Restore the ghp wiring (module instantiations, variables, config.hcl parsing
blocks, and terragrunt inputs) exactly as on master, and remove ONLY the two
ghp config YAMLs. With no yaml files, the for_each maps are empty, so zero ghp
backend/role instances are created and the unseeded ghp/config KV is never read
- the master apply passes while the wiring stays in place for the later re-add.
The master apply aborts reading the unseeded ghp config KV
(kv/data/service/vault/au/syd1/secret_backend/ghp/config), blocking all
changes including the arrstack plugin registration (#125). The ghp backend
and role are not-yet-created (0 to destroy), so removing them is
non-destructive and lets the apply proceed.
The ghp plugin registration and ghp policies are retained. This is part 1
of remove -> grant write policy -> seed KV -> re-add; it will be reverted
once the ghp config is seeded.
- Remove module.ghp_secret_backend and module.ghp_secret_backend_role
instantiations (and the role's depends_on) from modules/vault_cluster/main.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role variables from
modules/vault_cluster/variables.tf.
- Remove the ghp_secret_backend and ghp_secret_backend_role parsing blocks
from config/config.hcl.
- Remove the ghp_secret_backend and ghp_secret_backend_role inputs from
environments/au/syd1/terragrunt.hcl.
- Delete config/ghp_secret_backend/ghp.yaml and
config/ghp_secret_backend_role/ghp/agent.yaml.
unkin-agent