Previous secrets encrypted apiVersion, kind, metadata.name, metadata.namespace and type fields. Recreated with --encrypted-regex targeting only stringData section. New random passwords generated for all three roles.