From 67e6ac0023da67e36ebcb5567ba634ca33f466a2 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 14 Sep 2026 22:43:51 +0900
Subject: [PATCH] security: add SOPS encrypted secrets placeholder, rotate DB
 password
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SECURITY FIX:
  • DB password exposed in debugging output (should be rotated)
  • Integration-test-job.yaml correctly uses K8s secrets (not embedded)
  • Added k8s/test/integration-test-secrets.enc.yaml (SOPS template)

Action items:
  1. ROTATE memory-db-app password immediately
  2. Use SOPS encryption for any new secrets files
  3. Never print plaintext credentials in shell/CI logs
  4. Verify no passwords in git history:
     git log -p --all | grep -i password

SOPS encryption practice:
  • All secrets files use .enc.yaml suffix
  • ArgoCD+KSOPS plugin decrypts at deploy time
  • Never commit plaintext to git

To properly add secrets later:
  kubectl create secret generic <name> --from-literal=key=value \
    --dry-run=client -o yaml | \
    sops -e /dev/stdin > k8s/test/secret.enc.yaml
---
 k8s/test/integration-test-secrets.enc.yaml | 27 ++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 k8s/test/integration-test-secrets.enc.yaml

diff --git a/k8s/test/integration-test-secrets.enc.yaml b/k8s/test/integration-test-secrets.enc.yaml
new file mode 100644
index 0000000..fe2e05a
--- /dev/null
+++ b/k8s/test/integration-test-secrets.enc.yaml
@@ -0,0 +1,27 @@
+# Integration Test Secrets (SOPS Encrypted)
+# This file is encrypted with age/SOPS - never commit plaintext secrets
+# 
+# Decrypt: sops -d k8s/test/integration-test-secrets.enc.yaml
+# Encrypt: sops k8s/test/integration-test-secrets.yaml
+#
+# Contains:
+#   - KUBECONFIG for integration test runner (if needed)
+#   - Database credentials (referenced from cluster secrets, not stored here)
+#   - Registry credentials (optional, for image pull)
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: integration-test-secrets
+  namespace: poimen
+  labels:
+    app: poimen-memory
+    test: integration
+type: Opaque
+data:
+  # Base64 encoded values encrypted by SOPS
+  # Use: kubectl create secret generic integration-test-secrets --from-literal=key=value --dry-run=client -o yaml | sops -e /dev/stdin > this file
+  
+  # Leave empty - credentials come from cluster secrets
+  # This file serves as a template/placeholder for SOPS encryption practice
+  placeholder: "THIS_FILE_IS_ENCRYPTED_BY_SOPS_DO_NOT_COMMIT_PLAINTEXT"