Move the AI gateway into the llm namespace and drop the inlining

ai-gateway-kustomization sat in flux-system, so the team's own bootstrap
was writing into a namespace the team has no access to — the thing the
move was meant to end. It follows the others into llm, with an explicit
sourceRef namespace since k8s-platform stays in flux-system.

The control-plane ExternalSecret goes with it, for the same reason it did
in the dataplane repos: it only lived in flux-system because
substituteFrom resolves in the Kustomization's own namespace.

And this retires a workaround. proxy-kustomization inlined
OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a
Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be
copied into flux-system — and could therefore not read
dataplane-template-defaults, which existed only there. k8s-platform now
places that ConfigMap in every domain namespace, so the reference works
and the duplicated value goes. Changing the cluster trace backend is one
edit again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Stéphane Tailland

2026-08-27 14:47:59 +02:00

parent b8b1b92226

commit e01b15f14c

3 changed files with 13 additions and 14 deletions

									
										dev/externalsecret-control-plane.yaml
									
		+1
		-1
	
												View File
												
				@@ -13,7 +13,7 @@ apiVersion: external-secrets.io/v1

				kind: ExternalSecret

				metadata:

				  name: llm-dev-control-plane

				  namespace: flux-system

				  namespace: llm

				spec:

				  refreshInterval: 1h

				  secretStoreRef: