alot more changes

build.sh

@@ -17,9 +17,36 @@ docker build \
 
 docker push matst80/otel-debug:latest
 
+# Shared key that only keeps strangers from uploading source maps (it is not a
+# real credential). Taken from the environment, else from the cluster secret,
+# else generated and stored there so the deployment can mount it.
+ensure_sourcemap_key() {
+  if [[ -z "${OTEL_SOURCEMAP_KEY:-}" ]]; then
+    OTEL_SOURCEMAP_KEY="$(kubectl get secret otel-sourcemap-key -n monitoring \
+      -o jsonpath='{.data.key}' 2>/dev/null | base64 -d || true)"
+  fi
+  if [[ -z "${OTEL_SOURCEMAP_KEY}" ]]; then
+    OTEL_SOURCEMAP_KEY="$(openssl rand -hex 24)"
+  fi
+  kubectl create secret generic otel-sourcemap-key -n monitoring \
+    --from-literal=key="${OTEL_SOURCEMAP_KEY}" --dry-run=client -o yaml | kubectl apply -f - >/dev/null
+  export OTEL_SOURCEMAP_KEY
+}
+ensure_sourcemap_key
+
+# Roll out first: the new image requires OTEL_SOURCEMAP_KEY, so the manifest has
+# to be applied before uploads, or any pod restart in between rejects them.
+# Only the app manifests. Not `-f k8s/`: clickhouse.yaml carries a CHANGE_ME
+# password Secret that would overwrite the live one, and auth-dev.yaml is a
+# partial AuthServer that must be applied by hand with
+# `kubectl apply --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`.
+kubectl apply -f k8s/deployment.yaml -f k8s/service.yaml -f k8s/ingress.yaml
+kubectl rollout restart deployment otel-debug-receiver -n monitoring
+kubectl rollout status deployment/otel-debug-receiver -n monitoring
+
 # Docker builds intentionally omit public source maps. Upload maps from the
-# exact UI build that went into the image before rolling it out; otherwise RUM
-# events can arrive with a release that the resolver cannot map.
+# exact UI build that went into the image right after rolling it out; until then
+# RUM events can arrive with a release that the resolver cannot map.
 if [[ "${UPLOAD_SOURCEMAPS}" == "true" ]]; then
   : "${OTEL_URL:?set OTEL_URL (for example https://otel.k6n.net), or set UPLOAD_SOURCEMAPS=false}"
   maps_dir="$(mktemp -d)"
@@ -40,12 +67,4 @@ if [[ "${UPLOAD_SOURCEMAPS}" == "true" ]]; then
   [[ "$found" == 1 ]] || { echo "no source maps found in UI build" >&2; exit 1; }
 fi
 
-# Only the app manifests. Not `-f k8s/`: clickhouse.yaml carries a CHANGE_ME
-# password Secret that would overwrite the live one, and auth-dev.yaml is a
-# partial AuthServer that must be applied by hand with
-# `kubectl apply --server-side --field-manager=otel-dev-auth -f k8s/auth-dev.yaml`.
-kubectl apply -f k8s/deployment.yaml -f k8s/service.yaml -f k8s/ingress.yaml
-kubectl rollout restart deployment otel-debug-receiver -n monitoring
-kubectl rollout status deployment/otel-debug-receiver -n monitoring
-
 kubectl logs -f deployment/otel-debug-receiver -n monitoring