Onboard keycloak + paledocs secrets to Salt pillar pipeline

forgejo_admin commented

2026-03-14 15:03:40 +00:00

Owner

Lineage

plan-pal-e-platform → secrets hardening (ad-hoc)

Repo

forgejo_admin/pal-e-platform

User Story

As a platform operator
I want all Terraform secrets flowing through the Salt pillar pipeline
So that make tofu-plan / make tofu-apply works without manual -var flags

Context

Two secrets were added to Terraform variables but never onboarded to the Salt pillar → GPG → Makefile → tfvars pipeline:

keycloak_admin_password — added in PR #34 (Keycloak deploy, 2026-03-14)
paledocs_db_password — added in PR #23 (pal-e-docs DB secret, gap since 2026-03-08)

Currently both require manual -var flags on every tofu plan/apply. This breaks the make tofu-plan / make tofu-apply targets.

File Targets

Files to modify:

salt/pillar/secrets/platform.sls — add GPG-encrypted values for both secrets
Makefile — add both to TF_SECRET_VARS list
salt/pillar/secrets_registry.sls — add metadata entries
README.md — add ## Secrets Architecture section documenting the pipeline

Acceptance Criteria

Both secrets GPG-encrypted in platform.sls
Both listed in TF_SECRET_VARS in Makefile
Both have entries in secrets_registry.sls
make tofu-secrets renders both into secrets.auto.tfvars
make tofu-plan works without manual -var flags
README has Secrets Architecture section documenting the pipeline
No plaintext secret values in any committed file

Test Expectations

make tofu-secrets completes without error and outputs correct var count
grep keycloak_admin_password terraform/secrets.auto.tfvars returns a line
grep paledocs_db_password terraform/secrets.auto.tfvars returns a line
make tofu-plan succeeds without any -var flags
Run: make tofu-secrets && grep -c '=' terraform/secrets.auto.tfvars (should be 12, up from 10)

Constraints

GPG encrypt with key ID 81A03D1CF874DC90 (Salt Master key, per secrets_registry.sls)
Follow the sop-secrets-management "Adding a new platform secret" procedure exactly
Plaintext values come from ~/secrets/pal-e-services/secrets.env (keycloak) and must be sourced for paledocs from the existing k8s secret or Salt state
Do NOT commit plaintext values — only GPG-encrypted PGP blocks in platform.sls
README section should explain the pipeline without revealing actual values

Checklist

PR opened with Closes #N
make tofu-secrets tested
No unrelated changes

sop-secrets-management — the public SOP (procedures)
PR #34 — keycloak_admin_password gap origin
PR #23 — paledocs_db_password gap origin

### Lineage `plan-pal-e-platform` → secrets hardening (ad-hoc) ### Repo `forgejo_admin/pal-e-platform` ### User Story As a platform operator I want all Terraform secrets flowing through the Salt pillar pipeline So that `make tofu-plan` / `make tofu-apply` works without manual `-var` flags ### Context Two secrets were added to Terraform variables but never onboarded to the Salt pillar → GPG → Makefile → tfvars pipeline: - `keycloak_admin_password` — added in PR #34 (Keycloak deploy, 2026-03-14) - `paledocs_db_password` — added in PR #23 (pal-e-docs DB secret, gap since 2026-03-08) Currently both require manual `-var` flags on every `tofu plan/apply`. This breaks the `make tofu-plan` / `make tofu-apply` targets. ### File Targets Files to modify: - `salt/pillar/secrets/platform.sls` — add GPG-encrypted values for both secrets - `Makefile` — add both to `TF_SECRET_VARS` list - `salt/pillar/secrets_registry.sls` — add metadata entries - `README.md` — add `## Secrets Architecture` section documenting the pipeline ### Acceptance Criteria - [ ] Both secrets GPG-encrypted in `platform.sls` - [ ] Both listed in `TF_SECRET_VARS` in Makefile - [ ] Both have entries in `secrets_registry.sls` - [ ] `make tofu-secrets` renders both into `secrets.auto.tfvars` - [ ] `make tofu-plan` works without manual `-var` flags - [ ] README has Secrets Architecture section documenting the pipeline - [ ] No plaintext secret values in any committed file ### Test Expectations - [ ] `make tofu-secrets` completes without error and outputs correct var count - [ ] `grep keycloak_admin_password terraform/secrets.auto.tfvars` returns a line - [ ] `grep paledocs_db_password terraform/secrets.auto.tfvars` returns a line - [ ] `make tofu-plan` succeeds without any `-var` flags - Run: `make tofu-secrets && grep -c '=' terraform/secrets.auto.tfvars` (should be 12, up from 10) ### Constraints - GPG encrypt with key ID `81A03D1CF874DC90` (Salt Master key, per `secrets_registry.sls`) - Follow the `sop-secrets-management` "Adding a new platform secret" procedure exactly - Plaintext values come from `~/secrets/pal-e-services/secrets.env` (keycloak) and must be sourced for paledocs from the existing k8s secret or Salt state - Do NOT commit plaintext values — only GPG-encrypted PGP blocks in `platform.sls` - README section should explain the pipeline without revealing actual values ### Checklist - [ ] PR opened with `Closes #N` - [ ] `make tofu-secrets` tested - [ ] No unrelated changes ### Related - `sop-secrets-management` — the public SOP (procedures) - PR #34 — keycloak_admin_password gap origin - PR #23 — paledocs_db_password gap origin