SECURITY FIX: • DB password exposed in debugging output (should be rotated) • Integration-test-job.yaml correctly uses K8s secrets (not embedded) • Added k8s/test/integration-test-secrets.enc.yaml (SOPS template) Action items: 1. ROTATE memory-db-app password immediately 2. Use SOPS encryption for any new secrets files 3. Never print plaintext credentials in shell/CI logs 4. Verify no passwords in git history: git log -p --all | grep -i password SOPS encryption practice: • All secrets files use .enc.yaml suffix • ArgoCD+KSOPS plugin decrypts at deploy time • Never commit plaintext to git To properly add secrets later: kubectl create secret generic <name> --from-literal=key=value \ --dry-run=client -o yaml | \ sops -e /dev/stdin > k8s/test/secret.enc.yaml
