Security: Implement secrets management and encryption

[monadic]

Priority: HIGH

Description

Database passwords and API keys are currently hardcoded in deployment manifests. No encryption is configured for data in transit between services.

Impact

• Credentials exposed in ConfigHub units
• Unencrypted internal traffic vulnerable to MITM
• Compliance violation for sensitive data

Required Actions

1. Integrate with external secret manager (Vault, AWS Secrets Manager, etc.)
2. Use Kubernetes Secrets for sensitive data
3. Enable TLS for all inter-service communication
4. Encrypt data at rest with encrypted PVCs

Acceptance Criteria

• No hardcoded credentials in manifests
• Secrets stored in external vault
• TLS enabled for all services
• PVCs encrypted at rest

References

• PCI-DSS 2.3 (Encrypt transmissions)
• Original finding in SECURITY-REVIEW.md