first commit

2026-08-20 17:28:05 +02:00
parent be7a3e8913
commit a0c96eab5b
21 changed files with 670 additions and 7 deletions
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: llm-dev-konnect-auth
+  namespace: llm
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: llm-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/llm/dev/konnect-pat
+        property: token
@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: llm-dev-ai-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: llm-dev
+      NAMESPACE: llm
+      CONTROL_PLANE_ID: "61bd9456-7f3b-4312-bf1e-44e7e7f2dade"
+      HOSTNAME: llm-dev.sttlab.local
+      TLS_ISSUER_NAME: sttlab-local-ca
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: platform-llm-dev
+  namespace: llm
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-platform-llm.git
+  secretRef:
+    name: platform-llm-git-auth
+  ref:
+    branch: main
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: platform-llm-dev-secrets
+  namespace: llm
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: platform-llm-dev-secrets
+  data:
+    - secretKey: OPENROUTER_BEARER
+      remoteRef:
+        key: kong-v2/platform-llm/dev/openrouter
+        property: bearer
+    - secretKey: LIBRECHAT_APIKEY
+      remoteRef:
+        key: kong-v2/platform-llm/dev/librechat-apikey
+        property: key
@@ -0,0 +1,36 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: platform-llm-dev
+  namespace: llm
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: platform-llm-dev
+  path: ./kong
+  prune: true
+  dependsOn:
+    - name: llm-dev-ai-gateway
+      namespace: flux-system
+  postBuild:
+    substitute:
+      NAME: llm-dev
+      NAMESPACE: llm
+      CONTROL_PLANE_REF_NAME: llm-dev-jzvxt
+      OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
+      AGENT_AUDIENCE: '["llm-proxy"]'
+      OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions
+      OPENROUTER_EMBEDDINGS_UPSTREAM_URL: https://openrouter.ai/api/v1/embeddings
+      VECTORDB_HOST: llm-dev-vectordb
+      VECTORDB_PORT: "6379"
+      RATE_LIMIT_GLOBAL_TOKENS_PER_MINUTE: "500000"
+      RATE_LIMIT_PER_CLIENT_TOKENS_PER_MINUTE: "50000"
+      # Looked up after consumer.yaml's llm-anonymous KongConsumer first
+      # reconciled — config.anonymous needs the real Consumer ID, not the
+      # username (Konnect stores it as a literal string otherwise, silently
+      # never resolving — verified live, request-termination never fired).
+      LLM_ANONYMOUS_CONSUMER_ID: "1efd79ee-fd2d-4f2d-beb8-e6e9b24185a1"
+    substituteFrom:
+      - kind: Secret
+        name: platform-llm-dev-secrets