move sensitive config from ConfigMap to Kubernetes Secrets

deploy_k8s.sh

@@ -149,8 +149,8 @@ deploy_vpc_agent() {
     # Create the namespace if it doesn't exist
     kubectl create namespace "$namespace" --dry-run=client -o yaml | kubectl apply -f -
 
-    # Apply configmap
-    kubectl apply -f configmap.yaml -n "$namespace"
+    # Apply credentials secret
+    kubectl apply -f credentials-secret.yaml -n "$namespace"
 
     # Create a values.override.yaml file to override the global API token
     cat <<EOF > values.override.yaml

helm/charts/celery_beat/templates/deployment.yaml

@@ -60,7 +60,10 @@ spec:
             - name: REDIS_URL
               value: "redis://redis-service:6379/0"
             - name: DRD_CLOUD_API_TOKEN
-              value: {{ .Values.global.DRD_CLOUD_API_TOKEN | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: drd-cloud-secret
+                  key: DRD_CLOUD_API_TOKEN
             - name: DRD_CLOUD_API_HOST
               value: {{ .Values.global.DRD_CLOUD_API_HOST | quote }}
             - name: NATIVE_KUBERNETES_API_MODE
@@ -102,5 +105,5 @@ spec:
             failureThreshold: 12
       volumes:
         - name: credentials-volume
-          configMap:
-            name: credentials-config
+          secret:
+            secretName: credentials-secret

helm/charts/celery_worker/templates/deployment.yaml

@@ -60,7 +60,10 @@ spec:
             - name: REDIS_URL
               value: "redis://redis-service:6379/0"
             - name: DRD_CLOUD_API_TOKEN
-              value: {{ .Values.global.DRD_CLOUD_API_TOKEN | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: drd-cloud-secret
+                  key: DRD_CLOUD_API_TOKEN
             - name: DRD_CLOUD_API_HOST
               value: {{ .Values.global.DRD_CLOUD_API_HOST | quote }}
             - name: NATIVE_KUBERNETES_API_MODE
@@ -119,7 +122,10 @@ spec:
             - name: REDIS_URL
               value: "redis://redis-service:6379/0"
             - name: DRD_CLOUD_API_TOKEN
-              value: {{ .Values.global.DRD_CLOUD_API_TOKEN | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: drd-cloud-secret
+                  key: DRD_CLOUD_API_TOKEN
             - name: DRD_CLOUD_API_HOST
               value: {{ .Values.global.DRD_CLOUD_API_HOST | quote }}
             - name: NATIVE_KUBERNETES_API_MODE
@@ -178,7 +184,10 @@ spec:
             - name: REDIS_URL
               value: "redis://redis-service:6379/0"
             - name: DRD_CLOUD_API_TOKEN
-              value: {{ .Values.global.DRD_CLOUD_API_TOKEN | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: drd-cloud-secret
+                  key: DRD_CLOUD_API_TOKEN
             - name: DRD_CLOUD_API_HOST
               value: {{ .Values.global.DRD_CLOUD_API_HOST | quote }}
             - name: NATIVE_KUBERNETES_API_MODE
@@ -225,5 +234,5 @@ spec:
 
       volumes:
         - name: credentials-volume
-          configMap:
-            name: credentials-config
+          secret:
+            secretName: credentials-secret

helm/credentials-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: credentials-secret
+  annotations:
+    meta.helm.sh/release-name: "{{ .Release.name }}"
+type: Opaque
+stringData:
+  secrets.yaml: |

helm/templates/drd-cloud-secret.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: drd-cloud-secret
+  labels:
+    app.kubernetes.io/managed-by: Helm
+  annotations:
+    meta.helm.sh/release-name: {{ .Release.Name }}
+    meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+type: Opaque
+stringData:
+  DRD_CLOUD_API_TOKEN: {{ .Values.global.DRD_CLOUD_API_TOKEN | quote }}

helm/values.yaml

@@ -24,14 +24,14 @@ global:
 # The network mapper provides service topology visibility and network insights
 # Default: enabled (recommended for full functionality)
 networkMapper:
-  enabled: false
+  enabled: true
 
 # Auto Update Configuration
 # Controls whether automatic deployment updates (restart cronjob) are enabled
 # When enabled, deployments are automatically restarted on schedule to pick up new images
 # Default: enabled (automatic updates for latest images)
 autoUpdate:
-  enabled: false
+  enabled: true
   schedule: "0 0 * * *"  # every day at 00:00 UTC
 
 celery-beat: