- Shipped
- November 15, 2026 at 1:03 AM UTC
- Author
- Kamo
- Commit
- 602e1c6
The Secret *** (key ***) was created by hand in namespace kamo with the SAME value the live ConfigMap held (sha256 compared, value never printed). The Deployment reads it via secretKeyRef (not optional: a pod without it does not start and the old pods keep serving); the ConfigMap and application.yml now say "${***}", and the code has no default any more - PasswordEncoderConfig refuses a blank or 'default-pepper' value at startup, because a wrong pepper rejects every stored password instead of failing loudly. The stale literal in deploy/k8s/gen is scrubbed too. The old value is still in git history; it cannot be rotated without invalidating every password.