feat: decrypt secrets at deploy time and create K8s Secrets directly (#5233)

* feat: decrypt secrets at deploy time and create K8s Secrets directly

Replace the Preflight webhook + Inject binary secret injection pipeline
with direct K8s Secret creation at deploy time. Krane now:

- Decrypts encrypted env vars via Vault during ApplyDeployment
- Creates a K8s Secret per deployment with plaintext env vars
- Mounts secrets via envFrom.secretRef (resolved by kubelet)
- Creates per-deployment RBAC (ServiceAccount + Role + RoleBinding)
- Creates a dockerconfigjson pull secret per namespace for Depot auth
- Sets AutomountServiceAccountToken: false on all customer pods
- Drops the Command field (image ENTRYPOINT/CMD runs natively)
- Removes the Inject label (webhook no longer needed)
- Cleans up Secret/SA/Role/RoleBinding on deployment deletion

The legacy SecretsService RPC is kept temporarily for backwards compat.

* cleanup: remove preflight, inject, and secrets provider (#5235)

Delete the entire preflight mutating webhook service, the inject binary
(PID 1 sidecar), and the secrets provider package. These are replaced by
Krane's deploy-time secret decryption and direct K8s Secret creation.

Removed:
- svc/preflight/ (webhook, mutator, registry credentials, cleanup loop)
- cmd/preflight/ (CLI command)
- cmd/inject/ (sidecar binary + Dockerfile)
- pkg/secrets/provider/ (KraneVaultProvider, only used by inject)
- dev/ local setup (Tiltfile, manifests, Dockerfile.inject)
- .github/workflows/release_inject.yaml
- docs/engineering/architecture/services/preflight/

Updated:
- dev/k8s/manifests/rbac.yaml (new RBAC for secrets/SA/roles)
- dev/k8s/manifests/cilium-policies.yaml (removed customer→krane policy)
- dev/k8s/manifests/vector-logs.yaml (updated comment)
- .goreleaser.yaml (removed inject tag ignore)

* cleanup

* fix rabbit comments

* fix rabbit comments

* fix rabbit comments

---------

Co-authored-by: Andreas Thomas <dev@chronark.com>

Author: Flo4604

.github/workflows/release_inject.yaml

@@ -11,10 +11,6 @@ version: 2
 partial:
   by: goos
 
-git:
-  ignore_tags:
-    - "inject/*"
-
 before:
   hooks:
     # You may remove this if you don't use go modules.

.goreleaser.yaml

@@ -102,7 +102,7 @@ clean-docker-test: ## Clean up dangling test containers
 
 .PHONY: tunnel
 tunnel: ## Forward ports 80/443 to frontline for *.unkey.local (run in separate terminal)
-	@sudo kubectl port-forward -n unkey svc/frontline 443:443 80:80
+	@sudo -v && while true; do sudo kubectl port-forward -n unkey svc/frontline 443:443 80:80 2>/dev/null; echo "port-forward exited, reconnecting..."; sudo -v; sleep 1; done
 
 .PHONY: dev
 dev: ## Start dev environment

Makefile

@@ -2,7 +2,6 @@ version: v2
 
 modules:
   - path: svc/ctrl/proto
-  - path: svc/krane/proto
   - path: svc/vault/proto
   - path: proto
 deps: