fix(sops): set encrypted_regex to data/stringData and configure DNS fallback resolvers (#33)

### Summary of Changes

1. **SOPS Secret Encryption Scope**:
- Configured `encrypted_regex: '^(data|stringData)$'` in `.sops.yaml`.
- Re-encrypted PostgreSQL and Umami secrets so `apiVersion`, `kind`, and
`metadata.name` remain in clean plaintext.
- Prevents Kustomize controller panic on encrypted metadata during Flux
GitOps reconciliation.

2. **Reliable DNS Fallback**:
- Added standard fallback DNS resolvers (`1.1.1.1`, `8.8.8.8`,
`77.88.8.8`) to `03-cleanup.sh` and `bootstrap-cluster.sh`.

.sops.yaml

@@ -1,3 +1,4 @@
 creation_rules:
   - path_regex: ci/k8s/.*secret.*\.yaml$
+    encrypted_regex: '^(data|stringData)$'
     age: "age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl"

ci/cloud-init/user-data.template.yaml

@@ -94,6 +94,15 @@ write_files:
       #!/usr/bin/env bash
       set -euo pipefail
 
+      echo "=== [Bootstrap] Ensuring Reliable DNS Resolution ==="
+      if ! grep -q "nameserver" /etc/resolv.conf 2>/dev/null; then
+        cat << 'EOF_DNS' > /etc/resolv.conf
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 77.88.8.8
+EOF_DNS
+      fi
+
       echo "=== [Bootstrap] Applying Sysctl Hardening ==="
       sysctl --system
 

ci/k8s/apps/postgres/secret.sops.yaml

@@ -1,25 +1,25 @@
-apiVersion: ENC[AES256_GCM,data:XU0=,iv:0HP8xIgbhQzBxIAsUBnkxi7wWMuyedsyOMC+zO9Fvw8=,tag:H7rYCSkBAog0ut4eXP9dWQ==,type:str]
-kind: ENC[AES256_GCM,data:8nu6otux,iv:FiHwWJpQDxF/LS5lfqYsH3Fk3YCEp+OZstpmvgGI5s4=,tag:tsiQtQH/W3SQ1Dk7ov65NA==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:2PmmHyt4B6+tnYUb7R+zbA==,iv:Ox++aI1pcNWSnaYZRsto9hh1X9rrX9nb/Ra+MeDbAKI=,tag:kYfWd1QRRyEgb6RZ24OYGA==,type:str]
-    namespace: ENC[AES256_GCM,data:85gh76P2r88Y7KHsoQ==,iv:GPDJiMPubS/0VsIBlCKpYMrX2XWa+U/3pG3pHBIXFnI=,tag:HLMCW7lh9pQV3elfkSsBBA==,type:str]
-type: ENC[AES256_GCM,data:7QaM8COE,iv:2oml3iRBnXZvlGqAJEXBg3BR/hq7gw0f7+UoMFsxOtI=,tag:e7Ky0fjons6BQdsF/ynknw==,type:str]
+    name: postgres-secrets
+    namespace: com-ermnvldmr
+type: Opaque
 stringData:
-    POSTGRES_DB: ENC[AES256_GCM,data:+7B7L0Y=,iv:iIqQkEL4DWIcb4HkfURJeMe9NUVLCHumc1GcHwIzwLQ=,tag:xWLqm+WBWvm8F0MH71WtMA==,type:str]
-    POSTGRES_USER: ENC[AES256_GCM,data:L+H5q14=,iv:3M0Vp0+HYOeQAUxPcjZEnY2KUTr26ehVjEMjdF5nYWE=,tag:z8KhOSWQnsLxpkernIrx+w==,type:str]
-    POSTGRES_PASSWORD: ENC[AES256_GCM,data:dwrnI8QNbyWuTIIW1CsUvlLu9xQR6qXYygBVtbc213VAVX3A6nh8lA==,iv:qN2ApXdPHviuAamJ/4vf6FCA0BiIQO4QKeI+HPg/Msg=,tag:kNfLE4lgCT0T6CUx8EW6Dg==,type:str]
+    POSTGRES_DB: ENC[AES256_GCM,data:ChvCjVw=,iv:97n6Q+WzbVOwvRZGGHAfBXQDPx5mnUCSsUNs76xV1p4=,tag:mZLUB3q0UR+9ovqmndFrRg==,type:str]
+    POSTGRES_USER: ENC[AES256_GCM,data:V1q4xfE=,iv:RPHHhWLkdmKHG6CMubrw8JUfHlDXnL0x76JEo05O+mo=,tag:PV1YEyqeb8bTF/98SL1uKQ==,type:str]
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:aBWfOuPyeAEo0vf8fAYzlTfXooPKX6FPbHkpBQ+4zve0KBQh7/yvjQ==,iv:FB/fZoLirzPTbDIel7wRECQP85sFFlIdyoljrilbMxU=,tag:tTZz1PHhaLtmPO9Pg8Vh5g==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRdnhpb2RkZmpBZVJ6ZHdO
-            dTlDZlk5SHoyeDNjdjJVOG5xa0ZuZGhNSUE4ClN2a1puUm9NTGdXMS9xVDFNN3Vi
-            YTNkemRBR2ZqMTI2Q0VsSU90OXNGNTAKLS0tIDkyRWRYODJKcEExa0JlVVVwaEtH
-            QlFhL0gxZ0FxdVpaZmQ3Q3F4c1JITk0KZxdLfBhiF9i8knoqfx1nE3K5dPtZ8sJ/
-            2LBK7CS0o7BfyLjeBxehboLT2sGv2JFDr/zgVfGo6KPfzuFNDVrYrA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxRXIvMEpaWU1XNjV2OFpp
+            Z1lYb25kOFVVaXlRYkdzSmxWbmxqaXR6TEhRCnF0M2ovRVNmdTU3WnNOcy82OExV
+            YXNjZVJrbTdXQWJxMjQvNEdZNlBwcjAKLS0tIEEzczNmZjFwT1d2aXVKV1Bvdm1Q
+            UnZoNVNCYjJiYWd6WlNobGEyUGh5NmMKkUTDkYlNkXH8DegvBT7ymkL7h1B9x77N
+            IxeZI5mp8vc347/620+cbMMr2+aELlgs9/bJhUcLRm0Bv8UDVLOleg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
-    lastmodified: "2026-08-23T10:41:12Z"
-    mac: ENC[AES256_GCM,data:geILRWPP2+bbSsS0JNQ2FiMSRbYeRWI6eYuKZKvNT8k21xVnVhiW/6+eK+oC1mGlxY5t/MNypdTAzaeNQaB+eMNUDfqDa2YhOcmP2KjabCb1hWqOAm675G83ZMerBZZb5CgwswYNF0HAsYIX6mr1o4zhQjmMhE/0I6eovwmYX9k=,iv:MwCKb/ENFXnG3Plof4krdu4DXkxlmXMMbebX0MXasyc=,tag:FtSRZeffdlpQb44f7z/flg==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:tvk/U3XXcRrJCI8I0yUID6jwnlPc1ftiOHs8uxqrbAtLN3KelHGy94fWyxYMoboHeh5R8pNErIxk9EsJok2wjrSENZWMXueVZHtMUWlyC4DhTDAVVYhJ6sL85f6cMiHWDNSlTk4AvfWvdvE6b/0coZ7Rybgw5kNeW6Stw4CSbu4=,iv:sfiOamzam1e0t01KaGHSsnZOBpBGEi3K0KK50QDmaFs=,tag:Ul6xShhIdvTuX3qS6Uo4Kg==,type:str]
     version: 3.13.3

ci/k8s/apps/umami/secret.sops.yaml

@@ -1,24 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:vuU=,iv:zpYbCxqVLtsR3u32TCmrWuR2Tsh+MkJU2svi1blu1hI=,tag:JmXQYWJ0mxITglxfofJ6NA==,type:str]
-kind: ENC[AES256_GCM,data:9rg7//dU,iv:Dv5Ezu6iR1vQO7LAaRbp02KAPpYayJlnVINCbmYJTqc=,tag:9/ORm++3ai4cWGVkzksEtw==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:4uR03R2de95TVff9IQ==,iv:EVKzFEFpV+JI26z2rrq26Bzm+IvwF+Fz5pbeuGJ69no=,tag:iPkp4SW2n2qxD8jRGzn/Pw==,type:str]
-    namespace: ENC[AES256_GCM,data:nZ3xeCc0z7c+RYrcjA==,iv:lY7t/JpPAZ1XkjfHAyYdCKQPlOwy43L6tU+cPMsMuzI=,tag:1YDH4AZqFEJdki2AV33mRg==,type:str]
-type: ENC[AES256_GCM,data:nSMCLir6,iv:RpZRrH9jlHUv3w+O8w93xAdL313BAFNKSbV20Tx6YfE=,tag:C7yQ9C92tzHbfDjuSjVY9Q==,type:str]
+    name: umami-secrets
+    namespace: com-ermnvldmr
+type: Opaque
 stringData:
-    APP_SECRET: ENC[AES256_GCM,data:bDL4s2ZTQO8SZnqOHs7AbDZKcXEeEOP0rgq2x6XbNbJeQiyPpT586AXPlxFG2Evj8isayPh4B5Xv9BGWGHgQkQ==,iv:HnRwLJdinB15xScCAj7Mr5iBZZ74e9qwU58t3OTb87Y=,tag:ZXIA7KqtpkTxPBta85R8FQ==,type:str]
-    DATABASE_URL: ENC[AES256_GCM,data:lNFfvx22Etq97UyLG192//h4iD2LWyz+y2kFUcEPNhiBt63lcZCngzyNRJtp2F9XqHJOCUyzciTZMyP96jQIRNJFusg1BZG/gWrs/eV/40x6aWn8VTZLQdU382DUa7adINo02//w1Jyj35Jlvk7Lx7TycplkFqc=,iv:1Uq8rH6Ih869Udz4Vrjh6k8miue7tMgD7N6Oba7oZmY=,tag:XwtAQvkTphqA5Rckbm9RQA==,type:str]
+    APP_SECRET: ENC[AES256_GCM,data:aaoXs+F/lXvP0kHNZ+Uoo0HB4GnYZ9raYOgEbRwIrkSFGSoTuv/PkvSOYDppDLKxhNMDLhbgTJwEMrHGZzIewQ==,iv:W3u4QPKetqBDSZdsRte5zYeFy9SlRmPw4ORGFTGzN7A=,tag:bkVyGsKgcMGODY4Chpv+8Q==,type:str]
+    DATABASE_URL: ENC[AES256_GCM,data:XbAdd3hNGS+n42XgTQF5rg7AiBkbjFGHOeuTROLgjmIMCUh7afPSheFn6v8bSaibePYJdQBrdFK+kYW9o7aFYhe8Hz1cneATNP0PoQaqlxSrcnM+DeHQzFTC+98ACkskLgk27heZFjCdRr3A4LVRdcet/+2q/8U=,iv:UwxEwPeYdPYrvi30qso4yCZ6m20geusN+P7DOjowjEw=,tag:bQB7OupyNnCjn0INB8T7sg==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBISnVmeG1oYndJNnNWbkZT
-            YVloQk5YelFrbHZWZm9RTk9VTjNKU3hPazFzCmY2MUYrM1VBc2E0ZHRZWURZcjJa
-            S0VjUS8yV3JISzRWREhxSFBaQ3BoU0UKLS0tIFRpTUpPUWlzaXBETjZjSzZhd1lr
-            NWoxZS9DaGtMSEs5dXdWVElHUjdaMWMK9r5mAJfgvpGGiluxhcO2/uhb8ZhJMIkt
-            N6pnLh/OwrOL7JiTqiERTQHSKrltFuZKuZKqoNCo0dYDzfRCpWHcDw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZ2h6THNGTnY2ay9Tc2Q3
+            S0xxU3NEZGx2TS9MRFdqZDV6aEtUalBWRFVJCjZMd1VCdkg1cjIxSlliZXNRQnU0
+            YnMzTXJOSGdsUDUwNkdDdWZWcmRaZjgKLS0tIDdEOFoyOWtvZytITys4bk9ra082
+            WmFIREJMS1BVU0o1VnZHby9ZSHN4cGcKReBW7hdTPH8eGqPzEYkOdrIUYm9a1jOi
+            du/1fhAyhjimbbCNdOSuSjrSP8QX6mxwPoDb1dVlKi0Rah5VGW+HWw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1jpa7hqyzzdfq7lvnw3l8qy6648mtjgpcqnljl5jz92dcqjrnsqfsn7m0fl
-    lastmodified: "2026-08-23T10:41:12Z"
-    mac: ENC[AES256_GCM,data:t4K0VskS20T0fSokIx/7/YwnYAYpD7hTQIS2jNDtv3QtISZ24skrCLA1qMEa6uDqtXHFLa9VsRbH219gu6tTzA/84e547TEfKMSX+LAlv/T6yzxL8Sje9PuZo1wA7alViHtzu0NHKUava3dKzYkJF4sh8tIr/8CGpCvYIIWHXvA=,iv:lLxua+PsyjS0YlLkh5BO0/ZrdiKgktCT/b52IqGiQVU=,tag:kwn6j0XLfaricKEfe6Y6Gw==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-23T13:25:31Z"
+    mac: ENC[AES256_GCM,data:QZOb7pmfDpEn2/kefQQ8k4WJQddlF5jKTY5EaSm1Srt33DceELA3NPJMiozAzpbIEoLR6a7oR6C7zofHHVCBmYcRd2DSHqafW3EOtOt5noiAmkGOQKEWH7aSRFJqcy5EmBcVihd81Z1CkJI6MPcBeQvY0BlVqgm2YqX2QQBolgI=,iv:TB+Rn3ffe4HzVHjk2+XaKaLG1+589AmBhPjOXXKWHto=,tag:zfKVYP1h/4sWXSVtuhQH8Q==,type:str]
     version: 3.13.3

ci/packer/scripts/03-cleanup.sh

@@ -17,9 +17,13 @@ ln -sf /etc/machine-id /var/lib/dbus/machine-id
 # Ensure SSH host keys are generated and valid
 ssh-keygen -A
 
-# Clean cloud-init logs, state, and reset temporary build DNS
-rm -f /etc/resolv.conf /etc/cloud/cloud-init.disabled /run/systemd/generator*/cloud-init.disabled
-touch /etc/resolv.conf
+# Reset DNS with reliable fallback resolvers
+rm -f /etc/cloud/cloud-init.disabled /run/systemd/generator*/cloud-init.disabled
+cat << 'EOF' > /etc/resolv.conf
+nameserver 1.1.1.1
+nameserver 8.8.8.8
+nameserver 77.88.8.8
+EOF
 cloud-init clean --logs --seed || true
 rm -rf /var/lib/cloud/*