feat(mysql): cross-repo MySQL app provisioning contract#30
Merged
Conversation
Encapsulates per-app GSM secret shells (user/pass/name) and IAM bindings granting the runtime SA reader on its own shells plus the shared db-host secret. Output app_entry feeds mysql-app-catalog.
Email of the personal-cloud CI/CD service account that needs reader access on bootstrap GSM secrets (oci-tf-aws-*, db-admin-*). Default matches the production SA; overridable via tfvars.
- shehryar.tf: replaces 3 inline secret resources with the
app-with-mysql module call. Cloud Run secret refs now use
literal IDs (consistent with the existing db-host pattern).
- mysql-catalog.tf: locals.mysql_apps publishes JSON to the
mysql-app-catalog GSM secret. IAM bindings grant personal-cloud's
deploy SA reader on the bootstrap secrets so its workflow can
fetch creds without manual gcloud bootstrapping.
- variables.tf + main.tf: thread personal_cloud_deploy_sa
through the apps module boundary.
- outputs.tf: surface shehryar identity/hosting/api URLs at root.
State for shehryar-db-{user,pass,name} shells has been imported
into the new module addresses.
Terraform Plan
|
This was referenced Apr 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Establishes a single contract (
mysql-app-catalogGSM secret) between firebase-cloud and personal-cloud so adding a new app's MySQL database becomes a one-file edit + push.app-with-mysqlmodule: per-app GSM secret shells ({app}-db-{user,pass,name}) + IAM bindings to runtime SA + db-host access.mysql-catalog.tf: publishes JSON map of apps to GSM, plus IAM bindings grantingpersonal-cloud-ci-cddeploy SA reader on bootstrap secrets (catalog, db-admin-, oci-tf-aws-).shehryar.tf: removes inline secret declarations, uses the new module. Cloud Run env refs use literal secret IDs (consistent with existingdb-hostpattern).personal_cloud_deploy_savariable through the apps module boundary.State for
shehryar-db-{user,pass,name}shells already imported into the new module addresses; this PR's apply will be a no-op on those (they show as in-place updates only because the GCP provider auto-addsgoog-terraform-provisionedlabels).Companion PR on personal-cloud has already merged (commit b318211): consumes the catalog, drops duplicate shell ownership, all 6 OCI-using workflows now fetch creds from GSM after WIF auth.
Spec:
docs/superpowers/specs/2026-04-25-mysql-app-provisioning-design.mdin personal-cloud.Plan:
docs/superpowers/plans/2026-04-25-mysql-app-provisioning.mdin personal-cloud.Test plan
gcloud secrets versions access latest --secret=mysql-app-catalog | jq .returns{"shehryar":{"database":"rn_chatapp","sa_email":"shehryar-runtime@..."}}gcloud iam service-accounts list --filter="email~shehryar"shows both-runtimeand-ci-cdSAsgcloud secrets get-iam-policy shehryar-db-usershowsshehryar-runtimebindinggcloud secrets get-iam-policy mysql-app-catalogshowspersonal-cloud-ci-cdbindingterraform-mysql-apps.yamlon personal-cloud succeeds and writes per-app secret versions