From fbe1f7614e721b85c30b3bc5f4cd43d27a8dd711 Mon Sep 17 00:00:00 2001
From: Nick Lathe <nick.lathe@code.org>
Date: Thu, 6 Aug 2026 09:33:46 -0700
Subject: [PATCH] Allow db creds declared in Cfn to be secrets

Signed-off-by: Nick Lathe <nick.lathe@code.org>
---
 .../charts/eso-per-env/templates/_envtype.tpl | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/apps/infra/charts/eso-per-env/templates/_envtype.tpl b/apps/infra/charts/eso-per-env/templates/_envtype.tpl
index 9573ff6c..650b198d 100644
--- a/apps/infra/charts/eso-per-env/templates/_envtype.tpl
+++ b/apps/infra/charts/eso-per-env/templates/_envtype.tpl
@@ -89,6 +89,32 @@ spec:
         - regexp:
             source: {{ printf "^%s/cdo/(.*)$" .environment_type | quote }}
             target: "$1"
+    #==========================================================================
+    # CloudFormation-provisioned DB endpoints and credentials.
+    #
+    # dashboard declares these as !StackSecret (code-dot-org config.yml.erb),
+    # which resolves by reading the EC2 instance's aws:cloudformation:stack-name
+    # tag. There is no EC2 instance in Kubernetes, so that resolution cannot
+    # work; syncing the secrets here instead means pods read them as CDO_* env
+    # vars and never call Secrets Manager at boot.
+    #
+    # Only single-namespace env types get this. Adhoc deployments have one
+    # CloudFormation stack per adhoc, so there is no CfnStack/adhoc/* path, and
+    # the multi-namespace IAM policy does not grant one.
+    #
+    # NOTE: dataFrom entries merge in order, so a key present under both paths
+    # would take its value from this second entry. The two sets are disjoint
+    # today (<env>/cdo/* holds mysql:// URLs, CfnStack/<env>/* holds hostnames,
+    # ports, and RDS-Proxy-format credential JSON).
+    #==========================================================================
+    - find:
+        path: {{ printf "CfnStack/%s/" .environment_type | quote }}
+        name:
+          regexp: {{ printf "^CfnStack/%s/.*$" .environment_type | quote }}
+      rewrite:
+        - regexp:
+            source: {{ printf "^CfnStack/%s/(.*)$" .environment_type | quote }}
+            target: "$1"
 {{- else }}
 #==============================================================================
 # ClusterExternalSecret fanout for multi-namespace env types like adhoc-*