refactor(gitops): establish platform ownership boundaries

iac/terraform/live/dev-k3s/vault-database/main.tf

@@ -17,9 +17,23 @@ provider "vault" {
   token            = var.vault_token
 }
 
+moved {
+  from = vault_database_secret_backend_connection.platform_postgres
+  to   = vault_database_secret_backend_connection.auth_system_postgres
+}
+
+removed {
+  from = vault_database_secret_backend_role.postgres_operator
+
+  lifecycle {
+    destroy = false
+  }
+}
+
 locals {
-  migration_role_name = "auth-db-migration-dev"
-  operator_role_name  = "postgres-operator-dev"
+  database_config_name = "auth-system-postgres-dev"
+  database_mount_path  = "database"
+  migration_role_name  = "auth-db-migration-dev"
 
   creation_statements = [
     <<-EOT
@@ -38,10 +52,10 @@ locals {
   ]
 }
 
-resource "vault_database_secret_backend_connection" "platform_postgres" {
-  allowed_roles     = [local.migration_role_name, local.operator_role_name]
-  backend           = var.database_mount_path
-  name              = var.database_config_name
+resource "vault_database_secret_backend_connection" "auth_system_postgres" {
+  allowed_roles     = [local.migration_role_name]
+  backend           = local.database_mount_path
+  name              = local.database_config_name
   plugin_name       = "postgresql-database-plugin"
   verify_connection = true
 
@@ -52,24 +66,18 @@ resource "vault_database_secret_backend_connection" "platform_postgres" {
     password_wo_version     = var.postgres_admin_password_version
     username                = var.postgres_admin_username
   }
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "vault_database_secret_backend_role" "auth_db_migration" {
-  backend               = var.database_mount_path
+  backend               = local.database_mount_path
   creation_statements   = local.creation_statements
-  db_name               = vault_database_secret_backend_connection.platform_postgres.name
+  db_name               = vault_database_secret_backend_connection.auth_system_postgres.name
   default_ttl           = var.auth_db_migration_default_ttl_seconds
   max_ttl               = var.auth_db_migration_max_ttl_seconds
   name                  = local.migration_role_name
   revocation_statements = local.revocation_statements
 }
-
-resource "vault_database_secret_backend_role" "postgres_operator" {
-  backend               = var.database_mount_path
-  creation_statements   = local.creation_statements
-  db_name               = vault_database_secret_backend_connection.platform_postgres.name
-  default_ttl           = var.postgres_operator_default_ttl_seconds
-  max_ttl               = var.postgres_operator_max_ttl_seconds
-  name                  = local.operator_role_name
-  revocation_statements = local.revocation_statements
-}