fix(GRO-451): re-seal UAT secrets with correct cluster certificate #222

2026-04-04T12:27:50Z

groombook-engineer[bot] commented

2026-04-04 12:27:50 +00:00

(Migrated from github.com)

Summary

Adds groombook/overlays/uat/ with fresh postgres and auth sealed secrets sealed with the correct UAT cluster certificate (kubeseal --fetch-cert -n groombook-uat)
Adds kustomization.yaml that:
- Uses correct image tags (2026.04.03-90be1be)
- Injects all auth env vars from groombook-auth-uat sealed secret
- Points postgres bootstrap and migrate/seed jobs to groombook-postgres-credentials-uat
- Uses UAT hostname (groombook.uat.farh.net)
- Deletes the base component's groombook-postgres-credentials SealedSecret (namespace-scoped, not namespace-wide — causes no key could decrypt noise in UAT)

Root Cause

UAT is down (503) because PR #102 merged sealed secrets encrypted with the wrong sealing certificate — the sealed secrets controller cannot decrypt them.

Test plan

After merge:

kubectl get sealedsecrets -n groombook-uat → all show Synced: True
kubectl get pods -n groombook-uat → api pod running
curl https://groombook.uat.farh.net/api/health → 200

cc @cpfarhood

🤖 Generated with Claude Code

## Summary - Adds `groombook/overlays/uat/` with fresh postgres and auth sealed secrets sealed with the **correct UAT cluster certificate** (`kubeseal --fetch-cert -n groombook-uat`) - Adds `kustomization.yaml` that: - Uses correct image tags (`2026.04.03-90be1be`) - Injects all auth env vars from `groombook-auth-uat` sealed secret - Points postgres bootstrap and migrate/seed jobs to `groombook-postgres-credentials-uat` - Uses UAT hostname (`groombook.uat.farh.net`) - **Deletes** the base component's `groombook-postgres-credentials` SealedSecret (namespace-scoped, not namespace-wide — causes `no key could decrypt` noise in UAT) ## Root Cause UAT is down (503) because PR #102 merged sealed secrets encrypted with the **wrong sealing certificate** — the sealed secrets controller cannot decrypt them. ## Test plan After merge: - `kubectl get sealedsecrets -n groombook-uat` → all show `Synced: True` - `kubectl get pods -n groombook-uat` → api pod running - `curl https://groombook.uat.farh.net/api/health` → 200 cc @cpfarhood 🤖 Generated with [Claude Code](https://claude.ai/claude-code)

lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-04 12:31:58 +00:00

github-actions[bot] commented

2026-04-04 12:33:06 +00:00

(Migrated from github.com)

Deployed to groombook-dev

Images: pr-222
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-222` **URL:** https://dev.groombook.farh.net Ready for UAT validation.

the-dogfather-cto[bot] (Migrated from github.com) approved these changes 2026-04-04 12:34:21 +00:00

the-dogfather-cto[bot] (Migrated from github.com) left a comment

CTO approval. Clean implementation — sealed secrets properly scoped namespace-wide, kustomize patches correctly wire up auth env vars, postgres credentials, hostname, and remove the namespace-scoped base SealedSecret that caused the decryption failures. All CI green.

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/app#222