argoyle
b98ec2b96a
Part of the dancefinder.unbound.se cutover to Frostmoln Production (infra: unboundsoftware/infra#1896, already applied). - Replaces the AWS `deploy-prod` job (failing since CI left AWS) with `deploy-prod-frostmoln` (`deploy prod-frostmoln -n dancefinder`), as schemas did. - Restricted securityContext (runAsNonRoot, drop ALL, seccomp RuntimeDefault) and `imagePullSecrets: oci-registry` (Platform registry). - Listens on 8080 (`PORT`) as uid 65534. MAPS_API_KEY comes from the namespace's SecretStore (Frostmoln Secret `dancefinder`). Merging deploys to Frostmoln only; DNS still points at AWS until the cutover. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01H6eVuR4Yt3m7TbDTDwyZJi Reviewed-on: https://gitea.unbound.se/dancefinder/geo-service/pulls/417
22 lines
555 B
YAML
22 lines
555 B
YAML
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: geo-service
|
|
spec:
|
|
refreshInterval: 1h
|
|
# The namespace's store (infra frostmoln/production/apps.tf); MAPS_API_KEY
|
|
# lives in the Frostmoln Secret "dancefinder", next to the API's settings
|
|
# (infra frostmoln/production/scripts/seed-app.sh).
|
|
secretStoreRef:
|
|
name: frostmoln
|
|
kind: SecretStore
|
|
target:
|
|
name: geo-service
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
MAPS_API_KEY: "{{ .MAPS_API_KEY }}"
|
|
dataFrom:
|
|
- extract:
|
|
key: dancefinder
|