feat(SRE-8899): support new and old secrets (migration 1/2)

[vmarlier]

Linear Story

We are migrating global properties outside of application helm-chart.
This is the first iteration.

Current secrets used are only from the application helm-chart:

• <app>-aws-secret
• <app>-aws-parameter-store
• <app>-aws-secret-application

The desired status is this one (that will be achieved with the next PR on config-parser):

• <app>-aws-secret-application (application helm-chart)
• <app>-aws-parameter-store (application helm-chart)
• global-aws-secret (flux-config)
• global-aws-parameter-store (flux-config)

To have a smooth migration, we will have both approach at the same time:

• <app>-aws-secret-application (application helm-chart)
• <app>-aws-parameter-store (application helm-chart)
• <app>-aws-secret (application helm-chart)
• global-aws-secret (flux-config)
• global-aws-parameter-store (flux-config)

[linear]

SRE-8899 Investigate and optimize ExternalSecret consumption patterns to reduce AWS SSM Parameter Store API usage

[Copilot]

Pull request overview

Adds support for consuming both legacy app-scoped secrets and new global secrets/parameter-store mounts during the first phase of migrating global properties out of the application Helm chart.

Changes:

• Extend parse-config.sh to load global-aws-secret and global-aws-parameter-store in addition to existing sources.
• Update local docker-compose.yml to mount new global fixture volumes for the env-loader.
• Add test fixtures for global secret/parameter-store volumes to exercise the new loading paths.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
parse-config.sh	Loads global secret + parameter-store directories and merges into application.properties.
docker-compose.yml	Mounts global fixture volumes into the env-loader container.
test/fixture/volumes/global-aws-secret/with_special_chars	Adds a special-characters fixture value for global secret parsing.
test/fixture/volumes/global-aws-secret/infrastructure_private.terraform	Adds a global secret fixture for .terraform suffix stripping.
test/fixture/volumes/global-aws-secret/infrastructure_openai_key	Adds a global secret fixture for key remapping.
test/fixture/volumes/global-aws-secret/infrastructure_launch-darkly_key	Adds a global secret fixture for key remapping.
test/fixture/volumes/global-aws-secret/infrastructure_global_launch-darkly_key	Adds a global secret fixture for prefix stripping behavior.
test/fixture/volumes/global-aws-secret/ignore_multiline	Adds a multiline fixture to ensure multiline values are ignored.
test/fixture/volumes/global-aws-parameter-store/_infrastructure_msk_endpoint	Adds a global parameter-store fixture for leading _ stripping and key normalization.
test/fixture/volumes/global-aws-parameter-store/_application_kerberos_redis_kerberos-authz_url	Adds a global parameter-store fixture for application prefix stripping.
test/fixture/volumes/global-aws-parameter-store/_application_kerberos_authentication_allowed_issuers	Adds a global parameter-store fixture for JSON-like value handling.
test/fixture/volumes/global-aws-parameter-store/_application_global_kerberos_cache_kerberos-authz_url	Adds a global parameter-store fixture for application.<scope>. prefix stripping.

Comments suppressed due to low confidence (1)

parse-config.sh:60

• The redirect target in printf ... >> $WORKDIR/application.properties is unquoted, so a WORKDIR containing spaces or glob characters would break the path (word-splitting/globbing). Quoting the redirection path (and, ideally, validating WORKDIR early) makes the script more robust.

        log "source=$FILENAME destination=$KEY"

        VALUE=$(cat "$FILENAME")
        RESULT="$KEY=$VALUE"
        printf "%s\n" "$RESULT" >> $WORKDIR/application.properties
      fi

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.