Replace Doppler bash sync with Kubernetes Operator

AGENTS.md

@@ -47,5 +47,5 @@
 - **No default registry**: Tilt loads images directly into Kind. Do not add `default_registry('localhost:5000')` unless you also create a local registry.
 - **Docker must be running** before `setup-kind` or Tilt image builds.
 - **Production manifests** live in `deploy/prod/`. On `main` pushes, CI builds GHCR images (`ghcr.io/openstaticfish/microservices/{site-analyzer,scraper,lightpanda-mcp}`) and commits updated `newTag` to `kustomization.yaml`.
-- **Secrets**: managed by Doppler (`openstaticfish-microservices` / `dev` config). `scripts/apply-webshare-secret` reads from Doppler; if Doppler is not authenticated, it prints a warning and skips (non-fatal).
+- **Secrets**: managed by the Doppler Kubernetes Operator. `k8s/doppler-webshare-secret.yaml` syncs Doppler project `openstaticfish-microservices` / config `dev` into Kubernetes secret `webshare-api`. The cluster needs a `doppler-token-secret` in namespace `doppler-operator-system`; do not commit token values.
 - **No tests, lint, or CI checks exist** in this repo yet — do not invent commands that don't exist.

README.md

@@ -20,16 +20,10 @@ All project CLI dependencies are provided by `flake.nix`, including:
 
 ## Quick Start
 
-Create or select the local Kind cluster:
+Nuke any stale state, create a fresh Kind cluster, and start Tilt:
 
 ```bash
-nix run .#setup-kind
-```
-
-Start Tilt:
-
-```bash
-nix run .#tilt -- up
+nix run .#tilt-up
 ```
 
 Open the Tilt UI:
@@ -57,10 +51,10 @@ curl http://localhost:9222/json/version
 curl http://localhost:8000/healthz
 ```
 
-Stop Tilt resources:
+Nuke Tilt + Kind cluster:
 
 ```bash
-nix run .#tilt -- down
+nix run .#tilt-down
 ```
 
 ## Dev Shell
@@ -74,12 +68,13 @@ nix develop
 Inside the shell:
 
 ```bash
-setup-kind
-tilt up
-tilt down
+tilt-up            # nuke stale state, recreate Kind cluster, start Tilt
+tilt-down          # nuke Tilt + Kind cluster
+tilt up            # start Tilt (assumes cluster exists)
+tilt down           # tear down Tilt resources only
 kubectl get pods
 docker ps
-doppler secrets
+doppler secrets     # list Doppler project secrets
 ```
 
 ## Project Commands
@@ -102,13 +97,25 @@ Create the `openstaticfish` Kind cluster if needed, select the `kind-openstaticf
 nix run .#tilt -- up
 ```
 
-Run Tilt with the required runtime tools available, including `kind`, `kubectl`, and `docker`.
+Start Tilt with the required runtime tools, including `kind`, `kubectl`, and `docker`. Assumes the Kind cluster already exists and the context is set.
+
+```bash
+nix run .#tilt-down
+```
+
+Nuke Tilt + Kind cluster: kills any stale Tilt process on port 10350, then deletes the Kind cluster.
+
+```bash
+nix run .#tilt-up
+```
+
+Nuke stale state, create a fresh Kind cluster, set the kube context, then start Tilt. Use this after switching worktrees or crashes.
 
 ```bash
 nix run .#tilt -- down
 ```
 
-Tear down Kubernetes resources managed by Tilt.
+Tear down only the Tilt-managed Kubernetes resources without deleting the cluster.
 
 ```bash
 nix flake show
@@ -388,7 +395,20 @@ Run commands with secrets injected:
 doppler run -- your-command
 ```
 
-Tilt uses Doppler to create the local Kubernetes `webshare-api` secret for the scraper service. Do not commit local `.env` files; `.env` and `.env.*` are ignored by Git.
+Tilt installs the Doppler Kubernetes Operator and applies `k8s/doppler-webshare-secret.yaml` to sync Doppler project `openstaticfish-microservices` config `dev` into the local Kubernetes `webshare-api` secret for the scraper service.
+
+The operator needs a Kubernetes token secret in the `doppler-operator-system` namespace. Create it once after the Kind cluster exists:
+
+```bash
+kubectl create namespace doppler-operator-system --dry-run=client -o yaml | kubectl apply -f -
+kubectl create secret generic doppler-token-secret \
+  --namespace doppler-operator-system \
+  --from-literal=serviceToken="$(doppler configure get token --plain)" \
+  --dry-run=client \
+  -o yaml | kubectl apply -f -
+```
+
+Do not commit local `.env` files or token values; `.env` and `.env.*` are ignored by Git.
 
 ## Production Deployment
 
@@ -426,11 +446,11 @@ Runtime secrets, including the scraper Webshare configuration, stay in Doppler p
 ├── k8s/
 │   ├── lightpanda-cdp.yaml
 │   ├── lightpanda-mcp.yaml
+│   ├── doppler-webshare-secret.yaml
 │   ├── scraper.yaml
 │   └── site-analyzer.yaml
 ├── scripts/
 │   ├── analyze-site
-│   ├── apply-webshare-secret
 │   ├── load-test-site-analyzer
 │   ├── screenshot-lightpanda-page
 │   ├── setup-kind
@@ -464,10 +484,10 @@ git add -A
 
 The Tiltfile allows only the `kind-openstaticfish` Kubernetes context to avoid accidentally deploying to another cluster.
 
-If Tilt reports that it cannot connect to Kubernetes, rerun:
+If Tilt reports that it cannot connect to Kubernetes, run:
 
 ```bash
-nix run .#setup-kind
+nix run .#tilt-up
 ```
 
-Then restart Tilt.
+This nukes stale state, recreates the Kind cluster, and starts Tilt.

Tiltfile

@@ -31,8 +31,15 @@ k8s_yaml('./k8s/lightpanda-cdp.yaml')
 k8s_yaml('./k8s/lightpanda-mcp.yaml')
 
 local_resource(
-    'webshare-secret',
-    cmd='bash ./scripts/apply-webshare-secret',
+    'doppler-operator',
+    cmd='kubectl apply -f https://github.com/DopplerHQ/kubernetes-operator/releases/latest/download/recommended.yaml && kubectl wait --for=condition=Established crd/dopplersecrets.secrets.doppler.com --timeout=60s',
+    labels=['utility'],
+)
+
+local_resource(
+    'doppler-webshare-secret',
+    cmd='kubectl apply -f ./k8s/doppler-webshare-secret.yaml',
+    resource_deps=['doppler-operator'],
     labels=['utility'],
 )
 
@@ -40,7 +47,6 @@ local_resource(
 k8s_resource(
     workload='scraper-deployment',
     port_forwards='8080:8080',
-    resource_deps=['webshare-secret'],
     labels=['scraper'],
 )
 

k8s/doppler-webshare-secret.yaml

@@ -0,0 +1,29 @@
+apiVersion: secrets.doppler.com/v1alpha1
+kind: DopplerSecret
+metadata:
+  name: webshare-api
+  namespace: doppler-operator-system
+spec:
+  tokenSecret:
+    name: doppler-token-secret
+    namespace: doppler-operator-system
+  project: openstaticfish-microservices
+  config: dev
+  managedSecret:
+    name: webshare-api
+    namespace: default
+    type: Opaque
+  secrets:
+    - WEBSHARE_API_KEY
+    - WEBSHARE_PROXY_USERNAME
+    - WEBSHARE_PROXY_PASSWORD
+  processors:
+    WEBSHARE_API_KEY:
+      type: plain
+      asName: api-key
+    WEBSHARE_PROXY_USERNAME:
+      type: plain
+      asName: proxy-username
+    WEBSHARE_PROXY_PASSWORD:
+      type: plain
+      asName: proxy-password

scripts/apply-webshare-secret

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ -z "${DOPPLER_INJECTED:-}" ] && command -v doppler >/dev/null 2>&1 && doppler whoami >/dev/null 2>&1; then
-  exec doppler run -- bash "$0" "$@"
-fi
-
-if [ -n "${WEBSHARE_API_KEY:-}" ] && [ -n "${WEBSHARE_PROXY_USERNAME:-}" ] && [ -n "${WEBSHARE_PROXY_PASSWORD:-}" ]; then
-  kubectl create secret generic webshare-api \
-    --from-literal=api-key="$WEBSHARE_API_KEY" \
-    --from-literal=proxy-username="$WEBSHARE_PROXY_USERNAME" \
-    --from-literal=proxy-password="$WEBSHARE_PROXY_PASSWORD" \
-    --dry-run=client \
-    -o yaml | kubectl apply -f -
-else
-  echo "Webshare runtime config missing; country scraping unavailable"
-fi