Security improvements: - Fix NetworkPolicy port: gateway→authentik 80→9000 - Encrypt internal cluster DNS names (.svc.cluster.local) - SOPS encryption preserves Kubernetes structure (apiVersion, kind, metadata) - Only sensitive URLs are encrypted, not the config structure What's encrypted: ✓ jwksUrl, tokenUrl (authentik endpoints) ✓ All upstream service URLs (.svc.cluster.local) ✓ Internal infrastructure topology What stays readable: ✓ apiVersion, kind (Kubernetes needs these) ✓ metadata.name, namespace (pod identification) ✓ Configuration structure Fixes JWT validation failures and 401 errors on LLM requests.
