feat(flipt): add support for env valueFrom

flipt/schema/flipt/flipt.cue

@@ -7,7 +7,6 @@ import "strings"
 	//
 	// Flipt config file is a YAML file defining how to configure the
 	// Flipt application.
-	@jsonschema(schema="http://json-schema.org/draft/2019-09/schema#")
 	version?:        "1.0" | *"1.0"
 	experimental?:   #experimental
 	analytics:       #analytics
@@ -258,21 +257,23 @@ import "strings"
 		}
 	}
 
-	#db: {
+	#dbcommon: {
 		password?:                    string
 		max_idle_conn?:               int | *2
 		max_open_conn?:               int
 		conn_max_lifetime?:           =~#duration | int
 		prepared_statements_enabled?: bool | *true
-	} & ({
+	}
+
+	#db: *({
 		url?: string | *"file:/var/opt/flipt/flipt.db"
-	} | {
+	} & #dbcommon) | ({
 		protocol?: *"sqlite" | "cockroach" | "cockroachdb" | "file" | "mysql" | "postgres"
 		host?:     string
 		port?:     int
 		name?:     string
 		user?:     string
-	})
+	} & #dbcommon)
 
 	_#lower: ["debug", "error", "fatal", "info", "panic", "warn"]
 	_#all: _#lower + [for x in _#lower {strings.ToUpper(x)}]

flipt/templates/config.cue

@@ -114,12 +114,6 @@ import (
 			http_port:  8080
 			grpc_port:  9000
 		}
-		db: {
-			url:               "file:/var/opt/flipt/flipt.db"
-			max_idle_conn:     2
-			max_open_conn:     0
-			conn_max_lifetime: 0
-		}
 	} & fliptv1.#FliptSpec) | fliptv1.#FliptSpec)
 
 	persistence?: {
@@ -130,7 +124,12 @@ import (
 		size: *"5Gi" | string
 	}
 
-	env: [string]: string
+	env: [string]: (string | {
+		valueFrom: secretKeyRef: {
+			name: string
+			key:  string
+		}
+	})
 
 	autoscaling?: {
 		minReplicas: *1 | uint

flipt/templates/deployment.cue

@@ -53,7 +53,15 @@ import (
 								value: "/etc/flipt/known_hosts"
 							},
 						] + [
-							for k, v in #config.env {name: k, value: v},
+							for k, v in #config.env {
+								name: k
+								if v.valueFrom != _|_ {
+									valueFrom: v.valueFrom
+								}
+								if v.valueFrom == _|_ {
+									value: v
+								}
+							},
 						]
 						livenessProbe: {
 							httpGet: {