed_keys": [],
"allowed_response_headers": [],
"audit_non_hmac_request_keys": [],
"audit_non_hmac_response_keys": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"default_lease_ttl_seconds": "ENC[AES256_GCM,data:gA==,iv:S4rB4s2BuKuT+8AuY8Tp0uFw6lCp7evDigM6BJhWY3o=,tag:FSgp+bJu8qtrQv09EkjsSg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"delegated_auth_accessors": null,
"description": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"external_entropy_access": "ENC[AES256_GCM,data:KSpNcFE=,iv:aBzoWm43kr+8aHvV10l/6Bxq4dv6aQ9k7qxFVRhsUgQ=,tag:WOdbl83WO+Omok9IA1wthw==,type:bool]",
"id": "ENC[AES256_GCM,data:jgGOvKK0dA==,iv:jptuRGQPNpv5HBQYRHtp21eZBhLuR0a2BMr5wRV2pxM=,tag:keGgk6bTy1CyN6dxSKufLA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity_token_key": "",
"listing_visibility": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"local": "ENC[AES256_GCM,data:mqVSUqw=,iv:OlIN7lAAuf7hNxYcJxxAmXlyaw+8/nmctt32WcL7fJA=,tag:03iFu7RbnFXXgIcXGqPevw==,type:bool]",
"max_lease_ttl_seconds": "ENC[AES256_GCM,data:kQ==,iv:rzgUnkA6Zrl/vvjUoHfvCeiY7Q3OVcjabfJAGle+SiE=,tag:WFZZzfHW6ICc1X/fZsA57w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"options": {},
"passthrough_request_headers": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:wVdVxafgNQ==,iv:J5JojsK8f96OSOOvzA6t2hYkRgYH3Peps3ORAe26p78=,tag:nAS7yVyPKOo8qjt6G3xQaA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"plugin_version": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"seal_wrap": "ENC[AES256_GCM,data:GL4hIQk=,iv:EN7a3ik/rKbFZaOe2wkKDBUNtE2JjXuCtKK91ABZXTs=,tag:ZMvnpYZfjtTlFiWFHFYSZA==,type:bool]",
"type": "ENC[AES256_GCM,data:qIMfuTUC5Q==,iv:x0dYkU08QxIb9Dk9U8gJQLWitztnIs5ZyQefKYmuVOQ=,tag:DgtEjNONXR+VBYAaqM/laA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:5A==,iv:PDGy8HlPWzzR8ci7dB5SYITwgGEwzzBwGFB4yh0wY8Y=,tag:z1LJW3dR12Kj4Rcl90XtHQ==,type:float]",
"private": "ENC[AES256_GCM,data:DHDGsKrqra3uLRCKEh+lvfIO32AKHI9m4vag2E4pc/o=,iv:YyWj8qWHKEKvQO4Glhc7k2zviIjfGOikqk3Kfmp73ow=,tag:H8i6eFgQ/zQCZJcWj2DMmA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:yfKlSR1C8BQO0+Grek9yEM1J,iv:vGkUP4Xiqd7UGPz+J2dfWli+GP/dC+1+hQ9ZuUNrEA4=,tag:TNcVBcASbT7QcPIz14oaMg==,type:str]",
"ENC[AES256_GCM,data:l/zd5t9d0S6/R61Hl+6tQJxeJlZhlvHozvg=,iv:qLHa5IzbOlFGMHQufc4KdfR8wtqyl+QHZfZ7gLxgitk=,tag:L8W3bE/YsVQT9MNfOzoRBA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:9Abfd9PykQ==,iv:MW2HInsj1crkHQh8WdPcbhTD5tCdVxnHOpgaZhxKkWQ=,tag:wLt14zdM+vdRC92lCCfndA==,type:str]",
"type": "ENC[AES256_GCM,data:z6pIWxcM1fe3114Z,iv:GAP8vSRPtbYhGcxuAtmt4crzyjT8luMVq7a/HMHxzM0=,tag:+9Fb4VGxrTjfH9ZfslyXrQ==,type:str]",
"name": "ENC[AES256_GCM,data:J2VYZuQ=,iv:XemMjTkdH2z5ULFEa6tsxsXbyUcOk27FFzCDzTCw/Hk=,tag:rWCVBoeojsqa2FrNJI1umw==,type:str]",
"provider": "ENC[AES256_GCM,data:8cqO7SK9jEVXg6+1/+bMPkZaevSsHRR3wB7/YYJIaSBayX/RwXbqRDsH6JHF6A3/HQ==,iv:AoYzwdHddVRBx9VyH36UTQwJlh2edYp605MRjQb12sA=,tag:webVAWSOkExKOi61z2qMGQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:7Q==,iv:Nu22nsKxj7H/uMUqgaZoEPFLP/BNC6GWIVoNcPviKCw=,tag:wR0FUGGO0fgs+AMPD6ifMQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:NjWwqFapL3K6P2Y=,iv:UtEJwB3E9Xytwl91Q5soAfozi9PUYfSmCDaNSvRi6tI=,tag:EOmWf7YS5a0dfq+05Y0Y0w==,type:str]",
"name": "ENC[AES256_GCM,data:umbSjSC77HXlYcU=,iv:Xj7aZ++8kjtF+Si0wbhtSpy8xgOyWU7Sd6rG5bTnh/s=,tag:GLpSsffF0PC0/KcPnqNlpg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:CKz7RvLoQYOOsQCh79jseI8E+jcy9w9HwXoKmJUcSgnk0JfWdGihQ7EuHVWu3zqSJzY1U48QdOo7Ny7//uJLxQzI2q5jaRmG0rWHOYH5LUmV90eqEg==,iv:dONpkZDZ7Dxm4Wi/6+2mZMp+nHlZQgEAy7xJXuawU3Y=,tag:edCMLTkphamk3iBtOe10xg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:gA==,iv:SCZdiaaJMr2ZnQH8L9/WwXKnnuQ1Art7mYB1WGQGO9A=,tag:jQPa6Hbv4TCQ2dpn2UvzQA==,type:float]",
"private": "ENC[AES256_GCM,data:bj+cpFdgr6E=,iv:QyprCKxVMHGsRfQHXD+Wg0FjkSq1PKHMDpSn46ADPfo=,tag:lNFUkqyfvxqt6LgzhUBIHg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:v3r4/yjSVA==,iv:MyQrvf60vvPBWAM4VLyysjYF88g2kzqj6JH88VrPrVg=,tag:DFI7cxZ5GFaC6ZVqgniJtw==,type:str]",
"type": "ENC[AES256_GCM,data:Fe7LW2v8rTqlw42x,iv:4vY2uo7iOME1/cKXF/XdaGAIlzBNOPX2WyM3AL35n7I=,tag:zeYosU0NueNUcS33wh2WOg==,type:str]",
"name": "ENC[AES256_GCM,data:6mo=,iv:y+TJglbMDDFIlrOEvdMACIAlFAeA3+CIB/qKf9eNTII=,tag:h3dVredjorugs8bGz1zIbQ==,type:str]",
"provider": "ENC[AES256_GCM,data:cRDSyuPm/r0SZII4YUWWwOmbh0DSY4CHlAQfTa3lHTtUyh8MgXwawH4/b/aY1lZIqw==,iv:/oCgtt2M92vSkSwZW7aw9vFjqEVjl3fPn9xGDGky3QI=,tag:uOGa5q8ETZbgMyHiNWz+CA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:fw==,iv:C9VgrUy5y7aTBGW2d9p6Hp3F14lTVBVmwBuvE8WXluc=,tag:K1IPjCBTXjpkPTBFm2+2PQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:5m4=,iv:xy38YOvs5bWsKQInPjuBLE00xMU1y+TJHrKrjDpQnzE=,tag:rbw9xYZTUeOe18PAPhG0yg==,type:str]",
"name": "ENC[AES256_GCM,data:uK4=,iv:AJ9qK6FaBshIN1Z6Ds/3bZeKZbplK2Irmdngwe1OQmE=,tag:KydfOoT+WO+PtJrsnWXAig==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:+Hbn/ncV/9XCK+2UJPdF7r8POSo9gEHyVjnrJSkTDRfs//QJiOx+oCSxK3au54zXJgWDJenrReS4JVe/cmRhWB/JKLmC59suLtwc0AZpDdyAS7GpBVNCcn08hHMrUr2bWVkp0bdj5TlDJclE36G4VXvFB6b/ByYiErFsLqnAAKWaGMX165B9NCEVz5vyQYJhFmhtc8dGkRFs0n2CLmUeYS0eGlfvvku76cP5vjfupdhedQI7JI66fey4z+VqsUtqHuAErzz87bdst9A9X2vpcfOv41Hsdi13x8xPEekfvFaLT7jqS2ThtAQDzks/ToTGqngCU6tfRDIKE1QzKWh3WQY9aMaYmw7AzAmYZQHdW/CleFdlPM1XQ0U3cdzQIxAnQEXRs+AXIlPQJpuBsvzvlZ74Yxivpr2vVJA4YwTA9VgCBsYx2oVfEqib1tbmwU1HjZo/S5KXe/oItq9hZHXDYUmz0PfNRvDDNCPbC9Pt2CB7IDXVtDExeBRwCt0TLZjE4nJul2ULTRZ6fnHXqfJwAuCJVL91HNTDPHO30NFYN9Y3CSeNVrvMEQXHPaUdIF20PwtDQcgjiAcSlgrvHSPELdl56VxoTN9p1hgy8yXFWo/6Mk737R/MRhp15K10TVfE5aWtIYW1pOhc+kSRzYcoMQ5qmP4gKWbtUkoqbLWFegZkn0Mp6mqmr/hNsSbx1HHRJplKi+0juICM+iybbVNQE9Mx04r2RVTLJ8fCDWW2VHttSZJ0c0fZvL0H1DkAasFU1yyRwRmqzSHx4t76KsFD6E35NJQ//qpwkVzSCH58OlX97F0sJ603QS7d64T4ezJCtQywIianaDrDunmP9x9+,iv:rvfhfddmsRVg7G4wKL1SJxxJTeHcZs1f9DIMmOQ+4vM=,tag:z1jDFxFNuV2YCsl7vO1obQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:BQ==,iv:y6vQvIHIng/LahZ48ntdVG1wAXcuSvyRg8Rf3+ichX4=,tag:gvti7QFiRe9EfihPNTmw+w==,type:float]",
"private": "ENC[AES256_GCM,data:kWjs7LPb/ao=,iv:QndwmZKqv+VlPwZw7aTTF++HJetGIEdTUU2saCBFTGw=,tag:x4H2MGIiiTp+iGQO3hJA6w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:TC1bNufv6Q==,iv:xz8zfg3EfuPaRv0bT+WbCxXnf1hZYVdQgGfmaD6nTEU=,tag:WNrNM9lMN8dUh1JqGOCzyA==,type:str]",
"type": "ENC[AES256_GCM,data:vk5zU38pqvTETEIF,iv:kb/H/D+1RfEtibWJN4vCaa7kHRY0AaAgxyZzfEatpXA=,tag:cVF8UQW/zPTaIbr3Ulr+QQ==,type:str]",
"name": "ENC[AES256_GCM,data:n3ndmoOFrARdUw==,iv:qGLDZn8EdwyUSDMuN+B1RMhz8rstfJr4YU5/qKFBIfc=,tag:1NSE4BWJTN7cuGwaGe6i0g==,type:str]",
"provider": "ENC[AES256_GCM,data:uaRYpWHU6DweK1c79o/7ZQgbae1KbK34d6LMAc08RPAmD7FrJIF4Gb52hQaW9+60nQ==,iv:1hAZhXlRcd+zd0PNqA823k6z7uDi4YyLpdcM8YMu65A=,tag:VVh+kCyD6oDokYKS0HriyQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:RA==,iv:T8WMgfoRY6CR7O8PyogiJaFfC3+he5/ROBZZils12Ds=,tag:yJcTDI1h18LTSL6R81n+Zw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:D+ANc+pNBmfmgA==,iv:LUYLIyNdAa6xNed4vs57bGmuvslJQa+e/Z5WQIlvz18=,tag:8N8jyFVhYaWktRu8gW/KfQ==,type:str]",
"name": "ENC[AES256_GCM,data:tEMhiDz/wQZo+g==,iv:SXhAXMRQsoSirIiM6gdY/b/qDWp4W140Qbo9JovMkPc=,tag:oR2HkPahZuWNtvfe7X018A==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:G4wH8qmBvAr75Xa8CxD5miA6EFN9lIIJAzMRhcKHNGjmhpszZY3D+ylfYyTcYBOeTLfqqdANX/Q7d+KNlLv+rmHl1eD8zHbwlkhcTvyoAoPc0ay21VsgIVfFq3D85lmc01iEQGi/LnVdMxgcWPVtVsHMmBbdWCw4gAq95FS3QW+NvICoyrgYEueXBmgOJG9NGA+oQxGzK65cOf+lY6C7rtoSZKY2667QDFeS9g1+EW32GaEs9QxxCD+MKFmnGvYVHKRN/Y0xa3ABxJbwfdHMFN2dhPjP/EvN8iTF0U/CR9VxhbcRRNYLJD+MN5o=,iv:mZy8c2w2K9trXuhcjLVKmsnqJ/5Auhsc4YHToN+CEHU=,tag:+uP7qiYmWRyOUQfM49ko0w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:6g==,iv:U8Uz2VljP6SNVBq6NTqqaZDIBIVuroYLQdM6fsIV1v8=,tag:nT40acPYRgNhkrC7KtWmTw==,type:float]",
"private": "ENC[AES256_GCM,data:tO8eEQts+BY=,iv:DXo+Ro/BthCxu9PCDDqwjinfVHql8MS0UogLt12o8Mg=,tag:H/0MtyvpH0cjFzNMsX3vwA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:f466Tdc7UA==,iv:DFHkVcHX/qBAy9BF8jRgTK87ISj+1ZQZgF6NJF8UhUU=,tag:8iZ8k/Pn2KnUeGLL0PJPpA==,type:str]",
"type": "ENC[AES256_GCM,data:7BoFLcdcPyn1siOo,iv:5KsqNlm1MF1I5EJr1yzq0Dmxh10QMf9JwcYDoKhaNGQ=,tag:VqZcf2A9SBXojiOFCF6ySA==,type:str]",
"name": "ENC[AES256_GCM,data:cVS/2MlOQw/ogLlHNFFs,iv:kMHIR/5/x/mn1NszxkSbC9C1Y19mrhmL5FCetemWuzc=,tag:5dKCGeRAPHe2H4VNj9+Hng==,type:str]",
"provider": "ENC[AES256_GCM,data:tasKZ3M8oWLvw8AGcqEM7rTnzHChKOQY7a2cmwDpPlMNu8W2LCPINkXg+XA7uGkXvg==,iv:2jcEYm73ltZjfYAscveuOSA8BbaWhgkdb43MTlXZPAc=,tag:+1O9SBmB+gLIbK1OhA2boQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:awnayg==,iv:uERM3928fdWAUkKZom2cXDubIrtsjpXco2nMQuppZzg=,tag:HX+iYyE0rPh2UTEBk0Fq/w==,type:str]",
"schema_version": "ENC[AES256_GCM,data:oQ==,iv:cAM/6/iYZ8OsIKIW2yEbo3sDMuxDgYfqJujuB+2AiuQ=,tag:QzdsF+QK7E5HTEU0YeDCPg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:SKdk0eU21MqT5DD653Mlfi8oTrs=,iv:LAH81+o3E0YlfOlDhosWFqbSGjiRQkmKsAmvssCZVck=,tag:3SK8WSidq2yCIrv8ZiSWpw==,type:str]",
"name": "ENC[AES256_GCM,data:NlxeaEGp0g+l+GBXqw9CwQmIFRk=,iv:2oglLAT6x+zWTZgVqKJDEWdkjE7OrEVBcwaxXemBqDY=,tag:krE7nJF2e86MAc/4u9K84Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:nTIImvmNzLlohWGuDTGkex25ioQDbZNTK9qCfZaVguAy4hTvQKHLW9BJNaOztiW42aTMqO6tInBYilyvccNYzCnyK83p7avnq9IEZhbHBTyAyeiamgL0vCnJGfbfRYrve+34EQjCkmCcOy73XJesBv0IY+YK/3OXZUdn1jU9MZNT92e9kuyZ5rHNu9kp9YPnxxBLo8F0g6aJGOD3Hwe5CSCKDxV2Q1FFg4JJKx98e2FyBlX3mo/MPqqgwnJa3nwHW7jIsbNf5Y56XJU04cJY5Yu7AoDIH4OyDj9tmIROjeJvi8QkQwTH6tEH/GL/wskpBaWiXH6XssD1XJUQfGF9zGWgL+4nTD9yjUDrDlNCS51HR8JQ8TLqXJKNG6W57+roYrLiULNzwbMwd0pjDCKORTwV+WqCZU4SvCE96ZHTuNDI0cV7ZRpvPfYIivnkMP61TSd2QAZpHT2YladuVBKbPSVr74S/s2/BDJd+LfCEfKbgdYb5dBzzDdHmo7cuuchEeiakGgUCPeKupdtkxlgfi1NO5XZYs/nQmekqFa9DcTML3MnP43czwVhvOvK6qY95rxk5Ic7JAlcoPwZU49WbhlbrznAff0cp2B2ar6QwfQ6pxqLb3Se7TerjCilqdnI7V0mag6FXyAEboVrnFjbmKEZL,iv:pu6yRQ6sjtc/9pQDi+/LMxK7zQLwNI55u6V4yl+c2u8=,tag:7Y89+KkzhJMsR3kap+awjQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Qw==,iv:9Xx27zGZdCTyt0s63LACRP9NJ7I5vOZzg4Mqx1tYB/0=,tag:xOYXFYxKcLRBJBblu9O88Q==,type:float]",
"private": "ENC[AES256_GCM,data:WLT4UdjIAPI=,iv:gmkS8424Nzo9f5wnzKdHxXSlyRfgGN8lizBgm6c+jR0=,tag:t72+PUSH+S9D/hAHpQw7Qg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:YrYeDLVGSJfWVBk/pe5K94LlH9B7I6WDZ8TQGVRpJlI=,iv:J22rzk8HHRCmizKHEbDhNRvdFucO5Mh5KEqQgp4B4Mw=,tag:F6IuOKD55yh3pe3050ttkQ==,type:str]",
"ENC[AES256_GCM,data:KOqvXVHv1tveq/kK6N+ftk1X,iv:x6BiMqNIa2dxcaiIf9GOohldmrfr4agy1WXn6Qj8S38=,tag:2rVZ1DNXLdNJoKVq6EBlLA==,type:str]",
"ENC[AES256_GCM,data:GBnJqvxlNaH7F/Rs5bCidZNes5kfGIqjhWs=,iv:pZGtsF4WP7uR8y1aHiWylt9ZecPJkWG7Dny6bqNlw3g=,tag:pdjBibvwpcTZxoZSLSBV/A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:Ntgy5R//eOc=,iv:7F5gKMMc2bgR+esmYSg9O57QfAIOZqHhTHbLwcFvmhA=,tag:6BHE6dA7jeqaHpugWCVF7w==,type:str]",
"schema_version": "ENC[AES256_GCM,data:6A==,iv:5zE2sdqkyBHZpH+pkUKgp8k+HrX5wUyP8pnDo6Dilr4=,tag:FMY5+83REyN/xsfolOX2vQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:z6c+QpbEHbNvQUBazwdijQS0aP9fbP6d,iv:I67Hx8C/wcbce6mhjp2ZWSmR+dduZE4hVnhRWodLXXI=,tag:G+k4g3gAxfsjlbh0pFKrAA==,type:str]",
"name": "ENC[AES256_GCM,data:30tLud6tsYwpjYc3tyuJdD7S2fQqAm74,iv:yRVzsigwi8bu03FxB6djJIjRrBEi0KpIKXkb/VgHGhI=,tag:s87BQHbaD65kYJWq/6HDIw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:gvg8pPXkqaSoXHelCTfSemTZ4pJFqRg8naNBPW1im8dw9P7bwb+HraX3J0Mm6zKmqvkCwsqrUqoPtCCccesRWaYjtCHc1nn/sdHq7bWIx+UJRr/NfJdbE2qaXHKvqLiU6VO4lx0yz4mWUFuIt3Ze9WKsoljg/rn41d3vQL79AL3Ly6TROTzYdxIkOZHM17g7UDtJFduZecEv81V2xvuUqSZW9Dx0VeGWqWLjC6ThdRuTv21ipHbk9Cm7TOmJRMH0SYycVokMGvkKeHJGNahgwpUwl/s5UqyFiIU1Sc5Tj3qqDGrnQPj4O2kNigyzWGrbYjPo5iOUWmmW1OFM2AJ2wvyHtBDnRQUIZsvEYdwyGrU2Id+1rVuT5cOM5qOCknsK6hLl14q7HLFrKHy9+IBiVtdANwNu3997/Rm6uFE6mywB0hsijN0qqByQvX7zPLqabqlO3gcdVQrn2ljjuzpewyRh6AmIpCbwoKcd3x1pvwgnr6hV41XqIDpqEzPQYKoOIcS6GBpoHUfo9A/WkCD0A57R52/beOdnaw7du1B5VPxdw1ceOv9fPec1SJt/0kq6/3AbqRCv3PneB0U+IjaRFokvX2tDsiGgmIv3WFFIQlWSOedDifV1OeQpG3RI8TwAzqVJ3c7QpjBIR8ueKVcEYCkGJhug3eVY,iv:ZWrMU9NVOZq46zoCnCSVBA92qnaA8lAt1nFgaQw7wvU=,tag:KR8eqMCY0VL+vDhh4o+0aw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:XQ==,iv:MiUuP7EvBhUIiGieiKsiEL0vhFjapzT0BsZJ4BC/cPc=,tag:1ebUu6759HL8XhL0+EJV6A==,type:float]",
"private": "ENC[AES256_GCM,data:LESvBt2ua6s=,iv:zO9Y7dpLuLyB74/eT9GLD65a6etYIaX7puHc1tbj/j0=,tag:UxDzrQoX5mKv2wUABvfXFA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:JCHh2Jfhw6Pe6Vi4OlQRrqb1lPbToYOncfNY/vvaVEg=,iv:IMQCdgjzvDdmCYsclf05HnXezCPuOAJ0VQX3zjIrRXE=,tag:yC5iv6v4/Qij3YUbnff1KQ==,type:str]",
"ENC[AES256_GCM,data:5odFRHpFVIuFcsvLN8wlbrIQ,iv:a3KiFJ+Sh+FuA4nsjy7L2pkA/HFhbQnkW6sIxX1s2bA=,tag:2bfxRBFs5LcPaoM33MD/mQ==,type:str]",
"ENC[AES256_GCM,data:5IdGgGZZgbVbAl5LZaTXoJT5gXM8CMJAckI=,iv:48KVfCoE+9pHsfBTjHfjEk/Z7Nzxi2yRq5TSF7jOoRI=,tag:lFWLi+zXju1ZQWN/Wtk1tg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:mYoB4N38zw==,iv:iT4YW8cnAJoios20tDr74THMihgJ3aibZmMH3EyiuAI=,tag:Bv6aGThVo+5Varx5fb94hg==,type:str]",
"type": "ENC[AES256_GCM,data:sXAtCSkAJfVX+hEk,iv:ARTMKf0Bew1lsgaD3q4BEQBJNe2BW5zoEijfF+8qfCk=,tag:lb3HLN3KExfcy+RXu3xA1g==,type:str]",
"name": "ENC[AES256_GCM,data:0WonLZwTGk7/ufSW,iv:dsjO5eVmbUtaITZnq5I4BTpE5tmnmYvRJ+T/a7CFY7U=,tag:dCT2SMrith9UlneIw88K8g==,type:str]",
"provider": "ENC[AES256_GCM,data:mXSTV37WSv0alKkRJo/iZGHg7HY9cKdhoinw+s6jzfEmRoPMPHUL98BvMnIxelvtvA==,iv:pRxVuKoKJCgFa0JeO2ODWFXdkLZ2eaOJkLvmByy7xKQ=,tag:IH06pbV67DTTFyKAMbjI6w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:YQ==,iv:UwjyMtsyTpuSsKXCLvTMhV2g971MpFoiHmJ+1fk+Xuk=,tag:UAmYFW2/6kElgI9qtKP3yw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:kBM5S/cgCF9nkoFz,iv:9zXRa17MJ2LtoqRiigV+T/mYiHv8dKvGb7bLhkVFdaY=,tag:JYtSuF0eGJ7pkPGVE2Wzfg==,type:str]",
"name": "ENC[AES256_GCM,data:JH+M2pHNPKUuGJC1,iv:XCY2t9uiay5jCEWH4mYxcHzVbnDiLa3bTW0/9alDsXg=,tag:Mj4UdNyVVVMD5qYy12pfEw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:gmmwQaaZR2dvvIOv/8mgBrezOYfZ9wHsxgYx88Mux4156WAsBIBQCTIawbj90FV1o5V/P7+U4dXoiWnjFh0ay+bxKKW7goLfaQVLWxKMZyQ9fhAlKr248E6aJmgAPJ31tmKDa3mCyAq8i5/5EOouGkaei3XevrmuBTU=,iv:8dhV5z/7Nwz7/dSG9VxKrraoPRS/7/JnUbKHATycfqk=,tag:etvkg5yR3RhVrG2wqOrQ0w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:BQ==,iv:XOgEig1lMOru++7GmdDPtYxQsJUw/DLSAaHPIHj3SBg=,tag:uL8Io21X53Uqaxfigqk3fQ==,type:float]",
"private": "ENC[AES256_GCM,data:nzkUvpsjJfY=,iv:os8tqrjyQlFKYbXyaOOndioC0hQju8e1pFfgzybod8U=,tag:3vE5fnKVrQN15oa/nrH28Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:RBM/x6thqw==,iv:dFv2oj/QvZNWs8tRWfgv960iF9P+iurOgeB5RHNr6Sc=,tag:1mXzcwx2NI4uvywWQHIu6w==,type:str]",
"type": "ENC[AES256_GCM,data:gQ+5UQGCqNuGddnQ,iv:pXQyQ6DyxxVhoZMoTNgr/wYxCq5M34BHHrUvA8OejzQ=,tag:81+uFPTRaW/YStEcVCPtdg==,type:str]",
"name": "ENC[AES256_GCM,data:g6F8Egm4wtToew==,iv:gLCTqgT2E5JXfKjMob46fhYpSkBgwCRSW/L77lrgJmI=,tag:zAumaFoYLxf8OybtkyIGyw==,type:str]",
"provider": "ENC[AES256_GCM,data:cNCUfUcoTFnH70hTtxY+xAx/LWTmoSf6aRRccTSYsehnA32ggp2k5n5We7rVHrHlcg==,iv:BaFccDIzVmHl5t8qds1pc+rbzRj7MhiEYKPc+UJaOEU=,tag:y4NwDNJFTW1NnwKAWPa9zg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Gg==,iv:1K1XI3Z+78FxzDbWpEKn4rxNu5iYHqcfDGL8zODoOr4=,tag:OWM6A2db3sUWOePbHOxU2w==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:XgFCtEX1sTzcIw==,iv:q22OKDfccLa6grMKCHILw9eNIkKSw/h2e3pE1tYhrw8=,tag:KRuspkWXaVCO+H23iZb76g==,type:str]",
"name": "ENC[AES256_GCM,data:ROZ5vOOGmnwB9g==,iv:JJtD0iJICjVIMS7RW/0O05IIvPDjQOL56w4xgB45lTM=,tag:AbSqc77BMRI9sh72QXCycw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:BERny8FOZRNkbMDxoGaL15TSy6Jwv4iJ2Ds+TgWe1WdamAv83JMV1ZCe9IwBaFs+p8qOlMVlzGh3xh06MBXuQruspRTzVoY510A2iz3UnrxYnzbaHIdb+iUt4GAuMQGJ0jwsar141yeHkdyQxwttBWMyW/eWejxRmjXO/AHOriH1w5B+cDOR3tYf8uBoY98GG27jxXhRdaZx37dl0x5AgrMeS7d87QFszyhIEohFt1KQ+pDbyC6upO4P27kSwJ23Jmi7h67KYAWvb7htnoHd7q53IoNAq0jR,iv:eVf6MzVjXDoMreOmId54v36Nu2heUxpk4dFA+d9Pio8=,tag:h6jfcmprZlwtWgV/NlHa3Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:IA==,iv:IwOgtJaMQKadD45Sr2cy4zrv9IxvKKN8lNOAyEcgJcw=,tag:IUK+j3VwUO9z4O1c9DmYLA==,type:float]",
"private": "ENC[AES256_GCM,data:nlLujK+TrPQ=,iv:wWQ/3tmhg9nfBUwRbJ0kqVFy/q2qBLtnaQh3uN2G5+s=,tag:wdkRgoT5+Q8dRbBtbr4RXw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:tjXZExs7vQ==,iv:vUcwfGy8Mkgdng96ZzVzcdK0xll6K4zQlQ8wVE1zTdE=,tag:zApa0bG1LbMNg+e9WpnIrw==,type:str]",
"type": "ENC[AES256_GCM,data:diLVK2G3vifWLeGf,iv:KnCfstyFp90QSHuvqw8cVxTKRsLmCe0zfhAjrw7/Nuk=,tag:RYHYZke3onYtnI/FFrUe5A==,type:str]",
"name": "ENC[AES256_GCM,data:w0oTD+H3BAqG,iv:PLR9J6yW8MNxREnKbaV+HCjE9nJkoyEDQvDI8ceTzkk=,tag:m1+yxX4U76BX0OPWSjkM9w==,type:str]",
"provider": "ENC[AES256_GCM,data:KSqsFh+WF+NkypqWccd86Hdb58f/c3hixpIQkgA1LL8e0uoPAAlVjALpFW769+n+ww==,iv:UVqA2e211YTG0av/dis9r4jKhOX0YiajQOI/v2/tPRM=,tag:gcKhBo9F/JocanYo21bG7Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:lFtBtw==,iv:sp4kUTEZ+fgZeq8k/NGK/ka0SmnvCF8jjtwaMbE5OR4=,tag:GF+kshJ6GFZMloR4ywNJAQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:IQ==,iv:V4XUZa3RrX3iAFdbRgROjbbis5CSTpdelLy0fJZESII=,tag:hfEYmbAVxUk2mkdpoqFZdQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:UA401JKPCRTCeaILjYc=,iv:mrDs/K25tI7OQyTcKeHGavXHcFCwSex9AGxiqeyQnuI=,tag:5Ye4NDrGKuDx2MYyBeagQw==,type:str]",
"name": "ENC[AES256_GCM,data:WbQyYxkAhVO1q3RBGm8=,iv:+WcQXhKHNqFDRkMzp/HIXv8de3ict/lzFOvOGnvdNJM=,tag:87c3/gnHyQ6i8GxcNfAwPQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:SAu6jRdH1T6QdA9eluoyUEJ4ZlKVJId96H/UQghjuMmzVguKTMNFls/bawJbKn6qPGK1yQ08P9sNL/naJehX42lwNOvyZyQqiX3l1GFTYIW9KwSdL1/r83eODL+vifmh9/5KrBpcnnLhlkT23XJswrvjdPnrnW5+dSQ5T1P7tYUWQOOGdcea+/55YQo0rfjeBfcCwJfDMaqVgEtkknuFXRn0j49EsDg39LOJ+XnHH34UucAfDzrVjFTY4SlZvdDkl6WYK4PUs5dMtNS382fvaZvZSa7r0N+pcXpQDNootBc6WXbr292VVg==,iv:luhUXH0Sw525sHeIwr7OFybhJvYgn3XZvS6wLXqEmgY=,tag:EKym89tz3EafiIOyZR5Ceg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:eg==,iv:FN7XpSYVGKarJhZKwfUnQ6MXUrqgADbefYpIsRKWLxE=,tag:QeHDXhKmvoooYNrDO1l/9A==,type:float]",
"private": "ENC[AES256_GCM,data:FBLpTm8XQeU=,iv:Qu93Ua4xzJgRXNS5Ea0auAw7kHMtItL8simlNo2z45I=,tag:iKzYbVwNVQNHW3kD2Afmow==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:DmKDg4RpuRlyClPlkV56yEZx/NNGm8DOJ9L3vNCQCZQ=,iv:9x5KknD+0u9Psytw9NSaMj3Gbx5CN3AS+zMyF1z6COw=,tag:OjsUIX9CNzlCOlb5osfIDg==,type:str]",
"ENC[AES256_GCM,data:OlWdAtawcA2HDEQt36CeXG5B,iv:tQLaGydih3QTZn8YMiUYdcpOu+KrVIAQhdfamS6hRFs=,tag:vz4EHa1J+X5w7a5szVoTgQ==,type:str]",
"ENC[AES256_GCM,data:Y/qL0Ie8e89lFzWt5Fk1+h6bgJGJ7dZtHJ0=,iv:men2tXEvU47XNktJA79+Mmr6eVKtij9h5qR1BNFi6+U=,tag:DdIrscF2WzoYEvY+TcZCvQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:r1gsebj5DRI=,iv:PJZtNjRoGyfpuZM9eCx4iQgMMKg+FjLBr0bks7MMgDU=,tag:1zw9yd2EX9yLIsgunZeo3g==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Ww==,iv:NHE22dpDPgynUDblGXH48A/1MjOu8XK39tnXietRcy4=,tag:D/PG4wKINlZgRkqj4ghhnw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:AMXFXntI4gtsn8D5FA9N/1B2,iv:hdyHzMEWWAzWQvofGHg1wv7fyJPbrkvGtL3If+AjZas=,tag:PS4gQvdVukSL886+gQYpgw==,type:str]",
"name": "ENC[AES256_GCM,data:rn7jAWpcpAryOY6MPY95s/Pw,iv:WTxiEmcRuhVH4xa2vKRct7i+vhwRPcsmSOtuRoKx6JM=,tag:gO5ChYZfgrjHCo+4MHinQg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:GPFQtDhAsFUaRy8JQzbfjCMYPKQUAV5RQ8j+7T0+pJ3Auilv34AQu/5ORuno866rp3pJS9n/sT2tZvpdwWxwBKVEYRLA8SX6hf8lV1WzSJsc0SW2lkGDMwFILxabsR7P06VswkxulmG5kXF7bwhIxo2snICQfEwYjbndrTZbCJZDDDKUGTaaH5tx98bUJxWxIa+i7DeI7BFdRuxVOB/OXCVUVNCgfZYABLjgAfnsWncDwt18HTVBYUQ9WwKJQW69jGNETsS1PuCw+QRAmtgn2MilrelMhVrUOg==,iv:+zYbm31wXF6WzcwbRZs8Md0T4eFvWG+WhBPsvswG2uc=,tag:xdsGjnTesMKH8qNMFTcE9w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:aA==,iv:YpUeS/BCHPqN0KoaHhITPjdQzNySiOS95swr+ZGtbq0=,tag:EESVF0RZzNTzF65YuSL9mg==,type:float]",
"private": "ENC[AES256_GCM,data:okM6A1ZiiVw=,iv:tcMqO+BicKnnetiEShUM6BVkYuAvliSd6BITxQE24DI=,tag:e+7jglI5hOlU2FqZcpBP7g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:JAP1C+mrMQ0wBkBqV9KU3mol3lwR3WfRLrsiyHa4hO4=,iv:z22NRtApZKC7bGL8DFuedB3spMKFJqfFTMV045awGPQ=,tag:rD5hiQXMYZuFazNqIBaDXQ==,type:str]",
"ENC[AES256_GCM,data:xHZIvtO3z30jVpSI4uFOj4nI,iv:dO2kYtCL18QHZRb4gbJU3bA1akrMVHN9+vs08MQ4emk=,tag:JMZLHEHRBmeKGaCOIhVDgQ==,type:str]",
"ENC[AES256_GCM,data:aXhBuXsu5ysXAqa/dFP1ajLBH4SY4hypnDg=,iv:ceSEF099pAJ/v+GYp2i+BMF/UQJDmvUQfj7gfLJcNfs=,tag:gBpxuyFWpaCk0kPKQtcY/Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:fyzi/UhI2g==,iv:9bk67b/XGl3uwDbhWxNuW8mPxhYJHJiv6SevmB4MQSY=,tag:g1E+1/6dL9vvmU18pQ9gLQ==,type:str]",
"type": "ENC[AES256_GCM,data:rndzpQYCBuDkoiEi,iv:UajtntFhdIdhtpqPM1NrEboUaIfdKBY17v0KDO7ZeFw=,tag:HvgNEYmGihP290nXk7gK9g==,type:str]",
"name": "ENC[AES256_GCM,data:iGjrpwjUerP33Pmtah1t,iv:zPxDp2HIXr7T0Bty7gEr2p+7HKGxsHxedywrD6WQID4=,tag:yGP2Kr/H1wM3KHkflL8kQw==,type:str]",
"provider": "ENC[AES256_GCM,data:ZSskZ4mPCT0jfxiYuOY4a6vQifmqqZPr4QmW3DOPVuKUTJnZirgsuiCfO2R10JTULQ==,iv:mpm7WmOOup3rM4SuWvDIlAlbBDyzkA0Q639ChTMXWOw=,tag:ygZmx6Y1osgfVV+Bjq3gzA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:mw==,iv:WdGws1R7fTcsBuRHVV87oazyyRKtQm6Fu1N/Y3PKOGo=,tag:HSDRJ5EYKiynIQeEl8Ivaw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:UJen1ypvY9bxcljIfcUl,iv:KnMqLCl+m1mTucfmS95PeSUzj/pVF5md4TFc7cQ0+1M=,tag:ByD+bD6MjPFoQLPHL5Wd5A==,type:str]",
"name": "ENC[AES256_GCM,data:imPNOgW2zOlGQ37M2XqX,iv:Wb1oeTTBYsET/K+7V2hmU19I3a45Gj0gB16l/XqFyUQ=,tag:OugiwqbpxrqKZItVZ2CPDA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:SpjfZwoxCgaE08rSUF9iYSzEggaU/vQnKAcNtYIPF+rAwFA2AbdxwARhlAoq+uEfOURFBaCXNQkBM/8f5ZNi5HeDSqXV1XTEt+O5DcOy2vSIvVO5+qdAFYSQKNk1Ql1YZt+44sR8IXuNHbi3KUQUCOGhAer6EEk6NrNAGsGukWPZsHSNM/Z8AcTNvqsxmmMGPCIk02gufzHB2Z4l4UTeq5WqRL3AAhqmhTIpTv3t48UHk91wOoMvxA5rZjNQBWKSVBducaFjNiDgvCdX9IlcBf5VRb4WxSxrXHNi9r0/6PBOiOVmIx2Bt//hrWoMmXQTcJDeIAPaytB0wUDB+3OgHh80WwCr2hxzEwIypzTvt/k/O4pgNwysdz5ce+n1uK89G5uk3BeZOT2gItyf+4dFW0TwB0CDS9R/Qz8ELIgxMqudHtCr8lOlAJSV9CbIIq4Us9hwjAyCOXX0kdDQZI7x5GGk1uZ35DxZgS49P+MdfNHhMjJ9LOjXdueahT57oHj/WUINTxRvzPQPTPOSpSmEs1iVWAO+gZUQPA+8f/R/2zXmyUewG5NLvWD/HBK/zo+AxA9SWI+w3StKvnUmStSiJL26f/XFfamhZo2A4nQvnEG6FO3M83nME1driBZraVwsVqprqu3gK7EGLq+0P6XAZ1n1nRAo1BDHQVtqt1BaFfbgb+riO0NQ7Q+0oMgIs/g6o8wW1ak4Wns8p6Dqn/fddfK3txumd7oY5zznFihrbpCv4SUEmfLj8Ys9kqq1bl+VfCX0Kk5ddyRXAy8AyJ7fxW75DrkdVUywFH6RYjXrqYnwiMkOTg==,iv:OI/HrOXwdJ8IEEIH8i3HwZQ0XjAVeB0w91f79sOhbi0=,tag:iCd42I7SnFNoZkpIztB+pQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Fw==,iv:QajyCHqFGPPv3EVB4Hg9BBydsVgr/exmAdUAsMvheGM=,tag:eDZV5AToNypIixC7aEzXjw==,type:float]",
"private": "ENC[AES256_GCM,data:qvJy+WjKIgE=,iv:tR2x3wRHUVsU/s6jCXe55i0shrDJ5PISrSYQjiEKfBo=,tag:9WQrJCA6yPFvH4fPUA98Pg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:8nXd4vS8fQ==,iv:1l5jj7cg3vMhh2jo4z8im3qJ8z2RTovnb8WzsisB3SI=,tag:jYV1BJqM6vShIIauZTgUyA==,type:str]",
"type": "ENC[AES256_GCM,data:s4hKrxEldfeMUq6w,iv:r5HgqIvLZX+rRyXAtpOeC4OHPAFs6agWQAi1hPn3laA=,tag:LiXGl5oLSzSzeKh+jE+jOQ==,type:str]",
"name": "ENC[AES256_GCM,data:LL5r75aQW7wONDlkcj5H,iv:86RGpHVBZzPse5o+8Ew8U8Mz36GnAyUFeFB2aEWMO24=,tag:yZSTNGgNogUqbn47uhhtdQ==,type:str]",
"provider": "ENC[AES256_GCM,data:R2w+/hflNeGpPTOS7m5EO2Lz/cs2MYqOYuineE/63gnQPZqIQPJvWTCTExBCaUZ16A==,iv:rbhckPaE5j8MYGwNuspjWmNXLMuc9ZqzdrqlryKScb4=,tag:NMDdqoT+OiZQo1uZpv0EAA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:PQ==,iv:AT9kXym4lD9/bQkyS7H8muyEyH6xqQHMHdlziAHeGUA=,tag:G63MBO9Ayr4rEjC88otpPg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:SRxlWYnXxPaxsm0xw0Fm,iv:YnmUZmvGNI++GjVXN8Ued2e8+AzD/7HSte4Piz7ieJE=,tag:Ob+AjR+xgVrHhtrHejYOOg==,type:str]",
"name": "ENC[AES256_GCM,data:ah6GVCEzol9+YhtiK7xO,iv:UDAISrq0xVJWQDxPN5YmqU/euIq+EketclL40y0qLcg=,tag:Vv6Oojnf+37pOi9iJBSlOA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:QNtGzSXNlSXAGC7BLVd3BbkF2psseXgjNveUawnnF5ZFuEteH16JUuBItUCwqKvRpwULEgKj4hZaswRsDME=,iv:mGwgSaY+0fZAaUj0acpbM/BIxzBuOBzOWQ3n5zzpRsU=,tag:V8SP2mp8SG5WeGXSQ6L4gw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Og==,iv:/LJKEhcwx8ZRpYgBzCUuRw3UClQ1t7d27SHSJRuR0Ww=,tag:WZdtgcJ3E3jKlAmWViIg7w==,type:float]",
"private": "ENC[AES256_GCM,data:txNNiCmUhGk=,iv:fnbGdyMS1gp7Xt//vctMqrxUaOQ4xEG3J57lK3GvUAw=,tag:bxRpBApm78dELCOZkKYT9w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:JUNIkYTXVw==,iv:kyTH4A2DMpYt4ujQd204TzyrLa6gNFeMLgTKKlYEfs8=,tag:A3EMmgl60T5l34AdvO9NMg==,type:str]",
"type": "ENC[AES256_GCM,data:mgtoLipU1ANhNTo5,iv:vFu0izxosgfDAtRfRVaWHYfh1/eah0nwSPc2eEz6yMI=,tag:jjuof/ayY1rOMZleuIdB6Q==,type:str]",
"name": "ENC[AES256_GCM,data:X9IByTN8vihwR4D9rF/SPKTw,iv:fVwkgyCon93LZfZz3Q7Jncb//X9p90yNQA9Sss5QWes=,tag:eXWPJqXtVCyQ5sHRDmfHOw==,type:str]",
"provider": "ENC[AES256_GCM,data:yRgGo/ddr8zOdKWV/qmNOBD5w3NtGEZDK7GD2ydkhE7pszEO1qH1RVpSvv0Kh0M17A==,iv:t+FeMo9YVzwQQWvzdbvL9V3I/VuXnamBA/j8iFEVuJw=,tag:ym03OKfvJHzgQKfWfylkwg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:8TWF7+aysiiB,iv:w4s8UyGRhm66LmujJVTp79Cirig2soPd5Z5Z2tujjH0=,tag:Cc5poo+SHZwRyBdsJzQwKQ==,type:str]",
"schema_version": "ENC[AES256_GCM,data:zA==,iv:b4oVRCef97bwDoJyw/QH1qkY2qI+6pZ0x1XoHZUAcsw=,tag:FWewniOzG+NDb4P3lc8DNw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:GdkuJ/sQfOWZHYOHAjDqlzdJHB86msYq1WGIKA==,iv:GLC0W+CJK1VGlJ8KNCDJVBob+9SFk49/mReJw8kecgo=,tag:QD5zx9H+GF5j9/5Pw97wBA==,type:str]",
"name": "ENC[AES256_GCM,data:8zOHd+aoM8hg0MOnWp10LiFQHG8Yp1ei/yZyfw==,iv:nrcHtLBxDKk008beZuGlqIhcGca/ukHxRmzHSWKk9mg=,tag:OivZw/vmUDHdBaScmF8Nfw==,type:str]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:nhhejMvCBUQolixg4mOGqEFos7boXZBKWnuLHlLO1qlSqs5ImYhA/uH/+dAlE5ChTeCbB21LuWbRgRSqar/Y2o/hcx1WfiEhcBTExIezhUklmHCYlXF1NJB/jB3PlzcVY+uGLVA1FOS+BSCyNkNqcwq+5J0pUMZqHDN9WajgF0TjpU6rNnit5YUV+mb+FUUfelTU1I6DsbX5Ck59Z//vjl4iLZZZ2FkgDAxpktJ0xZAsyHg4xvf+Jc4tk4nNwjElpTpWAvPzo4BdzkTdD9xNJxtVoXxT4KhItP1AJbZuOqWyVcbp6WdeVoQMPYBUTlxmjEuSEPuQx8Imn2ceZiSwHnZ/mFxQGNmOO6cAIM+Hx57kMv1v0firX2cwa0dr06SjKTpAp7VryUhSYuQKgR51SNtpdYECckH58Q==,iv:SCxFCBhbLAn2mSB1LOSPAxpEhI7S4s0UVpQ8/BoF0GA=,tag:9CmIP7tZHKorgzccqQqntQ==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:OA==,iv:x7F7M8gxLlA7QHe0LLKrMlQxiP1TE1vU2MEMK8eK9Yg=,tag:Tg5p4+g76ySVBG/Oz6orlg==,type:float]",
"private": "ENC[AES256_GCM,data:0cmkKaweHMA=,iv:tV84tqxknojoi7DGiaY+dVacMqNw2CBFBDInl6mCIZw=,tag:5ZBAtoomeQB1vAGF4nmaUQ==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:F6yq,iv:8yUOgWfHM4KqEzauEu0+wUCCY085Sg1nQUYqQTtt69o=,tag:O0qg+32kz9ggbZVUJjzpcw==,type:str]",
"schema_version": "ENC[AES256_GCM,data:9w==,iv:ivWfUqkvWlJJQY8mXWtuiYQ5bvcBCaDmupM9/c/c2P8=,tag:F4PeaTIKd3nfjW1EE1TXcg==,type:float]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:vA39/X+6HtE3WYAEWcLfTs/ksB0GKg==,iv:AMOhKVolnaNBxYGhl3NCU+6tnxI4zETbRrcd9J8WDRk=,tag:aEFQUhQ6DoW1Y28wuGKAkw==,type:str]",
"name": "ENC[AES256_GCM,data:5t6B1HTq3JMF/hbcQZKFaNDVhq1Tdw==,iv:F+He8hyQnpBvscTgu20A4E6yaQPaHOnM0PCbKeeU3gE=,tag:BcAgOLUrp6+WfS4Zud2LTg==,type:str]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:Ooq7o8b/HEa+NMU3UPDgoyxGvlAAYHey16JDQBDUAFHDSx5MouaXZKKxlup5Mn/3atcvYxAI3Wvfeskb2N9gUM/DXT1k1ThNtDi5zyoRP1mC2JM36I0lnTibH3aq3C+8GiIYMF9P0BTpdKOkCrixzV/hTEl19H1GMOuFXIqzlRCpwBSH4WvnvP3QEMmakM3x7V6gtaDVEDzSXmQWMqvGP/WoyuaURhcXyExsvzvUWGeOHV8FpchRgnecEDm498/4LaoGoVyhBQX5hGVc1x6MjiCzzTm0h8CrPXxD2dinJO7eZyLa4lBVvFDFongqGr6hqxHuQQA8NUH05a1+rnHcnN/OPmVcJ1o4gcue+4ekqd1maqzFhGDzvuZ6wxP1Cy7JKde2nPvaDe2TOcz60g==,iv:B9dySEsLwHf+H+oX9idyjQ6y9mpjYxOsI8VPjqRIp+I=,tag:GcF+WFFVjFxZ0uU1J/29WA==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:vA==,iv:LgDij2kFht9lZNoGooNYiCZbVilSETT5ZPvsAiWJofI=,tag:05odSGVPepA956MXiWjyLg==,type:float]",
"private": "ENC[AES256_GCM,data:fr2SlFXxNrM=,iv:dooCx3HFRuqnzxCCPoPDennYMSzzhqQ1x6di+L8gL5A=,tag:/lmKiaH2i5Icu+dzRSfXDw==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:kHpZn28X,iv:1swKiY6ZbZzU62z/igw/77WEeofQ7FgZBdDNNBquWwU=,tag:/J0gM6NJRydyKJBah93HHA==,type:str]",
"schema_version": "ENC[AES256_GCM,data:Pw==,iv:VTx5//3Pt6jrQzSxxo8hzV1spk0pXMqBJ3Ct9AEEv8k=,tag:yDTtzsQxim9QrgvyPiD4KA==,type:float]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:aJ8l3JjxKOJky/ka7oboGjzsiqZIwt0v4w==,iv:xPeXQslhfaEo8sJzKYimTdk9L+aAm6doRf06N1ga4Ik=,tag:G30p7ifv+tLYUSBg2cr32Q==,type:str]",
"name": "ENC[AES256_GCM,data:hbftlGwjzMHSPNpPtsRaPVFUaW2ifBKTPg==,iv:vvTavnptgwKXsjE/Um9SY1scnbf/hmS7xpmIfhyoFlw=,tag:U09uWJSOzHXaG4zMbrfQMg==,type:str]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"namespace": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"policy": "ENC[AES256_GCM,data:vUosjPGBG29YnRjQJSorB24EOWUGMVZM+LCQ2Ra6hWAYZT8ZP7DxsONblgrL10/5w9J6LFfGlSAaYEIYRrzEvcSqBB0iYvQLjmSoIyhRSAu3NZXkUvzZ5J4dNujz/37Gyg0j+ZzIZuab++W4b+ag36hW1Nq8mj8lD7L9A7DnqHwFZm9zIl2P9mSAbQvAn7GnqgfXVsDovJGbd+pKAvmzsoa9AHOStdd8bDjvIzEAJWYu9d4rBDivnemPjg9eoXwhUOVulzD99O+TBL/+ueD65Ywy5A4Bylik8HUCHNaePluZzJyg9sIr7m9N3ye2hU3/2N6Iym2FUR5GQEec49pBI2DbCSqUuMrndFZirgUdwNvBaqVa+f1pW5Z0VipQnJGmx3c8yMlKC5csHfxnqYVlK5y/1w==,iv:2FeHQm7DDcrRLOSE4vFWlxd1v+41P4+Ief79jxnzAxI=,tag:bcIZieoOElO5Nuro0hy24A==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:4g==,iv:t8L4MBbeHdn+J3JlyJyhdzf/YJSfcbSWPfn3NvmurPk=,tag:YkBfwOVWLfAFQGsENZgKCw==,type:float]",
"private": "ENC[AES256_GCM,data:fNERWkV0L4k=,iv:jVLxXAUvcP/x/4k3oKct1gbuO5YGdVfNEcT2nSFVbwo=,tag:QyKVyf0sGpDpQtxlrddl0w==,type:str]"
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"mode": "ENC[AES256_GCM,data:9R9yeY7fKw==,iv:a9Bqu0sbzoEeaV7scROfFRhNZUQv4sihHTmWZO+cH/E=,tag:SSiiQtD36QEe0RovF6vOFg==,type:str]",
"type": "ENC[AES256_GCM,data:n7mtJEkBGJLYqXGXhAnkyKZz2FqJDZ6RliewMhBEMiU=,iv:bfSPfG1YgHPt/IpAgMh4+WX8wHWXU/h0XBCY5hjh97Q=,tag:B337xYtBrNhLmZy5bOVFJg==,type:str]",
"name": "ENC[AES256_GCM,data:6znwIeUv5HWut8nCKZQE,iv:RbyTSRADrXYXxk9PTbY87QOK0W9BK1lsImFuaAmgq6Q=,tag:WIpib7O7N0M4N0M1l5Drlw==,type:str]",
"provider": "ENC[AES256_GCM,data:Htb5lk9AiwgjULfnf4HYTaM6AXiECcq7g6nk7nnCZkbV6VlQFDo+uq6h192RBTTv3Q==,iv:xOvNd/bjbjICEDRncyQZ45wty3Gj5ts+IB91zGgto3s=,tag:CMEQwXrBzGd2rbXrRHJ6wA==,type:str]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:AXF/Wu3XjHcnFOlVjA==,iv:pieY2aYui5vSbP6AWUjm4EA9EZby91yUdc0rm/QZT2w=,tag:Bgm9W+93IkVPwDXoVshGLw==,type:str]",
"schema_version": "ENC[AES256_GCM,data:1A==,iv:qV+fz1HNaYB8lYdD9UqQtPhpRnVxijgWaUyhmt/R/78=,tag:HFJplKDcoe3q26hlniartg==,type:float]",
state(vault): update encrypted state
2026-06-20 20:14:53 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"allow_plaintext_backup": "ENC[AES256_GCM,data:fOhraWA=,iv:TT65nrnWi39d4+jxExnlu/xOiO3KcU+UuKOsplXxbJs=,tag:0qPpy3qPTw1DhPHzAzHqvA==,type:bool]",
"auto_rotate_period": "ENC[AES256_GCM,data:GQ==,iv:NhodqXeULETpP4c+Sk25G+cCpbYqATN7ocCIHxxSAWg=,tag:288oss0xUXZ+tF91WE/fYg==,type:float]",
"backend": "ENC[AES256_GCM,data:DgSWfTHWGw==,iv:GG8504u/Iaa4alaZvbyG915cnO54TZx5X/b78EIq11I=,tag:nyE/qnldLP0PfVbcdSUTxQ==,type:str]",
"convergent_encryption": "ENC[AES256_GCM,data:BElQHQU=,iv:zMHhkJMdVlV6pWOxmLU168hYXIhDfTIN+x5ka0XQeoA=,tag:4nr37mJZNalPOMSzHyrbBw==,type:bool]",
"deletion_allowed": "ENC[AES256_GCM,data:f4+RisA=,iv:gPjsGHRiatSfY/Bilr/JwyKl5lJ6of+WAQ5ysCDMJ3g=,tag:NOwCPl8dRNJvu9qkGccDCw==,type:bool]",
"derived": "ENC[AES256_GCM,data:+54iY4Y=,iv:PZLZGPg6jplh7CGNG5czsNAgCWjq0cl++64CM/Y4m6o=,tag:ne2xCC9GpF5rIGsfJNsohA==,type:bool]",
"exportable": "ENC[AES256_GCM,data:5zZVHss=,iv:1IQ0Rkx00os+a3AAZ4d4cxSKnsSjOccPcil5fZ+z2zA=,tag:0ZXFa6Jl5fBcgWzQnFW4Ig==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"hybrid_key_type_ec": null,
"hybrid_key_type_pqc": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:xP7upKMCeTHhXLHrwhI1ujJamoRJw48wE9ixSUWvHlRZmKsTiA==,iv:wfjsnx1ACpIKitKH7P06hosODA4Lq9NE+qRfHc+dNYs=,tag:BVoe03QmDO8usnTqeBBQsQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"key_size": null,
"keys": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:aDwXEJt2n1BsJw==,iv:/UvuMT55l8crlezt0JZKZ9teYvEBftW48FTUWBgM6y4=,tag:ToCOvGKqXD2xh47mUKQ50w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"latest_version": "ENC[AES256_GCM,data:sQ==,iv:pJNrPxsPIftRETx8b7ovneGm1zDOuIV/4w5jHHHlN3Q=,tag:i+IL9DJXJb94BNyWSaBF+A==,type:float]",
"min_available_version": "ENC[AES256_GCM,data:bw==,iv:HYdAqC9DEeRdOZiMTNdnu1Z1WWQqR/fP7n73Od1tRwE=,tag:m5Zf4pIYJx1upGZRZHK6fg==,type:float]",
"min_decryption_version": "ENC[AES256_GCM,data:RQ==,iv:yBx5ClGdTd3NbwYJXz7XTcOxppnFJ0zpHrQRuG0odBM=,tag:2F0Q+bUJxeSpannI2a1V0w==,type:float]",
"min_encryption_version": "ENC[AES256_GCM,data:SQ==,iv:7lqRJ547DtI6uxgE32QzUaxsAkfRMbYwal8enpTMAak=,tag:drNmtdU4KCGeFhq6/C3ozQ==,type:float]",
"name": "ENC[AES256_GCM,data:IZW2cktJPMdCFNw825byZAxW4FdLWjxP,iv:jrKkDuhc+yBoebXQjq5yb+0HXrQRind8L7D6OGauvY8=,tag:/Zh59Xd4y+9390SCxB+o1w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"parameter_set": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"supports_decryption": "ENC[AES256_GCM,data:Ub1v7g==,iv:JT9WXEcfvZZ2xAvhDzmzXRQfXyzX7NXEfNlgIK6u6/w=,tag:b+YD2Ez3gPiMdEbSFNDLLw==,type:bool]",
"supports_derivation": "ENC[AES256_GCM,data:68lrTA==,iv:tyKTjxptAElkqPFA/YAFGhMcRo552NfZsCMvQWpRgTA=,tag:nPCiAaqPGbV5d9K7VuC3CQ==,type:bool]",
"supports_encryption": "ENC[AES256_GCM,data:idHBtw==,iv:leJC6Yn+uxuV66Hcac/Byalouiz6481A7Wn2B6xYuqY=,tag:9iJY2G63uEoeJDHtXWfhcQ==,type:bool]",
"supports_signing": "ENC[AES256_GCM,data:BY47BmI=,iv:B0k2YiNiCNJ4H+ZWbCILef40gEUprfm0XkpeE8Zelrg=,tag:wHgYf1TlkCKOtUeyoCTG9A==,type:bool]",
"type": "ENC[AES256_GCM,data:5ipGb35Um7YbqQnd,iv:JjDDKAUVjSqCrFcdR3ehkaH0ZqTTks2fJJDx7AJSdKY=,tag:+zh3TvnfAmTzZc9Ggk1uMw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:4A==,iv:WPTcVOY1+jZDUl2Wl7lizUpU6/kWTXsrcqUPHLT3b1M=,tag:/m2ICDEY29U2T3X3s7NL8g==,type:float]",
"private": "ENC[AES256_GCM,data:53wlZ16WawxFDBVdSmVFh/DCAUjGX0xaEUrV/9B/F30=,iv:7RlPdnmK+f0LTI4+LQA8V23J4tQFzujeFuwQE5GkXiU=,tag:J//G6u0Hk+x+8Id+ZA1mNg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:2Xlr2lL1ACYyIUzLazbAGicFbL5Gx5kp8tYtaBdwlG4=,iv:cS2rXYzr/BR4l2rwtOGnwPuIICjZVdxv63D8xhkoIQs=,tag:mCOjQMJiY5c6k4RS7wviVw==,type:str]",
"ENC[AES256_GCM,data:Gv8tKtG0bbRxNr4wkbqmWXkw,iv:4Mkx54YDZL71XB1qk6/DEWw4RfG6eGuZDgQOAB9i+1M=,tag:rIo+N03xdM4SPU5liWr8AQ==,type:str]",
"ENC[AES256_GCM,data:LL7h0t2MNhtbLEwneAm9tHTXncsOAL0mrcM=,iv:3H39LwXZgPxJFrSrHxhUU+a4A7oSs8pMgdBWLLkscIg=,tag:a2jN41RUw2IgQ9bvv/pRvg==,type:str]",
"ENC[AES256_GCM,data:NJZW9W7gHMD+XhWnFi0MqJDpKQ==,iv:/bpFn3eDTfRHbqIc1B1OH4C6gVTVhRw7pjF5aYZKlQM=,tag:8JBfkoaji/itBt47QRvykg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:ckuFgDZ1tIQ=,iv:XLOCZPuOrpMXS0Tyd6opM011DVpy7Qit6kdIeMqvEXk=,tag:JMvHbt+2/23flIJyO9ie/w==,type:str]",
"schema_version": "ENC[AES256_GCM,data:KA==,iv:6X8LabalhJrHKF81njzllsxnXgJRHdTLkaa4rauy4Iw=,tag:QK7NwKA0n4ZQXXkFo+v8Qg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"allow_plaintext_backup": "ENC[AES256_GCM,data:/pH0Z2s=,iv:QzsuChbE5zvDbrHntTXMqewSQhuifyF+ie8kTQTyfMI=,tag:tYUrTyiH25hRFMrzJhuRdw==,type:bool]",
"auto_rotate_period": "ENC[AES256_GCM,data:CA==,iv:aYKbbgjzHzPzlVc8NXaDQKQzbj2uso837xSaxLe4qXs=,tag:abCSNYs7Fp15SR2JiRMzMw==,type:float]",
"backend": "ENC[AES256_GCM,data:JFt4+Jtkig==,iv:4v0nl6DOg0x1MoV12AmHHV9s4+BWTs0Bc6uh/0QX7Yk=,tag:MhpxGJokwswn0qtXYgVwoQ==,type:str]",
"convergent_encryption": "ENC[AES256_GCM,data:bJcMWBs=,iv:DzpThZsif/1Xl/HBYufyPloqDybIPbIzWJFjXbQLESE=,tag:bifoKQaYiNlResGyZmWSQg==,type:bool]",
"deletion_allowed": "ENC[AES256_GCM,data:5Nzy0Uc=,iv:ejY0YlDMkGDNIdyDPNlsGMPTaDufHkiLjlhes7xLfVI=,tag:TOU/Q+ikjIrpOx1jZNSyDw==,type:bool]",
"derived": "ENC[AES256_GCM,data:uB3GGEI=,iv:SBiHc1nYvi8OjVV7cyMfQU8V+KFkKL9XLkWdTrqLvlM=,tag:LAyhn/Z6oU2g5oIH4uYu5g==,type:bool]",
"exportable": "ENC[AES256_GCM,data:qNxksO4=,iv:9V27/s6WudqqS81AoZs++nezSFVatGXBwQbbh5fgKQk=,tag:Fu66JlBsEOqyZR5In6edyA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"hybrid_key_type_ec": null,
"hybrid_key_type_pqc": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:Q7zWbdxvaOs4/zjCwvhVaS4Tug4Fm8fXtIQSA1EmZDo=,iv:85yjYAbBMsvqfLUpC1NaA5W2BBqvx4tabGbejUeY+l0=,tag:epGBQ8Qu/DEKD64hHbphvw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"key_size": null,
"keys": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:EQnU4As3pSeoEw==,iv:I5sELNK8a0ZM5dbbBVA7/kwYxBy0WmEsoJP7iDoFkIc=,tag:g9HCbW/m7qqpXuhMn7h9TA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"latest_version": "ENC[AES256_GCM,data:zg==,iv:hjrSXY0C6YSC15MA/GKIR5ZD6VWeXmB7u7BtdCUVRck=,tag:/cIXX3LW0OdO+U15NQVp6Q==,type:float]",
"min_available_version": "ENC[AES256_GCM,data:8g==,iv:0ynthHg+dQjzIypAU+ht65bU2CEiVftOwTs37fffxMc=,tag:QB7oJ9LxMXZ76HNCsldPQA==,type:float]",
"min_decryption_version": "ENC[AES256_GCM,data:Jw==,iv:4VeLgOyIS8pG5Y9UJSLRXwWrGuux8XluvgymOrlIoZQ=,tag:LX7carH/7lYtDZoCXkccoQ==,type:float]",
"min_encryption_version": "ENC[AES256_GCM,data:eg==,iv:I1dyi7yAdhL9q96J+iBH2Jg2Xr1bBac2siPxphqTVNM=,tag:7EhQZG5spJPNREh//CYc4A==,type:float]",
"name": "ENC[AES256_GCM,data:6wOdhrUtbwqV94ROlgIao8jQnA==,iv:qfM7G2ZyhtubAofwp8sIc9zOTfjCcEVvq84A/pLY918=,tag:1qotJxlkipFQqZ3A28pyKQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"namespace": null,
"parameter_set": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"supports_decryption": "ENC[AES256_GCM,data:xI52rw==,iv:/ycmVHZctJu2WEHth0Aj+VOBfULE01xWljpOQH0czvA=,tag:RLzGgQo/4OdR/HfDOLJ9YA==,type:bool]",
"supports_derivation": "ENC[AES256_GCM,data:SL0mww==,iv:Qg6fnW6nFFPrFIh9AAMOuCvLMmyBD6HzHAV92PhLLGE=,tag:/QasnV4OzgcreHIgqz2vAQ==,type:bool]",
"supports_encryption": "ENC[AES256_GCM,data:jgPH+w==,iv:L2siC7hspzKVqkn1cV+7fNweeRQokuYqxrccsT5GBag=,tag:mKrvPLOgBNduEQJpF1Gstw==,type:bool]",
"supports_signing": "ENC[AES256_GCM,data:VjlQPuI=,iv:eSwAU+rLK9N21mwbm1nKkBJfHUjlV0nYSk0V61C/ZM0=,tag:O6CcAX5id2FsAuusDoz4RA==,type:bool]",
"type": "ENC[AES256_GCM,data:RazUAOYQc9w8Ul/A,iv:M+mdofb+cI+VCYQWC04PXNK10UGBz7UakuBnU35Fgbk=,tag:fCNcA6iz2tmkjLzW4L4vfA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Lw==,iv:Mm7f8aL1BrgV3QdlYfHJ8DxUimBZQKm4kM/gZTtfasA=,tag:ce+/OehDguJ+5J22SNT7aQ==,type:float]",
"private": "ENC[AES256_GCM,data:3iEs6+tzEZWV1t62N5b2lAu/OP6eJm76XGXHIZhFZgg=,iv:ps/6BNWRAQ/BuLGhKcZvLMNBsrwAw0uHuX7aX8Etets=,tag:zxy8AL83FbdsNYgT5Azr2g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:PQ6Q67T3C7qnic6YaI+5WawsYxexVu5VDw1LR55vXIE=,iv:uG0o0jsbeCLzB6vV91C+FHHyXPzTGQkA6NORmhOI+3o=,tag:QOz/En9CyTFvGx2iRyTjOg==,type:str]",
"ENC[AES256_GCM,data:Z9PLRxNS8j8uQSPjcA7kkEt4,iv:lzJyvoM0yCU3/20qc/rim+Dv2dK6V+ya576yGMEjD3s=,tag:+t5/B6rLEAzIT6M/wklPbg==,type:str]",
"ENC[AES256_GCM,data:GIzEwjoj3kX2ay09L3qegiXMJ9HaZloBX7Y=,iv:THGiSWkQE5wJbF1t0YR9YhZvIS/+7KgVW7HyiyH9HYo=,tag:jjQ6kvTxBzUhWEtqgy7AHw==,type:str]",
"ENC[AES256_GCM,data:UH7AEVgklNNyJRaBis7qMFnlWg==,iv:YVjC8+gDoxzSydxoTSebHOoktT1F2M8DDlyPuFciX6A=,tag:PYySTJKwtA1caevMWu+UaQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"module": "ENC[AES256_GCM,data:UgrSwyMNcGqBPEnMbYc=,iv:pHv6YR4rRxPdUaKnUdW2oQWRVZe0bt4OLr0BTg0vUXg=,tag:+FCHJv+JNA79V09An0ZWvA==,type:str]",
"mode": "ENC[AES256_GCM,data:eh0LF8ywSw==,iv:x8PQj04loRw6EE8bm1MEgdnArVY2VNJbDCInDFyHMwg=,tag:+rZ9wjd//CGW3RM6rbVg5w==,type:str]",
"type": "ENC[AES256_GCM,data:QIEZWSktuGdaNetXYhEFJ0w=,iv:l2pPM+U6vA8f29pigp1ptLgttZ8mCEDYpoWc3OVBFxU=,tag:2QtwCaQcXw17lCcr5xmYDQ==,type:str]",
"name": "ENC[AES256_GCM,data:Pe9VEy/Blw==,iv:sruL5+d3dsbS1qG4V8SDS/gjLepIGGTZzPSKl7qOlyk=,tag:XsW8XMJracKdaRAnLrjQvg==,type:str]",
"provider": "ENC[AES256_GCM,data:gmlDE8Reis+FZ0oWPhiG8eN+SAgP9PrWnYgvgF8iBjuliNoiN9Z26cWFN9fA9LEbaDgRPEjupQ==,iv:OjEJ10dWIxpgwndQrNRA3IlYy0+i4bjFI6GiigzK+CQ=,tag:hJJndEiCzwbU3XWr47oBDA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"index_key": "ENC[AES256_GCM,data:qQ==,iv:f6p7zGFyu6GvywZ041xOXKs0oFXwS20VCA1fmlRvgNs=,tag:FYVwIZcG9ExYK4o9LTMs4A==,type:float]",
"schema_version": "ENC[AES256_GCM,data:aQ==,iv:HXNoILBEvqyD8iSP8klq0djnFDWHY91GWbw/9k+E7NM=,tag:WODBDb+og4l7hDVQ8xuRuw==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"allow_overwrite": "ENC[AES256_GCM,data:NYDIUA==,iv:pe9wn0nKwx3C7RJLejLOMdqq3h5oFlFXdXvM99a9GPk=,tag:rbe2ErTo95EhwGu3gIU74Q==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"comment": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"content": "ENC[AES256_GCM,data:lE/y/BBn1Sije66l1e9VMYQcugb9Y3ut9IckBwf/JCDaBoNeLm4p8lLKMvqJ1UVfMsZFSBY=,iv:4Cc3aosYYcvpp8Y5Qqi4qLwdxNnu+B/xpu0J9E/atTs=,tag:45aq0rc6v0Gt0FN6E/3D0w==,type:str]",
"created_on": "ENC[AES256_GCM,data:2jDlH1x2o703ayGcN3s60yZ/zJ96AnMEzGxz,iv:h1WBGybVr0Wj8DV+QeREO3+w4bDSS+Xu/nHI6W0xMu8=,tag:LgrtzXDi8P5UT+6bPqQ+Mw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"data": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"hostname": "ENC[AES256_GCM,data:FuEChZTI/gqZMsIL107dME7SdLNs,iv:a8U4AMy8lK+vU/tCqjX9gstiz5e+YKUzU1SgjBOZq9g=,tag:DRfRcqyQy/oqHjD/gMNw6A==,type:str]",
"id": "ENC[AES256_GCM,data:Ld5KZq4L9z6Elss/bC+dIUwGfWF0sbfGqtnX6Pxt7MI=,iv:I9pfqrETI+N5p4AEerFzziNxA/7kX4I6swek6R7RQbQ=,tag:RKLFln+yOBAekWFrZYW+qw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"modified_on": "ENC[AES256_GCM,data:3OOk6woofRUPK0z9OTT7EIpRKewz45ml9EQL,iv:218reB8cctVWHF9gfUjw40B9HWUYxvpPPD7/HXW0l3s=,tag:OfQHJVpkVefYI1bkAGDohg==,type:str]",
"name": "ENC[AES256_GCM,data:+p2lIhY=,iv:Te1SbOTx5yE0KBJE31+HOOM3Eq8/C0AEHd30lYP+8aE=,tag:bt35iPUZI06zIX8betE8TA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"priority": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"proxiable": "ENC[AES256_GCM,data:TX2P3g==,iv:KCA5auJ/HC/+1nrnKNhWix3hQukLf8Fw7Hov+UvwwDw=,tag:04AyI156znYLyPIKXNhXQw==,type:bool]",
"proxied": "ENC[AES256_GCM,data:q9+h9Q==,iv:A6gSHOyaKcrbqzSA/4GbEZqfgyj2oCYp4oXbBvjUoA8=,tag:vduL/mBSkuLgBhib3zK6mg==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"tags": [],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ttl": "ENC[AES256_GCM,data:Rg==,iv:x64ifsoMBh4KlLPMbxRtBAsJ9aZDV2xYfeg7H25X4Pk=,tag:7sZpnxtYRLjbA6gw/xlE9Q==,type:float]",
"type": "ENC[AES256_GCM,data:m2A/zP0=,iv:XbTAut8sfxoC3DZ6d5vk2j1v/Z8oYjBsI7aKVeOS9t4=,tag:b2ALGE5MRijheaIMFTQqQw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"zone_id": "ENC[AES256_GCM,data:vAAeGqaaMgmk70NNPPokcDnxITLfQV21sdk3R5tCi/g=,iv:KUBVtKrKC/Pam57xVT7dGQi7JfgUM9bNEnsKsA2qYUA=,tag:rMceA8Dp+W45U1WjGoCurw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:kA==,iv:Ye/lJKCnGHXpiSnzGZWhGxRIr7Wc6m63GN99/Ojv/QA=,tag:QJogjlf06eLQvcGp3kGllw==,type:float]",
"private": "ENC[AES256_GCM,data:H9BkqHEu3RDZi2zGWQ16gKOc6qhCxa8PD0xoRgNSbiAJNCedEVQLhLPViMCZw2dlC71dZgxxOh0y1GkPFCg0AFKmOZBBFSTTeJ4MlIeQjVNiKBDp5P5culK2Cj+aGcFqu0D7njN+/99o/MWhAqgZqdG+7lVQb4FllW1sOfhOWIhNN9JNFHL9+NjXSAU=,iv:ttCE7nD9zIpzbevengl2V1uDYTW7dsBRdjztjDLDlR8=,tag:uwqiL4+s3HpsB9A+p712gQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:olQC0dF4Y9AG/18ZjYeMejhzF2skxEVOAEKjESMvKCiHZOA=,iv:cHoYjUJ0OB5yk4aRcZnljTBlHAGVPWQAU2UpMB0E5Qo=,tag:w+Z1VTfHKMUSV1HkI0BcTQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"module": "ENC[AES256_GCM,data:rHgaoA6nsHlh4iwxoIU=,iv:sKMHhXKmBI9SRHWk1yTgUEorP+SXiABn5sQZLruvymM=,tag:sL+gUDPi2H3r/jZF7ABEtA==,type:str]",
"mode": "ENC[AES256_GCM,data:sSf7sXquyA==,iv:heOA8VSEqpO396uwnNQE+j4LHwqLG/lXvhWPsZfHsbU=,tag:dfNv/RhdpyJglFwlFyFGdQ==,type:str]",
"type": "ENC[AES256_GCM,data:AiCWbAPUX8WjzbjcOCBIprddFOdV,iv:WvfkOiwB4BWSzino41jp7VyM9KNZ44kHTitYDtVx1KE=,tag:7JmTqc1sqzLUvIPxQ62Icw==,type:str]",
"name": "ENC[AES256_GCM,data:jwmI4Fl2Ngo6o4gnlOtm,iv:fhCswjLB2sKJB5GDP3Q+7xgx3iihW7En4uozzG/HmZI=,tag:3BEoHkuxETlevfIOTxaOiw==,type:str]",
"provider": "ENC[AES256_GCM,data:Ce8QGenr0qJLjaI8oT/R2C3411eBCrm/oC0szD8sIowO408jna5VY8mlA07LUzNbIBW/9nQC,iv:BSZTUrQ0N3OleRycFCq5AmMLgI/P270UYETt0lGttCA=,tag:Ib3fD6jmQveakE0abO6FXw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:hQ==,iv:tYyrelsdISaq1RwO7jqeAHzmAmF1M3YvQtFw3NcEI9g=,tag:2Pvxt2sYMle33Ov9rk2+7A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:85DdSPdDUqTNQts=,iv:O/gdD4cHtOwrbj+LQI8uw3GY+sgRLrd+nh6v75UtMlw=,tag:FBMh09YApngOEdBbz5O6Xw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"cloudflare.viktorbarzin.me/dns-type": "ENC[AES256_GCM,data:H0g45oc6fQ==,iv:i41uVyhoTQ6UypR14sUhrrsA7ElMvLov6Ux4FVTg5aM=,tag:ji8rSUyewldSQ5nGiDg2Lw==,type:str]",
"gethomepage.dev/description": "ENC[AES256_GCM,data:waih3OMLoUyE8fs7V6Gg9bPWJUmQzkIEQDzcomJhMMP94u1x,iv:pgvMUP1J1R3AOzWkMwfSI95AsMCCXquqbfxvlwTbNgI=,tag:gb7PWnEX6k61FBb75aC4/Q==,type:str]",
"gethomepage.dev/enabled": "ENC[AES256_GCM,data:gD6JZA==,iv:qAJ8DGZyWxUccN/XT7NKyBpPlvbZLudlgz5Gudm+iWM=,tag:jvV8eOscfvL5p/S6RBJuIQ==,type:str]",
"gethomepage.dev/group": "ENC[AES256_GCM,data:KXW4hYt7WXBZ95GPGQ==,iv:cvtZWwqH5nWNygVsCVTZz/NmJ1Sp3HmUZ7OUsLOkU2g=,tag:3kYx2b5N8rFvP3BL3iJ0tw==,type:str]",
"gethomepage.dev/href": "ENC[AES256_GCM,data:P74Djgqb0nxkyxf8A/hx6Rou+D8TARv6tZcTCtk=,iv:zdRvMAU/cOotalBa/Y98svI+99RHkNxwaAXL//CLgj0=,tag:RNhrUejxsMHhgq6WSFE5HA==,type:str]",
"gethomepage.dev/icon": "ENC[AES256_GCM,data:nKaoyXIE4M2n,iv:l/Cqq7AcTH+UWyVRuzOz0yhV+GoVDRmqif1bJCCuiec=,tag:epO2dmcoW5//9D43jRuZJA==,type:str]",
"gethomepage.dev/name": "ENC[AES256_GCM,data:8mGzqjc=,iv:QtKys2bECCO2BfED5H3UpTBa4y3vM5I3QW50iArv4+Q=,tag:lrT4EuLee7CvphmpudbLdg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"gethomepage.dev/pod-selector": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"traefik.ingress.kubernetes.io/router.entrypoints": "ENC[AES256_GCM,data:Ulk4yopbP13k,iv:ATRGWdufC1tL1aD4MkERAH96kX0ZzVSJjFut5yaRDWk=,tag:s3p9hP80xP5bOjzKeWutJQ==,type:str]",
"traefik.ingress.kubernetes.io/router.middlewares": "ENC[AES256_GCM,data:gzvOsW3xAWVNl7si+4uJrJvKV6psS2vc6vMCK+PtDSIU97lB8+xe27s+8ajAzEAa7kD/WAeDc7+uZPIpHf6V2xsJLNmbGz2O1vV1b5O++AdcsYDEtc5DgZdmttEqlE5z7YwnL5BqtJ9j9baNDd8VT7BH1aEPopNMwCiNGT8SPBcMaGwnehy5D1jhwIbnMg4X+WfwLkH7Yn8miqtPSLKuQ605JjpRXBhfK/OfKFYUcGy6Bm4+HSvtwhmFrnSShJaRpUwIpyWYCb6U,iv:fFLcFG0opz6Ucb11Mr6ZO+8rFap5BMc0jxCzgCaHtzU=,tag:B9HOW1E3lcvVsDfdzIRoHg==,type:str]",
"uptime.viktorbarzin.me/external-monitor": "ENC[AES256_GCM,data:UyWOLQ==,iv:oSULfpPk3eacjTbdRWeqgDyEkE19gwOqHfyju5Z9lJQ=,tag:vPoPOOxB1j7Vs5PcVuzdHw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:Fg==,iv:M+AU8cbZuF4jarxtLAlVDXv9kWyEtlFHQUzcuxulbgQ=,tag:VA9nRiFY2qVzfQTQQMzAGg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:tZMPmys=,iv:CMdDqi9a4yl0aYgTp9d6dtXuG8Ty4NkgAD7bpi/E1VI=,tag:W5dm0J4ODHpJC+R6Np9VFA==,type:str]",
"namespace": "ENC[AES256_GCM,data:JVHOTbw=,iv:pp79OWljy/2orlCIUytFXdNyveXElRLCDqJWLZ2YgrU=,tag:CBRkire0UFM+kQTdMZWyVg==,type:str]",
"resource_version": "ENC[AES256_GCM,data:w+ZjyzvJyyJ0,iv:ru2Ah6epX0/PNoyJh6bsZZqUfCdKb9I+IS01q+5eXsA=,tag:VkEoEp5zeLfDKw/FLHDLTw==,type:str]",
"uid": "ENC[AES256_GCM,data:BooqFou+Ay+R4uGrHVcv/YArlYSE+BvGP2DLdJRw+3PKYGYP,iv:l+WHhtK0fXsuReVoQ7v7ac3sMcmUPRFs3qu4uh60404=,tag:O9xhdRbtxPACVyoiotK0dA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"spec": [
{
"default_backend": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ingress_class_name": "ENC[AES256_GCM,data:plKQmRV4eQ==,iv:BityOyyw+ffBFxX4IRHP571wegKH4Xu133dmybmNfGw=,tag:4cZ0VrmuMV7VZSrB7IGk9w==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"rule": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"host": "ENC[AES256_GCM,data:c/Hpdm7zF3jGxasY/azdhnP14EHi,iv:VwF8of+sIKaO6L2ONFviJ21vlhkqKJ9qWRE3olVlmao=,tag:zKPWLXjKU/JWTrx6XhyBqA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"http": [
{
"path": [
{
"backend": [
{
"resource": [],
"service": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:Tv3oVaWg+rwmxk/S,iv:6WuRdg84hdlfyC7c2Y3fARN47g8ZKDg2diLfaS4iLe8=,tag:SHTfaG0/ubVERJn3Zmr+/g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"port": [
{
"name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"number": "ENC[AES256_GCM,data:DwLkPw==,iv:8fR66wuLxqLMCnwtREmbd+JkKoAwYHLo+qLasBGlHZ8=,tag:Bh1NOeTgI6JrvyrwurHV1Q==,type:float]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
}
]
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"path": "ENC[AES256_GCM,data:gw==,iv:amF1HTsflnozKZEoRQUYES6TpJNA+xO70uGTh1ZygG8=,tag:krYB0kbQp3pNMKNb3obMoQ==,type:str]",
"path_type": "ENC[AES256_GCM,data:Wb/ePTefkF9X6U2i5d/JduaeVyGSCw==,iv:kNRDoK2ZvCrO86Q3cd2AmNEoszedlwUZ9/IDgVOHWYc=,tag:bGhLimhtd07alAEXiGEAvw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
}
]
}
],
"tls": [
{
"hosts": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:e06gtpMtJ94i1goAYhNAU3QTFhCf,iv:PbcaB/NDBqRBJXio5SvYpm4I2xDcxnITVK6b32qV43M=,tag:nI8Tn7GKiM7cSVTpdyz1cQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"secret_name": "ENC[AES256_GCM,data:Z3N8jDzcOzszfQ==,iv:LlLGfCnS8thJytmxSiG3y2kOK6UpAPb8MuurpwfRm2o=,tag:NDDi8G5cX4rOOpweU1j6Gw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
}
],
"status": [
{
"load_balancer": [
{
"ingress": [
{
"hostname": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ip": "ENC[AES256_GCM,data:P55CCpPODSYvQPY=,iv:YPFv2Ok1oyuTHFlGGyx85EOqVKLqwenwTh6t6YgaBUw=,tag:/Nbfs/BHpkvf0G6uzoinmw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
}
]
}
],
"timeouts": null,
"wait_for_load_balancer": null
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:VtSJhQC8zoI=,iv:o34SpJzlSZstnrSqfkCWAOGAHbVl//NJVJvUQMDXu0o=,tag:M/55sDiRpbuaLVOFEEjn6w==,type:str]",
"value": "ENC[AES256_GCM,data:IAA10w==,iv:hEmgd3pGDtQ35yZm/EFHLHewE3/V3ga01JPz+EV86g0=,tag:tcQJBhOhh5pcgr1DeMf7ig==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:qejH+WM=,iv:uRiT2MOEuUp+U5ytNHZ4YjAZOXNKaxooBpMF19fqAHY=,tag:yIerOaznWDsUHZHOQCqITQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:LA==,iv:g8r+p7CUb+bYksMvSu5JI7R86Hf6Fzgii1EnRo+jvoU=,tag:re5GfVMWKsYbTuaEPlFPyw==,type:float]",
"type": "ENC[AES256_GCM,data:K3YH53lU,iv:fVEcCNoUqYhOBz1kaq+3b/4p21K+7igTvhwBmwPXD6w=,tag:80YzHqYbWfT8i2pRDuLrtg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:6JSoLWLnrCM=,iv:TKy7jppWFDPTpnb55lEJoMagQQr/Xe1eP94JnLR8J1g=,tag:Hgzt1RIBb7yuMFF+Wk7Smg==,type:str]",
"value": "ENC[AES256_GCM,data:CRI9,iv:tnHHjduWOxDcYCuIDUwDzpdIYH7bObjS68uG/+kU2DE=,tag:vW+awgiNiEzAuwxrlXg96w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:h3SgwxI=,iv:zXzO4vtq7HLtM+4eaL+21XekUo0KLCVH4AJ3yWxRin0=,tag:G85N30wHLz29cDq9c7aiew==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:mw==,iv:vZjbbIekUZgCHnb/j3RDhzlFIGy4gP0+4RDzbFUhoQM=,tag:wjTWPUI1bBJXrFjaAyNP1Q==,type:float]",
"type": "ENC[AES256_GCM,data:OqF/Gp/d,iv:ExYE6lowJNmA33bQHXMfeYUquY0A/q6cdX/5kbhFsNY=,tag:FAL5UgwvVEqoprbqfiKzKQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:KMtd3oy+sag=,iv:rkyToo7AOfGaD0ps9dbNPuPozRR3kY7C7XLTquFCLzg=,tag:17avHbTBq6IIOeLSrkjUGg==,type:str]",
"value": "ENC[AES256_GCM,data:fyl+XTUYbB0nhtk=,iv:hy1t61aFrjzPlKHSxzaUTuJnJhGtdO8duEYumtfztxU=,tag:ipEyaQcLW/XkRuTRM0Y4xw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:tg==,iv:1nIMUmbKBBthHSEA+V/E8zNyATdU0EdfO/jm7xMyOlM=,tag:hOhhkAIPpy3FaHp6r4tFFA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:Uk4SdHD4l7sOAC36t7vhQjZl+WU=,iv:P4bEtdXqeFKyEinru3xPOwtoKA10zqUivzsmmenqgUk=,tag:GKSLxX4SfyEBi1QFPUTaKQ==,type:str]",
"kind": "ENC[AES256_GCM,data:m8cTJVFTFg==,iv:m0wSRxZIHGBj/kPHFKJ0ZXLu2EuWODWoI8ugQq+Cp70=,tag:+eJIjkZ8UDuFgqf8UR0e6A==,type:str]",
"name": "ENC[AES256_GCM,data:IZ0yaso=,iv:Rl/T3GpKpam2i4ERGj9DlNuQphirW+6zWuegm6V3VR8=,tag:xrZ6CMdx1QL1Rj3BwGSUMg==,type:str]",
"namespace": "ENC[AES256_GCM,data:v3Vc+CQ=,iv:QEUsIM7mkfFSEU3LVXRzHehCYiwi4F8+AE0wA6xegpw=,tag:KifjwAIkjiHWkijwjC/XCw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:9vmpIdaa3212tESoa/k3hitXSy25Xge0X09hmXrk4On/pLl71YOmSb2JpOKoVoWcnR0o5PzD4/SQy6HJ22Ty1lAYPDcLaEboC/kyGizIsWyF39SUw6i1NHPZPnj50TUqbtxQ9kSgjadAbMefI68lDLw6JKgqQo0J,iv:rePyDUaCr5HyLz572iyNgBKdP/V8Fh3vNTYyHGwL1As=,tag:QuLUM4lrK+dmH6VYdvy22Q==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:gwADcP70kOS1A1Keqp/wQmo3NuIQmRBX4Bg=,iv:SeNi/CKz4sUgoatS/CMOPevTBjvkfe4XiI2SeWMoK94=,tag:8uoX1o2msoAD4cnm9gorHw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"module": "ENC[AES256_GCM,data:zqQlI/THtqFHe7wQ0O7DgIE=,iv:w0ORxcYiNQ5v8h7bwmD4st37irsWZM3/GbkH3WHDHXc=,tag:GxlVqsEFKCsHrJppZzNDWA==,type:str]",
"mode": "ENC[AES256_GCM,data:uV5WGO0cHQ==,iv:vTbCypwvDGrirFbA3GQxRR5WThuxxh9w5CJPPnNDLpY=,tag:itezZhGBUKrgOR627I9mzQ==,type:str]",
"type": "ENC[AES256_GCM,data:2JQDHpOm4u18Y7zCPVfBGHg=,iv:oJoyzl+OKBI4f/dBvGQ4G+xCySGk+TMqqBFtudsfois=,tag:Lfi3x0Xt7i2BYgYNfdLPsg==,type:str]",
"name": "ENC[AES256_GCM,data:SyWm2xIfyByEKA==,iv:oD2uxMbbEoAP9rwiceuRpBAcYlRwyzH1FE+PW940a34=,tag:N4j2Ho/DhPSPhMqwL09dQw==,type:str]",
"provider": "ENC[AES256_GCM,data:8NL/21R8FonQhzs0eK7A550u2lAJdeSMMeBxzpP/yYo60CFtG8JGVDQCj96dehOsxJL0MTWe,iv:6PrrBlHSS6C8kv7raVw6oNqsxKY/Sts9Yo23BW/dwyA=,tag:+uhywgqNcC0N1QwyJ4slgw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:SQ==,iv:mjR7tv1S+DvpJM5uVp8Bslif3TQ5/Tw2ndoJgvsvme4=,tag:TfNR8JIMaWHeoUzjP73qfQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
"binary_data": null,
"binary_data_wo": null,
"binary_data_wo_revision": null,
"data": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"tls.crt": "ENC[AES256_GCM,data:jOjvpH/Y9l4GRzZkRxKQmVdt2e3m1ya4SbVX4vG7BvbiZHsYFNXrxxGKOzTAQ5gkfmJ08jPr7u9sg1NSpOK5F+R+2qLi1GLDIfR7am9v6vb7Cj/yuOX5c0WEiaR87uR8hCMdLU2c9cUyfffFyThTFd6S0bl7C0MRpHApltZkon11YztvqsSCoICwmhCzJbp7cZOqGx2lvJzHhciSM3cJbN63XFzf6yGWmpNAS4luFg7m3pxS9pObxMnMI1CP+mNcRfPOpWjejaKqlYgQAuFA4B2PdPUsthWyW7tbS1Y7W4A5R73xNi7sYlowl6X7yzAl/z23JkkEPJ0CxkqnJ6RDRT5IU2F4/0olkAkEthGK1w2KTRgogw4jVPjmvc6RGz+2+V5Eto66A6xMsJHBfLj+TvZGLsv+5TjwrdwyJEx66B4scnpzodiu3aJTTeNqgjvZGxyNt96JTCFK15tcq+aQZ9BRxOz/Ep9yO28PtNoZFeEQICqa6+t2bNxD8HejSwyxhkpVsqSHfv2M+6PDPNmDmqum1cECa2EmmaPXMulmam/evV/V7kYOcX9fJd7u7pcJN/7YRR4rWkwe5PyeZum9cqp5x0MmcU/CAox9yJwRTibobXmLs0vHNOaT/8fVKbBY/8oFE4O66xRToj7VSTa3SzSMuLnOdBdgK6F1Zy88noIghvEQa0QZrkmIVYgWDs0CnsxHvuIBVKDY5jkWtzrj0gCHQLG3DFTTKONyNov+IaW0fseSTZrOODK9c48FpFh8l6KoORDmRYGdQsMoAghWTvXN0un62YYKhxboDdvspu24HSSmXKrrNqjzRFSwg/XcRFCzHFmzhnFoQPbau0IeFbPBIIE3EQtMVHs+bgGy08sqkpIUpqkCq2Z20z9ecVDzYNKQ0fIVabylO0YUygWJa/l13+Nv9HEkmG+oTMSxO9hkOwf02Q8bekHr7JkDrYYtySYBx4ZNw2UeLl+EKAB6rYYwdB9cSnZ67ssuZP+cDdFv2Sn3L43i1PPsFB4Gnn747fHLtWusMjYuar1lnF1U7H0O+dzOOAnXnp/IubetpPOVlOY2IUz677eE/ASRsb3Vf1OPJUCEH3t+hx7XY7x6BS2fY3i7S6kVsT3LAldW24kb3AdQwhVQ67hITRgLxdxJ/xXp+9G7CW1pptjX5BRSEDovdfgCqKX9Y+yAGfZG85GSx8xqi2tIVTvkCshhhw/rYHWxrB8o8YV8cZD9rLlAg9IU09uAvYxY3aX1hADgmJ8bVd9re3n+XaSHHCql4J/wKGLEfXf8HOlSnygjWYoG+xziz/4bEqAw0I7hxEafI8JptObjNHK9UlRQtFJ0PPxVhagRt0oX4sdQOKKptmwzbVRihWzXMKG5RDtwVEbtZjCSpZ0WIXmvhXHPbm+14vg1apg8scovzQInS1VGtiWWR3Ssb4Va3Rtt5NBLXOXvVpr9AGJtVcRZVfzVQIWED6q8ZkGTvBW3EhUEmCkvywK9ZnlR8AgqACePv2GMeFHaA3cJd1hEOAdTE8Ys7ng+HaEJ4sxU2Zn78uLeIX6ZxsrMjsOP0D1rENxjeHexiRC2JoA7Wt4pnIk7lq13qJkCtpVbQyzWbsFGkm/2frZPLWX/3ocsbHaB69Nro1YpsIy4Et3E/PLpvPEdO6GJFN/X5k4/MINS55jQx2BaaNbOV0+XCrCBcewuglqZxLTzFuW85QVcIw7bAfUOkUcqd97YtK8+caMbxlk9FLYEAXTRIl/9lp/aSHjhtHEExm+AUEwniEnJoq3S3fzjLwjEnd3rrHQ6sgmmrBZ6oejoQSv8yvvaObJAjDqM/5l7i2fvt9QXSURkgbzQPDRIn573ZsI5m/lMoxkbyPfzjeOOmhucznUcJ1qclEBMxKBDL4ium6nJF9SB3L2ttgE8U/RDTCaoc65xef8Yq5eReoyqIdz1Fvy0wGO+lpxeU5dWGkyoUPuxBZPi3T8SVhyifDD7JKuTM1rEgeb30muWG0hhxPCEDiG3mKMXDL1Mf5XMRVgHp+R/boAQW6SdjbjK69+8Ot6Wk3mSlRspI8ZiitXcw3M4Nh6f345MtebKg+pe6N5/DG3XRmxh4td/WxxzEQG3o1Nr1pfpsyZw2Heu4QTADSJkf82Rh7gB0p6jk2yyO82aNo+btwu+xV8fWJ8v5jPB1SzhiJDndapdQteYzCUO20qDEWeXWpuTMgiPb4g0xARBp2rDcT7bSg7EPSCwku4uJSJQyfXwrjD+/MfwHLy7zp/DwNi1PBuiwBC67cfz9PI+Tr6ZWcuvMNDC9JhX6OuJmX/hUKhRwUNqjqHIyKoecIcZQ9ifNPcjGLGNDTs0ZowVz3Ba56P2s8oYB2/s7wpI2hCcj980k+ftr7C1GVr4z+qWUEaNNnSRJiPkaBsjXdmX4TSCt+q/41t8GbjVPcv2byoMk7wyIR7xX0bfv5eSy3dHHp4qv4ZQOoW0SFv/FmSNbMckbydUSlo6q9+uKyiR/1NTs9ATqsz4L2IyFWChKx4VyPtQapFqSzG21zGKMV/5Yr6MsnaoviV5CtTjhXwkStnu1aWXd1rzTgB3trXVda4hiiorY10iSUhzZnL3hgTNc5dKF4tpTb95EinfyJ23/DWRJ2tpzWeNVuuHXDwBBWECVHCh9RF2nk4KY8RMhSzazM/kJB6cmgUPGuCGDvHm0ivOD7LBS6Z2PkkBU/s0JgFdGRlc+inFIZzT1J6VpPohMxjEAbggWmebff8otuLDOt8NA2S3aCR2lBAOy0OKdoqsFhN6Gd4F7jdT5vGbBgI1mTGorrvc9aKngWs/kCyoQodgco1+UzQQOmnGnVEvH5oNU/ApoOOv4MIJGqFK87MsP1/+VXmecHeMPvkXz94viFDKoRkrSit7yNl/aV5+85GxZTIcd/1yizqJDIG9/A395wBfKaEdctdj2Db33tWd2SxJgVRIeeQNe1M5s4z25d6JMZPqaDW76ABK3ectNpbMgkVH2hh6vkO309/KXAbq08rcVRfN0/BGwT+hlZ9u2CXNMjeGWR7Fn44sNcC4CvhhJOUoGOfnZ5smD7SHl1qUQmD6tCQStydEIqQMqRoRvwD7vzm3NdH7DrKpwhuYSsj9HbxlO96vU+3uewne2T4gl1NPEYEB6bYTvpj/H/nESnhovNaxG/co2Q3jR7int6idvtf1hbtC/lVhf3zehogBnbbVfIy9jRHsIJ7AvZzSJNyVWj3t18CAWmf/24+eAptwyC+AWUePbkQujQZ2PNw30XYTAPZ5mdp/yCgT37oj3zDgSV0QJvAdvYZlFofb3g9Doey+tSm0DMbNULBGX1rh477Ed4B9eTtUUzlW2abvrIY7C/7rvyKf9DQz3N/+sUeZGdpsh8yLb2/Ho6nXV43ojRRN1W/432WxKk82iHpgv4C9jXeE3TtHF9au4J9DjZxtV2cMfQPB2ZjlNgTqb0Y8Z8r77YRpXXW7ms9VV/Q/VxLVeolCby2ht69P5s0Rsc5L48OmJCO0NaKweO2lr9NdhKGkYZP8ZXv3z78A3VzOGlrMKaaAQGEgPo9U1/hEBjuYSI0XEbTOhVcC1GCHbCZHb2/HPoz0t4AsQOw13t8L17aEaUSsDlnf/r+CYGYATQdoNt+QdJ4GniUqCgYRUb7+G1z0eQY0LvvzN/ZhNb80o1PRCJnlgKcFLhvdLKFLEvPeIEKAtLU+Xed5o2+8RwUqTz/zi/CxZkxP2kkSIjCoveJSlnMHISLcbSeblD5fRTQupbQPm8Fu5tLg7bSOLvNxkizBrLRn2h0T18gFdJYYg0GiAIu6VytlXFkiGWunTFZ1EiK8WBGufMHS+wn14if5dCNeV15/Ah5iXx4/ye78opDGPcrpDziphy26nG2GPL7HqqUJGeMxHz09T5NIYhYYjy0duIbOfhAYmCofDbewS4c3nM7yqtkrfNBJXYqZxnft2KJyOW6osJQ0UgVQIZ0nJ1/Xcd2TSsRQ+fPCn52wV9fpW8Ks5QKDwH4YXuEAkGvowDBPdn4Hv3YGU2q19mpRVTzctVefSinr8sfsrFx77Jn582ciGJcN
"tls.key": "ENC[AES256_GCM,data:aeV5pP3lyNTEgxC0D5446edqaYwQgAT0luujxc8jymPnjme3C8Slana6MnBbBWKeVLaA2BAfx8sRIRn65lRnEJAAsmskDh2iLojPXpENCHjpOMq/4ZdwWnEB8DM0dAliTO30k8iIhP6HwghI4zfodX+SK4xn1HmpqkGSH41E23vtuPWkWG04XuL1jiPE8TGqN1EcFL7Nh1fYuAeBTAIR3hCvCR76bR+2dCRa5r6lhMX5TD1FH5NjwiuVZ5gAGJy97uyJ5ApJXZRcqapXNZza9pKkzZBskAopj9xxnp5vYhSXb9zWYNe8u0f6KQQbOkrVuw==,iv:oIgqI2r+DrYTqizKEnnmuREXgJGmN2z83jGnqFqCyXs=,tag:FJiKyeO+pJb0+uWiOIbLmA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"data_wo": null,
"data_wo_revision": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:2O2+H3wH5Nuw2mjB/jpViQ==,iv:wW1BpGQQVyrxiEadd4BdeMf1fuSXTp8OtVSQeOoi9K4=,tag:bymXyJ0HF6cugUf8XaPY/g==,type:str]",
"immutable": "ENC[AES256_GCM,data:Wci4cw4=,iv:lBekaxa0KVZGT0Q7cuuGnQbb8Thd3y1HDhp8PnNbpcc=,tag:+6wHNgr3fOdfrqLOREOyYQ==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:Jg==,iv:9iN+6u3o/jUmsswmhlHmC6wTUl73zCSBWH73lA9iQwg=,tag:Xn8wGCZW1HYF+B/HC9qxTQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"app.kubernetes.io/managed-by": "ENC[AES256_GCM,data:MAnrnHSerw==,iv:2vFh6RPmD83BsDDl6SiMqPRXYxX3bCzrIWphDW7VRlQ=,tag:EjrF1L7W+7lmLSli8iexDw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"generate.kyverno.io/clone-source": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generate.kyverno.io/policy-name": "ENC[AES256_GCM,data:OKDj0vjMzWXURbMnaRTU,iv:EOWPE7coafjT4uJJfYqCSfTeOruA6UAopejr1koD6cI=,tag:354Kolv6diOTWfa/QvyZSw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"generate.kyverno.io/policy-namespace": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generate.kyverno.io/rule-name": "ENC[AES256_GCM,data:BeO9Ih+j0UhY9diiuezZ,iv:y5oLw0eH+GXGneZzXkm2yYqCPyI/+p2MYRUCUliDOeo=,tag:9B3i+kGPOj2vTtlzduAtKg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"generate.kyverno.io/source-group": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generate.kyverno.io/source-kind": "ENC[AES256_GCM,data:7vg4Q4bE,iv:vqpTj71WDQByevSKGJiEI/13zbXfAYcfMGLZd2pGwPE=,tag:LmjRU5l+ouqSusAR5GArPA==,type:str]",
"generate.kyverno.io/source-namespace": "ENC[AES256_GCM,data:7C2nt9Hxog==,iv:2/2plJaci7BbScvRNGXd8SIPQnTrAhB/MFgnaV0DysI=,tag:bO8qsrlR9im5I5mmATdnPw==,type:str]",
"generate.kyverno.io/source-uid": "ENC[AES256_GCM,data:boxsbHeckhnr7Jfix7eWpRSOmlOL5mEy7trmU1nfMN1pbmVb,iv:qAWJuhXl/q7ed2FM7EQs39D7/TUOsqrE9IeSANPoqho=,tag:ht7kfnkODE6EbdNwvPQNXg==,type:str]",
"generate.kyverno.io/source-version": "ENC[AES256_GCM,data:9cE=,iv:bhcU585myk7VeBmFtAKWTUKXfkLbLeE5uk5atbq1rQ4=,tag:KvviKuvF7jh+G1h61UZlJA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"generate.kyverno.io/trigger-group": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generate.kyverno.io/trigger-kind": "ENC[AES256_GCM,data:gg4yXegK94WZ,iv:sMfI4+SjwPMcLoMied/P+0njQiwbo0LAei12r2XFXlw=,tag:w8E3S7CeE8fGE6ior69Fvg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"generate.kyverno.io/trigger-namespace": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generate.kyverno.io/trigger-uid": "ENC[AES256_GCM,data:F8sKPk3JCDZZX6wapBML2kz0j7Rc1FsdKDE7CjdUcupHocy3,iv:YrbjGL/dZr7Xao2RfiTtpwhuof1MozK2canDfZfN+vk=,tag:kKiNkVEygGWR57rdL/KiJg==,type:str]",
"generate.kyverno.io/trigger-version": "ENC[AES256_GCM,data:8m4=,iv:bisURp3Q39ekDR5Sr0PdVI71bVoJL6Hnz0UlqPa57m0=,tag:pbb10ObvxrJVPi0CMZGFUA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:a035xRk/2jk2Kw==,iv:VWskgYwHVesL2nHVTMbYYrWo7C47rha3NzSwgFotqRM=,tag:QE7p+PPRdghyOKDCWCK4ig==,type:str]",
"namespace": "ENC[AES256_GCM,data:1PkGqgw=,iv:+ctMV6Qv40USO1N+EAYegsW0I5MyeaSoUWU0Qnf6NB4=,tag:lTYejJprL5+4H8qCB3QEBA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:bH55NHJ0TDG+,iv:fvLHxzURPiZ4/o6+bAOqcrdCrbWbdTjv0Qdvz5CalV8=,tag:UbwOeL2ul7hVZtWENw5dbw==,type:str]",
"uid": "ENC[AES256_GCM,data:9Z+sDjhw3vMCWDEwkM8yvrJus2q/PkTdBMl4VyWnkrV6JXBO,iv:PAONuv5m0Kt/6jrF3Oc8sch8p7UV6j+OBQ6P3qdrIJ4=,tag:g3VgO9ottbcxm5oNjTG3Pg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:k4HfMpKyuN/8iRQ/VWFGNh8=,iv:tIEqHKmaLmM/ugj5m2gPJ+R9/PXjuo0ZAasOSnAU+DU=,tag:ACoJTZ7Hikw8hVUovhqvGA==,type:str]",
"wait_for_service_account_token": "ENC[AES256_GCM,data:7IFvWw==,iv:CCHFRHqOEvypVhZwK4scxHmYsUEDtKEker4NTATPl04=,tag:psJO8/gj5low0St4X5fTPg==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:fjkdAv/T5fk=,iv:eCh+bhIlBoZy9p20RxQbr6IfPx7CexNLj84nG49Ku7Q=,tag:Oy2lxvtBZu7T1JcAsPYGTw==,type:str]",
"value": "ENC[AES256_GCM,data:FwV6gGeiN/sIVd0=,iv:LeyEJnkfnm0CpacbCGNiXI/hWftBiuqR1sVL83wzbuE=,tag:fxFG/+ZAzAHzsRhID7iubw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:ugc7pPFKlec=,iv:CrsfD8bHLv37448qGhMmfLqPP18cHh6LiaQOGR/Rqlo=,tag:uPCg2lx+plPhnDLjLUXcLg==,type:str]",
"value": "ENC[AES256_GCM,data:C5+STw==,iv:40jBevnIjqzQwYfBnjOU2cdRt95MaHnblnNcVFPpjYY=,tag:dsByFbD4Ez/xffRHOlnEeg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
[
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:TgwWMPFPlHU=,iv:aFrmKkTJYHkKvls8RjjRvy65tPMA5DlWsalT2XDzvSk=,tag:aZLs0T4FmOVJGi24c0vhBQ==,type:str]",
"value": "ENC[AES256_GCM,data:XxkpdPIE808=,iv:NYM4wG5i6hBGdLhxVGvlrJTTo0RgYYm+D7Y/GvYkQBE=,tag:CN1/cFPkWqO2KHJfytKdXQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:alB9Ul0=,iv:2pznFIQeS0qszS53/HMle7LlBBgnvj21lXKkoTixsd4=,tag:UwFhkV0jdvvi0xZuZUdEfg==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"value": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"value": "ENC[AES256_GCM,data:+g==,iv:GyKLRuMp+Esfrv7Z3BWK93LRpcB1H7o0aZ4jFOYNv/A=,tag:tD3QEkoEg/XQAI7IBt2/OA==,type:float]",
"type": "ENC[AES256_GCM,data:VPHP2sMf,iv:2l6IR5yUecYRuMXP1rPoYqucf/MDL23fKl2gofmXUls=,tag:n6Qp/EXJRVdJLcHWmFWk2A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"type": "ENC[AES256_GCM,data:C3w0jJUtISo=,iv:JHjoGsL/umCEa6p3RdaQPtxWcxqV/l/htAbddbkLmSs=,tag:IsYDE/uPFXoJmBZjalVpKQ==,type:str]",
"value": "ENC[AES256_GCM,data:Z0jUFg==,iv:zRN7GTIysvLaCcBwSrrYgIW6Pgosu+JMyS6/iGxz4Mo=,tag:Fd7sdNxsX9byRNHObU2BHA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:Ww==,iv:3ovJuacEjCxmxnTv5KpRw41CStIRU8+TCjM1Znn5N4s=,tag:R4Z6I7Y5DrFzQb6+0r8Z6A==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"identity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"api_version": "ENC[AES256_GCM,data:8ws=,iv:Mx4VGjrIKPuBL8emF3GMz+QDJh3/kg+IHQFO2+WLpGM=,tag:EZB/uiX71mcI0CZ2OciGig==,type:str]",
"kind": "ENC[AES256_GCM,data:hi6j2jqQ,iv:uyPjNv9Kus3GQ3ipv+0uU7pboOO8I3S9WaWMrXIKb7I=,tag:4dTdD1FTRoe4mpCUIArNUA==,type:str]",
"name": "ENC[AES256_GCM,data:CgpyN3/JrbV9qw==,iv:sM9nXCFzzodh0G4gPUdR99Mkk97AE0zA59PZ7a12RHo=,tag:NJtIRJwNBeESfJqt2d+1og==,type:str]",
"namespace": "ENC[AES256_GCM,data:CaeWt3o=,iv:pf9N0OnHLdT4D8uT0VTpYVHprQPEYBgBW4yh1z5Y9bE=,tag:m8qfzReZZW+GAEkBSlrk1Q==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"private": "ENC[AES256_GCM,data:GCNg4KVvL+gwDDPGlC3CUf3ROx/fWaQQoYgAlymT88CCMkzvqs3szSbKkzO8WWtkWhe0jAb9yol/5P5VhEcYoT5kX+4l3rLWOFqaAXi51w0OnhlD,iv:vv9zp56k1VSC7TMlEwroxX1vFRAglDqeVnDfXpNHVso=,tag:+lpFE2LllHtt/iwKsHBOWA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:7yC7nkFFN9Y5bE+Z0PCqZKksMxGSxRdpg3c=,iv:8Gu5eYmV0AvXLrJ5s/SmTrDlypON7mAoMHovOc9qWQ4=,tag:hEFVmM+KbLz/Dl3oSAk2Sw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"module": "ENC[AES256_GCM,data:dfggOINyEep1c10rFAvM+Hcov53uiRBuWdUyfg==,iv:2X3m9heKEcDOspCpI07IeILINDnzRoO0aGHAOSjJHVk=,tag:A+e8mfNjg7p58rWOGmNIFQ==,type:str]",
"mode": "ENC[AES256_GCM,data:V1mbDRexGw==,iv:JuyhWXNq6zmJR7kYa3tnm31m/DrInuKgPWLVIip/oOQ=,tag:uFLoSRLm7doTso54vNOG5A==,type:str]",
"type": "ENC[AES256_GCM,data:35rUMXKdAVQ9DTB6u8g5p3h1kXnzvp1ITVONmQ==,iv:BY+ZaFu8i16CWFgj88Y9M8EoDGK9YUQu6z2MGJmi+sU=,tag:jfwPYXMbyf9TKAzWSDqQuw==,type:str]",
"name": "ENC[AES256_GCM,data:EerNPQ==,iv:AUrYqdScxMDZIXTW2ykS+Y8gCSoCocp0KiyDf4/pdOk=,tag:NhwVLRCabLoRWhdwP5KF0Q==,type:str]",
"provider": "ENC[AES256_GCM,data:3BfPGQgYlnLjJ889GL6HGLynRNglDP7OquFgLbFSO2v1LHTgj/hj3HO5OijeMB+eAcuiVCKP,iv:nOgfoT+IJ1GqzXp7zrJ/Sj5daL6tdSITPYLWmmSWdQA=,tag:lmLgKssPcSEs+wQ5MP38Yw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:hQ==,iv:7k4uXM/PPit7ElKEpIbd6UHEzfVWjz3H04rBSFZKLvY=,tag:ZTw7mRv9WBSPhVo6nXpMXg==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:4Cqg25l4/L3Q4kyEOW8Ztxg=,iv:pkL+95sm4uM6nxOnDpAaITgOQZ4jYwUMrs+gjVA7gbs=,tag:Rk6MtlyyAnao/vBpKpP2qw==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:YA==,iv:EnpCAx6XA0Zbj2qR4zdUtVIUW68m/K+IL1vqMqSZm/g=,tag:tIOCxpVJQEPnGoTSVZVlTA==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:odNY6WWJbr3uDj0IxnDh0f0=,iv:zkEGtPAu0s6EYjuXVQaEeoRYuZt7P6O5tMB2kXF6eKE=,tag:tfG+vthExJwUOya0KV9FGA==,type:str]",
"resource_version": "ENC[AES256_GCM,data:byQnKaBgGGfG,iv:x/QtMrXHc+42zDphqYgOmeXCABXzPC/Bxg8iyOJUXhc=,tag:Sd1IPMVsrtytzkhzueSb9g==,type:str]",
"uid": "ENC[AES256_GCM,data:IvLwlzmj6DBgp28fi8w8JQ76DGB7edtv683vDSHD/+2AOHRK,iv:SixymNiUmBpvQmgKYtosy48c/WbzU/SvEXv1ydS3J08=,tag:Xvmse/03C2oouc+4A8N5cQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"spec": [
{
"access_modes": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:rUJm17xH4GKDbq+2ZQ==,iv:jyndXG1Isq4OvFXdlWQouENx1dsPdmfuMHX6QjpC3f4=,tag:rRRhG4bHmLsn+rIeRbzAZw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"capacity": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"storage": "ENC[AES256_GCM,data:PPgk,iv:4PupaDIkK+p6wApDU4c/tyAk7myHuPQPuKIas39Y+8Y=,tag:YRtAu83R48GcPKfnBOU3rg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"claim_ref": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:YWjROwo+JZtF+SY7BCLx2Ks=,iv:XsfL0Swu8BqrOyZoFLGyw8U3j3cxaCJPmzP+sDJBTxU=,tag:k0Kse50EeRboYt4yOtX4Sw==,type:str]",
"namespace": "ENC[AES256_GCM,data:BnHefUc=,iv:Gf6MaURGNckY+1BMja/CdDyPemSJGA2BP/EVNDR7e1A=,tag:OnGGl3w8apqLYJORk5BuTQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"mount_options": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:xTNOr94kNY1R,iv:0jCnnCneDRQEpuh3XOZCy8VWeru0czVUAfAJwz1S6kM=,tag:XHk2NgUS7wqZN36EQbelkg==,type:str]",
"ENC[AES256_GCM,data:KdcHZ2xovmik,iv:IP7xN0dK84D2ecoCZ/X9kg4hL7fVw79ILoUVaHzp2I8=,tag:ruT9zaKo6u9f+MVyUcC6eg==,type:str]",
"ENC[AES256_GCM,data:Tt2v2DcsuFGi,iv:ElrJV726FTxeDgbZk0WhbaFnSgqocLvQSQUuMTkuLjY=,tag:v7NdjyCgweo155h+ZFXCkw==,type:str]",
"ENC[AES256_GCM,data:g1xDVA==,iv:ycrNlOL3N56Hs0Whi8n6W1zGyJfl0IzL6+9geGU1EbA=,tag:Dz6x99/5E74dj/O103rWCw==,type:str]",
"ENC[AES256_GCM,data:ekK3QtQTkM8=,iv:DKlYCyYdDRWCoJB/quIUSsQ6wHxsXORWy91t3LmG9so=,tag:KP5eratnJYjlavkFoI4ydg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"node_affinity": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"persistent_volume_reclaim_policy": "ENC[AES256_GCM,data:A+q4vxCO,iv:tLguzxzoHV0p8F3sb/WCbXdGZVOTJ8Z8HMmYbaGNV4k=,tag:HJ1MwVvZghapqdpnb3Y29g==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"persistent_volume_source": [
{
"aws_elastic_block_store": [],
"azure_disk": [],
"azure_file": [],
"ceph_fs": [],
"cinder": [],
"csi": [
{
"controller_expand_secret_ref": [],
"controller_publish_secret_ref": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"driver": "ENC[AES256_GCM,data:wl27PajBfID/qifnGkE=,iv:x+0tJzu+2hK12IkRHWP0E0CoWG2u5v4ELx8mGi9jhHM=,tag:3kawjdKAmW3Z8R/9UMYkqQ==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"fs_type": "",
"node_publish_secret_ref": [],
"node_stage_secret_ref": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"read_only": "ENC[AES256_GCM,data:3hiFE44=,iv:SwskuepZFIYmXWMsrhNxFCyc4qs0fjnYVtZisOYJkJ0=,tag:LTmQpeTvuGynT0AWEIhOJA==,type:bool]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"volume_attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"server": "ENC[AES256_GCM,data:VsigHKb2XFOIMiMyXA==,iv:cpwmaV51yF8+0qxgI8gtPEnnWN0xqUVvf5UbNZYtLQI=,tag:mw8KvC+tIqbc5NqDa65J/Q==,type:str]",
"share": "ENC[AES256_GCM,data:HDR0Qch+nvyXp6jSj/AohsK+m/rH,iv:TYBAT250VjIJ8M7FYYvOXqSqIahpmT+ze1BOd9Gp5a4=,tag:/LIo6/9ecSQCh+L0ANMrrw==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"volume_handle": "ENC[AES256_GCM,data:bDAN1jeaeXOodAm0PasbWuw=,iv:YmZ2QHIwBidaJ3BwE6Hjrku1f1rzev53Noi7yu4g/h8=,tag:nnL9mtde/+fkWNpxtfRk3w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"fc": [],
"flex_volume": [],
"flocker": [],
"gce_persistent_disk": [],
"glusterfs": [],
"host_path": [],
"iscsi": [],
"local": [],
"nfs": [],
"photon_persistent_disk": [],
"quobyte": [],
"rbd": [],
"vsphere_volume": []
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"storage_class_name": "ENC[AES256_GCM,data:ahR3NYa82gMf9Xg=,iv:Et/VbRPkdBbQRo9ZbZk+rAAw0xvTT+ql06X3I2xXgTU=,tag:XZJ0wJ2UnZeOfdheXvFOZg==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:x48DGoiuxAaYSQ==,iv:XdTxR4vEyNSJVgFl24VOhqqcNt90V/p0ft8VZmzOsL0=,tag:aQoixaDEjKZ+O2k/Pqo0ZQ==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:uA==,iv:/VhoEVDsSuRDeBp27ZgBRwVDkBeRAV0aroRUHfCHNWk=,tag:FWybFQ3uoeFO3tCAOdH84g==,type:float]",
"private": "ENC[AES256_GCM,data:jF2ARZnyIkqfnP6hoLb9bKuNfbKO/5FXHjsI8k7K91Jz7kF1AOryw7VMzU/kwvWwW1hPku2MI9UPuvqhYpjFf9kREkKiSMztMZv6OLS7crjtz/MgvXM9PQ==,iv:8twX9PKSbWB3dKvVpuplGhL4vgZUgRv9eiyrdoTaivY=,tag:cT9dWLahQnsaq33uejdZ3A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
]
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"module": "ENC[AES256_GCM,data:TFikhx6r3T3vnD/RG4ip8rSQNns/nG1TIWETjw==,iv:/VqaZ9g+YcpMq8ENXUb/WFeRl1q3o0s1Q/VCihdciHA=,tag:p3Wh71yb5wMAKnLMxt7Prg==,type:str]",
"mode": "ENC[AES256_GCM,data:HZw/HWtVIg==,iv:hmSNh2AD/092hgErt119lQUsA5fgx1h3eVAZ0kuTiLA=,tag:PEIFW55vbm0mzcX0tDBt7w==,type:str]",
"type": "ENC[AES256_GCM,data:NUNOL2x5p4RU3MB0YSjJBycCuPws57ddlNxCgf2Hqbj2wQ==,iv:fFPfs65xLmaIvaZEAId3nt65MYEi7xVwyt52g9bed8U=,tag:gGNdVLfbGtt4TqQOoJQsJw==,type:str]",
"name": "ENC[AES256_GCM,data:xw3bfQ==,iv:mbMZrq6N7ezM0C+UIe+JGX7dkGzHdpGU6ZIWJLj16y4=,tag:wpMAohawtUc1qwxgIjV0QQ==,type:str]",
"provider": "ENC[AES256_GCM,data:jN0t+AB+0uFM66/KGA2xWPxdd5D+zSBoh0PBA1SUCDJYkbiOfpxhHSLyxrIm9g7e0hgtcbAp,iv:teXHlGb88oMWK+3F83W6uog3x7Te/R5HuLKQ3f1iE5g=,tag:bYok0yuqUEnZSdwfwRS4ew==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"instances": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"schema_version": "ENC[AES256_GCM,data:Kw==,iv:lRo3lv46VqhfDIInbWH1R50Fk9jDVtiZiMkdox1pcgE=,tag:Jva8GRSqdUt8Oe3YY4q98Q==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"attributes": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"id": "ENC[AES256_GCM,data:CQ3GACig12u1isBeFJWLeNCgx0Tcj1s=,iv:eUGUFieGoAd1YN8574OlTFggFxyu+0TFZp3qlD+jmIY=,tag:Ut6PX7OkMPb5ASeqOF5jDA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"metadata": [
{
"annotations": {},
"generate_name": "",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"generation": "ENC[AES256_GCM,data:Gg==,iv:xankoAeZ5aqaYRy0QhiPEMzMhoE99/+kXu1Gz5fE2KU=,tag:WGta9IotljRcLU8M6s/CYQ==,type:float]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"labels": {},
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"name": "ENC[AES256_GCM,data:MKXFwxbPyIsfqAyuFAOIquY=,iv:07BnhvTa+bhM1TfJ0JMCgbf6zjeCUkApaU+7kjAXnd0=,tag:moAo2MhZw99TrlG0fqKAOw==,type:str]",
"namespace": "ENC[AES256_GCM,data:tSNjzC8=,iv:aGUj3Ix8Qy67JG2hqSOy2XLueic1+ngE35QioFyHSy0=,tag:iAARtz+2XGw/o1JMYuPf3A==,type:str]",
"resource_version": "ENC[AES256_GCM,data:q2XLrGypAe36,iv:ROs6xpSesxHNbdSsXi7QOs9AeE6r4r1UyfznCSfgqxA=,tag:T38FM6Xsra+0LIIUX4Fxog==,type:str]",
"uid": "ENC[AES256_GCM,data:DGrb9upuylCGhEXPI/c9o1d3RbN3aIwDkU/ppSN9/XT7uo1V,iv:CSqgokEatf90yAb2XGhWOmVpndMFe8pKUz/qYcHvRqM=,tag:iuEFhUc+2+AOnuUcOZYj3w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"spec": [
{
"access_modes": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:k+oN8sIv9BbH1qR88A==,iv:o4QQ/nBRWKPDUZbc1GHU4F99PqqBlqbjY/XwOmPa2Ko=,tag:duRqFiQnc8b4jnJLXrH9HA==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
],
"resources": [
{
"limits": {},
"requests": {
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"storage": "ENC[AES256_GCM,data:clPT,iv:ipcSleD3VCK23FZC9KiqFaK3t6WHI4IHFd1flmIA3B0=,tag:EZ08ztYUOOkJ6BW4SF0x3A==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
}
],
"selector": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"storage_class_name": "ENC[AES256_GCM,data:2583Ni2b1N+6XBg=,iv:x/QfXr6FLF293Z5sSY1WIKXOo4Poop2SDcBIkCKS0J8=,tag:tvNh83A1YHkZ0S+3oCNcmw==,type:str]",
"volume_mode": "ENC[AES256_GCM,data:gLPqRFIsYJq7ow==,iv:OoQULvuHXesyAZQjQYCK343elWgKiLoJ9fwFYN+hWlU=,tag:evCBC1Km8Wyk+P4m0Q31RA==,type:str]",
"volume_name": "ENC[AES256_GCM,data:4ZAjAV1Dx+29xNTxcxxDutA=,iv:e4I2VWRmVJawrp4GeEINtzz2hGxuP3sL7PS+DBjjpRA=,tag:jtwpDPUvd1Ivi12LTSE+xg==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"timeouts": null,
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"wait_until_bound": "ENC[AES256_GCM,data:49e8xA==,iv:/dLczgUxGewBJ1DAKmVy6a5OwdxX46t8G4bAsJYnl+w=,tag:Y5KlaxdD8kKHb/TiQ9SmMw==,type:bool]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
"sensitive_attributes": [],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"identity_schema_version": "ENC[AES256_GCM,data:+w==,iv:FibdOkytaduRbgYLj13RxsVYAXjyf3xZu398y4cwmIo=,tag:B/S8G9o9TPWMSqpsDvT+eg==,type:float]",
"private": "ENC[AES256_GCM,data:sKkU+Sz0oVeOShx66MbBNXn9nM1EVepR1XTnHV/x6KN/r1yO3Rcu5xutw+mShsOR3xPKAS2tHgPXXkdSIB80e7s3w12oeX/PHq/vALuNHyMLYXESDYV2rg==,iv:T0oSkb8VImuPfVr/kx6xw58nGD3u0bA3EPIE0aOc5gM=,tag:dZUL0TDftQ0kUNWjr9BsCA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"dependencies": [
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"ENC[AES256_GCM,data:qKQhAR7Jt4WAXnqgTPTW700WlPOflIkLjZU=,iv:iC+RrhKkr1zYyyE+DqBX7n+0xdYacTeKmwi+c/0uNDg=,tag:EgPKlN40IMNQMD7eRrg/kw==,type:str]",
"ENC[AES256_GCM,data:R/gSyzu5W1FN2cOWQa1+FEgWob0dRtOIgrnB9l79yk6s2gtZLoJZgM6euMjZLkWpExDDq67fiGmYcGgdr/I=,iv:paZQ7FiMjScm3Tdzx0gMYH76pSPY/Bxa766C/avPCTU=,tag:gtbrQZYTBq6rM8RCIINU/w==,type:str]"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
]
}
]
}
],
"check_results": [
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"object_kind": "ENC[AES256_GCM,data:V6fU,iv:bBdJcSVWsdcBqyIvO5q/nwgCVIRMToOjBi0LO3ol61I=,tag:V93KS+INRPnrQb/hkifAAw==,type:str]",
"config_addr": "ENC[AES256_GCM,data:UiMY35sBoUhy3kgegm01f50A0m5k3qXGmEXp,iv:XcTIom6f45cXTQrxyzX9u/L+O60l7Hi+C+TtMs0UlfI=,tag:VXiWcODC/ZIjJcG64vsUrA==,type:str]",
"status": "ENC[AES256_GCM,data:X5uOOcXkDQ==,iv:KwJJJbCU0kQi9fEO2LryTO4cn4097cAUv5TSalNiIhQ=,tag:G6eTIz1PTwW9ZEhCPQ8uZA==,type:str]",
"objects": null
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"object_kind": "ENC[AES256_GCM,data:wEyP,iv:7/lF0YfE4KpcjU0JmpObhEEOPDVBZOBueeLajjHDFPU=,tag:uSPeKUtUJOZZcIK6rc6tqQ==,type:str]",
"config_addr": "ENC[AES256_GCM,data:Yc9jsshxdELEfYumCqIu0PdDbL85CCs=,iv:pWO2c2sRc9jr1TFlnb2pDdLcGl8RLKpnCqfkWIbhzj0=,tag:rJBotwwPrNGuDw5lyK62jg==,type:str]",
"status": "ENC[AES256_GCM,data:vCWny7HENA==,iv:Svskes2OiNc1iCXnBs/HvivI6Tm37KJF/i/1v34Wvbo=,tag:yXRHM+5F0Yz/KZz+DT/UrQ==,type:str]",
"objects": null
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"sops": {
"hc_vault": [
{
"vault_address": "https://vault.viktorbarzin.me",
"engine_path": "transit",
"key_name": "sops-state-vault",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"created_at": "2026-06-24T20:55:38Z",
"enc": "vault:v1:x9d3sK8Jyw19Xumn3bab91p6rP9jwQ+VeWlx4eP7Rq2NRQDPMd5GptywV7+Zsoc1aDRXz9rNrMEitzPY"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
"age": [
{
"recipient": "age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCV01IL1NRR2hvUTRyY0M0\nMllCekpNOEdEMTJ3a2IxM2c4d0RuYkVhcGo4CjFkU3hXYU4zSFl5OEdoSFZDcTh0\nMlg1K0hHTWJiWXpVUWhJUmNjRXd6NDAKLS0tIDZHMFRLcEtJeUJENUMxb2RGUnZD\naTN4UTVybXZjTWEzM2R3dWtYeUhQMlkKmOb7tFMSXC+2oRgsFsk8Igoaii76gq5X\nqtyVf0NQlUWeWQajjRitmeLq0N2YRbR30h5zKyFvfEve8dfWpn873w==\n-----END AGE ENCRYPTED FILE-----\n"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
},
{
"recipient": "age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90",
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWNXVXR2ZLTVFLN094aU9w\nV3AzSUoxUzZHRUw0MjJtVW02VEdzNUo2elc0ClZLUmdCWC9yQU5FQnF2MWlCbkZa\nd2ZCK2NBSU1ETjdtaTNXamRMVHZyK3cKLS0tIEI3QUdmeVdSN0RDYlRyVDVnUUhv\nblc3ZjZobFRtUVVtZHJxY3BRc001QjQKqsaFT+DFZPnfo8ycDYG451m7kxkoCz8L\nvc8geFxmTaGoJy+YGhbzLPV/TvgDhBrW1Tg6ag/5e+w3q9rPu0S+9Q==\n-----END AGE ENCRYPTED FILE-----\n"
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
}
],
deploy goldmane-edge-aggregator: durable who-talks-to-whom edge trail (#58, ADR-0014) Infra side of ADR-0014: an mTLS gRPC consumer of Calico Goldmane's Flows API that records the namespace-pair edge-set in CNPG and posts a daily new-edge digest to #security. Adds the goldmane-edge-aggregator stack, the pg-goldmane-edges Vault rotation role (Tier-0 vault state updated here), and the namespace in the ghcr-credentials allowlist. Cert: REUSES the operator-minted, Tigera-CA-signed whisker-backend client cert (Goldmane verifies only the CA chain, not identity) instead of minting from the Tigera CA private key. This avoids putting the CA key in TF state AND the hashicorp/tls provider, which is incompatible with this repo's global generate-providers/lockfile pattern (it broke every stack's lockfile). Verified live: aggregator streaming flows, 174 edges in Postgres across 50x54 namespaces, db+slack ExternalSecrets synced, digest dry-run formats correctly, private image pulls via the Kyverno-synced ghcr-credentials. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-24 20:55:38 +00:00
"lastmodified": "2026-06-24T20:55:38Z",
"mac": "ENC[AES256_GCM,data:0eWERYCAdOWMQX7nqrrBLDr3hZnQY4CicFzhN2yjmuH2y/8v+WMEFm/GoVpFUP8r6qtiA7qH3bZl9xOqP3I0NgxPJak53CwYADqOFITJqwIffl98GmoCF9lYv8QqatPB5kmkH47MKgSuEVc6w8vP+HOU3UYlO49E3084KA1Hc6o=,iv:WtTx9NSJJEMoLbfQf9Y1irGdGvlBwUvghXQMRMAGE5g=,tag:244LI3MRRdJmJp4gsbYCKA==,type:str]",
fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip] 6d224861 came from a --no-checkout worktree whose empty index made the commit drop every file except two. This restores 05b50d2b's full tree and correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the live infra was never applied from the broken commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-09 08:45:33 +00:00
"unencrypted_suffix": "_unencrypted",
"version": "3.12.1"
}
}
Reference in a new issue Copy permalink