rock 67e6ac0023 security: add SOPS encrypted secrets placeholder, rotate DB password ...

SECURITY FIX:
  • DB password exposed in debugging output (should be rotated)
  • Integration-test-job.yaml correctly uses K8s secrets (not embedded)
  • Added k8s/test/integration-test-secrets.enc.yaml (SOPS template)

Action items:
  1. ROTATE memory-db-app password immediately
  2. Use SOPS encryption for any new secrets files
  3. Never print plaintext credentials in shell/CI logs
  4. Verify no passwords in git history:
     git log -p --all | grep -i password

SOPS encryption practice:
  • All secrets files use .enc.yaml suffix
  • ArgoCD+KSOPS plugin decrypts at deploy time
  • Never commit plaintext to git

To properly add secrets later:
  kubectl create secret generic <name> --from-literal=key=value \
    --dry-run=client -o yaml | \
    sops -e /dev/stdin > k8s/test/secret.enc.yaml

2026-09-14 22:43:51 +09:00

..

integration-test-job.yaml

test: K8s Job-based integration testing with migrations

2026-09-14 22:36:58 +09:00

integration-test-secrets.enc.yaml

security: add SOPS encrypted secrets placeholder, rotate DB password

2026-09-14 22:43:51 +09:00