Add improvements

infrastructure/kubernetes/base/components/cert-manager/cluster-issuer-production.yaml

@@ -8,7 +8,7 @@ spec:
     # The ACME server URL (Let's Encrypt production)
     server: https://acme-v02.api.letsencrypt.org/directory
     # Email address used for ACME registration
-    email: admin@bakery-ia.local  # Change this to your email
+    email: admin@bakewise.ai
     # Name of a secret used to store the ACME account private key
     privateKeySecretRef:
       name: letsencrypt-production

infrastructure/kubernetes/base/components/demo-session/deployment.yaml

@@ -66,8 +66,6 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        - name: CLONE_JOB_IMAGE
-          value: "bakery/inventory-service:latest"
         resources:
           requests:
             memory: "256Mi"

infrastructure/kubernetes/base/deployments/demo-cleanup-worker.yaml

@@ -44,11 +44,6 @@ spec:
           value: "rediss://:$(REDIS_PASSWORD)@redis-service:6379/0?ssl_cert_reqs=none"
         - name: LOG_LEVEL
           value: "INFO"
-        - name: INTERNAL_API_KEY
-          valueFrom:
-            secretKeyRef:
-              name: demo-internal-api-key
-              key: INTERNAL_API_KEY
         - name: INVENTORY_SERVICE_URL
           value: "http://inventory-service:8000"
         - name: RECIPES_SERVICE_URL

infrastructure/kubernetes/base/kustomization.yaml

@@ -15,7 +15,6 @@ resources:
   - configmaps/postgres-logging-config.yaml
   - secrets/postgres-tls-secret.yaml
   - secrets/redis-tls-secret.yaml
-  - secrets/demo-internal-api-key-secret.yaml
 
   # Additional configs
   - configs/postgres-init-config.yaml
@@ -23,7 +22,8 @@ resources:
   # Migration jobs
   - migrations/auth-migration-job.yaml
   - migrations/tenant-migration-job.yaml
-  - migrations/tenant-seed-pilot-coupon-job.yaml
+  # Note: tenant-seed-pilot-coupon-job.yaml removed - pilot coupon is now seeded
+  # automatically during tenant-service startup (see app/jobs/startup_seeder.py)
   - migrations/training-migration-job.yaml
   - migrations/forecasting-migration-job.yaml
   - migrations/sales-migration-job.yaml

infrastructure/kubernetes/base/migrations/tenant-seed-pilot-coupon-job.yaml

@@ -1,76 +0,0 @@
-# Seed job for PILOT2025 coupon - runs after tenant migration
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: tenant-seed-pilot-coupon
-  namespace: bakery-ia
-  labels:
-    app.kubernetes.io/name: tenant-seed-pilot-coupon
-    app.kubernetes.io/component: seed
-    app.kubernetes.io/part-of: bakery-ia
-spec:
-  backoffLimit: 3
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: tenant-seed-pilot-coupon
-        app.kubernetes.io/component: seed
-    spec:
-      imagePullSecrets:
-      - name: dockerhub-creds
-      serviceAccountName: demo-seed-sa
-      initContainers:
-      - name: wait-for-tenant-migration
-        image: busybox:1.36
-        command:
-        - sh
-        - -c
-        - |
-          echo "Waiting 30 seconds for tenant-migration to complete..."
-          sleep 30
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "100m"
-      - name: wait-for-tenant-service
-        image: curlimages/curl:latest
-        command:
-        - sh
-        - -c
-        - |
-          echo "Waiting for tenant-service to be ready..."
-          until curl -f http://tenant-service.bakery-ia.svc.cluster.local:8000/health/ready > /dev/null 2>&1; do
-            echo "tenant-service not ready yet, waiting..."
-            sleep 5
-          done
-          echo "tenant-service is ready!"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "100m"
-      containers:
-      - name: seed-coupon
-        image: bakery/tenant-service:dev
-        command: ["python", "/app/scripts/seed_pilot_coupon.py"]
-        env:
-        - name: TENANT_DATABASE_URL
-          valueFrom:
-            secretKeyRef:
-              name: database-secrets
-              key: TENANT_DATABASE_URL
-        - name: LOG_LEVEL
-          value: "INFO"
-        resources:
-          requests:
-            memory: "256Mi"
-            cpu: "100m"
-          limits:
-            memory: "512Mi"
-            cpu: "500m"
-      restartPolicy: OnFailure

infrastructure/kubernetes/base/secrets.yaml

@@ -29,54 +29,54 @@ data:
   AI_INSIGHTS_DB_USER: YWlfaW5zaWdodHNfdXNlcg==  # ai_insights_user
   DISTRIBUTION_DB_USER: ZGlzdHJpYnV0aW9uX3VzZXI=  # distribution_user
 
-  # Database Passwords (base64 encoded from .env)
-  AUTH_DB_PASSWORD: djJvOHBqVWRSUVprR1JsbDlOV2JXdGt4WUFGcVBmOWw= # v2o8pjUdRQZkGRll...
-  TENANT_DB_PASSWORD: bnNDVFpONkJsMDBjcWswZGNzcnVwUXRVWERFQ2dNVnY= # nsCTZN6Bl00cqk0d...
-  TRAINING_DB_PASSWORD: UGxwVklOZlpCaXNOcFBpekNWQndKMTM3Q2lwQTlKUDE= # PlpVINfZBisNpPiz...
-  FORECASTING_DB_PASSWORD: eElVNDVJdjFEWXVXajhiSWczdWprR05TdUZuMjhuVzc= # xIU45Iv1DYuWj8bI...
-  SALES_DB_PASSWORD: QUdkOTdZb3ZXc1c1ZURCMWtLeTEwQkg3YTZGYUpUSkQ= # AGd97YovWsW5eDB1...
-  EXTERNAL_DB_PASSWORD: OFJCSHR4a1dVYjFUTm1DeGV2d2Q1VzhnV3hQREpBcGU= # 8RBHtxkWUb1TNmCx...
-  NOTIFICATION_DB_PASSWORD: ZENDM21LMEVGSXZhRUV6Sm1naEFJTzJIbTg2Y2psRko= # dCC3mK0EFIvaEEzJ...
-  INVENTORY_DB_PASSWORD: VDB1Sm5YczByNFRVbXhTUWVRMkR1UUdQNkhVMExFYmE= # T0uJnXs0r4TUmxSQ...
-  RECIPES_DB_PASSWORD: MlFDRjlwc1R3WmpTaE9KNEE5d1dZOUlNMnVJc2pJc3Y= # 2QCF9psTwZjShOJ4...
-  SUPPLIERS_DB_PASSWORD: cG1LNjFMY2drVDBmY25OaFZZQ25heGdFZlRJV2tBVng= # pmK61LcgkT0fcnNh...
-  POS_DB_PASSWORD: OGxLZzN1RWlJTFBmVTJiRnlHTXdWTWhTc1RQOFRCeGg= # 8lKg3uEiILPfU2bF...
-  ORDERS_DB_PASSWORD: VFR1ZEJpbTdOVlJrcFlYejkzNEVUY0lFZGdlYTZ3VE4= # TTudBim7NVRkpYXz...
-  PRODUCTION_DB_PASSWORD: bFNZSDRacFBieHlIQXMweVRzelRWWWRSc3lBUjFKYUc= # lSYH4ZpPbxyHAs0y...
-  ALERT_PROCESSOR_DB_PASSWORD: T0NqMmtzaHdSNmNZNFFoT3U4SlpsR2RPZnF5Y0ZtV2Y= # OCj2kshwR6cY4QhO...
-  DEMO_SESSION_DB_PASSWORD: ZGVtb19zZXNzaW9uX3Bhc3MxMjM=  # demo_session_pass123
-  ORCHESTRATOR_DB_PASSWORD: b3JjaGVzdHJhdG9yX3Bhc3MxMjM=  # orchestrator_pass123
-  PROCUREMENT_DB_PASSWORD: cHJvY3VyZW1lbnRfcGFzczEyMw==  # procurement_pass123
-  AI_INSIGHTS_DB_PASSWORD: YWlfaW5zaWdodHNfcGFzczEyMw==  # ai_insights_pass123
-  DISTRIBUTION_DB_PASSWORD: ZGlzdHJpYnV0aW9uX3Bhc3MxMjM=  # distribution_pass123
+  # Database Passwords (base64 encoded - URL-SAFE PRODUCTION PASSWORDS)
+  AUTH_DB_PASSWORD: RThLejQ3WW1WekRsSEdzMU05d0FiSnp4Y0tuR09OQ1Q=  # E8Kz47YmVzDlHGs1M9wAbJzxcKnGONCT
+  TENANT_DB_PASSWORD: VW5tV0VBNlJkaWZncGdoV2N4Zkh2ME1veVVnbUY0ekg=  # UnmWEA6RdifgpghWcxfHv0MoyUgmF4zH
+  TRAINING_DB_PASSWORD: WnZhMzNoaVBJc2ZtV3RxUlBWV29taTRYZ2xLTlZPcHY=  # Zva33hiPIsfmWtqRPVWomi4XglKNVOpv
+  FORECASTING_DB_PASSWORD: QU9CN0Z1SkczVFFSWXptdFJXZHZja3JuQzdsSGtJSHQ=  # AOB7FuJG3TQRYzmtRWdvckrnC7lHkIHt
+  SALES_DB_PASSWORD: NlN1R1lETFRiZjdjWGJZb1RETGlGU2ZSZDBmU2FpMXA=  # 6SuGYDLTbf7cXbYoTDLiFSfRd0fSai1p
+  EXTERNAL_DB_PASSWORD: anlOZE1YRWVBdnhLZWxHOElqMVptRjk4c3l2R3JicTc=  # jyNdMXEeAvxKelG8Ij1ZmF98syvGrbq7
+  NOTIFICATION_DB_PASSWORD: NWJ0YzVZWExjUnZBaGE3dzFaNExNNnNoSmRxU21oVGQ=  # 5btc5YXLcRvAha7w1Z4LM6shJdqSmhTd
+  INVENTORY_DB_PASSWORD: NU5hc09uR1M1RTlXbkV0cDNDcFBvUEVpUWxGQXdlWEQ=  # 5NasOnGS5E9WnEtp3CpPoPEiQlFAweXD
+  RECIPES_DB_PASSWORD: QlRvc2IzMDlpc05DeHFmV25WZFhQZ0xMTUI5VmM5RXQ=  # BTosb309isNCxqfWnVdXPgLLMB9Vc9Et
+  SUPPLIERS_DB_PASSWORD: ZjVUQzd1ekVUblI0ZkowWWdPNFRoMDQ1QkN4Mk9CcWs=  # f5TC7uzETnR4fJ0YgO4Th045BCx2OBqk
+  POS_DB_PASSWORD: Q1hIdE5nTTFEYmRiR2VGYTdRWE5lTkttbVAxVWRsc08=  # CXHtNgM1DbdbGeFa7QXNeNKmmP1UdlsO
+  ORDERS_DB_PASSWORD: emU1aVJncVpVTm1DaHNRbjV3MGFDWFBqb3h1MXdNSDk=  # ze5iRgqZUNmChsQn5w0aCXPjoxu1wMH9
+  PRODUCTION_DB_PASSWORD: SVpaUjZ5dzFqUmFPM29iVUtBQWJaODNLMEdmeTNqbWI=  # IZZR6yw1jRaO3obUKAAbZ83K0Gfy3jmb
+  ALERT_PROCESSOR_DB_PASSWORD: WklyWjBNQnFsRHZsTXJtcndndnZ2UUwzNm5yWFFqdDU=  # ZIrZ0MBqlDvlMrmrwgvvvQL36nrXQjt5
+  DEMO_SESSION_DB_PASSWORD: R291ZWlkcWFSNDhJejJFMDdmT0tyd3BSeXBtMjV1cW4=  # GoueidqaR48Iz2E07fOKrwpRypm25uqn
+  ORCHESTRATOR_DB_PASSWORD: cndCZTdZck5GMVRCMkE3N3U5cUVVTGtWdEJlbU1xdm8=  # rwBe7YrNF1TB2A77u9qEULkVtBemMqvo
+  PROCUREMENT_DB_PASSWORD: dUNhRHllZm5aMXhpd21TcDRNMnQ3QzQ1bkJieGltT1g=  # uCaDyefnZ1xiwmSp4M2t7C45nBbximOX
+  AI_INSIGHTS_DB_PASSWORD: ZGp6M2M1T09KYkJOT28yd2VTY0l0dmlra0pyV2l5dUw=  # djz3c5OOJbBNOo2weScItvikkJrWiyuL
+  DISTRIBUTION_DB_PASSWORD: ZGp6M2M1T09KYkJOT28yd2VTY0l0dmlra0pyV2l5dUw=  # djz3c5OOJbBNOo2weScItvikkJrWiyuL
 
-  # Database URLs (base64 encoded)
-  AUTH_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYXV0aF91c2VyOnYybzhwalVkUlFaa0dSbGw5TldiV3RreFlBRnFQZjlsQGF1dGgtZGItc2VydmljZTo1NDMyL2F1dGhfZGI= # Updated with new password
-  TENANT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdGVuYW50X3VzZXI6bnNDVFpONkJsMDBjcWswZGNzcnVwUXRVWERFQ2dNVnZAdGVuYW50LWRiLXNlcnZpY2U6NTQzMi90ZW5hbnRfZGI= # Updated with new password
-  TRAINING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdHJhaW5pbmdfdXNlcjpQbHBWSU5mWkJpc05wUGl6Q1ZCd0oxMzdDaXBBOUpQMUB0cmFpbmluZy1kYi1zZXJ2aWNlOjU0MzIvdHJhaW5pbmdfZGI= # Updated with new password
-  FORECASTING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZm9yZWNhc3RpbmdfdXNlcjp4SVU0NUl2MURZdVdqOGJJZzN1amtHTlN1Rm4yOG5XN0Bmb3JlY2FzdGluZy1kYi1zZXJ2aWNlOjU0MzIvZm9yZWNhc3RpbmdfZGI= # Updated with new password
-  SALES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc2FsZXNfdXNlcjpBR2Q5N1lvdldzVzVlREIxa0t5MTBCSDdhNkZhSlRKREBzYWxlcy1kYi1zZXJ2aWNlOjU0MzIvc2FsZXNfZGI= # Updated with new password
-  EXTERNAL_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZXh0ZXJuYWxfdXNlcjo4UkJIdHhrV1ViMVRObUN4ZXZ3ZDVXOGdXeFBESkFwZUBleHRlcm5hbC1kYi1zZXJ2aWNlOjU0MzIvZXh0ZXJuYWxfZGI= # Updated with new password
-  NOTIFICATION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vbm90aWZpY2F0aW9uX3VzZXI6ZENDM21LMEVGSXZhRUV6Sm1naEFJTzJIbTg2Y2psRkpAbm90aWZpY2F0aW9uLWRiLXNlcnZpY2U6NTQzMi9ub3RpZmljYXRpb25fZGI= # Updated with new password
-  INVENTORY_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vaW52ZW50b3J5X3VzZXI6VDB1Sm5YczByNFRVbXhTUWVRMkR1UUdQNkhVMExFYmFAaW52ZW50b3J5LWRiLXNlcnZpY2U6NTQzMi9pbnZlbnRvcnlfZGI= # Updated with new password
-  RECIPES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcmVjaXBlc191c2VyOjJRQ0Y5cHNUd1pqU2hPSjRBOXdXWTlJTTJ1SXNqSXN2QHJlY2lwZXMtZGItc2VydmljZTo1NDMyL3JlY2lwZXNfZGI= # Updated with new password
-  SUPPLIERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc3VwcGxpZXJzX3VzZXI6cG1LNjFMY2drVDBmY25OaFZZQ25heGdFZlRJV2tBVnhAc3VwcGxpZXJzLWRiLXNlcnZpY2U6NTQzMi9zdXBwbGllcnNfZGI= # Updated with new password
-  POS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcG9zX3VzZXI6OGxLZzN1RWlJTFBmVTJiRnlHTXdWTWhTc1RQOFRCeGhAcG9zLWRiLXNlcnZpY2U6NTQzMi9wb3NfZGI= # Updated with new password
-  ORDERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JkZXJzX3VzZXI6VFR1ZEJpbTdOVlJrcFlYejkzNEVUY0lFZGdlYTZ3VE5Ab3JkZXJzLWRiLXNlcnZpY2U6NTQzMi9vcmRlcnNfZGI= # Updated with new password
-  PRODUCTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvZHVjdGlvbl91c2VyOmxTWUg0WnBQYnh5SEFzMHlUc3pUVllkUnN5QVIxSmFHQHByb2R1Y3Rpb24tZGItc2VydmljZTo1NDMyL3Byb2R1Y3Rpb25fZGI= # Updated with new password
-  ALERT_PROCESSOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWxlcnRfcHJvY2Vzc29yX3VzZXI6T0NqMmtzaHdSNmNZNFFoT3U4SlpsR2RPZnF5Y0ZtV2ZAYWxlcnQtcHJvY2Vzc29yLWRiLXNlcnZpY2U6NTQzMi9hbGVydF9wcm9jZXNzb3JfZGI= # Updated with new password
-  DEMO_SESSION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZGVtb19zZXNzaW9uX3VzZXI6ZGVtb19zZXNzaW9uX3Bhc3MxMjNAZGVtby1zZXNzaW9uLWRiLXNlcnZpY2U6NTQzMi9kZW1vX3Nlc3Npb25fZGI=  # postgresql+asyncpg://demo_session_user:demo_session_pass123@demo-session-db-service:5432/demo_session_db
-  ORCHESTRATOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JjaGVzdHJhdG9yX3VzZXI6b3JjaGVzdHJhdG9yX3Bhc3MxMjNAb3JjaGVzdHJhdG9yLWRiLXNlcnZpY2U6NTQzMi9vcmNoZXN0cmF0b3JfZGI=  # postgresql+asyncpg://orchestrator_user:orchestrator_pass123@orchestrator-db-service:5432/orchestrator_db
-  PROCUREMENT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvY3VyZW1lbnRfdXNlcjpwcm9jdXJlbWVudF9wYXNzMTIzQHByb2N1cmVtZW50LWRiLXNlcnZpY2U6NTQzMi9wcm9jdXJlbWVudF9kYg==  # postgresql+asyncpg://procurement_user:procurement_pass123@procurement-db-service:5432/procurement_db
-  AI_INSIGHTS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWlfaW5zaWdodHNfdXNlcjphaV9pbnNpZ2h0c19wYXNzMTIzQGFpLWluc2lnaHRzLWRiLXNlcnZpY2U6NTQzMi9haV9pbnNpZ2h0c19kYg==  # postgresql+asyncpg://ai_insights_user:ai_insights_pass123@ai-insights-db-service:5432/ai_insights_db
-  DISTRIBUTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZGlzdHJpYnV0aW9uX3VzZXI6ZGlzdHJpYnV0aW9uX3Bhc3MxMjNAZGlzdHJpYnV0aW9uLWRiLXNlcnZpY2U6NTQzMi9kaXN0cmlidXRpb25fZGI=  # postgresql+asyncpg://distribution_user:distribution_pass123@distribution-db-service:5432/distribution_db
+  # Database URLs (base64 encoded - with strong passwords)
+  AUTH_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYXV0aF91c2VyOkU4S3o0N1ltVnpEbEhHczFNOXdBYkp6eGNLbkdPTkNUQGF1dGgtZGItc2VydmljZTo1NDMyL2F1dGhfZGI=
+  TENANT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdGVuYW50X3VzZXI6VW5tV0VBNlJkaWZncGdoV2N4Zkh2ME1veVVnbUY0ekhAdGVuYW50LWRiLXNlcnZpY2U6NTQzMi90ZW5hbnRfZGI=
+  TRAINING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vdHJhaW5pbmdfdXNlcjpadmEzM2hpUElzZm1XdHFSUFZXb21pNFhnbEtOVk9wdkB0cmFpbmluZy1kYi1zZXJ2aWNlOjU0MzIvdHJhaW5pbmdfZGI=
+  FORECASTING_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZm9yZWNhc3RpbmdfdXNlcjpBT0I3RnVKRzNUUVJZem10UldkdmNrcm5DN2xIa0lIdEBmb3JlY2FzdGluZy1kYi1zZXJ2aWNlOjU0MzIvZm9yZWNhc3RpbmdfZGI=
+  SALES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc2FsZXNfdXNlcjo2U3VHWURMVGJmN2NYYllvVERMaUZTZlJkMGZTYWkxcEBzYWxlcy1kYi1zZXJ2aWNlOjU0MzIvc2FsZXNfZGI=
+  EXTERNAL_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZXh0ZXJuYWxfdXNlcjpqeU5kTVhFZUF2eEtlbEc4SWoxWm1GOThzeXZHcmJxN0BleHRlcm5hbC1kYi1zZXJ2aWNlOjU0MzIvZXh0ZXJuYWxfZGI=
+  NOTIFICATION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vbm90aWZpY2F0aW9uX3VzZXI6NWJ0YzVZWExjUnZBaGE3dzFaNExNNnNoSmRxU21oVGRAbm90aWZpY2F0aW9uLWRiLXNlcnZpY2U6NTQzMi9ub3RpZmljYXRpb25fZGI=
+  INVENTORY_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vaW52ZW50b3J5X3VzZXI6NU5hc09uR1M1RTlXbkV0cDNDcFBvUEVpUWxGQXdlWERAaW52ZW50b3J5LWRiLXNlcnZpY2U6NTQzMi9pbnZlbnRvcnlfZGI=
+  RECIPES_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcmVjaXBlc191c2VyOkJUb3NiMzA5aXNOQ3hxZlduVmRYUGdMTE1COVZjOUV0QHJlY2lwZXMtZGItc2VydmljZTo1NDMyL3JlY2lwZXNfZGI=
+  SUPPLIERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vc3VwcGxpZXJzX3VzZXI6ZjVUQzd1ekVUblI0ZkowWWdPNFRoMDQ1QkN4Mk9CcWtAc3VwcGxpZXJzLWRiLXNlcnZpY2U6NTQzMi9zdXBwbGllcnNfZGI=
+  POS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcG9zX3VzZXI6Q1hIdE5nTTFEYmRiR2VGYTdRWE5lTkttbVAxVWRsc09AcG9zLWRiLXNlcnZpY2U6NTQzMi9wb3NfZGI=
+  ORDERS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JkZXJzX3VzZXI6emU1aVJncVpVTm1DaHNRbjV3MGFDWFBqb3h1MXdNSDlAb3JkZXJzLWRiLXNlcnZpY2U6NTQzMi9vcmRlcnNfZGI=
+  PRODUCTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvZHVjdGlvbl91c2VyOklaWlI2eXcxalJhTzNvYlVLQUFiWjgzSzBHZnkzam1iQHByb2R1Y3Rpb24tZGItc2VydmljZTo1NDMyL3Byb2R1Y3Rpb25fZGI=
+  ALERT_PROCESSOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWxlcnRfcHJvY2Vzc29yX3VzZXI6WklyWjBNQnFsRHZsTXJtcndndnZ2UUwzNm5yWFFqdDVAYWxlcnQtcHJvY2Vzc29yLWRiLXNlcnZpY2U6NTQzMi9hbGVydF9wcm9jZXNzb3JfZGI=
+  DEMO_SESSION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZGVtb19zZXNzaW9uX3VzZXI6R291ZWlkcWFSNDhJejJFMDdmT0tyd3BSeXBtMjV1cW5AZGVtby1zZXNzaW9uLWRiLXNlcnZpY2U6NTQzMi9kZW1vX3Nlc3Npb25fZGI=
+  ORCHESTRATOR_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vb3JjaGVzdHJhdG9yX3VzZXI6cndCZTdZck5GMVRCMkE3N3U5cUVVTGtWdEJlbU1xdm9Ab3JjaGVzdHJhdG9yLWRiLXNlcnZpY2U6NTQzMi9vcmNoZXN0cmF0b3JfZGI=
+  PROCUREMENT_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vcHJvY3VyZW1lbnRfdXNlcjp1Q2FEeWVmbloxeGl3bVNwNE0ydDdDNDVuQmJ4aW1PWEBwcm9jdXJlbWVudC1kYi1zZXJ2aWNlOjU0MzIvcHJvY3VyZW1lbnRfZGI=
+  AI_INSIGHTS_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vYWlfaW5zaWdodHNfdXNlcjpkanozYzVPT0piQk5PbzJ3ZVNjSXR2aWtrSnJXaXl1TEBhaS1pbnNpZ2h0cy1kYi1zZXJ2aWNlOjU0MzIvYWlfaW5zaWdodHNfZGI=
+  DISTRIBUTION_DATABASE_URL: cG9zdGdyZXNxbCthc3luY3BnOi8vZGlzdHJpYnV0aW9uX3VzZXI6ZGp6M2M1T09KYkJOT28yd2VTY0l0dmlra0pyV2l5dUxAZGlzdHJpYnV0aW9uLWRiLXNlcnZpY2U6NTQzMi9kaXN0cmlidXRpb25fZGI=
 
   # PostgreSQL Monitoring User (for SigNoz metrics collection)
   POSTGRES_MONITOR_USER: bW9uaXRvcmluZw==  # monitoring
   POSTGRES_MONITOR_PASSWORD: bW9uaXRvcmluZ18zNjlmOWMwMDFmMjQyYjA3ZWY5ZTI4MjZlMTcxNjljYQ==  # monitoring_369f9c001f242b07ef9e2826e17169ca
 
-  # Redis URL
-  REDIS_URL: cmVkaXM6Ly86T3hkbWRKamRWTlhwMzdNTkMySUZvTW5UcGZHR0Z2MWtAcmVkaXMtc2VydmljZTo2Mzc5LzA= # redis://:OxdmdJjdVNXp37MNC2IFoMnTpfGGFv1k@redis-service:6379/0
+  # Redis URL (URL-safe password)
+  REDIS_URL: cmVkaXM6Ly86SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0FAcmVkaXMtc2VydmljZTo2Mzc5LzA=  # redis://:J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A@redis-service:6379/0
 
 ---
 apiVersion: v1
@@ -89,7 +89,7 @@ metadata:
     app.kubernetes.io/component: redis
 type: Opaque
 data:
-  REDIS_PASSWORD: T3hkbWRKamRWTlhwMzdNTkMySUZvTW5UcGZHR0Z2MWs= # OxdmdJjdVNXp37MN...
+  REDIS_PASSWORD: SjNsa2x4cHU5QzlPTElLdkJteFVIT2h0czFnc0lvM0E=  # J3lklxpu9C9OLIKvBmxUHOhts1gsIo3A
 
 ---
 apiVersion: v1
@@ -103,8 +103,8 @@ metadata:
 type: Opaque
 data:
   RABBITMQ_USER: YmFrZXJ5  # bakery
-  RABBITMQ_PASSWORD: Zm9yZWNhc3QxMjM=  # forecast123
-  RABBITMQ_ERLANG_COOKIE: YmFrZXJ5LXNlY3JldC1jb29raWU=  # bakery-secret-cookie
+  RABBITMQ_PASSWORD: VzJYS2tSdUxpT25ZS2RCWVFTQXJvbjFpeWtFU1M1b2I=  # W2XKkRuLiOnYKdBYQSAron1iykESS5ob
+  RABBITMQ_ERLANG_COOKIE: YzU4MzQ2NzBhYjU1OTA1MTUzZTM1Yjg3ZmVhOTZkNWMxNGM4ODExZjIwM2E3YWI3NmE5MWRjMGE5MWQ4ZDBiNA==  # c5834670ab55905153e35b87fea96d5c14c8811f203a7ab76a91dc0a91d8d0b4
 
 ---
 apiVersion: v1
@@ -117,9 +117,9 @@ metadata:
     app.kubernetes.io/component: auth
 type: Opaque
 data:
-  JWT_SECRET_KEY: eW91ci1zdXBlci1zZWNyZXQtand0LWtleS1jaGFuZ2UtaW4tcHJvZHVjdGlvbi1taW4tMzItY2hhcmFjdGVycy1sb25n  # your-super-secret-jwt-key-change-in-production-min-32-characters-long
-  JWT_REFRESH_SECRET_KEY: eW91ci1zdXBlci1zZWNyZXQtcmVmcmVzaC1qd3Qta2V5LWNoYW5nZS1pbi1wcm9kdWN0aW9uLW1pbi0zMi1jaGFyYWN0ZXJzLWxvbmc=  # your-super-secret-refresh-jwt-key-change-in-production-min-32-characters-long
-  SERVICE_API_KEY: c2VydmljZS1hcGkta2V5LWNoYW5nZS1pbi1wcm9kdWN0aW9u  # service-api-key-change-in-production
+  JWT_SECRET_KEY: dXNNSHc5a1FDUW95cmM3d1BtTWkzYkNscjBsVFk5d3Z6Wm1jVGJBRHZMMD0=  # usMHw9kQCQoyrc7wPmMi3bClr0lTY9wvzZmcTbADvL0=
+  JWT_REFRESH_SECRET_KEY: b2ZPRUlUWHBEUXM0a0pGcERTVWt4bDUwSmkxWUJKUmd3T0V5bStGRWNIST0=  # ofOEITXpDQs4kJFpDSUkxl50Ji1YBJRgwOEym+FEcHI=
+  SERVICE_API_KEY: Y2IyNjFiOTM0ZDQ3MDI5YTY0MTE3YzBlNDExMGM5M2Y2NmJiY2Y1ZWFhMTVjODRjNDI3MjdmYWQ3OGY3MTk2Yw==  # cb261b934d47029a64117c0e4110c93f66bbcf5eaa15c84c42727fad78f7196c
 
 ---
 apiVersion: v1

infrastructure/kubernetes/base/secrets/demo-internal-api-key-secret.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: demo-internal-api-key
-  namespace: bakery-ia
-type: Opaque
-stringData:
-  # IMPORTANT: Replace this with a secure randomly generated key in production
-  # Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
-  INTERNAL_API_KEY: "REPLACE_WITH_SECURE_RANDOM_KEY_IN_PRODUCTION"