a62b43d19e
## Context
The infra repo has 31 `ignore_changes` blocks. Phase 1 of the state-drift
consolidation audit classified 21 as legitimate (immutable fields, cloud-computed
values) and 10 as intentional workarounds for known drift sources. The remaining
10 were indistinguishable from accidental/forgotten drift suppression without
reading the surrounding context.
This commit adds a uniform `# DRIFT_WORKAROUND: <reason>, reviewed 2026-04-18`
marker above the 8 intended-workaround blocks (6 CI image-tag decoupling + 2
non-deterministic secret hashes) so they are easy to distinguish from
accidental drift suppression during future audits.
## What is NOT in this change
- Functional behavior — `ignore_changes` lists are byte-identical.
- The Kyverno `dns_config` ignore paths (covered by Wave 3 shared module).
- Workarounds being removed — the CI decoupling is intentional by user decision.
## Files touched
CI image-tag decoupling (6):
- stacks/k8s-portal/modules/k8s-portal/main.tf (also has dns_config for Kyverno)
- stacks/novelapp/main.tf
- stacks/claude-memory/main.tf
- stacks/plotting-book/main.tf
- stacks/trading-bot/main.tf (api deployment)
- stacks/trading-bot/main.tf (workers deployment — 6 containers)
Non-deterministic secret hashes (2):
- stacks/owntracks/main.tf (htpasswd bcrypt)
- stacks/mailserver/modules/mailserver/main.tf (postfix-accounts.cf)
## Test Plan
### Automated
```
$ rg DRIFT_WORKAROUND stacks/ | wc -l
8
$ terraform fmt -recursive stacks/k8s-portal stacks/novelapp stacks/claude-memory \
stacks/plotting-book stacks/trading-bot stacks/owntracks stacks/mailserver
(no output — already formatted)
$ git diff --stat
stacks/claude-memory/main.tf | 1 +
stacks/k8s-portal/modules/k8s-portal/main.tf | 1 +
stacks/mailserver/modules/mailserver/main.tf | 3 ++-
stacks/novelapp/main.tf | 1 +
stacks/owntracks/main.tf | 1 +
stacks/plotting-book/main.tf | 1 +
stacks/trading-bot/main.tf | 2 ++
7 files changed, 9 insertions(+), 1 deletion(-)
```
### Manual Verification
No apply required — HCL comments only, zero effect on plan output.
## Reproduce locally
1. `cd infra && git pull`
2. `rg "DRIFT_WORKAROUND.*reviewed 2026-04-18" stacks/ | wc -l` → expect 8
3. `terraform fmt -check -recursive stacks/` → expect clean exit
Closes: code-yrg
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| .terraform.lock.hcl | ||
| backend.tf | ||
| main.tf | ||
| providers.tf | ||
| secrets | ||
| terragrunt.hcl | ||