fix(opensearch): single-node discovery, fsGroup, encrypt secrets, drop obsidian

- discovery.type: single-node (bypasses vm.max_map_count bootstrap check)
- fsGroup: 1000 (fixes AccessDeniedException on PVC data dir)
- control-plane tolerations (schedulable on CP nodes)
- secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
- remove orphaned obsidian-git-ssh-secret.enc.yaml

k8s/app/obsidian-git-ssh-secret.enc.yaml

@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:gSI=,iv:nfXxHTEXSY6eDPOLfQWxQaX/Ge7s08QF6GqQ847cdKg=,tag:szUjeOolHuomGQQdrV7U4A==,type:str]
-kind: ENC[AES256_GCM,data:HC8zcR8G,iv:wk4XliU5bPi32M0QV6OhJs3tSkirOczWJjR+1MgjxpM=,tag:jcD8R327PRv8x7wYh4Tdrg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:HouUGg1P3iPycnr5doLc9w==,iv:kzODDxNBix4e/kAGrF8io165crqPHewyuG8MCZhr3mM=,tag:hX9peWSY5LwM7/08S+QLuw==,type:str]
-    namespace: ENC[AES256_GCM,data:OCIDOqNz,iv:GhtxD5cXXTnl/7Po1rY3I+jacI9Kz4bXp+Nz2UVTOTE=,tag:F7TuNLkSluKm4TZZ1Q33VQ==,type:str]
-type: ENC[AES256_GCM,data:ErqH5L3k,iv:JioZqat2ZYSO83vEnl1MY6YiCC3RttfEkGc2OumJHBY=,tag:K68wmCX8sMzcnGUz1aBpWA==,type:str]
-stringData:
-    id_ed25519: ENC[AES256_GCM,data:YqrAUmZCvEDC2q8c4Ns+WxW2l+oC31arj1MPYwt6AkIv026kZk9ucywkOWT/Ww0VgiUWF/0t/gzkm7K5D5fSk5vP6PyWV5Zqvlo8Zqy1VBLc3V9gbQeCsA4i8+FO3zZ0k2l3HAefEqhJ4Bnj3dKDOTX4bsbE/H/4n8WCojYnOLdU4esqm5r4bOCnFv5wBkbkob6AwfqekdaBZfuPOqW2sstDSRN6km1UZafCYuMY0XQTxCKYM8Izt3px8sfBq37oA6syDpxNuEpAk0uYumHhSBHKRAnsDY61pjfCbR2xy/3IeEPr6EVf5HwV+2ElhtSB/Zfzin5GZvAgX3gu3HuFznHUYH5olLEEFvVtw8fWLh3avwwCsAlUsDKZoTV1t1bzGni1OPYK3ZfsAmQqI1lvdFlRj++e6L3vDBkVG5qowTelbSb6/TWMDpJw/CsX3bgeKEoFUt2vi9IxwdYO/onuExVrT23WeanoSmrnXRaBqr6xIV5yW5CCbBBRmRU7a6jkwtkhe8dHFTKejaqjBpzPdlZOvhzKBHlOy4eDGjeV7CkzrRw=,iv:bSGkeMli13DSDFAu1+4Kg5sqSJ8LbdpLfN5oIwzLyTM=,tag:9DYK17ET7rkfmmpwxjicog==,type:str]
-    known_hosts: ENC[AES256_GCM,data:FaWsLxkot5Zxh7mobbUGDFqKLOdmP5APg09nkDyqGHyDp0v0Pjc19jeizM+tq3b3aH59YGlPe/4xQf7ZXZRZjWQE+m/TcVujtLD4hfCc40wqZh1XtTtdC6Tf1p3JbqxP0uQVy1+EFVwPCimUsZfp7gtcT/Hmu1JAW9biGmvACO9+dDeHGzBH5ZRCw3+dEYmcLgGIRgzpOwJLfHr/hkvdlflhzmEHMliBIl+TpqQ38GFQmw0ia7UEJzj3ghoDj7HjrHqlBa7aBHJpaEBYVwq8cN7JaLnyO1Y4+LIU8ln/CEzeg9wxVJoMO8IBcQCCgXoC+ogEpNFVb+pdUfRl/3Ye97ZJFmdJoorvSHIR02e9n7E2G3Ox9iImwnwI76X3FokuY0zcGIkcIho6JN3/8k3Z4VLDl2qGflo7jK6QP1DEsGUGhGwPRVrpPNkMDxYQeBIqlwFzfRuF/gDZj3ZWadCYB7NwByVgTcZFqiMtQ74z6jYGMiPIpW2OCY4HGu9ecGPR02USEu39CjJUCWH9WbQZTjmK3n4yYy4X4WPMbc0IekSCC2ossBznMoFsu7q7L13arqC99j9ZOv8aJ7KgMpGpOVPoN2AURJTFhgMX8TD93AvbFNVNqA0t+Y+g0Hq5f/py8XPzj4b6l8A4QxK3Awj4gf5BbK2lNjL+Cgo2kgwPsPvNd4hvx3gbamDOPNf+lH6iGLF19QyoJPHlOD/k9hkcMRerAEOLZriTylgpj2joXOaeKVrk8qkAZBunQKNc3e0xXH1i5obqz871DbbOVvrfYhmSNG93IEDG3hvNPbIc2uXYIJBciXxEaNO2PEypaLDgnNczEoVyUn2MXTJ6XMr/fkKvVBTmDuFd7BWk1JM6gWKnKvdN2G7bBHz5D43jGmmv+Z4bcd4Z4ViO8yAMbB3kKMLxMZQiSsrOudcQM1rzip2HBYb7JhK3yQwTbqTXZo64hejYW6+KYZysSB+A4itITvQR1G50lKndLd1XXqRbfV00DSZmNPRt0dKcTRkEX2RdCOkh6Wddo7D41V4eDRoHY+rctirsDKE/IA875ooAxpj5CWsHjAzlVrSUUVB2D0IBdlCPaZ5LVSo8i8+9S4rakEdmwe5dceUTC9mNIuzFtUeAshW4J2U4UzIQGOVt0BolwWfWiO5QvuAMC7aH1kJOr9gUB69IwDASdd+PbyEvjCQigVXEeObcliJu9QZohcoQU09fI1ajmPC5x2g2Rbo8DPakQTdsHuzdNm/zMZ/yUhi7+5/jZmwI3kRdgA9EMmhl+T2qAwNbhBiW2Iim44R0ZFuWMv6SCX2Kl9KxH+HW7dS8H7FJbAG7w9kiivpHP0sBTRfSgN9ddR6veVRiZWXNJ38sNy88GXdwzRM90XJAwQ==,iv:mv3hoMwPcEmOBbsIRoKLUuEsUolotv1VtikLiItwuJg=,tag:7amQiuiaVwowLAQcNoq72A==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINTF2OGRmUWoxTmFEZUdv
-            SWJKRlFhaVkzbUtOaTVnbHFjd1UzR2RFdVFNClpFODhlQVJIQjhlOEJBL2pDVmJa
-            UjlZZmFHKzA4eDJEMk9KTDMyOGZ2VWcKLS0tIFRHREo1dXNRKzJVYkROQSt1WjFV
-            ZXZYVjAwSlZhT0ZMbG1qNDVUWnJyQ2cKfs4t6HsQG5Wiyp6QvFqvm4+/o4NAL3qu
-            6L9vyhl2jufrbxmR+IsEBCxYS7rh6dCbxTUFap3MD2lYIGF9hRnGjQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-28T23:27:09Z"
-    mac: ENC[AES256_GCM,data:wJC6YCHXq6I/bqUjfwFRvpULZ1Yt39PoWFKzzOAq6h/pHsUrWEgrkm+3+dLaPpz663b0B75BiCQjQb4igXWr38O5I+FKonRHsbsH+D+pO+dq++yNYG8T30KGaquVfnsm8ijWGWxOY9nULUXfKcYfqvsR9P7KCV7bdcWuZ5xzZ5o=,iv:w5f3h0hb2ooeNYK1QZactpmpT8mAYa94V8FBewP0MUY=,tag:qlgUutFanhjk1HIBJqmLQg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/infra/databases/kustomization.yaml

@@ -6,3 +6,4 @@ kind: Kustomization
 resources:
   - memory-db.yaml
   - opensearch.yaml
+  - opensearch-secrets.enc.yaml

k8s/infra/databases/opensearch-secrets.enc.yaml

@@ -0,0 +1,47 @@
+apiVersion: ENC[AES256_GCM,data:xSU=,iv:t2LYU13AWsBqRTzsbljhR3uM8AUMwX8AJZ1Q9s/46gY=,tag:QfClc6Cr7gjiDTjgTdq+1g==,type:str]
+kind: ENC[AES256_GCM,data:sjgfLQYH,iv:QCyzSrxg3HsRJfBLvwlFdMcUo88kbJzZAeXNrJ2YSrs=,tag:yZKDAS4hpzyEQQ6gvtyhTw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:rfqGzVlF0d0tHHT4o0uvArR3,iv:7qeXDnvy/zqIxWXgAH6FD7SR/s2PGmtzuTNUVnI9NbY=,tag:MJG4Ev8Piv+i3kNy+d9KbA==,type:str]
+    namespace: ENC[AES256_GCM,data:MfEXmFbQ,iv:1PzndXHLkHTaqdulcB75dp0w9MYSS7OmcokopABKkYI=,tag:qGzDyDVzP5VfQO/sq4TriA==,type:str]
+type: ENC[AES256_GCM,data:bsY8OgFB,iv:cpVq3oMyyKF5AEfQ7Y3ZPJGyLcLyXMYlzmb7Y6nQI5E=,tag:DlmO76zIFYwFnAGxaMwB0A==,type:str]
+stringData:
+    admin-password: ENC[AES256_GCM,data:aVO1QkWOxPtto6j5xK3lNfz+UmE=,iv:1o1QMqVqRBgNgH26rOswGyAxb3lc8OkXsYFA7BiFjJ8=,tag:g4y+Rg/aFhwF2l/qe5lJLQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK
+            ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY
+            QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5
+            YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8
+            1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:17:13Z"
+    mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
+---
+apiVersion: ENC[AES256_GCM,data:XCk=,iv:Gd3Y7b8a4bVOe64bCQ7Ei8nJHH6xc9Zrji6Rtd0fw/k=,tag:Va6SUiTEDOSXCQ6jcIwfVQ==,type:str]
+kind: ENC[AES256_GCM,data:+njd1eMI,iv:g0snsmlEoV8c1FYPFso27H5xKEXsigouQH6JOrznY+w=,tag:MlZY20Dvd2WX8xwaYXsaxw==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:HUJjyVhvJPe4Hebp2azXZKl6z1D7L/Jg/eWw1g==,iv:UnLftsqTxqRnvGfkhqDgRoElYk1jMVk4YqPl5Wb5M48=,tag:GPSSLMw9aLJd/3gYRsyI3g==,type:str]
+    namespace: ENC[AES256_GCM,data:N7i+rOc2,iv:MvFxdJRNsENNCl/q1zURiN++iFJHYWqxt55CiKE2haM=,tag:JMlOQuwHqeILTrCZ/PdVxg==,type:str]
+type: ENC[AES256_GCM,data:tgPKouoR,iv:CMtRUgOeZ17x2oHYR2ae9Kpz9e0+BG3CtEFKLhIPqS8=,tag:ljFNeCAeS23L/L92+OkRhg==,type:str]
+stringData:
+    password: ENC[AES256_GCM,data:dGER+nQ=,iv:cytyAcsiLibNGfPfDMuoW6ouZsZgqRVL1bVBjm2f2SU=,tag:IzoK0isBHpTN8LGVjoIjfw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzWEp2ODAxZ3poc3JGdExK
+            ZmkwdnlLcm9GZ0FhbENHOGE1L3BLR3N5SzJnClRuTnNCMjk3ajdaS1BvaEM3cEJY
+            QzBoRUF2RFlFdllDWTRvR05GSS84VjQKLS0tIEV4VHU1ZnhlMzRZVDBUbFRwMXV5
+            YnJMWUtob0g4SEFqM2ljYkNoZFdINWsKE2oxq4IIZZzbjN02a2DUVn89rG83djb8
+            1YIgsMcc4Iuln/OijoY4VCx+zMh40ldn7IdNWwPGDMTq3sZNimQmPw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:17:13Z"
+    mac: ENC[AES256_GCM,data:7yAla8UGOqzgQ/DfH5NslwNkS/EvIpLf5zFr0Dqmk7li4yRd17rT1Syw4E4vnRCUteNLn/jISN/R55Vbt1d/K2GrjIlTSIi92ULlb2J3Uhwx9htyQuSDD7JbV9IZRjdC+Mf912k/TGqlezNRdYT/hRON8q+c+9hrLQ/1eKdcZ6s=,iv:H3X/KEaO23bJlMrHdCCjejcqiBvrYSq9Jxoy/Vr+H/4=,tag:NqxtbwoWWpn/WUMb+S4h1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/infra/databases/opensearch.yaml

@@ -65,8 +65,7 @@ data:
     # Cluster settings
     cluster.name: poimen-memory
     node.name: ${HOSTNAME}
-    cluster.initial_master_nodes: opensearch-0
+    discovery.type: single-node
-    discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local
     
     # Network
     network.host: 0.0.0.0
@@ -127,16 +126,12 @@ spec:
     spec:
       serviceAccountName: opensearch
       hostNetwork: false
-      
+      securityContext:
-      initContainers:
+        fsGroup: 1000
-        - name: sysctl
+      tolerations:
-          image: busybox:1.28
+        - key: node-role.kubernetes.io/control-plane
-          command:
+          operator: Exists
-            - sysctl
+          effect: NoSchedule
-            - -w
-            - vm.max_map_count=262144
-          securityContext:
-            privileged: true
       
       containers:
         - name: opensearch
@@ -400,18 +395,6 @@ spec:
 
 ---
 
-# Secret: OpenSearch Dashboards password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-dashboards-secret
-  namespace: poimen
-type: Opaque
-stringData:
-  password: "admin"  # ⚠️  Change in production
-
----
-
 # ServiceAccount for OpenSearch Dashboards
 apiVersion: v1
 kind: ServiceAccount
@@ -419,14 +402,4 @@ metadata:
   name: opensearch-dashboards
   namespace: poimen
 
----
+# Secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
-
-# Secret for OpenSearch Admin Password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-secrets
-  namespace: poimen
-type: Opaque
-stringData:
-  admin-password: "OpenSearch@Admin123!"