From baa5991248727705333584d9701392f55d9dd6af Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Sat, 12 Sep 2026 02:34:22 -0700
Subject: [PATCH] fix(helm): wire Discord webhook public key

---
 k8s/helm/commonly/templates/core/backend-deployment.yaml | 6 ++++++
 k8s/helm/commonly/templates/secrets/api-keys.yaml        | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/k8s/helm/commonly/templates/core/backend-deployment.yaml b/k8s/helm/commonly/templates/core/backend-deployment.yaml
index cea28aaaf..92713d1c6 100644
--- a/k8s/helm/commonly/templates/core/backend-deployment.yaml
+++ b/k8s/helm/commonly/templates/core/backend-deployment.yaml
@@ -259,6 +259,12 @@ spec:
               name: api-keys
               key: discord-guild-id
               optional: true
+        - name: DISCORD_PUBLIC_KEY
+          valueFrom:
+            secretKeyRef:
+              name: api-keys
+              key: discord-public-key
+              optional: true
 
         # Social login (OAuth) providers — names match what
         # controllers/oauthController.ts reads. The old GITHUB_CLIENT_ID /
diff --git a/k8s/helm/commonly/templates/secrets/api-keys.yaml b/k8s/helm/commonly/templates/secrets/api-keys.yaml
index 11082b54c..2573fd670 100644
--- a/k8s/helm/commonly/templates/secrets/api-keys.yaml
+++ b/k8s/helm/commonly/templates/secrets/api-keys.yaml
@@ -91,6 +91,12 @@ spec:
   - secretKey: discord-guild-id
     remoteRef:
       key: commonly-dev-discord-guild-id
+  # Discord webhook verification (B2). Create this remote key in Secret
+  # Manager before deploying the fail-closed ingress; ESO rejects api-keys
+  # when a referenced remote key is missing.
+  - secretKey: discord-public-key
+    remoteRef:
+      key: commonly-dev-discord-public-key
 
   # OAuth Providers
   - secretKey: google-client-id