From f382c87f58aed53e9d64a37c96e676321fabf7be Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Sun, 23 Aug 2026 23:16:37 +0200 Subject: [PATCH] pelican: migrate to envFrom with per-container InfisicalSecrets Folds the pelican-config ConfigMap into Infisical so the container has a single envFrom. Pins imagePullPolicy to IfNotPresent because ghcr.io/pelican-dev/panel no longer allows anonymous pulls. --- applications/pelican/pelican-configmap.yaml | 20 --------------- .../deployment.yaml} | 21 +++------------- .../pelican/infisicalsecret.yaml} | 9 ++++--- .../persistentvolumeclaim.yaml} | 0 .../service.yaml} | 0 .../pelican/postgres/infisicalsecret.yaml | 25 +++++++++++++++++++ .../persistentvolumeclaim.yaml} | 0 .../service.yaml} | 0 .../statefulset.yaml} | 21 +++------------- .../deployment.yaml} | 0 .../service.yaml} | 0 11 files changed, 36 insertions(+), 60 deletions(-) delete mode 100644 applications/pelican/pelican-configmap.yaml rename applications/pelican/{pelican-deployment.yaml => pelican/deployment.yaml} (60%) rename applications/{infisical/Infisical-secrets/pelican-infisicalsecret.yaml => pelican/pelican/infisicalsecret.yaml} (72%) rename applications/pelican/{pelican-data-persistentvolumeclaim.yaml => pelican/persistentvolumeclaim.yaml} (100%) rename applications/pelican/{pelican-service.yaml => pelican/service.yaml} (100%) create mode 100644 applications/pelican/postgres/infisicalsecret.yaml rename applications/pelican/{pelican-postgres-persistentvolumeclaim.yaml => postgres/persistentvolumeclaim.yaml} (100%) rename applications/pelican/{pelican-postgres-service.yaml => postgres/service.yaml} (100%) rename applications/pelican/{pelican-postgres-statefulset.yaml => postgres/statefulset.yaml} (60%) rename applications/pelican/{pelican-redis-deployment.yaml => redis/deployment.yaml} (100%) rename applications/pelican/{pelican-redis-service.yaml => redis/service.yaml} (100%) diff --git a/applications/pelican/pelican-configmap.yaml b/applications/pelican/pelican-configmap.yaml deleted file mode 100644 index ff8639e..0000000 --- a/applications/pelican/pelican-configmap.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: pelican-config - namespace: pelican -data: - APP_NAME: Pelican - APP_URL: https://pelican.jsme.be - BEHIND_PROXY: "true" - ADMIN_EMAIL: jeffreysmeets@jsme.be - DB_CONNECTION: pgsql - DB_HOST: pelican-postgres - DB_PORT: "5432" - CACHE_STORE: redis - QUEUE_CONNECTION: redis - SESSION_DRIVER: redis - REDIS_HOST: pelican-redis - REDIS_PORT: "6379" - XDG_DATA_HOME: /pelican-data - AWS_USE_PATH_STYLE_ENDPOINT: "true" diff --git a/applications/pelican/pelican-deployment.yaml b/applications/pelican/pelican/deployment.yaml similarity index 60% rename from applications/pelican/pelican-deployment.yaml rename to applications/pelican/pelican/deployment.yaml index 255714c..ca71dbe 100644 --- a/applications/pelican/pelican-deployment.yaml +++ b/applications/pelican/pelican/deployment.yaml @@ -20,6 +20,7 @@ spec: containers: - name: pelican image: ghcr.io/pelican-dev/panel:latest + imagePullPolicy: IfNotPresent ports: - containerPort: 80 resources: @@ -30,24 +31,8 @@ spec: cpu: 1000m memory: 1Gi envFrom: - - configMapRef: - name: pelican-config - env: - - name: DB_USERNAME - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_USERNAME - - name: DB_PASSWORD - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_PASSWORD - - name: DB_DATABASE - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_DATABASE + - secretRef: + name: pelican-app-secrets volumeMounts: - name: pelican-data mountPath: /pelican-data diff --git a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml b/applications/pelican/pelican/infisicalsecret.yaml similarity index 72% rename from applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml rename to applications/pelican/pelican/infisicalsecret.yaml index ee589cd..881543f 100644 --- a/applications/infisical/Infisical-secrets/pelican-infisicalsecret.yaml +++ b/applications/pelican/pelican/infisicalsecret.yaml @@ -1,7 +1,7 @@ apiVersion: secrets.infisical.com/v1alpha1 kind: InfisicalSecret metadata: - name: pelican-secrets + name: pelican-app-secrets namespace: infisical spec: hostAPI: https://infisical.jsme.be @@ -16,9 +16,10 @@ spec: secretsScope: projectSlug: "kubernetes" envSlug: "prod" - secretsPath: "/pelican" - recursive: true + secretsPath: "/pelican/pelican" + # Non-recursive: keys are already named as the container expects. + recursive: false managedSecretReference: - secretName: pelican-secrets + secretName: pelican-app-secrets secretNamespace: pelican secretType: Opaque diff --git a/applications/pelican/pelican-data-persistentvolumeclaim.yaml b/applications/pelican/pelican/persistentvolumeclaim.yaml similarity index 100% rename from applications/pelican/pelican-data-persistentvolumeclaim.yaml rename to applications/pelican/pelican/persistentvolumeclaim.yaml diff --git a/applications/pelican/pelican-service.yaml b/applications/pelican/pelican/service.yaml similarity index 100% rename from applications/pelican/pelican-service.yaml rename to applications/pelican/pelican/service.yaml diff --git a/applications/pelican/postgres/infisicalsecret.yaml b/applications/pelican/postgres/infisicalsecret.yaml new file mode 100644 index 0000000..b3c9bcb --- /dev/null +++ b/applications/pelican/postgres/infisicalsecret.yaml @@ -0,0 +1,25 @@ +apiVersion: secrets.infisical.com/v1alpha1 +kind: InfisicalSecret +metadata: + name: pelican-postgres-secrets + namespace: infisical +spec: + hostAPI: https://infisical.jsme.be + resyncInterval: 30 + authentication: + kubernetesAuth: + identityId: "5458def7-7c63-40d2-95da-41c614d0933a" + serviceAccountRef: + name: infisical-auth + namespace: infisical + autoCreateServiceAccountToken: true + secretsScope: + projectSlug: "kubernetes" + envSlug: "prod" + secretsPath: "/pelican/postgres" + # Non-recursive: keys are already named as the container expects. + recursive: false + managedSecretReference: + secretName: pelican-postgres-secrets + secretNamespace: pelican + secretType: Opaque diff --git a/applications/pelican/pelican-postgres-persistentvolumeclaim.yaml b/applications/pelican/postgres/persistentvolumeclaim.yaml similarity index 100% rename from applications/pelican/pelican-postgres-persistentvolumeclaim.yaml rename to applications/pelican/postgres/persistentvolumeclaim.yaml diff --git a/applications/pelican/pelican-postgres-service.yaml b/applications/pelican/postgres/service.yaml similarity index 100% rename from applications/pelican/pelican-postgres-service.yaml rename to applications/pelican/postgres/service.yaml diff --git a/applications/pelican/pelican-postgres-statefulset.yaml b/applications/pelican/postgres/statefulset.yaml similarity index 60% rename from applications/pelican/pelican-postgres-statefulset.yaml rename to applications/pelican/postgres/statefulset.yaml index 8f77e0f..30d9c9d 100644 --- a/applications/pelican/pelican-postgres-statefulset.yaml +++ b/applications/pelican/postgres/statefulset.yaml @@ -31,24 +31,9 @@ spec: volumeMounts: - name: pelican-postgres-data mountPath: /var/lib/postgresql/data - env: - - name: PGDATA - value: /var/lib/postgresql/data/pgdata - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_USERNAME - - name: POSTGRES_PASSWORD - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_PASSWORD - - name: POSTGRES_DB - valueFrom: - secretKeyRef: - name: pelican-secrets - key: DB_DATABASE + envFrom: + - secretRef: + name: pelican-postgres-secrets volumes: - name: pelican-postgres-data persistentVolumeClaim: diff --git a/applications/pelican/pelican-redis-deployment.yaml b/applications/pelican/redis/deployment.yaml similarity index 100% rename from applications/pelican/pelican-redis-deployment.yaml rename to applications/pelican/redis/deployment.yaml diff --git a/applications/pelican/pelican-redis-service.yaml b/applications/pelican/redis/service.yaml similarity index 100% rename from applications/pelican/pelican-redis-service.yaml rename to applications/pelican/redis/service.yaml