fix(hermes-db): reencrypt secrets with correct encrypted-regex ^(data|stringData)$

Previous secrets encrypted apiVersion, kind, metadata.name, metadata.namespace
and type fields. Recreated with --encrypted-regex targeting only stringData
section. New random passwords generated for all three roles.

apps/base/customer1/hermes-db/hermes-db-credentials.yaml

@@ -1,24 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:txA=,iv:gCFjwoYIBFCTXOTBjND+corfessRLGUh313T8aVsO0M=,tag:V/SjrvWG2vLrFTBP9CpWNA==,type:str]
-kind: ENC[AES256_GCM,data:ZgEuMlxy,iv:Wp4ZPGH4ID7t8BGEsnJ/Rm7wIVm9rWPQYLfj3CJmo5s=,tag:bd1KCKO6eKgsJtJ4YcWW4A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:0iXVLY1JDCujP/JQWELIr5dP4uSB,iv:Das8czGXBlxz+hC8KWh9jZwXJCQ12v+P6tSL4DUL1S4=,tag:l4kKkLd4LvRxECg31ob2fg==,type:str]
-    namespace: ENC[AES256_GCM,data:p7hF20bNI6CI,iv:FNB+sXTcgKQdE/1MZuYlxNukMSx5mWNXqVOtnxbvOCo=,tag:lOmXwn+jF3JapOGPWzEz2w==,type:str]
-type: ENC[AES256_GCM,data:NLgmDHre,iv:xMs4To5h+yPgQuYOVP2pu53cA1yqsh8d91trr/gvAWg=,tag:1FNpJ4VqHwfXP5L2T0jG1w==,type:str]
+    name: hermes-db-credentials
+    namespace: customer1
+type: Opaque
 stringData:
-    username: ENC[AES256_GCM,data:Kyn8uqkj,iv:0BMWC+W8RiAOhKeaWwCwpoxug0t5nHBRPqRfeGZPaF0=,tag:ECYB03gU8kk5mWKu5ERbEg==,type:str]
-    password: ENC[AES256_GCM,data:iWw+TY9t68laPLRstPN7gybhyUP3bz6lpRTSnSdAgW0=,iv:hFOncdpn0AoQ5JywZxkwnrOnE+jb0rFIeoU2FcTnkqY=,tag:f+rjg2kfGNTfR3gb8kVRBA==,type:str]
+    username: ENC[AES256_GCM,data:R3DLxC5/,iv:Q9026dVs2OTUzSldYtDh1cMP/6qxW68pbhphJhwlk5Y=,tag:ISs06+LqVP/aR/oxYP0K/Q==,type:str]
+    password: ENC[AES256_GCM,data:u0bmdtnkLmrECk3N0LrO6T7Uwy7iqAfkgfK4TqS6H3k=,iv:6FYk+vHKr6jjizTkZChUsYQAKKNgA7dP6vgDETg9Lcg=,tag:FQ/hpK93OTbID9OT8XfzHA==,type:str]
 sops:
     age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+        - recipient: age1z674fe9c0whe6g55l9lpm6vssx0l9xyzw5rv42tucwua25gvvg6q42t77v
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRc2haZVlrUEJUV2F5bHFm
-            WG5qV2xVYzl4UE5aM3VBNE9JUnJ4YVI5V2dzCkVJM2NDZDd6MjZsdElYR09aRkgw
-            MXZ5anlGVW1laHl3T2k0M2ZiUHZ3cjgKLS0tIG9od1JtU1lJY0ZrSUdtWWMxV1FM
-            Vk92L1NWVGpkMWRUdmNpV1AxS1RSMzQKjITIDbSQp+aaKDzR48ENFmuY+dMTYPaQ
-            1P8zng4fQptC9RBvps327Z5kMIAtS52zYeoYgBwgdXNtTsaoO4ddmA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRcVcvVjJZeDdBWFZ2Nmox
+            YnVrVXBpUkhDUFNIMWMySnNtcXkyRU9tNnhFClhCWEFrSStneTYwVFZhbE9sUHlh
+            OHNsQWtjb1VyMnE1cGM1UWZKKytXWE0KLS0tIDVDclVnTFFTbWJ6SXdFblZBTkl4
+            UEpBUU1ldWZVc0Jadm1pUHVOaW04bnMKHWfeHUikSfN9+Q27eD1xsqbXbZ8H3T2X
+            MKVildkb3jtUIJvA1FS+8RU0LkhmsoxKtE1ox0XQ66dAZPa8UVgLQA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-02T21:29:40Z"
-    mac: ENC[AES256_GCM,data:ioHm0Go1hjO4VYKhEiu3e2Pdz+FzwDjlzQ5rWNbmuoCRW3bdqXpIvGNMyALBX7e+UCo+PwlNWiu3JrhszxdLptsySdCpzz0z04CZoQCbej66xdi4U49VvMVCJyZaRP5ZGFysXQghz0m0z4QoAcMSyZZGh8f8PnLewxORiXwrS7c=,iv:HXjO4oABWJCSUHN4dQiMXV1dFR0bxpDYSJXhBQ4G970=,tag:LIIY8pv+0/U/IfaB2D8vuQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    lastmodified: "2026-05-02T22:00:51Z"
+    mac: ENC[AES256_GCM,data:zOHEP8m1lGrcPMfpZ6aEBnQWfe1pAXBWk0z85ghkMxgM/a5pp24RvEzprRQBMpx36tnd+Xk3oYwCwTUVv0Y5xm7ZFK0tGSbXbKHrqNoOYPHPnbhG3GB7kIRcxlK4FJXy4BAPHJSUv5MrfIAmLj4Fa5XCbsDeqRWazyytUnrDNvc=,iv:SBsIMSE44I9wdcSmCg7KBetdnyjj63oFol5K2+54Y78=,tag:LeBp0JWAmjCvhcPcwOUvhw==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.12.2

apps/base/customer1/hermes-db/memory-db-credentials.yaml

@@ -1,24 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:2mQ=,iv:LNl1ueDj/seVjsPVQ20/CQJnbEr7Fd/BqMogFKbWgCo=,tag:fVqYeJV9BqKWifP1idQKjg==,type:str]
-kind: ENC[AES256_GCM,data:44E4DRzE,iv:zIn6ZIrZm44IJuLFERN+WTgctZ/04KkmxURtjsUFUXs=,tag:DbRfwktJT4jdc4TR39QYqQ==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:rQCpZs4/HHeRnO0OgCr65HhYK84W,iv:dUiKDy3zsp7EO+wd/QI0W0M8dPHYKSDzmCP80Y+XIIM=,tag:bKWz+FI/PtCewuSaVB1cUA==,type:str]
-    namespace: ENC[AES256_GCM,data:cGonbW6DupwQ,iv:6EGZKJeC77OSgUikYPRRkAPraIdRLFLaQ/FD2+C4gco=,tag:TSl9wo35AMfjU62gcq0lsg==,type:str]
-type: ENC[AES256_GCM,data:xXPsacph,iv:u2HydlElviV+Pvs7nsZutnQbK2TIRm88uk7u9/fJels=,tag:h8f7Dy8JpvAJzUWwzjsMUw==,type:str]
+    name: memory-db-credentials
+    namespace: customer1
+type: Opaque
 stringData:
-    username: ENC[AES256_GCM,data:VF38x+hU,iv:epSlTbTaVeOkpUZkLQ5QHuidsh5JEQkPz0HpqYQIvLI=,tag:HjZ/F29xirkNR3IMzyA+Dw==,type:str]
-    password: ENC[AES256_GCM,data:Wu015YXUwNMuIIAUZ4Vd7BDfQS137VuQynL4e7rqtw8=,iv:7xA4FdSOXPJTwkA7guYR1IhPHjlXXDjtCaRcdGJ52kQ=,tag:kw/oxGWhPeXDkBKvxg3vog==,type:str]
+    username: ENC[AES256_GCM,data:qCoYuXNK,iv:cZIJ9IgPWBnfGsNDFIT3T63v+jzxKMrTDcbY4R9ZXDk=,tag:THcqn7xE3UOFmq/YGEj8zg==,type:str]
+    password: ENC[AES256_GCM,data:S594bfUc+w83/M6eoMuzWaTboTmbBOjq5WEy+ExNzG8=,iv:JGLwfvei/SmMaLUneZ20/Pp8WsnWP+Ih87sTIyllDFA=,tag:VlH+4Wopp2z9J4MTSDYH2g==,type:str]
 sops:
     age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+        - recipient: age1z674fe9c0whe6g55l9lpm6vssx0l9xyzw5rv42tucwua25gvvg6q42t77v
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsMkE4N2R3bTVRUWtZdkVi
-            N1Q4ZEo5ZHdmZjFNdVAydHdMeXkzZURFZVFBCmJxWnVLQ0F6OU52Y3FTa0N3Y2ZU
-            M2trTjdZL3E3R1lXa29lOWlGTVFCenMKLS0tIHVhVllpTXNzQ0hSblhnYW56eHIv
-            OW9sRDJLcU54TmdXdGpsTCtlUlR5NmMK7n5nIwAzxJgvJw9VqStiCVCE9wuNzMX2
-            NaREHasP+XtJpB3AGkNgwBr/LW7cZKs5uvy8vKUFqhqpk/hcDsHjhg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXQU1PbFNMWTMyM2dxUlpp
+            eTRHbnRXSnk2bDR4VVZycmFUcUVZYVRvUTJnCkFuQURyMTQ0Y0RwUDZNQWpFRFMx
+            Q0ZHRHdzN2VCeU1vcWx6dzFKT3cwQk0KLS0tIDZYYkxoSGk1RmF5VjJkK09IejJ1
+            SmR0TGlHOGZad2NNa1grUVNGQnZNUFUKHAJhqYReMS+w5gjQqqHTWafy6etxLpDP
+            mRujATlpk85g60GeKB7mwWvvX82SpaOZ9GJ+LePjpXwdclIOusofhg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-02T21:29:40Z"
-    mac: ENC[AES256_GCM,data:1vcokwfS2/qfWqMWpfTl1wmsgMcx9tUbMv7IP13lzBc1j7YirW4xs+a52hxGFityPJgWvp4/XwdUbt06l33IF7dykN6vT9lFK4792Kx6KzdmCqP2eawtT2GKT1ewfmO1Mjr/YJ77o1qmaek7BPwNv+8vlDg0Wlerbt0jsy2SqCI=,iv:O98sE1/kNbUYaljxDevO9Ow0CbDz7VWcTCRY3wvwF6s=,tag:Yy1kzaKc1JCW6Wkny7ITHg==,type:str]
-    unencrypted_suffix: _unencrypted
+    lastmodified: "2026-05-02T22:00:51Z"
+    mac: ENC[AES256_GCM,data:5EPPuVDZNXYE50rnXQyxajV4Zs0gZX+Lu5Zf5oERLs/TqFEBTQkew3hMMLuMflg3WQME7f9vcOVIYNAXL93rUCt28KHDAxv5WSNyBIZdTuZvfsYK6+we41wjdehvTf4SqsX2KznBVJKIO65ypNUtzrW/rJCj440UwWpgm/B2+/0=,iv:umvqqa7eSVgsbTopdOz0vkJdVPQxa66SFQx9dDxovmg=,tag:SJmrzPoX4gdrdTNEj8qe1g==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.12.2

apps/base/customer1/hermes-db/trading-db-credentials.yaml

@@ -1,24 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:GSk=,iv:EtxocdVlzVEPk6rHozVdjwOgjWqZNdJfG2PWrVRF1Ik=,tag:pBINgiS3tVGO6iQ0seax/g==,type:str]
-kind: ENC[AES256_GCM,data:T5+vJT+t,iv:GEuW09nF9g3ZFOtFx6kJfgkx+U80QYXkVMQDJoAKh7E=,tag:OTsAfg7FiOoe4C6eyZCLyQ==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:iM8e0gyP/bheft8exNWIuLAu9AObog==,iv:73wEhFh6OVB+vZEvYY0uEQj4U7NgDoOstWmka57J72Y=,tag:vRTgvDqoX3ccZDIwybiH0w==,type:str]
-    namespace: ENC[AES256_GCM,data:65gK9YhIlftj,iv:uZC14McBjB1LTMhalbPH2KJinstaaZyvlVDDe2FvKCE=,tag:j2yuQ6bD5VRYhAV0JhxflQ==,type:str]
-type: ENC[AES256_GCM,data:rjywm84O,iv:Yp9tttUgySGPSMRiSmuMff544kp0+k09t0Q8jGHWjiM=,tag:xgsEUcmI20kfJVsEU+zTBQ==,type:str]
+    name: trading-db-credentials
+    namespace: customer1
+type: Opaque
 stringData:
-    username: ENC[AES256_GCM,data:MHbgLPzGjQ==,iv:hwINFxef3rnIetuD1aICeTly2Y9oVieQoRHTfKtEAyk=,tag:hnAirU6ib5aOpRf6JyYZpA==,type:str]
-    password: ENC[AES256_GCM,data:jrxJhvglCEa+Kwed1mrtT+JnrpmQ4leVMOv1jVVcGw8=,iv:jHyO1uw3eo9uJfwQBZcG/UdVwnpkkr1fsrb9uFCE7B8=,tag:V4VeDoD/I0RE62x2pIFiOA==,type:str]
+    username: ENC[AES256_GCM,data:fqozOGjMOA==,iv:+7yvkH0+PTQEqXbd2teyN+VqOLJBDPs03EzUBdOMgdw=,tag:a8wZr/hCbA5xd1tY7OYFAA==,type:str]
+    password: ENC[AES256_GCM,data:JBfMrq2fsQHGAaw5qGFcjrQc7ID+v1f4pq9uvZxup5o=,iv:CgcXAovSEHrtGmyFzlG8qMwsYhijec4w+CBtX26KgVI=,tag:Y1niqpPBZiDtwWQKipjjNA==,type:str]
 sops:
     age:
-        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+        - recipient: age1z674fe9c0whe6g55l9lpm6vssx0l9xyzw5rv42tucwua25gvvg6q42t77v
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnM0RsNm5UTCsxdWJJRjdp
-            d1ZZcitVZ1p3aGgzY3YvWVk5aVZIUzZxSWpnCmk1S0NwUXpqWWw1bUoxbW5Kcm9X
-            cjdlb3pqbkpvQm95K2lxY1JtNlRRZm8KLS0tIERyZFl5M0hJUDdxZlBTaGxGbm1z
-            M0U5ajRJeTI3TmltOWFoR1R3Sk1LQlkKht8ze+iqhdwucRbqiNMAnwvs+idhs159
-            JBnY8Y90O1UBAB/yUoACVjGf32d3c6iCSOi2L35FopTjXNREgcU5wQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVM3h1ajJsdkwxeG10ZklX
+            S0V5dVVpYm5rUmtHZVVzcFJITEhpaHlLVmw0Ckg4UTFoblZMUUo4RDZraXZ3bFJX
+            MXduaFc3eW1Hd0Y0K292ZzVzdW5OK00KLS0tIFFFejMxSkN0cDQrbjhLcVBhb25H
+            LzBTZ0pLbUJDUmsyN1JiTUFWUVU2dUEKogDQhc16qijRDOR3dVpOhTcm7TBXblhR
+            jn8rx6WODXrHTVqkRzJV7iYCvSb/mHCyRoBC5WvoUsNQTa4u2FtBkg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-02T21:29:40Z"
-    mac: ENC[AES256_GCM,data:Bjl+US5pStZ+xiCJ1l1xtDl4bVldkqme5fxMQN5WNsvalo/bKXElUpxVLf52n5jWcZjkjNHWuM407db3NQmSwXqz1o6+qmwIgfv3hz3JViUh0JSiSX/tDz8+yLEQ7fPVkvehxfWaZN2wJhyHhuPvkOmz9Fm+YSxqbw9DaWr2BkI=,iv:83n0XewztuAnIdb/CLPmseQLLbo/uw+rD8t67lxD1J8=,tag:KiKtZKPCX5BRfJfZ8xdDkg==,type:str]
-    unencrypted_suffix: _unencrypted
+    lastmodified: "2026-05-02T22:00:51Z"
+    mac: ENC[AES256_GCM,data:BNXMSqTw3tTnSaUTF2vHmg7NM/eA3DuomPKrbTQR2X4TKJtdj5KNs5RbC9DeWktFze1QtT3nreTAm5jAHAz4wjWGIjBgqPy2KBy/ivXOGQJlCf80fiBwHLYcF4J10MC7yRp/yiTOInAVhCwH+B+KHgCtHlvlOhRiKcrgwvdsB38=,iv:zOpLrG43GOynzWSR+90SC/xQwUckOjn03povK6/7z4A=,tag:AH9Gc1aqpHLnZ99FLZ2U2w==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.12.2