chore: use vault for secrets

Author: mc-jones

Dockerfile

@@ -30,5 +30,5 @@ ARG COMMIT_HASH
 RUN test -n "$COMMIT_HASH" && \
   echo $COMMIT_HASH > COMMIT_HASH.txt
 
-ENTRYPOINT ["/usr/bin/dumb-init", "--"]
+ENTRYPOINT ["/usr/bin/dumb-init", "./scripts/load_secrets_and_run.sh"]
 CMD ["yarn", "start"]

hokusai/production.yml

@@ -28,14 +28,36 @@ spec:
         app.kubernetes.io/version: production
       name: positron-web
     spec:
+      initContainers:
+      - name: setenv
+        image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/fortress:production
+        imagePullPolicy: Always
+        command:
+        - python
+        - src/load/load.py
+        - kubernetes
+        - production
+        - positron
+        envFrom:
+        - configMapRef:
+            name: secrets-config
+        volumeMounts:
+        - name: secrets
+          mountPath: /secrets
       containers:
       - name: positron-web
         args:
         - yarn
         - production
         envFrom:
+        - configMapRef:
+            name: secrets-config
         - configMapRef:
             name: positron-environment
+        volumeMounts:
+        - name: secrets
+          mountPath: /secrets
+          readOnly: true
         env:
         - name: PORT
           value: '8080'
@@ -82,6 +104,7 @@ spec:
         options:
         - name: ndots
           value: '1'
+      serviceAccountName: positron
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -91,6 +114,9 @@ spec:
                 operator: In
                 values:
                 - foreground
+      volumes:
+      - name: secrets
+        emptyDir: {}
 ---
 apiVersion: autoscaling/v1
 kind: HorizontalPodAutoscaler
@@ -121,18 +147,41 @@ spec:
           annotations:
             cluster-autoscaler.kubernetes.io/safe-to-evict: 'false'
         spec:
+          initContainers:
+          - name: setenv
+            image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/fortress:production
+            imagePullPolicy: Always
+            command:
+            - python
+            - src/load/load.py
+            - kubernetes
+            - production
+            - positron
+            envFrom:
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
           containers:
           - name: positron-scheduled-posts-cron
             image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/positron:production
-            command:
+            args:
             - yarn
             - task
             - scripts/scheduled_posts.js
             imagePullPolicy: Always
             envFrom:
             - configMapRef:
                 name: positron-environment
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
+              readOnly: true
           restartPolicy: Never
+          serviceAccountName: positron
           affinity:
             nodeAffinity:
               requiredDuringSchedulingIgnoredDuringExecution:
@@ -142,6 +191,9 @@ spec:
                     operator: In
                     values:
                     - background
+          volumes:
+          - name: secrets
+            emptyDir: {}
 ---
 apiVersion: batch/v1
 kind: CronJob
@@ -158,18 +210,41 @@ spec:
           annotations:
             cluster-autoscaler.kubernetes.io/safe-to-evict: 'false'
         spec:
+          initContainers:
+          - name: setenv
+            image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/fortress:production
+            imagePullPolicy: Always
+            command:
+            - python
+            - src/load/load.py
+            - kubernetes
+            - production
+            - positron
+            envFrom:
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
           containers:
           - name: positron-unqueue-cron
             image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/positron:production
-            command:
+            args:
             - yarn
             - task
             - scripts/unqueue.js
             imagePullPolicy: Always
             envFrom:
             - configMapRef:
                 name: positron-environment
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
+              readOnly: true
           restartPolicy: Never
+          serviceAccountName: positron
           affinity:
             nodeAffinity:
               requiredDuringSchedulingIgnoredDuringExecution:
@@ -179,6 +254,9 @@ spec:
                     operator: In
                     values:
                     - background
+          volumes:
+          - name: secrets
+            emptyDir: {}
 ---
 apiVersion: batch/v1
 kind: CronJob
@@ -195,6 +273,22 @@ spec:
           annotations:
             cluster-autoscaler.kubernetes.io/safe-to-evict: 'false'
         spec:
+          initContainers:
+          - name: setenv
+            image: 585031190124.dkr.ecr.us-east-1.amazonaws.com/fortress:production
+            imagePullPolicy: Always
+            command:
+            - python
+            - src/load/load.py
+            - kubernetes
+            - production
+            - positron
+            envFrom:
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
           containers:
           - name: positron-data-export-cron
             image: artsy/mongo-data-sync
@@ -205,11 +299,18 @@ spec:
             envFrom:
             - configMapRef:
                 name: positron-environment
+            - configMapRef:
+                name: secrets-config
+            volumeMounts:
+            - name: secrets
+              mountPath: /secrets
+              readOnly: true
             args:
             - sh
             - ./export-db.sh
             - production
           restartPolicy: Never
+          serviceAccountName: positron
           affinity:
             nodeAffinity:
               requiredDuringSchedulingIgnoredDuringExecution:
@@ -219,6 +320,9 @@ spec:
                     operator: In
                     values:
                     - background
+          volumes:
+          - name: secrets
+            emptyDir: {}
 ---
 apiVersion: v1
 kind: Service