fix: restore tree dropped by 6d224861; land stem95su gdrive-sync (10m) [ci skip]

6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/external-secrets/main.tf

@@ -0,0 +1,85 @@
+resource "kubernetes_namespace" "external_secrets" {
+  metadata {
+    name = "external-secrets"
+    labels = {
+      tier = local.tiers.cluster
+      "keel.sh/enrolled" = "true"
+    }
+  }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
+}
+
+resource "helm_release" "external_secrets" {
+  name       = "external-secrets"
+  namespace  = kubernetes_namespace.external_secrets.metadata[0].name
+  repository = "https://charts.external-secrets.io"
+  chart      = "external-secrets"
+  version    = "0.12.1"
+
+  values = [yamlencode({
+    installCRDs = true
+  })]
+}
+
+# --- ClusterSecretStore for Vault KV v2 ---
+
+resource "kubernetes_manifest" "css_vault_kv" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ClusterSecretStore"
+    metadata   = { name = "vault-kv" }
+    spec = {
+      provider = {
+        vault = {
+          server  = "http://vault-active.vault.svc.cluster.local:8200"
+          path    = "secret"
+          version = "v2"
+          auth = {
+            kubernetes = {
+              mountPath = "kubernetes"
+              role      = "eso"
+              serviceAccountRef = {
+                name      = "external-secrets"
+                namespace = "external-secrets"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  depends_on = [helm_release.external_secrets]
+}
+
+# --- ClusterSecretStore for Vault Database Engine ---
+
+resource "kubernetes_manifest" "css_vault_db" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ClusterSecretStore"
+    metadata   = { name = "vault-database" }
+    spec = {
+      provider = {
+        vault = {
+          server  = "http://vault-active.vault.svc.cluster.local:8200"
+          path    = "database"
+          version = "v1"
+          auth = {
+            kubernetes = {
+              mountPath = "kubernetes"
+              role      = "eso"
+              serviceAccountRef = {
+                name      = "external-secrets"
+                namespace = "external-secrets"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  depends_on = [helm_release.external_secrets]
+}

stacks/external-secrets/providers.tf

@@ -0,0 +1,29 @@
+# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
+terraform {
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.0"
+    }
+  }
+}
+
+variable "kube_config_path" {
+  type    = string
+  default = "~/.kube/config"
+}
+
+provider "kubernetes" {
+  config_path = var.kube_config_path
+}
+
+provider "helm" {
+  kubernetes = {
+    config_path = var.kube_config_path
+  }
+}
+
+provider "vault" {
+  address          = "https://vault.viktorbarzin.me"
+  skip_child_token = true
+}

stacks/external-secrets/terragrunt.hcl

@@ -0,0 +1,8 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}