feat(helm): migrate eRPC config from Vault into Helm charts (PLA-2003)

[rguichard]

Summary

Moves the eRPC non-secret configuration out of Vault and into the repo so config is transparent, snapshot-able, and PR-reviewed. Vault keeps secrets and feature flags only.

Linear: PLA-2003

Changes

• helm/environments/prd/erpc/config/erpc.yaml — the main instance's config, exported from Vault secret/data/erpc/config, with inline Redis/Postgres passwords replaced by __SECRET_REDIS_PASSWORD__ / __SECRET_POSTGRES_PASSWORD__ placeholders. API-key placeholders (__SECRET_PROVIDER_*__, etc.) unchanged.
• templates/configmap-erpc-config.yaml (prd env chart) — renders each config/*.yaml into a <basename>-config ConfigMap as a pre-install,pre-upgrade hook (weight 0, sync-wave -4) so it is updated before the vault-config-creator job (weight 1, sync-wave -3).
• erpc chart vault.configMapName (new, default "") — when set, the render job mounts the ConfigMap instead of Vault-injecting the config template. Secrets are still injected from vault.secretsPath and substituted into placeholders; the job still erpc validates the rendered config and fails hard on unresolved placeholders.
• Only the main prd instance is migrated (vault.configMapName: erpc-config). erpc-dev / erpc-fallback / erpc-processing / erpc-router keep their Vault config paths until their configs are exported the same way (migration steps documented in the chart README).
• Chart bumps: erpc 0.1.35 → 0.1.36, erpc-prd 0.1.40 → 0.1.41 (+ Chart.lock / vendored tgz).

⚠️ Deploy prerequisite

Add these keys to Vault secret/data/erpc/secrets before syncing, or the render job will fail (by design):

• REDIS_PASSWORD — password from the redis://default:<pwd>@erpc-redis-haproxy URIs
• POSTGRES_PASSWORD — password from the postgres://postgres:<pwd>@erpc-db-* URIs

Testing

• ./validate-helm-charts.sh — helm lint + kubeconform pass for both charts.
• helm template on the prd env chart: main instance job mounts the erpc-config ConfigMap and only injects erpc-secrets from Vault; the 4 other instances render unchanged (still inject their config-* Vault paths).
• config/erpc.yaml parses with anchors and !!merge keys intact (verified with yq).

[wiz-c998a0ef2b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	6
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	6

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.