From a62b43d19e161c0c95c7bfa0b30c9a610eaac90e Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Sat, 18 Apr 2026 14:08:10 +0000 Subject: [PATCH] [infra] Document intended ignore_changes drift-workarounds [ci skip] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Context The infra repo has 31 `ignore_changes` blocks. Phase 1 of the state-drift consolidation audit classified 21 as legitimate (immutable fields, cloud-computed values) and 10 as intentional workarounds for known drift sources. The remaining 10 were indistinguishable from accidental/forgotten drift suppression without reading the surrounding context. This commit adds a uniform `# DRIFT_WORKAROUND: , reviewed 2026-04-18` marker above the 8 intended-workaround blocks (6 CI image-tag decoupling + 2 non-deterministic secret hashes) so they are easy to distinguish from accidental drift suppression during future audits. ## What is NOT in this change - Functional behavior — `ignore_changes` lists are byte-identical. - The Kyverno `dns_config` ignore paths (covered by Wave 3 shared module). - Workarounds being removed — the CI decoupling is intentional by user decision. ## Files touched CI image-tag decoupling (6): - stacks/k8s-portal/modules/k8s-portal/main.tf (also has dns_config for Kyverno) - stacks/novelapp/main.tf - stacks/claude-memory/main.tf - stacks/plotting-book/main.tf - stacks/trading-bot/main.tf (api deployment) - stacks/trading-bot/main.tf (workers deployment — 6 containers) Non-deterministic secret hashes (2): - stacks/owntracks/main.tf (htpasswd bcrypt) - stacks/mailserver/modules/mailserver/main.tf (postfix-accounts.cf) ## Test Plan ### Automated ``` $ rg DRIFT_WORKAROUND stacks/ | wc -l 8 $ terraform fmt -recursive stacks/k8s-portal stacks/novelapp stacks/claude-memory \ stacks/plotting-book stacks/trading-bot stacks/owntracks stacks/mailserver (no output — already formatted) $ git diff --stat stacks/claude-memory/main.tf | 1 + stacks/k8s-portal/modules/k8s-portal/main.tf | 1 + stacks/mailserver/modules/mailserver/main.tf | 3 ++- stacks/novelapp/main.tf | 1 + stacks/owntracks/main.tf | 1 + stacks/plotting-book/main.tf | 1 + stacks/trading-bot/main.tf | 2 ++ 7 files changed, 9 insertions(+), 1 deletion(-) ``` ### Manual Verification No apply required — HCL comments only, zero effect on plan output. ## Reproduce locally 1. `cd infra && git pull` 2. `rg "DRIFT_WORKAROUND.*reviewed 2026-04-18" stacks/ | wc -l` → expect 8 3. `terraform fmt -check -recursive stacks/` → expect clean exit Closes: code-yrg Co-Authored-By: Claude Opus 4.7 (1M context) --- stacks/claude-memory/main.tf | 1 + stacks/k8s-portal/modules/k8s-portal/main.tf | 1 + stacks/mailserver/modules/mailserver/main.tf | 3 ++- stacks/novelapp/main.tf | 1 + stacks/owntracks/main.tf | 1 + stacks/plotting-book/main.tf | 1 + stacks/trading-bot/main.tf | 2 ++ 7 files changed, 9 insertions(+), 1 deletion(-) diff --git a/stacks/claude-memory/main.tf b/stacks/claude-memory/main.tf index e0f0078e..d1a87d19 100644 --- a/stacks/claude-memory/main.tf +++ b/stacks/claude-memory/main.tf @@ -236,6 +236,7 @@ resource "kubernetes_deployment" "claude-memory" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].container[0].image ] diff --git a/stacks/k8s-portal/modules/k8s-portal/main.tf b/stacks/k8s-portal/modules/k8s-portal/main.tf index 7413d2bd..c44b06fc 100644 --- a/stacks/k8s-portal/modules/k8s-portal/main.tf +++ b/stacks/k8s-portal/modules/k8s-portal/main.tf @@ -113,6 +113,7 @@ resource "kubernetes_deployment" "k8s_portal" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA); Kyverno mutates dns_config for ndots. Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].dns_config, spec[0].template[0].spec[0].container[0].image, # CI updates image tag diff --git a/stacks/mailserver/modules/mailserver/main.tf b/stacks/mailserver/modules/mailserver/main.tf index cf75d9ab..695c1a28 100644 --- a/stacks/mailserver/modules/mailserver/main.tf +++ b/stacks/mailserver/modules/mailserver/main.tf @@ -127,9 +127,10 @@ resource "kubernetes_config_map" "mailserver_config" { logtarget = SYSOUT EOF } - # Password hashes are different each time and avoid changing secret constantly. + # Password hashes are different each time and avoid changing secret constantly. # Either 1.Create consistent hashes or 2.Find a way to ignore_changes on per password lifecycle { + # DRIFT_WORKAROUND: postfix-accounts.cf password hashes non-deterministic; would flap on every apply. Reviewed 2026-04-18. ignore_changes = [data["postfix-accounts.cf"]] } } diff --git a/stacks/novelapp/main.tf b/stacks/novelapp/main.tf index e5420752..f69e55d8 100644 --- a/stacks/novelapp/main.tf +++ b/stacks/novelapp/main.tf @@ -80,6 +80,7 @@ resource "kubernetes_deployment" "novelapp" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].container[0].image, ] diff --git a/stacks/owntracks/main.tf b/stacks/owntracks/main.tf index 78325eb6..a1b1e47b 100644 --- a/stacks/owntracks/main.tf +++ b/stacks/owntracks/main.tf @@ -77,6 +77,7 @@ resource "kubernetes_secret" "basic_auth" { type = "Opaque" lifecycle { + # DRIFT_WORKAROUND: htpasswd bcrypt hashes are non-deterministic per apply; would cause perpetual diff. Reviewed 2026-04-18. ignore_changes = [data] } } diff --git a/stacks/plotting-book/main.tf b/stacks/plotting-book/main.tf index f799badb..b89ed767 100644 --- a/stacks/plotting-book/main.tf +++ b/stacks/plotting-book/main.tf @@ -80,6 +80,7 @@ resource "kubernetes_deployment" "plotting-book" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].container[0].image, ] diff --git a/stacks/trading-bot/main.tf b/stacks/trading-bot/main.tf index a0942e7f..fea7bb02 100644 --- a/stacks/trading-bot/main.tf +++ b/stacks/trading-bot/main.tf @@ -314,6 +314,7 @@ resource "kubernetes_deployment" "trading-bot-frontend" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tags for api + migrations containers. Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].container[0].image, spec[0].template[0].spec[0].container[1].image, @@ -575,6 +576,7 @@ resource "kubernetes_deployment" "trading-bot-workers" { } } lifecycle { + # DRIFT_WORKAROUND: CI pipeline owns image tags for all 6 worker containers. Reviewed 2026-04-18. ignore_changes = [ spec[0].template[0].spec[0].container[0].image, spec[0].template[0].spec[0].container[1].image,