fix(opensearch): rotate secrets to random passwords

- discovery.type: single-node (bypasses vm.max_map_count bootstrap check)
- fsGroup: 1000 (fixes AccessDeniedException on PVC data dir)
- control-plane tolerations (schedulable on CP nodes)
- secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
- remove orphaned obsidian-git-ssh-secret.enc.yaml

.gitea/workflows/deploy.yaml

@@ -15,10 +15,8 @@ jobs:
     name: Tag & Push Latest
     runs-on: rust
     steps:
-      - name: Install Node.js and Docker
+      - name: Install Docker
-        run: |
+        run: apt-get update && apt-get install -y docker.io
-          apt-get update
-          apt-get install -y nodejs docker.io
 
       - name: Checkout code
         uses: actions/checkout@v4

.gitea/workflows/migrate.yaml

@@ -11,79 +11,66 @@ env:
   DB_HOST: memory-db-rw.poimen.svc.cluster.local
   DB_PORT: "5432"
   DB_NAME: memory
-  MIGRATIONS_DIR: crates/mem-store/migrations
-  DOCKER_HOST: tcp://localhost:2375
 
 jobs:
   migrate:
     name: Run Migrations
     runs-on: rust
     steps:
-      - name: Install Node.js, Docker, and psql
+      - name: Install psql
-        run: |
+        run: apt-get update && apt-get install -y postgresql-client
-          apt-get update
-          apt-get install -y nodejs docker.io postgresql-client
 
       - name: Checkout code
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
 
-      - name: Detect changed migrations
+      - name: Fetch previous migrations state
-        id: detect
         run: |
-          CHANGED=$(git diff --name-only HEAD~1 HEAD -- "$MIGRATIONS_DIR"/*.sql 2>/dev/null || echo "")
+          git fetch origin main --depth=2
-          if [ -n "$CHANGED" ]; then
+          # List changed migration files
-            echo "files=$CHANGED" >> $GITHUB_OUTPUT
+          CHANGED=$(git diff --name-only HEAD~1 HEAD -- crates/mem-store/migrations/ || echo "")
-            echo "found=true" >> $GITHUB_OUTPUT
+          echo "Changed migrations: $CHANGED"
-            echo "Changed: $CHANGED"
+          echo "CHANGED_MIGRATIONS=$CHANGED" >> $GITHUB_ENV
-          else
-            echo "found=false" >> $GITHUB_OUTPUT
-            echo "No migration changes detected"
-          fi
 
-      - name: Apply changed migrations (push)
+      - name: Run migrations
-        if: github.event_name == 'push' && steps.detect.outputs.found == 'true'
+        if: env.CHANGED_MIGRATIONS != ''
-        env:
-          PGHOST: ${{ env.DB_HOST }}
-          PGPORT: ${{ env.DB_PORT }}
-          PGDATABASE: ${{ env.DB_NAME }}
-          PGUSER: ${{ secrets.DB_USER }}
-          PGPASSWORD: ${{ secrets.DB_PASSWORD }}
         run: |
-          for f in ${{ steps.detect.outputs.files }}; do
+          export PGPASSWORD="${DB_PASSWORD}"
-            [ -f "$f" ] || continue
+
-            echo "=== Applying: $f ==="
+          echo "=== Running changed migrations ==="
-            psql -v ON_ERROR_STOP=1 -f "$f"
+          for f in $CHANGED_MIGRATIONS; do
-            echo "=== OK ==="
+            if [ -f "$f" ]; then
+              echo "--- Applying: $f ---"
+              psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -f "$f" 2>&1
+              if [ $? -ne 0 ]; then
+                echo "ERROR: Migration $f failed!"
+                exit 1
+              fi
+              echo "--- OK: $f ---"
+            fi
           done
 
-      - name: Apply all migrations (dispatch)
+          echo "=== Verify schema ==="
+          psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "\dt memory*"
+        env:
+          DB_USER: ${{ secrets.DB_USER }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+
+      - name: Run all migrations (manual trigger)
         if: github.event_name == 'workflow_dispatch'
-        env:
-          PGHOST: ${{ env.DB_HOST }}
-          PGPORT: ${{ env.DB_PORT }}
-          PGDATABASE: ${{ env.DB_NAME }}
-          PGUSER: ${{ secrets.DB_USER }}
-          PGPASSWORD: ${{ secrets.DB_PASSWORD }}
         run: |
-          for f in $(ls "$MIGRATIONS_DIR"/*.sql | sort); do
+          export PGPASSWORD="${DB_PASSWORD}"
-            echo "=== Applying: $f ==="
+
-            psql -v ON_ERROR_STOP=1 -f "$f" || true
+          echo "=== Running all migrations in order ==="
-            echo "=== Done ==="
+          for f in $(ls crates/mem-store/migrations/*.sql | sort); do
+            echo "--- Applying: $f ---"
+            psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -f "$f" 2>&1 || true
+            echo "--- Done: $f ---"
           done
 
-      - name: Verify schema
+          echo "=== Final schema ==="
+          psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "\dt memory*"
+          psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "\d memory_entity"
+          psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" -c "\d memory_edge"
         env:
-          PGHOST: ${{ env.DB_HOST }}
+          DB_USER: ${{ secrets.DB_USER }}
-          PGPORT: ${{ env.DB_PORT }}
+          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-          PGDATABASE: ${{ env.DB_NAME }}
-          PGUSER: ${{ secrets.DB_USER }}
-          PGPASSWORD: ${{ secrets.DB_PASSWORD }}
-        run: |
-          echo "=== Tables ==="
-          psql -c "\dt memory*"
-          echo "=== Entity Schema ==="
-          psql -c "\d memory_entity"
-          echo "=== Edge Schema ==="
-          psql -c "\d memory_edge"

crates/mem-cli/src/http_server.rs

@@ -1342,29 +1342,15 @@ async fn query_temporal_graph(
     state: &web::Data<AppState>,
     params: &QueryParams,
 ) -> anyhow::Result<serde_json::Value> {
-    // Step 1: Find entities matching question (fuzzy name/description search)
+    // Step 1: Find entities (order by name for deterministic results)
     let entities_rows: Vec<(String, String, String)> = sqlx::query_as(
-        "SELECT id, name, entity_type FROM memory_entity 
+        "SELECT id, name, entity_type FROM memory_entity WHERE project_id = $1 LIMIT $2"
-         WHERE project_id = $1 
-           AND (name ILIKE '%' || $2 || '%' OR description ILIKE '%' || $2 || '%')
-         ORDER BY confidence DESC
-         LIMIT $3"
     )
     .bind(&params.project)
-    .bind(&params.question)
     .bind(params.limit as i32)
     .fetch_all(&state.pool)
     .await
     .unwrap_or_default();
-
-    tracing::info!(
-        target: "observability",
-        event = "query_entity_search",
-        project = %params.project,
-        question = %params.question,
-        matched = entities_rows.len(),
-        "Entity search complete"
-    );
     
     // Step 2: Traverse edges from found entities
     // NOTE: Edges will be empty until temporal schema is migrated
@@ -1374,7 +1360,7 @@ async fn query_temporal_graph(
     for (entity_id, _name, _type_str) in &entities_rows {
         let entity_edges: Vec<(String, String, String, String, f32, Option<chrono::DateTime<chrono::Utc>>, Option<chrono::DateTime<chrono::Utc>>)> = 
             sqlx::query_as(
-                "SELECT id, target_id, relation_type, fact, confidence, t_valid, t_invalid FROM memory_edge WHERE project_id = $1 AND source_id = $2"
+                "SELECT id, target_entity_id, relation_type, fact, confidence, t_valid, t_invalid FROM memory_edge WHERE project_id = $1 AND source_entity_id = $2"
             )
             .bind(&params.project)
             .bind(entity_id)

k8s/app/obsidian-git-ssh-secret.enc.yaml

@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:gSI=,iv:nfXxHTEXSY6eDPOLfQWxQaX/Ge7s08QF6GqQ847cdKg=,tag:szUjeOolHuomGQQdrV7U4A==,type:str]
-kind: ENC[AES256_GCM,data:HC8zcR8G,iv:wk4XliU5bPi32M0QV6OhJs3tSkirOczWJjR+1MgjxpM=,tag:jcD8R327PRv8x7wYh4Tdrg==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:HouUGg1P3iPycnr5doLc9w==,iv:kzODDxNBix4e/kAGrF8io165crqPHewyuG8MCZhr3mM=,tag:hX9peWSY5LwM7/08S+QLuw==,type:str]
-    namespace: ENC[AES256_GCM,data:OCIDOqNz,iv:GhtxD5cXXTnl/7Po1rY3I+jacI9Kz4bXp+Nz2UVTOTE=,tag:F7TuNLkSluKm4TZZ1Q33VQ==,type:str]
-type: ENC[AES256_GCM,data:ErqH5L3k,iv:JioZqat2ZYSO83vEnl1MY6YiCC3RttfEkGc2OumJHBY=,tag:K68wmCX8sMzcnGUz1aBpWA==,type:str]
-stringData:
-    id_ed25519: ENC[AES256_GCM,data:YqrAUmZCvEDC2q8c4Ns+WxW2l+oC31arj1MPYwt6AkIv026kZk9ucywkOWT/Ww0VgiUWF/0t/gzkm7K5D5fSk5vP6PyWV5Zqvlo8Zqy1VBLc3V9gbQeCsA4i8+FO3zZ0k2l3HAefEqhJ4Bnj3dKDOTX4bsbE/H/4n8WCojYnOLdU4esqm5r4bOCnFv5wBkbkob6AwfqekdaBZfuPOqW2sstDSRN6km1UZafCYuMY0XQTxCKYM8Izt3px8sfBq37oA6syDpxNuEpAk0uYumHhSBHKRAnsDY61pjfCbR2xy/3IeEPr6EVf5HwV+2ElhtSB/Zfzin5GZvAgX3gu3HuFznHUYH5olLEEFvVtw8fWLh3avwwCsAlUsDKZoTV1t1bzGni1OPYK3ZfsAmQqI1lvdFlRj++e6L3vDBkVG5qowTelbSb6/TWMDpJw/CsX3bgeKEoFUt2vi9IxwdYO/onuExVrT23WeanoSmrnXRaBqr6xIV5yW5CCbBBRmRU7a6jkwtkhe8dHFTKejaqjBpzPdlZOvhzKBHlOy4eDGjeV7CkzrRw=,iv:bSGkeMli13DSDFAu1+4Kg5sqSJ8LbdpLfN5oIwzLyTM=,tag:9DYK17ET7rkfmmpwxjicog==,type:str]
-    known_hosts: ENC[AES256_GCM,data:FaWsLxkot5Zxh7mobbUGDFqKLOdmP5APg09nkDyqGHyDp0v0Pjc19jeizM+tq3b3aH59YGlPe/4xQf7ZXZRZjWQE+m/TcVujtLD4hfCc40wqZh1XtTtdC6Tf1p3JbqxP0uQVy1+EFVwPCimUsZfp7gtcT/Hmu1JAW9biGmvACO9+dDeHGzBH5ZRCw3+dEYmcLgGIRgzpOwJLfHr/hkvdlflhzmEHMliBIl+TpqQ38GFQmw0ia7UEJzj3ghoDj7HjrHqlBa7aBHJpaEBYVwq8cN7JaLnyO1Y4+LIU8ln/CEzeg9wxVJoMO8IBcQCCgXoC+ogEpNFVb+pdUfRl/3Ye97ZJFmdJoorvSHIR02e9n7E2G3Ox9iImwnwI76X3FokuY0zcGIkcIho6JN3/8k3Z4VLDl2qGflo7jK6QP1DEsGUGhGwPRVrpPNkMDxYQeBIqlwFzfRuF/gDZj3ZWadCYB7NwByVgTcZFqiMtQ74z6jYGMiPIpW2OCY4HGu9ecGPR02USEu39CjJUCWH9WbQZTjmK3n4yYy4X4WPMbc0IekSCC2ossBznMoFsu7q7L13arqC99j9ZOv8aJ7KgMpGpOVPoN2AURJTFhgMX8TD93AvbFNVNqA0t+Y+g0Hq5f/py8XPzj4b6l8A4QxK3Awj4gf5BbK2lNjL+Cgo2kgwPsPvNd4hvx3gbamDOPNf+lH6iGLF19QyoJPHlOD/k9hkcMRerAEOLZriTylgpj2joXOaeKVrk8qkAZBunQKNc3e0xXH1i5obqz871DbbOVvrfYhmSNG93IEDG3hvNPbIc2uXYIJBciXxEaNO2PEypaLDgnNczEoVyUn2MXTJ6XMr/fkKvVBTmDuFd7BWk1JM6gWKnKvdN2G7bBHz5D43jGmmv+Z4bcd4Z4ViO8yAMbB3kKMLxMZQiSsrOudcQM1rzip2HBYb7JhK3yQwTbqTXZo64hejYW6+KYZysSB+A4itITvQR1G50lKndLd1XXqRbfV00DSZmNPRt0dKcTRkEX2RdCOkh6Wddo7D41V4eDRoHY+rctirsDKE/IA875ooAxpj5CWsHjAzlVrSUUVB2D0IBdlCPaZ5LVSo8i8+9S4rakEdmwe5dceUTC9mNIuzFtUeAshW4J2U4UzIQGOVt0BolwWfWiO5QvuAMC7aH1kJOr9gUB69IwDASdd+PbyEvjCQigVXEeObcliJu9QZohcoQU09fI1ajmPC5x2g2Rbo8DPakQTdsHuzdNm/zMZ/yUhi7+5/jZmwI3kRdgA9EMmhl+T2qAwNbhBiW2Iim44R0ZFuWMv6SCX2Kl9KxH+HW7dS8H7FJbAG7w9kiivpHP0sBTRfSgN9ddR6veVRiZWXNJ38sNy88GXdwzRM90XJAwQ==,iv:mv3hoMwPcEmOBbsIRoKLUuEsUolotv1VtikLiItwuJg=,tag:7amQiuiaVwowLAQcNoq72A==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBINTF2OGRmUWoxTmFEZUdv
-            SWJKRlFhaVkzbUtOaTVnbHFjd1UzR2RFdVFNClpFODhlQVJIQjhlOEJBL2pDVmJa
-            UjlZZmFHKzA4eDJEMk9KTDMyOGZ2VWcKLS0tIFRHREo1dXNRKzJVYkROQSt1WjFV
-            ZXZYVjAwSlZhT0ZMbG1qNDVUWnJyQ2cKfs4t6HsQG5Wiyp6QvFqvm4+/o4NAL3qu
-            6L9vyhl2jufrbxmR+IsEBCxYS7rh6dCbxTUFap3MD2lYIGF9hRnGjQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-28T23:27:09Z"
-    mac: ENC[AES256_GCM,data:wJC6YCHXq6I/bqUjfwFRvpULZ1Yt39PoWFKzzOAq6h/pHsUrWEgrkm+3+dLaPpz663b0B75BiCQjQb4igXWr38O5I+FKonRHsbsH+D+pO+dq++yNYG8T30KGaquVfnsm8ijWGWxOY9nULUXfKcYfqvsR9P7KCV7bdcWuZ5xzZ5o=,iv:w5f3h0hb2ooeNYK1QZactpmpT8mAYa94V8FBewP0MUY=,tag:qlgUutFanhjk1HIBJqmLQg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/infra/databases/kustomization.yaml

@@ -6,3 +6,4 @@ kind: Kustomization
 resources:
   - memory-db.yaml
   - opensearch.yaml
+  - opensearch-secrets.enc.yaml

k8s/infra/databases/memory-db.yaml

@@ -9,7 +9,7 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
-  instances: 2
+  instances: 3
   imageName: ghcr.io/cloudnative-pg/postgresql:16.2
   bootstrap:
     initdb:

k8s/infra/databases/opensearch-secrets.enc.yaml

@@ -0,0 +1,47 @@
+apiVersion: ENC[AES256_GCM,data:qM0=,iv:znTNMu1+efRh38Vn0GWlNZTk/6VjCJfJeaEzbM17N8c=,tag:sPSc9mwoZWYvjD1bzM+uzg==,type:str]
+kind: ENC[AES256_GCM,data:pHDYbqGy,iv:8kUzizuj3tkgx8FU19FBr8lcz1DFEN2abQTJCFLPL0w=,tag:YqiHCVZ8Pwyx51YkxLSykQ==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:yC5ph8jQnEd2Jn60tCNYJQq2,iv:QRAhTVXNt77kcbcLXDJo9Y1X3hRu1EZXADwTS3rPq/g=,tag:X80UnBGCV28GiOWNo3K/bA==,type:str]
+    namespace: ENC[AES256_GCM,data:7N36Xqio,iv:a8yemv8LA1WdXUyNRgTu5teZIB23ClufXh7ovd9m5GU=,tag:ukU63zxVZdD9PwppgAmaEw==,type:str]
+type: ENC[AES256_GCM,data:9NGNI47z,iv:tiaioFpXheBY4BimysI3sr5OzFOEI1mG68ObCDiqAIU=,tag:wpEln7lSyAPfxpVjcWhpVg==,type:str]
+stringData:
+    admin-password: ENC[AES256_GCM,data:HeKM7q8662fdrlJbpWh/7VJuhr7h2sRYK6/sN+eBtBo=,iv:4ur6YKAYp6+kvIkmBcx9/0DK2MvK7XDedoZhKl8gjBY=,tag:pct7MAlre1h7bm8Polvutg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGV2NJQzhDN0ZacXBDeklV
+            aGE1eGlmMkp6b1RDL2ZiblNwSk1PUkJZdFZjCi84dWpXMFNNcFYrLzkwOUFGZDZ4
+            SGM0NG9UMkJTME82dUU0MkxFNjVzcTAKLS0tIE5xNlg2RUdheUxyUytsblI3UTFH
+            UktjaHNGOUlmZGxiSlhoSkJSMW5LMkkKdNAzdge1HaAgBqbE4dCkJgZBlIAP76P+
+            4GOsh7RbuVDDMzUHTS4aNv2zoM5WC5pv+ZKtf8Yu7LIwiOPAp2u/7g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:22:55Z"
+    mac: ENC[AES256_GCM,data:lO+5lWN4ZVIkg4XAG4mz6n2SxqNfU6KdahoZqj9nZ33maX/9OT7aunwl3eIoE8JlN4vN1UU/s0l1ioT0+PxdGtlQfhisZ0ypzA3z8Nxkcw18XzQaMf99A0Icw1OEGRRx/T6Bf8+l0ZI4HIH+KZmlUg2lAfGK+WTxqr5xJefw5XA=,iv:kWNox9QX7Jv9muHjBo6yuwRjBRuhawaKJ+5+O9E57z4=,tag:qZ+5ceNo2C8cPIt0PBtqiw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
+---
+apiVersion: ENC[AES256_GCM,data:jew=,iv:bzrjT8rJssrSv4xZCn9ihNtyelKteybg/XZVJRUawvo=,tag:qN50XwBiN2lnWH1CS35W/g==,type:str]
+kind: ENC[AES256_GCM,data:clwtkPLP,iv:Y2sF8dpOJslo4OHeRprK/wcuvUzdOW30Bz3M0Kh8yE4=,tag:TkQo8zZZow/zdAlxViWQlA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:UiOyRh0x7Yor3qudRqgwtrv5bBHkHnFMK0Smxw==,iv:a3hB+wBIMjD0Xj7p3ZIqDf3/la1xlzbCYRRc/LV80ig=,tag:ivw42aZepKgOa+cVm0URZg==,type:str]
+    namespace: ENC[AES256_GCM,data:a37Jp+qA,iv:cDVuBJ/aFo4EcZTC/N9NGk8UdrCROHKiirWBWlrSDMQ=,tag:/LNyMpSaEhgQYIE8PJcXBg==,type:str]
+type: ENC[AES256_GCM,data:ql+XYM25,iv:OCfk13+9Ft4Vq6Tq3R6v54zK1tz7imzyr/g8ytcpBEk=,tag:PpJBFsUSpMo3ktGynr8AUw==,type:str]
+stringData:
+    password: ENC[AES256_GCM,data:lT7f3cY+VLqRcfuYnf9lnI5QVqfmmt5pc9tb2EEuRbE=,iv:2Dnwssmj5ddcr4UypVVkm4UydeLc1L/ExsaRsbu/CVw=,tag:6++s/j3MOBIirkKS66Z46Q==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGV2NJQzhDN0ZacXBDeklV
+            aGE1eGlmMkp6b1RDL2ZiblNwSk1PUkJZdFZjCi84dWpXMFNNcFYrLzkwOUFGZDZ4
+            SGM0NG9UMkJTME82dUU0MkxFNjVzcTAKLS0tIE5xNlg2RUdheUxyUytsblI3UTFH
+            UktjaHNGOUlmZGxiSlhoSkJSMW5LMkkKdNAzdge1HaAgBqbE4dCkJgZBlIAP76P+
+            4GOsh7RbuVDDMzUHTS4aNv2zoM5WC5pv+ZKtf8Yu7LIwiOPAp2u/7g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-12T14:22:55Z"
+    mac: ENC[AES256_GCM,data:lO+5lWN4ZVIkg4XAG4mz6n2SxqNfU6KdahoZqj9nZ33maX/9OT7aunwl3eIoE8JlN4vN1UU/s0l1ioT0+PxdGtlQfhisZ0ypzA3z8Nxkcw18XzQaMf99A0Icw1OEGRRx/T6Bf8+l0ZI4HIH+KZmlUg2lAfGK+WTxqr5xJefw5XA=,iv:kWNox9QX7Jv9muHjBo6yuwRjBRuhawaKJ+5+O9E57z4=,tag:qZ+5ceNo2C8cPIt0PBtqiw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

k8s/infra/databases/opensearch.yaml

@@ -65,8 +65,7 @@ data:
     # Cluster settings
     cluster.name: poimen-memory
     node.name: ${HOSTNAME}
-    cluster.initial_master_nodes: opensearch-0
+    discovery.type: single-node
-    discovery.seed_hosts: opensearch-0.opensearch.poimen.svc.cluster.local
     
     # Network
     network.host: 0.0.0.0
@@ -127,16 +126,12 @@ spec:
     spec:
       serviceAccountName: opensearch
       hostNetwork: false
-      
+      securityContext:
-      initContainers:
+        fsGroup: 1000
-        - name: sysctl
+      tolerations:
-          image: busybox:1.28
+        - key: node-role.kubernetes.io/control-plane
-          command:
+          operator: Exists
-            - sysctl
+          effect: NoSchedule
-            - -w
-            - vm.max_map_count=262144
-          securityContext:
-            privileged: true
       
       containers:
         - name: opensearch
@@ -400,18 +395,6 @@ spec:
 
 ---
 
-# Secret: OpenSearch Dashboards password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-dashboards-secret
-  namespace: poimen
-type: Opaque
-stringData:
-  password: "admin"  # ⚠️  Change in production
-
----
-
 # ServiceAccount for OpenSearch Dashboards
 apiVersion: v1
 kind: ServiceAccount
@@ -419,14 +402,4 @@ metadata:
   name: opensearch-dashboards
   namespace: poimen
 
----
+# Secrets moved to opensearch-secrets.enc.yaml (SOPS-encrypted)
-
-# Secret for OpenSearch Admin Password
-apiVersion: v1
-kind: Secret
-metadata:
-  name: opensearch-secrets
-  namespace: poimen
-type: Opaque
-stringData:
-  admin-password: "OpenSearch@Admin123!"