fix(helm): require the app's ENCRYPTION_KEY on the migrations init container

Author: waleedlatif1

helm/sim/templates/deployment-app.yaml

@@ -80,7 +80,7 @@ spec:
                 secretKeyRef:
                   name: {{ include "sim.appSecretName" $ }}
                   key: {{ $key }}
-                  optional: true
+                  optional: {{ eq $key "ENCRYPT_ACCOUNT_TOKENS" }}
             {{- end }}
             {{- end }}
           envFrom:

helm/sim/tests/secret-modes_test.yaml

@@ -154,7 +154,7 @@ tests:
           content:
             name: ENCRYPTION_KEY
             valueFrom:
-              secretKeyRef: { name: t-sim-app-secrets, key: ENCRYPTION_KEY, optional: true }
+              secretKeyRef: { name: t-sim-app-secrets, key: ENCRYPTION_KEY, optional: false }
       - contains:
           path: spec.template.spec.initContainers[0].env
           content:
@@ -178,7 +178,7 @@ tests:
           content:
             name: ENCRYPTION_KEY
             valueFrom:
-              secretKeyRef: { name: my-existing-secret, key: ENCRYPTION_KEY, optional: true }
+              secretKeyRef: { name: my-existing-secret, key: ENCRYPTION_KEY, optional: false }
 
   - it: an extraEnvVars sealing opt-out reaches the migrations init container
     template: deployment-app.yaml