Provision secrets encryption key in bootstrap

[rowan-stein]

User Request

Add provisioning of the symmetric encryption key Kubernetes Secret for the Secrets service in bootstrap. The key should be configurable via a Terraform variable with a hardcoded default value for local dev.

Specification

1. New Terraform variable

File: stacks/platform/variables.tf

variable "secrets_encryption_key" {
  type        = string
  description = "Symmetric encryption key for locally-stored secret values in the Secrets service"
  default     = "dev-encryption-key-32bytes!!@#$%"
  sensitive   = true
}

2. New Kubernetes Secret resource

File: stacks/platform/main.tf

Add after the kubernetes_secret.litellm_master_key resource:

resource "kubernetes_secret_v1" "secrets_encryption_key" {
  metadata {
    name      = "secrets-encryption-key"
    namespace = kubernetes_namespace.platform.metadata[0].name
  }

  type = "Opaque"

  data = {
    encryptionKey = var.secrets_encryption_key
  }
}

3. Update secrets Helm values

File: stacks/platform/main.tf

Update the secrets_values local to include configMounts and env:

secrets_values = yamlencode({
  fullnameOverride = "secrets"
  service = {
    port = 50051
  }
  database = {
    url = format("postgresql://secrets:%s@secrets-db:5432/secrets?sslmode=disable", var.secrets_db_password)
  }
  image = {
    repository = "ghcr.io/agynio/secrets"
    tag        = local.resolved_secrets_image_tag
    pullPolicy = "IfNotPresent"
  }
  configMounts = [
    {
      name       = "encryption-key"
      sourceName = "secrets-encryption-key"
      type       = "secret"
      mountPath  = "/etc/secrets-encryption"
      readOnly   = true
    },
  ]
  env = [
    {
      name  = "ENCRYPTION_KEY_FILE"
      value = "/etc/secrets-encryption/encryptionKey"
    },
  ]
})

Patterns followed

• Terraform variable: same pattern as litellm_master_key (string, sensitive, hardcoded default)
• Kubernetes Secret: same pattern as kubernetes_secret_v1.ziti_management_enrollment (v1 resource, Opaque type)
• Helm configMounts + env: same pattern as ziti-management enrollment (configMounts with type=secret, env pointing to mounted file path)