From e01b15f14cd30ee512bb496b352852887c0410c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 27 Aug 2026 14:47:59 +0200 Subject: [PATCH] Move the AI gateway into the llm namespace and drop the inlining MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ai-gateway-kustomization sat in flux-system, so the team's own bootstrap was writing into a namespace the team has no access to — the thing the move was meant to end. It follows the others into llm, with an explicit sourceRef namespace since k8s-platform stays in flux-system. The control-plane ExternalSecret goes with it, for the same reason it did in the dataplane repos: it only lived in flux-system because substituteFrom resolves in the Kustomization's own namespace. And this retires a workaround. proxy-kustomization inlined OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be copied into flux-system — and could therefore not read dataplane-template-defaults, which existed only there. k8s-platform now places that ConfigMap in every domain namespace, so the reference works and the duplicated value goes. Changing the cluster trace backend is one edit again. Co-Authored-By: Claude Opus 5 --- dev/ai-gateway-kustomization.yaml | 6 +++++- dev/externalsecret-control-plane.yaml | 2 +- dev/proxy-kustomization.yaml | 19 +++++++------------ 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/dev/ai-gateway-kustomization.yaml b/dev/ai-gateway-kustomization.yaml index 980294b..68ca314 100644 --- a/dev/ai-gateway-kustomization.yaml +++ b/dev/ai-gateway-kustomization.yaml @@ -2,12 +2,16 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: name: llm-dev-ai-gateway - namespace: flux-system + namespace: llm spec: interval: 10m sourceRef: kind: GitRepository name: k8s-platform + # k8s-platform lives in flux-system: the templates are the platform's, + # this Kustomization is the team's. sourceRef resolves in the + # Kustomization's own namespace unless told otherwise. + namespace: flux-system path: ./dataplane-template prune: true postBuild: diff --git a/dev/externalsecret-control-plane.yaml b/dev/externalsecret-control-plane.yaml index a6370a9..2ae2359 100644 --- a/dev/externalsecret-control-plane.yaml +++ b/dev/externalsecret-control-plane.yaml @@ -13,7 +13,7 @@ apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: llm-dev-control-plane - namespace: flux-system + namespace: llm spec: refreshInterval: 1h secretStoreRef: diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml index 33a2770..550f193 100644 --- a/dev/proxy-kustomization.yaml +++ b/dev/proxy-kustomization.yaml @@ -41,18 +41,13 @@ spec: # The URI path is the collector's routing key: Fluent Bit tags the # record `llm` and turns that into the Loki label domain=llm. AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm - # Duplicated from k8s-platform's dataplane-template-defaults ConfigMap - # rather than pulled via substituteFrom, because that ConfigMap is - # deliberately single-instance in flux-system and this Kustomization - # cannot live there: its substitution Secret below holds real - # credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those - # in flux-system is the exact thing the Konnect PAT comment in - # gateway-kustomization.yaml refuses to do. Referencing the ConfigMap - # from the llm namespace just fails the build outright - # (optional: false), which is why this stack never deployed. - # Cost of the duplication: changing the cluster trace backend now takes - # an edit here too. - OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces substituteFrom: + # Readable again now that k8s-platform places this ConfigMap in every + # domain namespace. It used to be flux-system only, which is why this + # Kustomization — which must stay here, holding real credentials — had to + # inline OTEL_TRACES_ENDPOINT instead. Listed first so the Secret still + # wins on any key it defines. + - kind: ConfigMap + name: dataplane-template-defaults - kind: Secret name: platform-llm-dev-secrets