++

apps/rfi/base/backend-deployment.yaml

@@ -24,12 +24,12 @@ spec:
         vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/auth-path: auth/kubernetes
         vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi
+        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/notes/postgres/rfi
         vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/postgresql/apps/rfi" -}}
-          DB_HOST=postgresql.rfi.svc.cluster.local
-          DB_PORT=5432
-          DB_NAME=rfi_db
+          {{- with secret "secrets/data/apps/notes/postgres/rfi" -}}
+          DB_HOST={{ index .Data.data "host" }}
+          DB_PORT={{ index .Data.data "port" }}
+          DB_NAME={{ index .Data.data "database" }}
           DB_USER={{ index .Data.data "username" }}
           DB_PASSWORD={{ index .Data.data "password" }}
           {{- end -}}

apps/rfi/base/celery-deployment.yaml

@@ -24,12 +24,12 @@ spec:
         vault.hashicorp.com/agent-pre-populate-only: "true"
         vault.hashicorp.com/auth-path: auth/kubernetes
         vault.hashicorp.com/role: rfi
-        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/postgresql/apps/rfi
+        vault.hashicorp.com/agent-inject-secret-rfi-db: secrets/data/apps/notes/postgres/rfi
         vault.hashicorp.com/agent-inject-template-rfi-db: |-
-          {{- with secret "secrets/data/postgresql/apps/rfi" -}}
-          DB_HOST=postgresql.rfi.svc.cluster.local
-          DB_PORT=5432
-          DB_NAME=rfi_db
+          {{- with secret "secrets/data/apps/notes/postgres/rfi" -}}
+          DB_HOST={{ index .Data.data "host" }}
+          DB_PORT={{ index .Data.data "port" }}
+          DB_NAME={{ index .Data.data "database" }}
           DB_USER={{ index .Data.data "username" }}
           DB_PASSWORD={{ index .Data.data "password" }}
           {{- end -}}

apps/rfi/base/namespace.yaml

@@ -5,3 +5,4 @@ metadata:
   name: rfi
   labels:
     istio-injection: enabled
+    security.deckhouse.io/pod-policy: privileged

apps/rfi/d8-ugmk-prod/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: rfi
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: frontend

apps/rfi/d8-ugmk-prod/patch.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: rfi
+spec:
+  values:
+    services:
+      frontend:
+        deployment:
+          replicaCount:
+            _default: 1

clusters/d8-ugmk-prod/kustomization.yaml

@@ -24,3 +24,4 @@ resources:
   - ../../apps/auth-flow/d8-ugmk-prod
   - ../../apps/notes/d8-ugmk-prod
   - ../../apps/workspaces/d8-ugmk-prod
+  - ../../apps/rfi/d8-ugmk-prod