- Shipped
- August 3, 2026 at 3:07 PM UTC
- Author
- Kamo
- Commit
- 7a7f7d8
KAMO_MFA_SECRET_KEY maps to kamo.mfa.secret-key by Spring's relaxed binding, and is what MfaEnrollmentService uses to encrypt stored TOTP secrets at rest. Without it the service still starts — deliberately, so that deploying the code and configuring the key are not one atomic operation across the platform — but enrollment throws rather than writing a second-factor secret in the clear. That degrades the feature, never the service. Key generated on-cluster (32 random bytes, base64) as the secret `mfa-enc-key`; the value exists only in Kubernetes and was never printed or committed. Rotating it invalidates existing enrollments, which is why it is its own secret rather than being folded into an existing one.