Commit c4ee21e4 authored by xuwang's avatar xuwang
Browse files

skills: document vault-login prereq placement for kube and TF repos 



otica-migrate-kube: add kc-render-sec: vault-login step after
kc-config: gke-login — OTICA's kube.mk has no vault prereq on
kc-render-sec; secret templates call vault-kv and need auth first.

otica-migrate-tf: add tf-render: vault-login guidance and warn against
tf-init: vault-login — tf-render runs before tf-init's recipe in the
chain, so vault-login on tf-init fires after vault is already needed.
gcp-login correctly stays on tf-init (GCS backend access).

Changelog-Added: kube: kc-render-sec: vault-login wiring step
Changelog-Added: tf: tf-render: vault-login; warn against tf-init: vault-login
Co-Authored-By: default avatarClaude Sonnet 4.6 <noreply@anthropic.com>
parent 1fc707c8

skills/otica/otica-migrate-kube/SKILL.md

+17 −0
Original line number Diff line number Diff line
@@ -240,6 +240,23 @@ awk '/kc-config:[ \t]*gke-login/{kc=NR} kc&&/^\t.*(export|:=|=)/{print FILENAME" 


No output = correctly placed.



### Wire up `kc-render-sec: vault-login`



OTICA's `kube.mk` defines `kc-render-sec: kc-init` with no vault prereq. Secret templates call `vault-kv` — vault must be authenticated before `kc-render-sec` runs. Add the extra prereq immediately after `kc-config: gke-login`:



```makefile

kc-config: gke-login

kc-render-sec: vault-login

```



This appends `vault-login` to the existing prereqs without redefining the recipe — Make merges extra prereq lines cleanly.



Verify with:



```bash

grep -n 'kc-render-sec\|kc-config' common/makefile.mk

```



### `.gitignore`: add OTICA artifact dirs



OTICA renders vault-sourced values into local build directories. All of these must be in `.gitignore` before any render runs:

skills/otica/otica-migrate-tf/SKILL.md

+25 −0
Original line number Diff line number Diff line
@@ -275,6 +275,31 @@ For nested repos (common/ structure), wire it as the first line of `common/env.m 


For flat repos (no `common/` — e.g. `gitlab-tf`), place `tools.txt` at the project root with no `TOOLS_FILE` override needed.



### Wire `vault-login` to `tf-render`, not `tf-init`



`tf-render` is where gomplate calls `vault-kv` and where the Vault Terraform provider token is first needed. OTICA's chain is `tf-plan → tf-init → tf-render`, so `tf-render` runs **before** `tf-init`'s recipe — a `vault-login` prereq on `tf-init` fires after vault is already needed.



```makefile

tf-init: gcp-login ## initialize terraform

tf-render: vault-login

```



**`gcp-login` stays on `tf-init`** — that's when `terraform init` hits the GCS backend, which needs GCP ADC. `tf-render` makes no GCP API calls.



If an existing repo has `tf-init: gcp-login vault-login`, move `vault-login` to `tf-render`:



```diff

- tf-init: gcp-login vault-login ## initialize terraform

+ tf-init: gcp-login ## initialize terraform

+ tf-render: vault-login

```



Verify:



```bash

grep -n 'tf-init\|tf-render' common/makefile.mk

```



### Validate



```bash