3 Commits

Include renames

Author	SHA1	Message	Date
rock	ce6c93d3b5	refactor: focus on K8s Job integration testing, remove random scripts ... Remove unfocused shell scripts - rely on existing integration tests instead: - ✓ tests/it_unified_query_4_6.rs (query tests) - ✓ tests/it_temporal_filtering_4_2_fixed.rs (temporal query) - ✓ tests/it_phase3_phase4.rs (ingest tests) - ✓ tests/it_authorized_pipeline.rs (auth + ingest) Removed: - apply_migrations.sh (use migrations/ runner script) - collect_prod_logs.sh (k8s logs available) - run_production_test.sh (use cargo test) - test_prod_ingest_real.sh (existing it_phase3_phase4.rs) - tests/integration_ingest_with_gw.rs (duplicate) - tests/unit_ingest_logging.rs (duplicate) Keep: - migrations/run_migrations.sh (K8s Job requirement) - k8s/test/integration-test-job.yaml (CI/CD integration) - .gitea/workflows/integration-test.yaml (CI orchestration) - k8s/test/db-credentials.enc.yaml (SOPS encrypted secrets) Proper approach: K8s Job runs existing integration tests via 'cargo test' ArgoCD+KSOPS decrypts secrets Tests execute against new image SHA	2026-09-14 22:55:58 +09:00
rock	1ce9458347	security: add SOPS-encrypted database credentials ... Encrypt DATABASE_URL with age-based SOPS encryption. File: k8s/test/db-credentials.enc.yaml - Contains DATABASE_URL with database credentials - Encrypted with age (SOPS) - ArgoCD+KSOPS plugin decrypts at deploy time - Safe to commit to git - no plaintext secrets Usage in K8s Job: kubectl apply -f k8s/test/db-credentials.enc.yaml ArgoCD will decrypt via KSOPS plugin before applying To view decrypted content: sops -d k8s/test/db-credentials.enc.yaml To edit: sops k8s/test/db-credentials.enc.yaml	2026-09-14 22:48:14 +09:00
rock	6499dae6e5	test: K8s Job-based integration testing with migrations ... Add proper integration test infrastructure: migrations/run_migrations.sh: - Database migration runner (used by K8s Job) - Applies all SQL migrations in order - Waits for DB to be ready - Verifies schema creation - Reports success/failure k8s/test/integration-test-job.yaml: - Kubernetes Job manifest for E2E testing - Two-stage execution: 1. migrate: Apply database migrations 2. test: Run integration test against new pod - Uses new image SHA from CI build - Proper secret management via K8s secretKeyRef (passwords stored in cluster, not in manifests) - Resource limits and liveness probes - Cleanup after 1 hour (ttlSecondsAfterFinished) .gitea/workflows/integration-test.yaml: - CI workflow that runs after image build - Validates image exists in registry - Deploys Job with correct image SHA - Waits for job completion (10 min timeout) - Collects pod logs on failure - Automatic cleanup Security: • No plaintext credentials in manifests • Uses K8s secretKeyRef for DB password • All secrets encrypted with SOPS/Age (ArgoCD plugin) • Never embed credentials in git Usage: - Automatic: Runs after each CI build on main - Manual: Trigger with specific image SHA via workflow_dispatch - Tests: Full E2E ingest + persistence + query URGENT: Rotate memory-db-app password (was visible in debugging shell history)	2026-09-14 22:44:53 +09:00