From 7889ed30f53dc372a1a3379b2b6b9f6719dd0634 Mon Sep 17 00:00:00 2001
From: Ashwin Kumar Sivakumar <ashwin@traceworks.in>
Date: Thu, 2 Jul 2026 18:00:10 +0530
Subject: [PATCH] Fix cross-namespace secretKeyRef in ai-assistant deployment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JWT_SECRET can't reference nxtgauge-backend-rust-secrets (namespace
nxtgauge) from the ai-assistant pod, which the prod overlay places in
nxtgauge-ai — Kubernetes secretKeyRef must be same-namespace. Duplicate
the value into nxtgauge-ai-assistant-secrets instead.
---
 apps/nxtgauge-ai-assistant/base/deployment.yaml | 4 ++--
 apps/nxtgauge-ai-assistant/base/secret.yaml     | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/apps/nxtgauge-ai-assistant/base/deployment.yaml b/apps/nxtgauge-ai-assistant/base/deployment.yaml
index e23761b..9ae3c56 100644
--- a/apps/nxtgauge-ai-assistant/base/deployment.yaml
+++ b/apps/nxtgauge-ai-assistant/base/deployment.yaml
@@ -44,8 +44,8 @@ spec:
             - name: JWT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: nxtgauge-backend-rust-secrets
-                  key: JWT_SECRET
+                  name: nxtgauge-ai-assistant-secrets
+                  key: jwt-secret
           resources:
             requests:
               cpu: 100m
diff --git a/apps/nxtgauge-ai-assistant/base/secret.yaml b/apps/nxtgauge-ai-assistant/base/secret.yaml
index 2b7aa18..8ef8586 100644
--- a/apps/nxtgauge-ai-assistant/base/secret.yaml
+++ b/apps/nxtgauge-ai-assistant/base/secret.yaml
@@ -7,6 +7,7 @@ type: Opaque
 stringData:
     #ENC[AES256_GCM,data:DzWkRm3f8tFc02M5GVMtvWxLscWMt/AsTW7U0+KenEDguLPOGZjSqTflKwlP11V7v7p3bCkvpmKFvRq3B8Qi0g3zzp0Q,iv:TA8ADbjVM5gw8zc6Synn/Ue6BT8k/PUtyvoNrXEgzd4=,tag:rhFeomxaYhX+pWmKjYW3fQ==,type:comment]
     ai-service-key: ENC[AES256_GCM,data:FjKo1h5loCYoXDOC4g37tLTbLU7lE+DewxMkUCXBO5op0tJByaXmBYy5ZZEDpplZxDsEPd4QiKoUg8bM9+2OSA==,iv:I//s3r9wSQujgtXPeFT1IArzu2LbObsFz7d8E0GN6iU=,tag:PkLaujtLklCWHQYGIB9uvQ==,type:str]
+    jwt-secret: ENC[AES256_GCM,data:yvyOL2w2QBq0yLz2UNf1YlqFpFX522j60h/lGGcjbEPgloYs1W7hAbPBfRsR//tySNRwR24PY5FcR2NPOFxqTg==,iv:JNPrJaCLgQb/JK7FIIy/hn3TwAmSmGj0N9oWtf5yI3w=,tag:cQp4ovPxyrCrF/ON+bmJkQ==,type:str]
 sops:
     age:
         - recipient: age1sqxc53yvap8763eup99g6eza6fa5u65qetdymlh5ch4ugvvv5q0sf3pm4l
@@ -18,7 +19,7 @@ sops:
             ckFFMndObTNzaFpyUVU5OTZOTUNiQXcKDPo+nnHRjPlswzW1WHQEde8Ae/icAsxH
             +aq9NUpDQ8FTCdIu0rtqVS1VaEyt1kXgBmrjHIJCIVVvFzTKfuXLGA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-07-02T12:18:28Z"
-    mac: ENC[AES256_GCM,data:DgCzaIaaDP4Q5lhOLkBmy1z0+kJ0CFBCGVal3WKiNpo8H9aEfArGsbvA4zleZphtzVP/R8GhegjUdkVXT+wZo30Py/4FLFuRxtiiUohxHCfaiqD/13KHKO6nEJPN3wV9Ab59x+PlWk8roDGuPggupUs7v4VdHKqk+qQwsaTuhiY=,iv:KdSKauwmArBWm817lFrYB7F7axx3TvKXBbbqOI0NOSg=,tag:dCi+4OgbyZKiXUZCR/I7ew==,type:str]
+    lastmodified: "2026-07-02T12:29:46Z"
+    mac: ENC[AES256_GCM,data:sEa957jGG3/hm+B13txCB18JdvOweUnfEf4rrtstzNrP1fnlwJl1/trWP72WDGyTPbY6t6Rh8XYeML8j7rgVjHowlkQdyXk6GTknUjDgwVQd/5mnDPwO9U6SGA5DM9SS49khcDcxvz4AqlAGTLT/l7EOymavwSLomkw4OOxEX3I=,iv:JBHSCDD/2u/xHViFlTJIXbeGkLldgFDGfAvDdqoMyjc=,tag:jrljvtbPEEOzFfAhYMIHCQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.10.2