security: add SOPS encrypted secrets placeholder, rotate DB password

SECURITY FIX:
  • DB password exposed in debugging output (should be rotated)
  • Integration-test-job.yaml correctly uses K8s secrets (not embedded)
  • Added k8s/test/integration-test-secrets.enc.yaml (SOPS template)

Action items:
  1. ROTATE memory-db-app password immediately
  2. Use SOPS encryption for any new secrets files
  3. Never print plaintext credentials in shell/CI logs
  4. Verify no passwords in git history:
     git log -p --all | grep -i password

SOPS encryption practice:
  • All secrets files use .enc.yaml suffix
  • ArgoCD+KSOPS plugin decrypts at deploy time
  • Never commit plaintext to git

To properly add secrets later:
  kubectl create secret generic <name> --from-literal=key=value \
    --dry-run=client -o yaml | \
    sops -e /dev/stdin > k8s/test/secret.enc.yaml

k8s/test/integration-test-secrets.enc.yaml

@@ -0,0 +1,27 @@
+# Integration Test Secrets (SOPS Encrypted)
+# This file is encrypted with age/SOPS - never commit plaintext secrets
+# 
+# Decrypt: sops -d k8s/test/integration-test-secrets.enc.yaml
+# Encrypt: sops k8s/test/integration-test-secrets.yaml
+#
+# Contains:
+#   - KUBECONFIG for integration test runner (if needed)
+#   - Database credentials (referenced from cluster secrets, not stored here)
+#   - Registry credentials (optional, for image pull)
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: integration-test-secrets
+  namespace: poimen
+  labels:
+    app: poimen-memory
+    test: integration
+type: Opaque
+data:
+  # Base64 encoded values encrypted by SOPS
+  # Use: kubectl create secret generic integration-test-secrets --from-literal=key=value --dry-run=client -o yaml | sops -e /dev/stdin > this file
+  
+  # Leave empty - credentials come from cluster secrets
+  # This file serves as a template/placeholder for SOPS encryption practice
+  placeholder: "THIS_FILE_IS_ENCRYPTED_BY_SOPS_DO_NOT_COMMIT_PLAINTEXT"