feat(secrets): replace config maps with secrets for sensitive configurations in multiple modules

terraform/modules/apps/mail/getmail.tf

@@ -1,10 +1,11 @@
-resource "kubernetes_config_map" "getmail_config" {
+resource "kubernetes_secret" "getmail_config" {
   metadata {
     name      = "getmail-config"
     namespace = kubernetes_namespace.mail.metadata[0].name
   }
 
   data = local.getmail_config
+  type = "Opaque"
 }
 
 resource "kubernetes_cron_job_v1" "fetch_emails" {
@@ -60,8 +61,16 @@ resource "kubernetes_cron_job_v1" "fetch_emails" {
 
             volume {
               name = "getmail-config"
-              config_map {
-                name = "getmail-config"
+              secret {
+                secret_name = kubernetes_secret.getmail_config.metadata[0].name
+                dynamic "items" {
+                  for_each = local.getmail_jobs
+                  content {
+                    key  = "getmailrc_${items.value.name}"
+                    path = "getmailrc_${items.value.name}"
+                  }
+
+                }
               }
             }
 

terraform/modules/apps/mail/resources/postfix/run.config

@@ -26,6 +26,9 @@ postconf -e "mydestination=$MY_DESTINATION"
 postconf -e "relayhost=[$SMTP_HOST]:$SMTP_PORT"
 postconf -e "smtp_sasl_auth_enable=yes"
 postconf -e "smtp_sasl_password_maps=static:$SMTP_USER:$SMTP_PASSWORD"
+# clear the password from memory
+unset SMTP_USER
+unset SMTP_PASSWORD
 postconf -e "smtp_sasl_security_options=noanonymous"
 postconf -e "smtp_tls_security_level=encrypt"
 postconf -e "smtp_use_tls=yes"