From 20f05584dc90cd9e3618f8f8cb6ca5c56e672783 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 6 Mar 2026 10:23:55 -0600
Subject: [PATCH] fix: use k8s secret for Stripe env vars instead of hardcoded
 values

- Changed from hardcoded placeholder values to secretKeyRef
- References towerops-billing secret (with optional: true)
- Won't crash if secret doesn't exist yet
- User can create secret later with real Stripe keys
---
 k8s/deployment.yaml | 36 ++++++++++++++++++++++++++++++------
 1 file changed, 30 insertions(+), 6 deletions(-)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index dccce38e..7d3fcabc 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -67,11 +67,23 @@ spec:
                   name: towerops-secrets
                   key: CLOAK_KEY
             - name: STRIPE_SECRET_KEY
-              value: "sk_test_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_SECRET_KEY
+                  optional: true
             - name: STRIPE_WEBHOOK_SECRET
-              value: "whsec_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_WEBHOOK_SECRET
+                  optional: true
             - name: STRIPE_PRICE_ID
-              value: "price_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_PRICE_ID
+                  optional: true
           envFrom:
             - secretRef:
                 name: towerops-db
@@ -160,11 +172,23 @@ spec:
             - name: DATABASE_SSL_VERIFY
               value: "false"
             - name: STRIPE_SECRET_KEY
-              value: "sk_test_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_SECRET_KEY
+                  optional: true
             - name: STRIPE_WEBHOOK_SECRET
-              value: "whsec_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_WEBHOOK_SECRET
+                  optional: true
             - name: STRIPE_PRICE_ID
-              value: "price_fake_placeholder"
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-billing
+                  key: STRIPE_PRICE_ID
+                  optional: true
           envFrom:
             # Redis connection configured via towerops-redis secret
             - secretRef: