From 92fd6a5086cc36b1aa9af3de7c93edff108db27c Mon Sep 17 00:00:00 2001
From: "getsantry[bot]" <66042841+getsantry[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 18:03:10 +0000
Subject: [PATCH 1/5] chore: bump socket-firewall chart and image versions

---
 terraform/variables.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/variables.tf b/terraform/variables.tf
index 49586ed..fff94e4 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -124,13 +124,13 @@ variable "firewall_domain" {
 variable "helm_chart_version" {
   description = "Version of the socket-firewall Helm chart"
   type        = string
-  default     = "0.2.4"
+  default     = "0.3.0"
 }
 
 variable "firewall_image_tag" {
   description = "Container image tag for socketdev/socket-registry-firewall (pinned for reproducible rollouts; bumped by check-firewall-versions workflow)"
   type        = string
-  default     = "1.1.159"
+  default     = "1.1.327"
 }
 
 variable "replica_count" {

From fc416d0b15d62c518791c7eff21967104f0b974d Mon Sep 17 00:00:00 2001
From: jeffreyhung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Wed, 17 Jun 2026 08:24:44 -0700
Subject: [PATCH 2/5] fix cicd

---
 .github/workflows/tf-apply.yaml | 4 +++-
 .github/workflows/tf-plan.yaml  | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tf-apply.yaml b/.github/workflows/tf-apply.yaml
index fd1f6ca..2c9832c 100644
--- a/.github/workflows/tf-apply.yaml
+++ b/.github/workflows/tf-apply.yaml
@@ -38,4 +38,6 @@ jobs:
           ${{ steps.auth.outcome == 'success'}}
         with:
           auto_approve: true
-          path: terraform
\ No newline at end of file
+          path: terraform
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/tf-plan.yaml b/.github/workflows/tf-plan.yaml
index 7a18eab..cb480cd 100644
--- a/.github/workflows/tf-plan.yaml
+++ b/.github/workflows/tf-plan.yaml
@@ -31,4 +31,6 @@ jobs:
           ${{ steps.auth.outcome == 'success'}}
         with:
           add_github_comment: changes-only
-          path: terraform
\ No newline at end of file
+          path: terraform
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From f2e38fef43b1b59c4d88cc473a99569d9a52e136 Mon Sep 17 00:00:00 2001
From: jeffreyhung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Wed, 17 Jun 2026 08:25:37 -0700
Subject: [PATCH 3/5] udpate

---
 terraform/terraform.tfvars | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/terraform.tfvars b/terraform/terraform.tfvars
index 6eea54c..11809dd 100644
--- a/terraform/terraform.tfvars
+++ b/terraform/terraform.tfvars
@@ -13,5 +13,5 @@ node_max_count    = 3
 firewall_domain = "sfw.security.sentry.io."
 
 replica_count      = 2
-helm_chart_version = "0.2.4"
-firewall_image_tag = "1.1.159"
+helm_chart_version = "0.3.0"
+firewall_image_tag = "1.1.327"

From 898287b5dbb1af8dd72cd2758db93935a2808e4e Mon Sep 17 00:00:00 2001
From: jeffreyhung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Wed, 17 Jun 2026 08:40:38 -0700
Subject: [PATCH 4/5] fix tf-plan SA permission

---
 README.md                    |  2 +-
 terraform/iam.tf             |  3 ++-
 terraform/kubernetes_rbac.tf | 40 ++++++++++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 terraform/kubernetes_rbac.tf

diff --git a/README.md b/README.md
index 78f5334..c848adb 100644
--- a/README.md
+++ b/README.md
@@ -199,7 +199,7 @@ Roles Terraform grants to the **apply SA**:
 | `roles/iam.serviceAccountUser` | Attach the node SA to node-pool VMs |
 | `roles/gkehub.gatewayEditor` + `roles/gkehub.viewer` | Reach the control plane via Connect Gateway; refresh the fleet membership |
 
-The **plan SA** receives read-only equivalents: custom `socketFirewallTfPlanReader`, `roles/container.viewer`, `roles/certificatemanager.viewer`, and `roles/gkehub.gatewayReader`.
+The **plan SA** receives read-only equivalents: custom `socketFirewallTfPlanReader`, `roles/container.viewer`, `roles/certificatemanager.viewer`, and `roles/gkehub.gatewayReader`. Because `container.viewer` maps to the `view` ClusterRole (which excludes secrets), a namespace-scoped Kubernetes `Role`/`RoleBinding` in [`kubernetes_rbac.tf`](terraform/kubernetes_rbac.tf) also grants `secrets` get/list/watch in `socket-firewall` for `terraform plan`.
 
 Because Terraform creates these custom roles and bindings on the first apply, the bootstrap identity (a project admin) must first grant the apply SA enough elevated access to perform that initial run, then tighten it:
 
diff --git a/terraform/iam.tf b/terraform/iam.tf
index b210bc0..3e8f277 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -363,7 +363,8 @@ resource "google_project_iam_member" "tf_plan_sa_reader" {
 }
 
 # Kubernetes API read access for the helm/kubernetes/kubectl providers during plan.
-# roles/container.viewer maps to the "view" RBAC ClusterRole in GKE.
+# roles/container.viewer maps to the "view" RBAC ClusterRole in GKE, which omits
+# secrets — see kubernetes_rbac.tf for the namespace-scoped secret read binding.
 resource "google_project_iam_member" "tf_plan_sa_k8s_viewer" {
   project = var.project_id
   role    = "roles/container.viewer"
diff --git a/terraform/kubernetes_rbac.tf b/terraform/kubernetes_rbac.tf
new file mode 100644
index 0000000..1edc897
--- /dev/null
+++ b/terraform/kubernetes_rbac.tf
@@ -0,0 +1,40 @@
+# ---------------------------------------------------------------------------
+# Supplemental Kubernetes RBAC for the plan SA
+# ---------------------------------------------------------------------------
+# roles/container.viewer maps to the predefined "view" ClusterRole, which
+# deliberately omits secrets. Terraform plan still refreshes
+# kubernetes_secret.socket_api_token (helm.tf), which calls the Kubernetes API
+# secrets.get endpoint. Grant read-only secret access in this namespace only.
+# ---------------------------------------------------------------------------
+
+resource "kubernetes_role" "tf_plan_secret_reader" {
+  metadata {
+    name      = "terraform-plan-secret-reader"
+    namespace = kubernetes_namespace.socket_firewall.metadata[0].name
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["secrets"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_role_binding" "tf_plan_secret_reader" {
+  metadata {
+    name      = "terraform-plan-secret-reader"
+    namespace = kubernetes_namespace.socket_firewall.metadata[0].name
+  }
+
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = kubernetes_role.tf_plan_secret_reader.metadata[0].name
+  }
+
+  subject {
+    kind      = "User"
+    name      = var.terraformer_plan
+    api_group = "rbac.authorization.k8s.io"
+  }
+}

From 7f3dcf4b01625f40d77811e82b3722d9cb29d3a7 Mon Sep 17 00:00:00 2001
From: jeffreyhung <17494876+Jeffreyhung@users.noreply.github.com>
Date: Wed, 17 Jun 2026 09:31:04 -0700
Subject: [PATCH 5/5] control versions solely in terraform.vars

---
 .../workflows/check-firewall-versions.yaml    | 25 +++++++++----------
 terraform/variables.tf                        |  2 --
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/check-firewall-versions.yaml b/.github/workflows/check-firewall-versions.yaml
index 35633d0..a7fe36c 100644
--- a/.github/workflows/check-firewall-versions.yaml
+++ b/.github/workflows/check-firewall-versions.yaml
@@ -29,30 +29,30 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          TF=terraform/variables.tf
+          TF=terraform/terraform.tfvars
 
-          read_default() {
+          read_tfvar() {
             local val
-            val=$(sed -n "/variable \"$1\"/,/}/p" "$TF" \
-              | grep -E '^\s+default\s*=' | head -1 \
-              | sed -E 's/.*"([^"]+)".*/\1/' || true)
+            val=$(grep -E "^[[:space:]]*$1[[:space:]]*=" "$TF" \
+              | head -1 \
+              | sed -E 's/.*=[[:space:]]*"([^"]+)".*/\1/' || true)
             if [ -z "$val" ]; then
-              echo "::error::variable \"$1\" not found or has no default in $TF" >&2
+              echo "::error::$1 not found in $TF" >&2
               exit 1
             fi
             echo "$val"
           }
 
-          set_default() {
-            sed -i "/variable \"$1\"/,/}/ s/default *= *\"[^\"]*\"/default     = \"$2\"/" "$TF"
+          set_tfvar() {
+            sed -i -E "s/^([[:space:]]*$1[[:space:]]*=[[:space:]]*)\"[^\"]*\"/\1\"$2\"/" "$TF"
           }
 
           newer_than() {
             [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -1)" = "$2" ] && [ "$1" != "$2" ]
           }
 
-          current_chart=$(read_default helm_chart_version)
-          current_image=$(read_default firewall_image_tag)
+          current_chart=$(read_tfvar helm_chart_version)
+          current_image=$(read_tfvar firewall_image_tag)
 
           latest_chart=$(curl -fsSL https://socketdev-demo.github.io/socket-firewall-helm/index.yaml \
             | grep -E '^\s+version:' | awk '{print $2}' | sort -V | tail -1)
@@ -71,11 +71,11 @@ jobs:
 
           summary=""
           if newer_than "$current_chart" "$latest_chart"; then
-            set_default helm_chart_version "$latest_chart"
+            set_tfvar helm_chart_version "$latest_chart"
             summary+="- \`helm_chart_version\`: \`$current_chart\` → \`$latest_chart\`"$'\n'
           fi
           if newer_than "$current_image" "$latest_image"; then
-            set_default firewall_image_tag "$latest_image"
+            set_tfvar firewall_image_tag "$latest_image"
             summary+="- \`firewall_image_tag\`: \`$current_image\` → \`$latest_image\`"$'\n'
           fi
 
@@ -106,7 +106,6 @@ jobs:
 
             ## Follow-up
             - Review the `terraform plan` check on this PR.
-            - If you override versions in `terraform/terraform.tfvars`, update those values to match before merging.
             - Confirm the new image is allowed by Binary Authorization before merging to `main`.
 
             Triggered by [check-firewall-versions](.github/workflows/check-firewall-versions.yaml).
diff --git a/terraform/variables.tf b/terraform/variables.tf
index a8866c4..507e98e 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -118,13 +118,11 @@ variable "firewall_domain" {
 variable "helm_chart_version" {
   description = "Version of the socket-firewall Helm chart"
   type        = string
-  default     = "0.3.0"
 }
 
 variable "firewall_image_tag" {
   description = "Container image tag for socketdev/socket-registry-firewall (pinned for reproducible rollouts; bumped by check-firewall-versions workflow)"
   type        = string
-  default     = "1.1.327"
 }
 
 variable "replica_count" {