security: encrypt ConfigMap with SOPS, remove plaintext secrets

- ConfigMap values encrypted with age/SOPS (YubiKey-gated) - Removed secrets.env, secret.yaml, poimen-application.yaml (plaintext) - Worker needs no secrets — uses local LLM via ClusterIP, JWT from activity input - Decrypt: sops-unlock && sops --decrypt k8s/configmap.enc.yaml
2026-09-06 05:56:49 -07:00
parent c2002022f2
commit 8a3375b775
6 changed files with 30 additions and 306 deletions
@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: k8s/.*\.enc\.ya?ml
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla