feat: deploy to Frostmoln production

The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se
context on the runners). Deploys now go to the Frostmoln production
cluster (namespace schemas), the way the sites do.

Frostmoln enforces restricted Pod Security: the pod runs as the image's
non-root user with a matching securityContext. The prod-only manifests
move to the prod-frostmoln target; the ALB ingress becomes a Traefik one
with a Let's Encrypt certificate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu

k8s/deploy.yaml

@@ -26,6 +26,11 @@ spec:
       labels:
         app.kubernetes.io/name: schemas
     spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        seccompProfile:
+          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -40,6 +45,10 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: schemas
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: "100m"

k8s/ingress-prod-frostmoln.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: "schemas.unbound.se"
+    http:
+      paths:
+      - path: /query
+        pathType: Prefix
+        backend:
+          service:
+            name: schemas
+            port:
+              name: api

k8s/ingress-prod.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-ingress
-  annotations:
-    alb.ingress.kubernetes.io/group.name: "default"
-    alb.ingress.kubernetes.io/scheme: internet-facing
-    alb.ingress.kubernetes.io/target-type: instance
-    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
-    alb.ingress.kubernetes.io/ssl-redirect: "443"
-    alb.ingress.kubernetes.io/healthcheck-path: '/health'
-spec:
-  ingressClassName: "alb"
-  rules:
-  - host: "schemas.unbound.se"
-    http:
-      paths:
-      - path: /query
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: schemas
-            port:
-              name: api

k8s/secrets-prod-frostmoln.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: schemas
+spec:
+  refreshInterval: 1h
+  # The namespace's store (infra frostmoln/production/schemas.tf); the
+  # Frostmoln Secret holds POSTGRES_URL, AMQP_URL and API_KEY
+  # (infra frostmoln/production/scripts/seed-schemas.sh).
+  secretStoreRef:
+    name: frostmoln
+    kind: SecretStore
+  target:
+    name: schemas
+  dataFrom:
+  - extract:
+      key: schemas

k8s/secrets.yaml

@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: schemas
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: external-secrets
-    kind: ClusterSecretStore
-  target:
-    creationPolicy: Owner
-    template:
-      mergePolicy: Merge
-      engineVersion: 'v2'
-      data:
-        POSTGRES_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_HOST }}:{{ .DB_PORT }}/schemas?sslmode=disable"
-        API_KEY: "{{ .API_KEY }}"
-  dataFrom:
-  - extract:
-      key: services/schemas
-  - extract:
-      key: rds/postgres/prod-psql
-  - extract:
-      key: mq/rabbit/prod