infisical: migrate all InfisicalSecrets to Kubernetes auth; drop universal-auth secret

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -0,0 +1,28 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: crowdsec-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/crowdsec"
+        recursive: true
+  managedSecretReference:
+    secretName: crowdsec-secrets
+    secretNamespace: crowdsec
+    secretType: Opaque
+# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
+# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
+#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
+#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)