MAPA-277: add change someones cell api ECR and RDS - dev

[Michael Willis (Mjwillis)]

Adds the resources for a second component in this existing namespace: hmpps-change-someones-cell-api, a new Kotlin API that takes over cell move orchestration from whereabouts-api, which is being decommissioned.

The API deliberately reuses the UI's namespace rather than getting its own, since it is the same product (DPS059) and the same team.

Dev only — preprod and prod will follow once this is proven.

Changes

• resources/github.tf — a second cloud-platform-terraform-hmpps-template module for hmpps-change-someones-cell-api, with source_template_repo = "hmpps-template-kotlin". This provisions the ECR and the GitHub Actions deploy secrets for the new repo. There is no separate ecr.tf in this namespace; the ECR comes from this module, as it does for the UI.
• resources/rds-postgresql.tf — Postgres 18 on db.t4g.micro, plus the rds-postgresql-instance-output secret and configmap. enable_rds_auto_start_stop = true for dev. Modelled on the hmpps-cell-sharing-risk-assessment-dev instance.
• 00-namespace.yaml — appends the new repo to the source-code annotation.
• 06-certificate.yaml — certificate for change-someones-cell-api-dev.hmpps.service.justice.gov.uk.

Notes for review

An RDS instance existed in this namespace until 14b0db32ab ("MAP-1366 removing hmpps-prisoner-cell-allocation-api"), which removed it along with the retired API. This largely restores what that commit deleted.

No provider "kubernetes" {} block is added to main.tf: it is absent here, but elasticache.tf already creates a kubernetes_secret successfully, so the pipeline is supplying kube config from the environment.

Existing terraform formatting in github.tf is left as it was — it was already non-fmt-clean before this change, and the code-formatter action tidies it.

Related: ministryofjustice/hmpps-change-someones-cell-api#1, JIRA MAPA-277 under epic MAPA-275.

[Sablu M (sablumiah)]

Terraform Plan Summary

Terraform Plan: 26 to be created, 0 to be destroyed, 0 to be updated, 0 to be replaced and 25 unchanged.

Resources to create:

+ kubernetes_config_map.rds
+ kubernetes_secret.rds
+ module.hmpps-change-someones-cell-api.github_actions_environment_variable.namespace_env_var
+ module.hmpps-change-someones-cell-api.github_repository_environment.env
+ module.hmpps-change-someones-cell-api.kubernetes_secret.application-insights[0]
+ module.hmpps-change-someones-cell-api.kubernetes_secret.kotlin_client_creds[0]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-name["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-namespace["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-cert["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-token["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role.github_actions_role
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role_binding.github-actions-rolebinding
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_secret_v1.serviceaccount-token
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_service_account.github_actions_serviceaccount
+ module.hmpps-change-someones-cell-api.random_password.session_secret
+ module.hmpps-change-someones-cell-api.time_rotating.weekly
+ module.hmpps-change-someones-cell.time_rotating.weekly
+ module.rds.aws_db_instance.rds
+ module.rds.aws_db_parameter_group.custom_parameters
+ module.rds.aws_db_subnet_group.db_subnet[0]
+ module.rds.aws_kms_alias.alias[0]
+ module.rds.aws_kms_key.kms[0]
+ module.rds.aws_security_group.rds-sg
+ module.rds.random_id.id
+ module.rds.random_password.password
+ module.rds.random_string.username

[Sablu M (sablumiah)]

This PR CANNOT be auto approved and requires manual approval from the Cloud Platform team.
Reason:
🕵️‍♂️ Detected changes to K8s YAML files. Manual review needed.
Please raise it in #ask-cloud-platform Slack channel.

[cloud-platform-actions]

Team name: move-a-prisoner

• Valid: true

Repository: [https://github.com/ministryofjustice/hmpps-change-someones-cell.git https://github.com/ministryofjustice/hmpps-change-someones-cell-api]

• Public: [true true]

[Sablu M (sablumiah)]

Terraform Plan Summary

Terraform Plan: 26 to be created, 0 to be destroyed, 0 to be updated, 0 to be replaced and 25 unchanged.

Resources to create:

+ kubernetes_config_map.rds
+ kubernetes_secret.rds
+ module.hmpps-change-someones-cell-api.github_actions_environment_variable.namespace_env_var
+ module.hmpps-change-someones-cell-api.github_repository_environment.env
+ module.hmpps-change-someones-cell-api.kubernetes_secret.application-insights[0]
+ module.hmpps-change-someones-cell-api.kubernetes_secret.kotlin_client_creds[0]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-name["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-namespace["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-cert["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-token["hmpps-change-someones-cell-api.dev"]
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role.github_actions_role
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role_binding.github-actions-rolebinding
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_secret_v1.serviceaccount-token
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_service_account.github_actions_serviceaccount
+ module.hmpps-change-someones-cell-api.random_password.session_secret
+ module.hmpps-change-someones-cell-api.time_rotating.weekly
+ module.hmpps-change-someones-cell.time_rotating.weekly
+ module.rds.aws_db_instance.rds
+ module.rds.aws_db_parameter_group.custom_parameters
+ module.rds.aws_db_subnet_group.db_subnet[0]
+ module.rds.aws_kms_alias.alias[0]
+ module.rds.aws_kms_key.kms[0]
+ module.rds.aws_security_group.rds-sg
+ module.rds.random_id.id
+ module.rds.random_password.password
+ module.rds.random_string.username

[Sablu M (sablumiah)]

This PR CANNOT be auto approved and requires manual approval from the Cloud Platform team.
Reason:
🕵️‍♂️ Detected changes to K8s YAML files. Manual review needed.
Please raise it in #ask-cloud-platform Slack channel.

[Sablu M (sablumiah)]

Your PR is applying in the build: https://concourse.cloud-platform.service.justice.gov.uk/teams/main/pipelines/environments-live/jobs/apply-namespace-changes-live/builds/23638