MAPA-277: add change someones cell api ECR and RDS - preprod

[Michael Willis (Mjwillis)]

Adds the resources for a second component in this existing namespace: hmpps-change-someones-cell-api, a new Kotlin API that takes over cell move orchestration from whereabouts-api, which is being decommissioned.

The API deliberately reuses the UI's namespace rather than getting its own, since it is the same product (DPS059) and the same team.

Follows #44922, which did dev. That change is proven — the API now deploys and reports healthy in dev, with Flyway having migrated the real RDS instance.

Changes

• resources/github.tf — a second cloud-platform-terraform-hmpps-template module for hmpps-change-someones-cell-api, with source_template_repo = "hmpps-template-kotlin" and reviewer_teams = [var.github_deployment_team] to match the existing UI module in this environment. This provisions the GitHub Actions deploy environment and its KUBE_* secrets.
• resources/rds-postgresql.tf — Postgres 18 on db.t4g.micro, plus the rds-postgresql-instance-output secret and configmap. Modelled on the hmpps-cell-sharing-risk-assessment instances owned by the same team.
• 00-namespace.yaml — appends the new repo to the source-code annotation, and fixes the team-name annotation (see below).
• 06-certificate.yaml — certificate for the API hostname.

The team-name fix

annotation-check resolves cloud-platform.justice.gov.uk/team-name against the GitHub API as a team slug, and this namespace had "Move a Prisoner" — a display name — so the lookup 404s.

This is pre-existing and unrelated to the new API; it surfaced because this is the first change to 00-namespace.yaml since that check was added. Corrected to the move-a-prisoner slug, which exists and is what the hmpps-cell-sharing-risk-assessment-* namespaces already use. Same fix as merged for dev.

Notes for review

An RDS instance existed in this namespace until 14b0db32ab ("MAP-1366 removing hmpps-prisoner-cell-allocation-api"), which removed it along with the retired API. This largely restores what that commit deleted.

Existing terraform formatting in github.tf is left as it was — it was already non-fmt-clean before this change.

Related: ministryofjustice/hmpps-change-someones-cell-api, JIRA MAPA-277 under epic MAPA-275.

[cloud-platform-actions]

Team name: move-a-prisoner

• Valid: true

Repository: [https://github.com/ministryofjustice/hmpps-change-someones-cell.git https://github.com/ministryofjustice/hmpps-change-someones-cell-api]

• Public: [true true]

[Sablu M (sablumiah)]

Terraform Plan Summary

Terraform Plan: 26 to be created, 0 to be destroyed, 0 to be updated, 0 to be replaced and 25 unchanged.

Resources to create:

+ kubernetes_config_map.rds
+ kubernetes_secret.rds
+ module.hmpps-change-someones-cell-api.github_actions_environment_variable.namespace_env_var
+ module.hmpps-change-someones-cell-api.github_repository_environment.env
+ module.hmpps-change-someones-cell-api.kubernetes_secret.application-insights[0]
+ module.hmpps-change-someones-cell-api.kubernetes_secret.kotlin_client_creds[0]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-name["hmpps-change-someones-cell-api.preprod"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.cluster-namespace["hmpps-change-someones-cell-api.preprod"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-cert["hmpps-change-someones-cell-api.preprod"]
+ module.hmpps-change-someones-cell-api.module.service_account.github_actions_environment_secret.serviceaccount-token["hmpps-change-someones-cell-api.preprod"]
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role.github_actions_role
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_role_binding.github-actions-rolebinding
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_secret_v1.serviceaccount-token
+ module.hmpps-change-someones-cell-api.module.service_account.kubernetes_service_account.github_actions_serviceaccount
+ module.hmpps-change-someones-cell-api.random_password.session_secret
+ module.hmpps-change-someones-cell-api.time_rotating.weekly
+ module.hmpps-change-someones-cell.time_rotating.weekly
+ module.rds.aws_db_instance.rds
+ module.rds.aws_db_parameter_group.custom_parameters
+ module.rds.aws_db_subnet_group.db_subnet[0]
+ module.rds.aws_kms_alias.alias[0]
+ module.rds.aws_kms_key.kms[0]
+ module.rds.aws_security_group.rds-sg
+ module.rds.random_id.id
+ module.rds.random_password.password
+ module.rds.random_string.username

[Sablu M (sablumiah)]

This PR CANNOT be auto approved and requires manual approval from the Cloud Platform team.
Reason:
🕵️‍♂️ Detected changes to K8s YAML files. Manual review needed.
Please raise it in #ask-cloud-platform Slack channel.