react-resume: migrate to envFrom with per-container InfisicalSecrets

Stores PRINTER_ENDPOINT pre-assembled instead of building it from CHROME_TOKEN via $() interpolation.
2026-08-23 23:47:13 +02:00
parent 3c24cd4b9d
commit 3e13b76c6a
6 changed files with 64 additions and 146 deletions
@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume/resume"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: resume-app-secrets
+    secretNamespace: resume
+    secretType: Opaque
@@ -27,108 +27,6 @@ spec:
            requests:
              cpu: "500m"
              memory: "1Gi"
-          env:
-            - name: TZ
-              value: Europe/Brussels
-            - name: NODE_ENV
-              value: production
-            - name: PORT
-              value: "3000"
-            - name: APP_URL
-              value: https://resume.jsme.be
-            - name: STORAGE_URL
-              value: https://s3.jsme.be/resume
-            - name: CHROME_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: chrome_token
-            - name: PRINTER_ENDPOINT
-              value: ws://chrome.resume.svc.cluster.local:3000?token=$(CHROME_TOKEN)
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_url
-            - name: AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: auth_secret
-            - name: OAUTH_PROVIDER_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_provider_name
-            - name: OAUTH_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_id
-            - name: OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_secret
-            - name: OAUTH_DISCOVERY_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_discovery_url
-            - name: SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_host
-            - name: SMTP_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_port
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_user
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_pass
-            - name: SMTP_FROM
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_from
-            - name: SMTP_SECURE
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_secure
-            - name: S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_access_key_id
-            - name: S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_secret_access_key
-            - name: S3_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_region
-            - name: S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_endpoint
-            - name: S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_bucket
-            - name: S3_FORCE_PATH_STYLE
-              value: "true"
+          envFrom:
+            - secretRef:
+                name: resume-app-secrets