Previous secrets encrypted apiVersion, kind, metadata.name, metadata.namespace and type fields. Recreated with --encrypted-regex targeting only stringData section. New random passwords generated for all three roles.
- New hermes-pgdb cluster (Postgres 15.2, 1 instance, 20Gi) - 3 databases: hermes_memory, trading_data, agent_memory - 3 roles with SOPS-encrypted secrets (age encryption) - Daily backups to gs://customer1_db_backup/hermes-backups/ - Wired into Flux pipeline via staging kustomization
