Description
A regulatory-only deployment needs its namespace, Secrets, Pod Identity role scoped to its own service account and profiles, and a helm_release. Mirrors kubernetes.tf and aws-iam.tf for the regulatory prefix and namespace. The experiments service account and Secret are per use case.
Acceptance Criteria
- #1 Regulatory namespace, Secrets (otlp, agento11y, faro if used, experiments), Pod Identity association and helm_release exist only when regulatory is selected
- #2 The regulatory role can invoke only its own teams’ application inference profiles
- #3 chart_values_regulatory output exists for deploy_workloads = false users
- #4 Regulatory namespace, Secrets, Pod Identity association and helm_release exist only when regulatory is selected, and traffic_enabled suspends its loadgen and CronJob
- #5 The regulatory role invokes only its own teams’ profiles through its own policy and profile resources named from regulatory_name
- #6 chart_values_regulatory output exists for deploy_workloads = false users; outputs and examples/complete use try() so regulatory-only and touchline-only both apply
Definition of Done
- #1 just check
Implementation Plan
Implement the corrected design and frozen regulatory contracts, with disjoint file ownership for parallel work. Prove local runtime/rendered/mock-plan behaviour, integrate into just check, complete CodeRabbit review before landing code, and record live-only acceptance separately. No live deployment, image publication, new credential or CVE exception is authorized by this local implementation pass.
Implementation Notes
Local Terraform integration passes validation plus 12 mock-provider scenarios including regulatory-only, both, no host, external release, paused traffic/capture off and custom namespace separation. Regulatory resources and profiles exist only when selected; application invocation policy is separate and restricted to regulatory profiles. Shared host maps/policy stay unchanged. Default compatibility still matches original base over 140 resource entries and 12 pre-existing outputs; new disabled chart_values_regulatory is null and explicitly asserted. No apply performed.
Final Summary
Implemented and locally validated regulatory-only profiles, exact Pod Identity trust, restricted invoke policy, namespace, three Secrets, experiments identity, chart values and conditional Helm release. Root examples/outputs support every use-case combination and external deployment. Full local gate and original default-plan compatibility pass. CodeRabbit reviewed the final batch; all issues resolved. No cloud apply was performed.