Generate a Mermaid diagram showing the full infrastructure and deployment flow for the payment application. Note: Mermaid does not support `\n` inside node labels — use `
` for line breaks within labels. Cluster: single OpenShift cluster — 5 worker nodes, 16 vCPU and 64 GB RAM each. Two namespaces: bob-demo-staging and bob-demo-prod. Image registry: OpenShift internal image registry (image-registry.openshift-image-registry.svc:5000). The diagram should show: Infrastructure layer (Terraform): - Both namespaces on the same cluster - Per namespace: ResourceQuota, NetworkPolicy, ServiceAccount - Per namespace: PostgreSQL Deployment + ClusterIP Service (port 5432, internal only) + PersistentVolumeClaim (5Gi) - NetworkPolicy rules: payment-service → postgres-service on port 5432 allowed, all other ingress/egress denied by default Configuration layer (Ansible): - PostgreSQL credentials Secret injected per namespace - ConfigMap for app configuration - PostgreSQL readiness wait before pre-flight health check CI/CD and deployment flow: - CI builds image → pushes to OpenShift internal registry under bob-demo-staging - CD auto-deploys payment-service to bob-demo-staging → connects to postgres-service in same namespace - Image promoted via oc tag within internal registry to bob-demo-prod - Manual approval gates production deployment - payment-service in bob-demo-prod connects to its own postgres-service Output the diagram as a .md file: payment-app-java17/infra/IaCArchitecture.md Once the file is saved, display the Mermaid diagram directly in the chat so we can see it immediately.

Based on the IaC architecture diagram in payment-app-java17/infra/IaCArchitecture.md, generate a complete Terraform configuration to provision the OpenShift environment and GitHub Actions secrets for the payment application. ## Infrastructure Overview **Cluster**: Single OpenShift cluster — 5 worker nodes, each with 16 vCPU and 64 GB RAM (80 vCPU / 320 GB RAM total) **Namespaces**: bob-demo-staging and bob-demo-prod ## Output Files All files under payment-app-java17/infra/terraform/: ### 1. provider.tf — Provider configuration - Kubernetes/OpenShift provider (hashicorp/kubernetes ~> 2.27) - GitHub provider (integrations/github ~> 6.0) - Null provider for local-exec provisioners ### 2. variables.tf — Input variables - OpenShift: cluster URL, token - GitHub: token, owner, repository - Namespaces: staging/prod names (defaults: bob-demo-staging, bob-demo-prod) - ResourceQuota settings - PostgreSQL configuration - All sensitive values with no defaults (must be supplied via TF_VAR_* at runtime) ### 3. main.tf — OpenShift infrastructure Provision for **each namespace** (staging and prod): - **Namespace** with labels and annotations - **ResourceQuota**: - requests.cpu: 4, limits.cpu: 8 - requests.memory: 8Gi, limits.memory: 16Gi - **NetworkPolicy**: - Default-deny all ingress/egress - Allow ingress to payment-service from within namespace only - Allow payment-service to connect to postgres-service on port 5432 - **ServiceAccount** — payment-service-sa with least-privilege RBAC (Role + RoleBinding) - **PostgreSQL** (separate instance per namespace, no sharing): - PersistentVolumeClaim — 5Gi storage - Deployment — postgres:15, single replica, resource limits (1 CPU, 2Gi memory) - Service — postgres-service on port 5432 (ClusterIP, internal only) ### 4. github-secrets.tf — GitHub Actions secrets Provision five secrets for CI/CD pipeline: - OPENSHIFT_SERVER — OpenShift cluster API URL - OPENSHIFT_TOKEN — Service account token for authentication - OPENSHIFT_REGISTRY — Internal registry URL (from: oc get route default-route -n openshift-image-registry --template='{{ .spec.host }}') - NAMESPACE_STAGING — bob-demo-staging - NAMESPACE_PROD — bob-demo-prod All values read from environment variables (TF_VAR_* prefix). ### 5. outputs.tf — Output values - Namespace names (staging/prod) - Cluster endpoint - PostgreSQL service endpoints (staging/prod) - PostgreSQL ClusterIPs - ServiceAccount names - PVC names - GitHub secrets status (optional) ### 6. .env.example — Environment variable template Document all required TF_VAR_* variables with descriptions: - TF_VAR_cluster_url — OpenShift API server URL - TF_VAR_cluster_token — Service account token - TF_VAR_github_token — GitHub PAT with repo scope - TF_VAR_github_owner — GitHub organization or user - TF_VAR_github_repository — Repository name - TF_VAR_openshift_server — OpenShift cluster API URL (for GitHub secrets) - TF_VAR_openshift_token — Service account token (for GitHub secrets) - TF_VAR_openshift_registry — Internal registry URL ## Requirements - Use placeholder values for all sensitive data — supplied via environment variables at runtime - No hardcoded secrets in .tf files - Separate PostgreSQL instance per namespace (no sharing between staging and prod) - Single Terraform workspace manages both OpenShift infrastructure and GitHub secrets - Do not apply or run any Terraform commands

Based on the IaC architecture diagram in payment-app-java17/infra/IaCArchitecture.md, generate an Ansible playbook to configure the OpenShift environment after Terraform provisioning. Single cluster, two namespaces: bob-demo-staging and bob-demo-prod. Each namespace has its own PostgreSQL instance provisioned by Terraform. Output all files under payment-app-java17/infra/ansible/: 1. playbook.yml — main playbook targeting both namespaces 2. inventory/hosts.yml — single OpenShift cluster inventory 3. roles/payment-app/tasks/main.yml — configuration tasks for each namespace: - Create Kubernetes Secret for PostgreSQL credentials: DB_URL: jdbc:postgresql://postgres-service:5432/paymentdb DB_USER: payment_user DB_PASSWORD: - Create ConfigMap for application configuration - Verify service account permissions - Wait for PostgreSQL pod to be ready before proceeding - Run a pre-flight health check to confirm namespace is ready for deployment Note: No image pull secret needed — OpenShift internal registry automatically grants pull access to the default service account within the same namespace. Use placeholder values for all credentials. Do not run the playbook.