react-resume: migrate to envFrom with per-container InfisicalSecrets

Stores PRINTER_ENDPOINT pre-assembled instead of building it from CHROME_TOKEN via $() interpolation.

applications/react-resume/chrome/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-chrome-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume/chrome"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: resume-chrome-secrets
+    secretNamespace: resume
+    secretType: Opaque

applications/react-resume/chrome/react-resume-chrome-deployment.yaml

@@ -20,24 +20,6 @@ spec:
         image: ghcr.io/browserless/chromium:latest
         ports:
         - containerPort: 3000
-        env:
+        envFrom:
-        - name: TIMEOUT
+          - secretRef:
-          value: "10000"
+              name: resume-chrome-secrets
-        - name: CONCURRENT
-          value: "10"
-        - name: TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: resume-secrets
-              key: chrome_token
-        - name: EXIT_ON_HEALTH_FAILURE
-          value: "true"
-        - name: PRE_REQUEST_HEALTH_CHECK
-          value: "true"
-        resources:
-          limits:
-            memory: "1Gi"
-            cpu: "500m"
-          requests:
-            memory: "512Mi" 
-            cpu: "250m"

applications/react-resume/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: resume-postgres-secrets
+    secretNamespace: resume
+    secretType: Opaque

applications/react-resume/postgres/react-resume-postgres-statefulset.yaml

@@ -30,22 +30,9 @@ spec:
           volumeMounts:
             - name: resume-postgresql-database
               mountPath: /var/lib/postgresql
-          env:
+          envFrom:
-            - name: POSTGRES_PASSWORD
+            - secretRef:
-              valueFrom:
+                name: resume-postgres-secrets
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_name
       volumes:
         - name: resume-postgresql-database
           persistentVolumeClaim:

applications/react-resume/resume/infisicalsecret.yaml

@@ -1,7 +1,7 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: resume-secrets
+  name: resume-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/reactive_resume"
+        secretsPath: "/reactive_resume/resume"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: resume-secrets
+    secretName: resume-app-secrets
     secretNamespace: resume
     secretType: Opaque

applications/react-resume/resume/react-resume-deployment.yaml

@@ -27,108 +27,6 @@ spec:
             requests:
               cpu: "500m"
               memory: "1Gi"
-          env:
+          envFrom:
-            - name: TZ
+            - secretRef:
-              value: Europe/Brussels
+                name: resume-app-secrets
-            - name: NODE_ENV
-              value: production
-            - name: PORT
-              value: "3000"
-            - name: APP_URL
-              value: https://resume.jsme.be
-            - name: STORAGE_URL
-              value: https://s3.jsme.be/resume
-            - name: CHROME_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: chrome_token
-            - name: PRINTER_ENDPOINT
-              value: ws://chrome.resume.svc.cluster.local:3000?token=$(CHROME_TOKEN)
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_url
-            - name: AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: auth_secret
-            - name: OAUTH_PROVIDER_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_provider_name
-            - name: OAUTH_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_id
-            - name: OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_secret
-            - name: OAUTH_DISCOVERY_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_discovery_url
-            - name: SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_host
-            - name: SMTP_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_port
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_user
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_pass
-            - name: SMTP_FROM
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_from
-            - name: SMTP_SECURE
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_secure
-            - name: S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_access_key_id
-            - name: S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_secret_access_key
-            - name: S3_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_region
-            - name: S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_endpoint
-            - name: S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_bucket
-            - name: S3_FORCE_PATH_STYLE
-              value: "true"