pelican: migrate to envFrom with per-container InfisicalSecrets

Folds the pelican-config ConfigMap into Infisical so the container has a single envFrom. Pins imagePullPolicy to IfNotPresent because ghcr.io/pelican-dev/panel no longer allows anonymous pulls.

applications/pelican/pelican-configmap.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pelican-config
-  namespace: pelican
-data:
-  APP_NAME: Pelican
-  APP_URL: https://pelican.jsme.be
-  BEHIND_PROXY: "true"
-  ADMIN_EMAIL: jeffreysmeets@jsme.be
-  DB_CONNECTION: pgsql
-  DB_HOST: pelican-postgres
-  DB_PORT: "5432"
-  CACHE_STORE: redis
-  QUEUE_CONNECTION: redis
-  SESSION_DRIVER: redis
-  REDIS_HOST: pelican-redis
-  REDIS_PORT: "6379"
-  XDG_DATA_HOME: /pelican-data
-  AWS_USE_PATH_STYLE_ENDPOINT: "true"

applications/pelican/pelican/deployment.yaml

@@ -20,6 +20,7 @@ spec:
       containers:
         - name: pelican
           image: ghcr.io/pelican-dev/panel:latest
+          imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
           resources:
@@ -30,24 +31,8 @@ spec:
               cpu: 1000m
               memory: 1Gi
           envFrom:
-            - configMapRef:
+            - secretRef:
-                name: pelican-config
+                name: pelican-app-secrets
-          env:
-            - name: DB_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_USERNAME
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_PASSWORD
-            - name: DB_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_DATABASE
           volumeMounts:
             - name: pelican-data
               mountPath: /pelican-data

applications/pelican/pelican/infisicalsecret.yaml

@@ -1,7 +1,7 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: pelican-secrets
+  name: pelican-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/pelican"
+        secretsPath: "/pelican/pelican"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: pelican-secrets
+    secretName: pelican-app-secrets
     secretNamespace: pelican
     secretType: Opaque

applications/pelican/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: pelican-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/pelican/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: pelican-postgres-secrets
+    secretNamespace: pelican
+    secretType: Opaque

applications/pelican/postgres/statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: pelican-postgres-data
               mountPath: /var/lib/postgresql/data
-          env:
+          envFrom:
-            - name: PGDATA
+            - secretRef:
-              value: /var/lib/postgresql/data/pgdata
+                name: pelican-postgres-secrets
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_USERNAME
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_DATABASE
       volumes:
         - name: pelican-postgres-data
           persistentVolumeClaim: