2 Commits

Include renames

Author	SHA1	Message	Date
rock	67e6ac0023	security: add SOPS encrypted secrets placeholder, rotate DB password ... SECURITY FIX: • DB password exposed in debugging output (should be rotated) • Integration-test-job.yaml correctly uses K8s secrets (not embedded) • Added k8s/test/integration-test-secrets.enc.yaml (SOPS template) Action items: 1. ROTATE memory-db-app password immediately 2. Use SOPS encryption for any new secrets files 3. Never print plaintext credentials in shell/CI logs 4. Verify no passwords in git history: git log -p --all | grep -i password SOPS encryption practice: • All secrets files use .enc.yaml suffix • ArgoCD+KSOPS plugin decrypts at deploy time • Never commit plaintext to git To properly add secrets later: kubectl create secret generic <name> --from-literal=key=value \ --dry-run=client -o yaml | \ sops -e /dev/stdin > k8s/test/secret.enc.yaml	2026-09-14 22:43:51 +09:00
rock	8c609a575c	test: K8s Job-based integration testing with migrations ... Add proper integration test infrastructure: migrations/run_migrations.sh: - Database migration runner (used by K8s Job) - Applies all SQL migrations in order - Waits for DB to be ready - Verifies schema creation - Reports success/failure k8s/test/integration-test-job.yaml: - Kubernetes Job manifest for E2E testing - Two-stage execution: 1. migrate: Apply database migrations 2. test: Run integration test against new pod - Uses new image SHA from CI build - Proper secret management for DB credentials - Cleanup after 1 hour (ttlSecondsAfterFinished) - Resource limits and liveness probes .gitea/workflows/integration-test.yaml: - CI workflow that runs after image build - Validates image exists in registry - Deploys Job with correct image SHA - Waits for job completion (10 min timeout) - Collects pod logs on failure - Automatic cleanup Usage: - Automatic: Runs after each CI build on main - Manual: Trigger with specific image SHA via workflow_dispatch - Tests: Ingest pipeline + entity persistence + query Requires: - KUBECONFIG_B64 secret (base64-encoded kubeconfig) - DB credentials (via memory-db-app secret in cluster) - Image already pushed to registry	2026-09-14 22:36:58 +09:00