fix(wazuh): preserve degraded production readback

apps/api/tests/test_iwooos_wazuh_api.py

@@ -45,7 +45,7 @@ def test_iwooos_wazuh_v1_route_rejects_missing_server_side_env(monkeypatch: pyte
 
     response = _client().get("/api/v1/iwooos/wazuh")
 
-    assert response.status_code == 503
+    assert response.status_code == 200
     data = response.json()
     assert data["status"] == "misconfigured_missing_server_side_wazuh_env"
     assert data["configured"] is False
@@ -61,7 +61,7 @@ def test_iwooos_wazuh_rejects_non_https_base_url(monkeypatch: pytest.MonkeyPatch
 
     response = _client().get("/api/iwooos/wazuh")
 
-    assert response.status_code == 503
+    assert response.status_code == 200
     data = response.json()
     assert data["status"] == "misconfigured_missing_server_side_wazuh_env"
     assert data["boundaries"]["secret_value_collection_allowed"] is False

apps/api/tests/test_iwooos_wazuh_prod_manifest.py

@@ -4,7 +4,6 @@ from pathlib import Path
 
 import yaml
 
-
 REPO_ROOT = Path(__file__).resolve().parents[3]
 DEPLOYMENT_PATH = REPO_ROOT / "k8s" / "awoooi-prod" / "06-deployment-api.yaml"
 
@@ -34,8 +33,13 @@ def test_iwooos_wazuh_readonly_live_metadata_enabled_by_gitops_flag_only() -> No
     assert env["IWOOOS_WAZUH_EXPECTED_MIN_AGENT_COUNT"]["value"] == "6"
 
 
-def test_iwooos_wazuh_prod_manifest_does_not_inline_secret_values() -> None:
+def test_iwooos_wazuh_prod_manifest_references_secret_values_without_inlining() -> None:
     env = _api_env()
 
     for name in ("WAZUH_API_BASE_URL", "WAZUH_API_USERNAME", "WAZUH_API_PASSWORD"):
-        assert name not in env
+        assert "value" not in env[name]
+        assert env[name]["valueFrom"]["secretKeyRef"] == {
+            "name": "awoooi-secrets",
+            "key": name,
+            "optional": True,
+        }