sync-modules: mirrored modules of release 3.2.0-F-feature-simpl-31671.658.0f17980a

+++ kubernetes/README.md
+++ kubernetes/ovh/credentials.tf
+++ kubernetes/ovh/variables.tf

kubernetes/README.md

@@ -12,6 +12,7 @@ Provisions a managed Kubernetes cluster with one node pool and generates scoped
 | `cloud_account` | Cloud account (environment) name, second segment of the Vault credentials path, filled by the provisioner from the cloudAccount header via the `{CLOUD_ACCOUNT}` placeholder |
 | `requester_unique_id` | Requester unique id, third segment of the Vault credentials path, filled by the provisioner from the requesterUniqueId header via the `{REQUESTER_UNIQUE_ID}` placeholder |
 | `username` | Consumer ServiceAccount name, defaults to `simpl-consumer`, last segment of the Vault credentials path |
+| `credentials_version` | Opaque rotation marker for the consumer credential, defaults to `1`. Changing the value recreates the consumer ServiceAccount and its token Secret, revoking every previously issued consumer token and publishing a fresh credential to Vault. Managed by the credential renewal workflow, not by the deployment script author |
 | `admin_username` | Management (renewer) ServiceAccount name, defaults to `simpl-renewer` |
 | `name_prefix` | Prefix for resource names, defaults to `simpl` |
 | `region` | OVH region for the cluster |
@@ -22,7 +23,7 @@ Provisions a managed Kubernetes cluster with one node pool and generates scoped
 
 Cloud credentials are never module inputs, they reach the provider from the runner environment.
 
-Credentials, following the existing Vault contract: the OVH admin kubeconfig (client certificates) is never delivered. A `kubernetes` provider chained on the fresh cluster creates, in the same apply, the consumer and the management ServiceAccounts (cluster-admin), each with a non expiring legacy token Secret: credentials stay valid until a renewal is requested, and the renewal revokes them by deleting and recreating the ServiceAccount. Both are delivered as assembled kubeconfigs written by the module to Vault: `secret/{provider}/{cloud_account}/{requester_unique_id}/{username}` with the consumer kubeconfig (companions: token, server, ca_data) and the `admin` sibling entry with the root kubeconfig and the management username. No secret material is ever part of an output or of the user body. The Vault provider configuration is generated by the provisioner next to the deployment script, and it authenticates through the Vault Kubernetes auth method with the service account of the Terraform runner, against a Vault role configured at installation time.
+Credentials, following the existing Vault contract: the OVH admin kubeconfig (client certificates) is never delivered. A `kubernetes` provider chained on the fresh cluster creates, in the same apply, the consumer and the management ServiceAccounts (cluster-admin), each with a non expiring legacy token Secret: credentials stay valid until a renewal is requested, and the renewal revokes them by changing the `credentials_version` input, which makes Terraform delete and recreate the ServiceAccount and its token Secret in the next apply. Both are delivered as assembled kubeconfigs written by the module to Vault: `secret/{provider}/{cloud_account}/{requester_unique_id}/{username}` with the consumer kubeconfig (companions: token, server, ca_data) and the `admin` sibling entry with the root kubeconfig and the management username. No secret material is ever part of an output or of the user body. The Vault provider configuration is generated by the provisioner next to the deployment script, and it authenticates through the Vault Kubernetes auth method with the service account of the Terraform runner, against a Vault role configured at installation time.
 
 Note: this module configures the `kubernetes` provider internally (chained on the cluster it creates), so the module block must not use `count`, `for_each` or `depends_on`.
 

kubernetes/ovh/credentials.tf

@@ -17,14 +17,26 @@ resource "kubernetes_namespace_v1" "access" {
   depends_on = [ovh_cloud_project_kube_nodepool.this]
 }
 
+// Rotation anchor: replacing this resource (any change to credentials_version)
+// cascades to the consumer ServiceAccount and its token Secret through
+// replace_triggered_by, performing the credential rotation inside Terraform.
+resource "terraform_data" "credentials_version" {
+  input = var.credentials_version
+}
+
 // Consumer access: ServiceAccount + non expiring legacy token Secret. The
 // binding references the ServiceAccount by name, so it survives the
-// delete/recreate performed by the credential renewal workflow.
+// delete/recreate performed by the credential rotation. Recreating the
+// ServiceAccount changes its UID, which revokes every token issued for it.
 resource "kubernetes_service_account_v1" "consumer" {
   metadata {
     name      = var.username
     namespace = kubernetes_namespace_v1.access.metadata[0].name
   }
+
+  lifecycle {
+    replace_triggered_by = [terraform_data.credentials_version]
+  }
 }
 
 resource "kubernetes_cluster_role_binding_v1" "consumer_admin" {
@@ -56,6 +68,10 @@ resource "kubernetes_secret_v1" "consumer_token" {
 
   type                           = "kubernetes.io/service-account-token"
   wait_for_service_account_token = true
+
+  lifecycle {
+    replace_triggered_by = [terraform_data.credentials_version]
+  }
 }
 
 // Management (renewer) access: ServiceAccount + NON EXPIRING legacy token

kubernetes/ovh/variables.tf

@@ -36,6 +36,12 @@ variable "username" {
   default     = "simpl-consumer"
 }
 
+variable "credentials_version" {
+  description = "Opaque rotation marker for the consumer credential. Changing the value recreates the consumer ServiceAccount and its token Secret, revoking every previously issued consumer token and publishing a fresh credential to Vault. Managed by the credential renewal workflow, not by the deployment script author."
+  type        = string
+  default     = "1"
+}
+
 variable "admin_username" {
   description = "Management (renewer) ServiceAccount name, stored in the Vault admin entry"
   type        = string