From 605667df1d5c62b558684fd9ce60e7b25e0dcd7b Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes-agent@sirius0xdev.com>
Date: Mon, 25 May 2026 01:53:19 +0000
Subject: [PATCH] fix: wire JWT_SECRET_KEY in live kustomize path

Previous PR #139 added the secret to trading-platform/deploy/k8s/base/
but the live cluster uses apps/base/customer1/trading-platform/ kustomize.

- Create execute-service-jwt-secret.yaml (SOPS encrypted) in secrets/
- Add to secrets/ kustomization.yaml resources
- Wire JWT_SECRET_KEY env var in execute-service deployment
- Points to execute-service-jwt-secret via secretKeyRef
---
 .../execute-service/deployment.yaml           |  5 ++++
 .../secrets/execute-service-jwt-secret.yaml   | 28 +++++++++++++++++++
 .../secrets/kustomization.yaml                |  1 +
 3 files changed, 34 insertions(+)
 create mode 100644 apps/base/customer1/trading-platform/secrets/execute-service-jwt-secret.yaml

diff --git a/apps/base/customer1/trading-platform/execute-service/deployment.yaml b/apps/base/customer1/trading-platform/execute-service/deployment.yaml
index 1eed507..232b73f 100644
--- a/apps/base/customer1/trading-platform/execute-service/deployment.yaml
+++ b/apps/base/customer1/trading-platform/execute-service/deployment.yaml
@@ -58,6 +58,11 @@ spec:
                 secretKeyRef:
                   name: trading-db-credentials
                   key: password
+            - name: JWT_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: execute-service-jwt-secret
+                  key: JWT_SECRET_KEY
           startupProbe:
             httpGet:
               path: /health
diff --git a/apps/base/customer1/trading-platform/secrets/execute-service-jwt-secret.yaml b/apps/base/customer1/trading-platform/secrets/execute-service-jwt-secret.yaml
new file mode 100644
index 0000000..30906fb
--- /dev/null
+++ b/apps/base/customer1/trading-platform/secrets/execute-service-jwt-secret.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: execute-service-jwt-secret
+    namespace: customer1
+type: Opaque
+stringData:
+    JWT_SECRET_KEY: ENC[AES256_GCM,data:XGO6xkUuVTtOod5+fJ2pFZixQZwxO3Ob20VwoTaJpBLphwoH4cUwuIVXEaqH7azFA9ffaDlvk+155659JKAbkg==,iv:EZiTKcPswqyM3WvKYTLlYBqXKxrI+GqG+a10SK7H3lM=,tag:38OLXoHUgj/3f+a5MO3akA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXdjI0OElSMURaZVR0NHd6
+            bThjQzhPUjdSZmg0YXZqUjVnM3JkQlV4cnpFCmdoQVBGVVBIdjUxTThXclR5RnBu
+            QmJYb0xwM2FzRDlhdVM3NHpSc25mQ0EKLS0tIDE0R2JjTEEvMDlKWFFmdy9mSDVa
+            b0JvTFZjaHRpZ3Y1MTdKRDlBQlNpTzgKER8m3SSQNpORgy8dAb6tAxlyQqoyviuX
+            l749N8QN5U/RV2pqtsbfX7KKZNlAzXftp1Kpb1OpVuQApi7umAFCrg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-25T01:52:12Z"
+    mac: ENC[AES256_GCM,data:Zjvn6YPt+IQgQHgeBAqu9tB+lQM3yBo2ee8MT96lRcRlprdlbsRkugTjoshKO7yq6tkOK0o6k/iYBRx3QHnf3TDZ3KNkb11cyfsPPHBe1nHzzD1MCiQvZU/7TwLOwTPDC3hV+ceOnss3ACU2IkwqzVPROHM6zMSHvoa1XMvckBY=,iv:diaOY6qxOFL3h72H35NqW88rSf9Iii8cwhs46qDobXQ=,tag:TzrJLEYhJ98/ee1gMS3m4w==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.0
diff --git a/apps/base/customer1/trading-platform/secrets/kustomization.yaml b/apps/base/customer1/trading-platform/secrets/kustomization.yaml
index c7525ed..fab102a 100644
--- a/apps/base/customer1/trading-platform/secrets/kustomization.yaml
+++ b/apps/base/customer1/trading-platform/secrets/kustomization.yaml
@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
   - trading-secrets.yaml
+  - execute-service-jwt-secret.yaml