Feat/dev align provisioning access

.github/workflows/helm.yml

@@ -26,13 +26,9 @@ jobs:
           version: latest
 
       - name: Helm lint
-        run: |
-          set -euo pipefail
-          for c in charts/argocd/platform/cluster-secret-store charts/orders charts/payments; do
-            [ -f "$c/Chart.yaml" ] && { echo "== lint $c =="; helm lint "$c"; }
-          done
+        run: helm lint charts/argocd/platform/cluster-secret-store charts/orders charts/payments
 
-      - name: Helm render (region templating)
+      - name: Helm render
         run: helm template csstore charts/argocd/platform/cluster-secret-store --set region=eu-central-1 >/dev/null
 
       - name: YAML lint (argocd manifests)

.github/workflows/terraform.yml

@@ -15,57 +15,39 @@ permissions:
   contents: read
 
 jobs:
-  validate:
-    name: fmt / validate / tflint
+  lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
       - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: "~> 1.10"
-
-      - name: Format check
-        run: terraform fmt -check -recursive infrastructure
-
-      # Validate every root and module independently. -backend=false skips remote
-      # state, so no AWS credentials are needed for validation.
-      - name: Validate all dirs
-        run: |
-          set -euo pipefail
-          fail=0
-          dirs=$(find infrastructure -type f -name '*.tf' \
-            -not -path '*/.terraform/*' -exec dirname {} \; | sort -u)
-          for d in $dirs; do
-            echo "::group::validate $d"
-            terraform -chdir="$d" init -backend=false -input=false >/dev/null
-            terraform -chdir="$d" validate -no-color || fail=1
-            echo "::endgroup::"
-          done
-          exit $fail
-
+      - run: terraform fmt -check -recursive infrastructure
       - uses: terraform-linters/setup-tflint@v4
-        with:
-          tflint_version: latest
+      - run: tflint --init
+      - run: tflint --recursive --chdir=infrastructure
 
-      - name: TFLint
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: hashicorp/setup-terraform@v3
+        with:
+          terraform_version: "~> 1.10"
+      - name: Validate roots and modules
         run: |
-          tflint --init
-          tflint --recursive --chdir=infrastructure
+          for dir in $(find infrastructure -name '*.tf' -not -path '*/.terraform/*' -printf '%h\n' | sort -u); do
+            terraform -chdir="$dir" init -backend=false -input=false >/dev/null
+            terraform -chdir="$dir" validate
+          done
 
   security:
-    name: Trivy IaC scan
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Trivy config scan
-        uses: aquasecurity/trivy-action@master
+      - uses: aquasecurity/trivy-action@master
         with:
           scan-type: config
           scan-ref: infrastructure
           severity: HIGH,CRITICAL
           exit-code: "1"
-
-  # plan/apply jobs will be added here later (assume the executor role per env via
-  # OIDC, terraform plan on PRs, gated apply on merge to main).

charts/argocd/README.md

@@ -5,7 +5,7 @@ How dev gets from "empty cluster" to "everything running", and where to add thin
 ## The chain
 
 ```
-Terraform (infrastructure/environments/dev/bootstrap)
+Terraform (infrastructure/environments/dev/argocd)
   └─ installs argo-cd            (values: install/dev/argocd-values.yaml)
   └─ installs argocd-apps chart  (values: install/dev/appsets.yaml)
         ├─ AppProjects:  dev-platform, dev-apps

charts/argocd/apps/orders.yaml

@@ -1,6 +1,4 @@
-# User application parameters, consumed by the dev-apps ApplicationSet
-# (install/dev/appsets.yaml). Env-agnostic: the ApplicationSet supplies the repo,
-# revision, ECR registry, image-updater annotations, and values-<env>.yaml.
+# Params for the dev-apps ApplicationSet (env-agnostic; appset adds repo, registry, values-<env>.yaml).
 name: orders
 namespace: orders
 path: charts/orders

charts/argocd/apps/payments.yaml

@@ -1,6 +1,4 @@
-# User application parameters, consumed by the dev-apps ApplicationSet
-# (install/dev/appsets.yaml). Env-agnostic: the ApplicationSet supplies the repo,
-# revision, ECR registry, image-updater annotations, and values-<env>.yaml.
+# Params for the dev-apps ApplicationSet (env-agnostic; appset adds repo, registry, values-<env>.yaml).
 name: payments
 namespace: payments
 path: charts/payments

charts/argocd/install/dev/appsets.yaml

@@ -1,17 +1,8 @@
-# Values for the argocd-apps Helm chart, installed once by Terraform (the dev
-# bootstrap root). This is the only thing Terraform renders into ArgoCD; from
-# here ArgoCD owns everything.
-#
-# It creates:
-#   - projects:        dev-platform (third-party tools) + dev-apps (user apps)
-#   - applications:    platform-root  -> app-of-apps over charts/argocd/platform/*
-#   - applicationsets: dev-apps       -> one Application per charts/argocd/apps/*.yaml
-#
-# See charts/argocd/README.md for the full chain.
+# argocd-apps chart values, installed by Terraform. Creates the projects, the
+# platform app-of-apps, and the dev-apps ApplicationSet. See ../../README.md.
 
 projects:
-  # Third-party / opensource cluster tools. Broad: they install CRDs and other
-  # cluster-scoped resources across the external-secrets and argocd namespaces.
+  # Third-party tools — broad (CRDs, cluster-scoped, external-secrets + argocd ns).
   dev-platform:
     namespace: argocd
     finalizers:

charts/argocd/platform/image-updater.yaml

@@ -14,8 +14,7 @@ spec:
     chart: argocd-image-updater
     targetRevision: 0.12.3
     helm:
-      # Images replicate from shared into this account, so the registry is
-      # same-account; the argocd-image-updater Pod Identity role grants ECR read.
+      # Same-account registry (images replicate here); Pod Identity grants ECR read.
       values: |
         serviceAccount:
           name: argocd-image-updater

charts/orders/templates/NOTES.txt

@@ -6,16 +6,16 @@
   {{- end }}
 {{- end }}
 {{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "orders-temp.fullname" . }})
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "orders.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
 {{- else if contains "LoadBalancer" .Values.service.type }}
      NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "orders-temp.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "orders-temp.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "orders.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "orders.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
   echo http://$SERVICE_IP:{{ .Values.service.port }}
 {{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "orders-temp.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "orders.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
   export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
   echo "Visit http://127.0.0.1:8080 to use your application"
   kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT

charts/orders/templates/_helpers.tpl

@@ -1,7 +1,7 @@
 {{/*
 Expand the name of the chart.
 */}}
-{{- define "orders-temp.name" -}}
+{{- define "orders.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
@@ -10,7 +10,7 @@ Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
-{{- define "orders-temp.fullname" -}}
+{{- define "orders.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
 {{/*
 Create chart name and version as used by the chart label.
 */}}
-{{- define "orders-temp.chart" -}}
+{{- define "orders.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels
 */}}
-{{- define "orders-temp.labels" -}}
-helm.sh/chart: {{ include "orders-temp.chart" . }}
-{{ include "orders-temp.selectorLabels" . }}
+{{- define "orders.labels" -}}
+helm.sh/chart: {{ include "orders.chart" . }}
+{{ include "orders.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -45,17 +45,17 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{/*
 Selector labels
 */}}
-{{- define "orders-temp.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "orders-temp.name" . }}
+{{- define "orders.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "orders.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
 Create the name of the service account to use
 */}}
-{{- define "orders-temp.serviceAccountName" -}}
+{{- define "orders.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
-{{- default (include "orders-temp.fullname" .) .Values.serviceAccount.name }}
+{{- default (include "orders.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}

charts/payments/values.yaml

@@ -0,0 +1,99 @@
+replicaCount: 1
+image:
+  repository: 060309844053.dkr.ecr.eu-central-1.amazonaws.com/payments
+  pullPolicy: IfNotPresent
+  tag: "0.1.0"
+
+imagePullSecrets: []
+nameOverride: "payments"
+fullnameOverride: ""
+serviceAccount:
+  create: true
+  automount: true
+  annotations: {}
+  name: ""
+
+# This is for setting Kubernetes Annotations to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+podAnnotations: {}
+# This is for setting Kubernetes Labels to a Pod.
+# For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+podLabels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+service:
+  type: ClusterIP
+  port: 8080
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+# This is to setup the liveness and readiness probes more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+livenessProbe:
+  httpGet:
+    path: /healthz
+    port: http
+readinessProbe:
+  httpGet:
+    path: /healthz
+    port: http
+
+# This section is for setting up autoscaling more information can be found here: https://kubernetes.io/docs/concepts/workloads/autoscaling/
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+# Additional volumes on the output Deployment definition.
+volumes: []
+# - name: foo
+#   secret:
+#     secretName: mysecret
+#     optional: false
+
+# Additional volumeMounts on the output Deployment definition.
+volumeMounts: []
+# - name: foo
+#   mountPath: "/etc/foo"
+#   readOnly: true
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}

infrastructure/bootstrap/shared-infra/main.tf

@@ -11,6 +11,11 @@ resource "aws_s3_bucket_versioning" "tf_state" {
 }
 
 
+# SSE-S3 (AES256) for now. A customer-managed KMS key is the prod-correct choice
+# but needs a cross-account key policy granting every workload account that reads
+# state cross-account; deferred to a dedicated change to avoid locking out state
+# access. Tracked as a follow-up.
+#trivy:ignore:AWS-0132
 resource "aws_s3_bucket_server_side_encryption_configuration" "tf_state" {
   bucket = aws_s3_bucket.tf_state.id
 
@@ -43,6 +48,8 @@ resource "aws_s3_bucket_versioning" "cloudtrail_logs" {
   }
 }
 
+# See tf_state note above — same deferral.
+#trivy:ignore:AWS-0132
 resource "aws_s3_bucket_server_side_encryption_configuration" "cloudtrail_logs" {
   bucket = aws_s3_bucket.cloudtrail_logs.id
 

infrastructure/environments/dev/bootstrap/backend.tf → infrastructure/environments/dev/argocd/backend.tf

@@ -1,7 +1,7 @@
 terraform {
   backend "s3" {
     bucket       = "zeus-tfstate-890387920780"
-    key          = "dev/bootstrap/terraform.tfstate"
+    key          = "dev/argocd/terraform.tfstate"
     region       = "eu-west-1"
     encrypt      = true
     use_lockfile = true

infrastructure/environments/dev/bootstrap/providers.tf → infrastructure/environments/dev/argocd/providers.tf

@@ -21,9 +21,7 @@ provider "aws" {
   region = var.aws_region
 }
 
-# The cluster already exists when this root runs, so these data sources resolve
-# at plan time — no two-phase apply, unlike configuring providers from a
-# cluster resource in the same root.
+# Cluster already exists when this root runs, so these resolve at plan time (no two-phase).
 data "aws_eks_cluster" "this" {
   name = data.terraform_remote_state.cluster.outputs.cluster_name
 }

infrastructure/environments/dev/ecr-access.tf

@@ -1,12 +1,4 @@
-# Cross-account ECR (dev side)
-#
-# Images live in the shared account and are replicated into this account by the
-# shared account's aws_ecr_replication_configuration. This registry policy grants
-# the shared account permission to create the replica repositories and push the
-# replicated images. Once replicated, the node group pulls same-account (its
-# AmazonEC2ContainerRegistryReadOnly is enough) and ArgoCD Image Updater watches
-# this account's own registry.
-
+# Lets the shared account replicate images into this account's ECR.
 data "aws_iam_policy_document" "ecr_replication" {
   statement {
     sid    = "AllowSharedAccountReplication"