feat(secrets): replace config maps with secrets for sensitive configurations in multiple modules

terraform/modules/apps/gitea/main.tf

@@ -33,7 +33,7 @@ resource "kubernetes_manifest" "internal_cert" {
   }
 }
 
-resource "kubernetes_config_map" "gitea_config" {
+resource "kubernetes_secret" "gitea_config" {
   metadata {
     name      = "gitea-config"
     namespace = kubernetes_namespace.gitea.metadata[0].name
@@ -41,6 +41,7 @@ resource "kubernetes_config_map" "gitea_config" {
   data = {
     "app.ini" = local.config
   }
+  type = "Opaque"
 }
 
 
@@ -157,8 +158,12 @@ resource "kubernetes_deployment" "gitea" {
         }
         volume {
           name = "gitea-config"
-          config_map {
+          secret {
-            name = kubernetes_config_map.gitea_config.metadata[0].name
+            secret_name = kubernetes_secret.gitea_config.metadata[0].name
+            items {
+              key  = "app.ini"
+              path = "app.ini"
+            }
           }
         }
         dynamic "volume" {

terraform/modules/apps/m3uproxy/main.tf

@@ -32,7 +32,7 @@ resource "kubernetes_service_account" "m3uproxy_service_account" {
   automount_service_account_token = false
 }
 
-resource "kubernetes_config_map" "m3uproxy_config" {
+resource "kubernetes_secret" "m3uproxy_config" {
   metadata {
     name      = "m3uproxy-config"
     namespace = kubernetes_namespace.m3uproxy.metadata[0].name
@@ -40,8 +40,21 @@ resource "kubernetes_config_map" "m3uproxy_config" {
 
   data = {
     "m3uproxy.json" = local.m3uproxy_config
-    "playlist.json" = local.m3uproxy_playlist
   }
+
+  type = "Opaque"
+}
+
+resource "kubernetes_config_map" "m3uproxy_playlist" {
+  metadata {
+    name      = "m3uproxy-playlist"
+    namespace = kubernetes_namespace.m3uproxy.metadata[0].name
+  }
+
+  data = {
+    "playlist.m3u8" = local.m3uproxy_playlist
+  }
+
 }
 
 resource "kubernetes_deployment" "m3uproxy" {
@@ -73,16 +86,12 @@ resource "kubernetes_deployment" "m3uproxy" {
           "checksum/playlist" = local.m3uproxy_playlist_checksum
         }
       }
-
       spec {
         service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
-
-
         container {
           name              = "m3uproxy"
           image             = "a13labs/m3uproxy:${local.m3uproxy_version}"
           image_pull_policy = "Always"
-
           resources {
             requests = {
               memory = "256Mi"
@@ -93,7 +102,6 @@ resource "kubernetes_deployment" "m3uproxy" {
             container_port = 8080
             name           = "http"
           }
-
           readiness_probe {
             http_get {
               path = "/health"
@@ -103,7 +111,6 @@ resource "kubernetes_deployment" "m3uproxy" {
             period_seconds        = 10
             failure_threshold     = 10
           }
-
           env {
             name = "USERNAME"
             value_from {
@@ -113,7 +120,6 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
-
           env {
             name = "PASSWORD"
             value_from {
@@ -123,35 +129,51 @@ resource "kubernetes_deployment" "m3uproxy" {
               }
             }
           }
-
           security_context {
             allow_privilege_escalation = false
             run_as_user                = 1000
             run_as_group               = 1000
           }
-
           volume_mount {
             name       = "m3uproxy-config"
-            mount_path = "/app/conf"
+            mount_path = "/app/conf/m3uproxy.json"
+            sub_path   = "m3uproxy.json"
+            read_only  = true
+          }
+          volume_mount {
+            name       = "m3uproxy-playlist"
+            mount_path = "/app/conf/playlist.m3u8"
+            sub_path   = "playlist.m3u8"
             read_only  = true
           }
-
           volume_mount {
             name       = "m3uproxy-app-cache"
             mount_path = "/app/cache"
           }
-
           volume_mount {
             name       = "geoip-db"
             mount_path = "/app/GeoIP"
             read_only  = true
           }
         }
-
         volume {
           name = "m3uproxy-config"
+          secret {
+            secret_name = kubernetes_secret.m3uproxy_config.metadata[0].name
+            items {
+              key  = "m3uproxy.json"
+              path = "m3uproxy.json"
+            }
+          }
+        }
+        volume {
+          name = "m3uproxy-playlist"
           config_map {
-            name = kubernetes_config_map.m3uproxy_config.metadata[0].name
+            name = kubernetes_config_map.m3uproxy_playlist.metadata[0].name
+            items {
+              key  = "playlist.m3u8"
+              path = "playlist.m3u8"
+            }
           }
         }
 

terraform/modules/apps/mail/getmail.tf

@@ -1,10 +1,11 @@
-resource "kubernetes_config_map" "getmail_config" {
+resource "kubernetes_secret" "getmail_config" {
   metadata {
     name      = "getmail-config"
     namespace = kubernetes_namespace.mail.metadata[0].name
   }
 
   data = local.getmail_config
+  type = "Opaque"
 }
 
 resource "kubernetes_cron_job_v1" "fetch_emails" {
@@ -60,8 +61,16 @@ resource "kubernetes_cron_job_v1" "fetch_emails" {
 
             volume {
               name = "getmail-config"
-              config_map {
+              secret {
-                name = "getmail-config"
+                secret_name = kubernetes_secret.getmail_config.metadata[0].name
+                dynamic "items" {
+                  for_each = local.getmail_jobs
+                  content {
+                    key  = "getmailrc_${items.value.name}"
+                    path = "getmailrc_${items.value.name}"
+                  }
+
+                }
               }
             }
 

terraform/modules/apps/mail/resources/postfix/run.config

@@ -26,6 +26,9 @@ postconf -e "mydestination=$MY_DESTINATION"
 postconf -e "relayhost=[$SMTP_HOST]:$SMTP_PORT"
 postconf -e "smtp_sasl_auth_enable=yes"
 postconf -e "smtp_sasl_password_maps=static:$SMTP_USER:$SMTP_PASSWORD"
+# clear the password from memory
+unset SMTP_USER
+unset SMTP_PASSWORD
 postconf -e "smtp_sasl_security_options=noanonymous"
 postconf -e "smtp_tls_security_level=encrypt"
 postconf -e "smtp_use_tls=yes"

terraform/modules/apps/sftpgo/main.tf

@@ -49,7 +49,7 @@ resource "kubernetes_secret" "admin_credentials" {
   type = "Opaque"
 }
 
-resource "kubernetes_config_map" "object_store_credentials" {
+resource "kubernetes_secret" "object_store_credentials" {
   metadata {
     name      = "nextcloud-object-store-credentials"
     namespace = kubernetes_namespace.sftpgo.metadata[0].name
@@ -57,6 +57,7 @@ resource "kubernetes_config_map" "object_store_credentials" {
   data = {
     "credentials" = local.credentials
   }
+  type = "Opaque"
 }
 
 resource "kubernetes_service_account" "sftpgo" {
@@ -217,8 +218,12 @@ resource "kubernetes_deployment" "sftpgo" {
         }
         volume {
           name = "object-store-credentials"
-          config_map {
+          secret {
-            name = kubernetes_config_map.object_store_credentials.metadata[0].name
+            secret_name = kubernetes_secret.object_store_credentials.metadata[0].name
+            items {
+              key  = "credentials"
+              path = "credentials"
+            }
           }
         }
         dynamic "volume" {