fix(helm): Generate strong Temporal payload encryption key

helm/rest/nico-rest/charts/nico-rest-common/templates/secrets.yaml

@@ -2,6 +2,16 @@
 # SPDX-License-Identifier: Apache-2.0
 
 {{- if .Values.secrets.create }}
+{{- $temporalEncryptionKey := .Values.secrets.temporalEncryptionKey.value }}
+{{- if not $temporalEncryptionKey }}
+  {{- $existingSecret := lookup "v1" "Secret" (include "nico-rest-common.namespace" .) "temporal-encryption-key" }}
+  {{- $existingKey := dig "data" "temporal-encryption-key" "" $existingSecret }}
+  {{- if $existingKey }}
+    {{- $temporalEncryptionKey = $existingKey | b64dec }}
+  {{- else }}
+    {{- $temporalEncryptionKey = randBytes 32 }}
+  {{- end }}
+{{- end }}
 # db-creds and image-pull-secret are annotated as pre-install / pre-upgrade
 # hooks (weight -10) because the nico-rest-db migration Job runs as its own
 # pre-install hook at weight -5 and needs both to exist before it starts.
@@ -45,7 +55,7 @@ metadata:
     {{- include "nico-rest-common.labels" . | nindent 4 }}
 type: Opaque
 stringData:
-  temporal-encryption-key: {{ .Values.secrets.temporalEncryptionKey.value | quote }}
+  temporal-encryption-key: {{ $temporalEncryptionKey | quote }}
 ---
 apiVersion: v1
 kind: Secret

helm/rest/nico-rest/charts/nico-rest-common/tests/secrets_test.yaml

@@ -0,0 +1,32 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+suite: common secrets
+templates:
+  - secrets.yaml
+tests:
+  - it: generates the Temporal encryption key from 32 random bytes by default
+    asserts:
+      - matchRegex:
+          path: stringData.temporal-encryption-key
+          pattern: ^[A-Za-z0-9+/]{43}=$
+        documentIndex: 2
+
+  - it: uses an explicitly configured Temporal encryption key
+    set:
+      secrets:
+        temporalEncryptionKey:
+          value: configured-key
+    asserts:
+      - equal:
+          path: stringData.temporal-encryption-key
+          value: configured-key
+        documentIndex: 2
+
+  - it: omits all Secrets when creation is disabled
+    set:
+      secrets:
+        create: false
+    asserts:
+      - hasDocuments:
+          count: 0

helm/rest/nico-rest/charts/nico-rest-common/values.yaml

@@ -16,8 +16,9 @@ secrets:
     # -- Keycloak client secret. Replace in production.
     value: "nico-local-secret"
   temporalEncryptionKey:
-    # -- Temporal payload encryption key. Replace in production.
-    value: "local-dev"
+    # -- Temporal payload encryption key. When empty, Helm generates a key from
+    # 32 random bytes on install and reuses the existing Secret on upgrade.
+    value: ""
   imagePullSecret:
     # -- base64-encoded docker config JSON. Default is valid empty auth placeholder ({"auths":{}}).
     # Replace with real credentials for private registries.