[kyarijummai]

Summary

Use dedicated ServiceAccounts without auto-mounted API tokens

What was solved

#60 — Use a dedicated ServiceAccount with token automount disabled

Add dedicated ServiceAccounts for the backend and frontend with automountServiceAccountToken disabled, and wire the existing deployments to use them so pods no longer rely on the default ServiceAccount with an auto-mounted API token.

Addressed:

• Changed: k8s/backend-deployment.yaml, k8s/frontend-deployment.yaml, k8s/kustomization.yaml, k8s/frontend-deployment.yaml
• Create ServiceAccount resources for backend and frontend in k8s/ with automountServiceAccountToken: false
• Reference the new ServiceAccounts via serviceAccountName in k8s/backend-deployment.yaml and k8s/frontend-deployment.yaml
• Register the new ServiceAccount manifests in k8s/kustomization.yaml so they are applied

#61 — Restructure k8s/ into a Kustomize base with staging/production overlays

Restructure the flat k8s/ manifests into a Kustomize base plus staging and production overlays, moving environment-specific values (host, network/RPC, replicas, resources) into per-overlay patches, and update the deploy-k8s CI workflow and Kubernetes deployment docs to validate/render the new layout.

Addressed:

• Changed: k8s/ingress.yaml, k8s/configmap.yaml, .github/workflows/deploy-k8s.yml
• Create k8s/base containing the shared manifests (namespace, configmap, secrets, backend/frontend deployments, services, ingress) with a base kustomization.yaml
• Create k8s/overlays/staging and k8s/overlays/production, each with its own kustomization.yaml referencing ../../base
• Move environment-specific values into overlays: ingress host, network/RPC URL config, replica counts, and resource requests/limits

#62 — Parameterise the ingress host instead of app.example.com

Parameterise the Kubernetes ingress host, TLS secret, and ALLOWED_ORIGINS so they are no longer hardcoded to app.example.com placeholders. Use Kustomize overlay patches / a deploy-time variable (vars.DEPLOY_HOST) so the host is set at deploy time rather than hand-edited in k8s/ingress.yaml and k8s/configmap.yaml.

Addressed:

• Changed: k8s/ingress.yaml, k8s/configmap.yaml, k8s/kustomization.yaml
• Replace hardcoded app.example.com host in k8s/ingress.yaml with a parameterised value (e.g. Kustomize var/replacement or overlay patch driven by DEPLOY_HOST)
• Replace hardcoded TLS secret reference tied to the placeholder host with a parameterised value
• Replace hardcoded ALLOWED_ORIGINS placeholder in k8s/configmap.yaml with a value derived from the deploy host

#63 — Include the cert-manager ClusterIssuer manifest or document creating it

Add an example cert-manager ClusterIssuer manifest (HTTP-01 via nginx) for the letsencrypt-prod issuer referenced by k8s/ingress.yaml, and document the cert-manager prerequisites in docs/DEPLOY-KUBERNETES.md.

Addressed:

• Changed: k8s/kustomization.yaml, docs/DEPLOY-KUBERNETES.md
• Add an example ClusterIssuer manifest using HTTP-01 solver via nginx ingress, named letsencrypt-prod to match the ingress annotation
• Wire the new manifest into the kustomization so it is applied with the rest of the k8s resources
• Document cert-manager prerequisites (install cert-manager, nginx ingress controller, DNS/domain pointing to ingress) in docs/DEPLOY-KUBERNETES.md

Changes

• k8s/frontend-deployment.yaml (modify)
• k8s/backend-deployment.yaml (modify)
• k8s/kustomization.yaml (modify)
• .github/workflows/deploy-k8s.yml (modify)
• k8s/ingress.yaml (modify)
• docs/DEPLOY-KUBERNETES.md (modify)
• k8s/configmap.yaml (modify)

Approach

1. Use a dedicated ServiceAccount with token automount disabled #60 — Use a dedicated ServiceAccount with token automount disabled (Changed: k8s/backend-deployment.yaml, k8s/frontend-deployment.yaml, k8s/kustomization.yaml, k8s/frontend-deployment.yaml)
2. Restructure k8s/ into a Kustomize base with staging/production overlays #61 — Restructure k8s/ into a Kustomize base with staging/production overlays (Changed: k8s/ingress.yaml, k8s/configmap.yaml, .github/workflows/deploy-k8s.yml)
3. Parameterise the ingress host instead of app.example.com #62 — Parameterise the ingress host instead of app.example.com (Changed: k8s/ingress.yaml, k8s/configmap.yaml, k8s/kustomization.yaml)
4. Include the cert-manager ClusterIssuer manifest or document creating it #63 — Include the cert-manager ClusterIssuer manifest or document creating it (Changed: k8s/kustomization.yaml, docs/DEPLOY-KUBERNETES.md)

Issues

Closes #60
Closes #61
Closes #62
Closes #63

[drips-wave]

@kyarijummai Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits