move api secrets from configmap to .env-backed k8s Secret

2026-06-03 10:32:33 -03:00
parent 2dad62f7e7
commit bd34c8c5ce
5 changed files with 35 additions and 19 deletions
--- a/ctrl/Tiltfile
+++ b/ctrl/Tiltfile
@@ -16,7 +16,10 @@ if k8s_context() != 'kind-nvi':

 local('kubectl --context kind-nvi create namespace nvi --dry-run=client -o yaml | kubectl --context kind-nvi apply -f -')

-k8s_yaml(kustomize('k8s/overlays/dev'))
+# --load-restrictor=LoadRestrictionsNone: secretGenerator reads ../../../.env
+# (repo root), which kustomize otherwise refuses for security. Safe here —
+# it's our own repo, the path is explicit, and the only reachable file is .env.
+k8s_yaml(kustomize('k8s/overlays/dev', flags=['--load-restrictor=LoadRestrictionsNone']))

 # --- Images ---