Move the AI gateway into the llm namespace and drop the inlining

ai-gateway-kustomization sat in flux-system, so the team's own bootstrap
was writing into a namespace the team has no access to — the thing the
move was meant to end. It follows the others into llm, with an explicit
sourceRef namespace since k8s-platform stays in flux-system.

The control-plane ExternalSecret goes with it, for the same reason it did
in the dataplane repos: it only lived in flux-system because
substituteFrom resolves in the Kustomization's own namespace.

And this retires a workaround. proxy-kustomization inlined
OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a
Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be
copied into flux-system — and could therefore not read
dataplane-template-defaults, which existed only there. k8s-platform now
places that ConfigMap in every domain namespace, so the reference works
and the duplicated value goes. Changing the cluster trace backend is one
edit again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/ai-gateway-kustomization.yaml

@@ -2,12 +2,16 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: llm-dev-ai-gateway
-  namespace: flux-system
+  namespace: llm
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: k8s-platform
+    # k8s-platform lives in flux-system: the templates are the platform's,
+    # this Kustomization is the team's. sourceRef resolves in the
+    # Kustomization's own namespace unless told otherwise.
+    namespace: flux-system
   path: ./dataplane-template
   prune: true
   postBuild:

dev/externalsecret-control-plane.yaml

@@ -13,7 +13,7 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: llm-dev-control-plane
-  namespace: flux-system
+  namespace: llm
 spec:
   refreshInterval: 1h
   secretStoreRef:

dev/proxy-kustomization.yaml

@@ -41,18 +41,13 @@ spec:
       # The URI path is the collector's routing key: Fluent Bit tags the
       # record `llm` and turns that into the Loki label domain=llm.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm
-      # Duplicated from k8s-platform's dataplane-template-defaults ConfigMap
-      # rather than pulled via substituteFrom, because that ConfigMap is
-      # deliberately single-instance in flux-system and this Kustomization
-      # cannot live there: its substitution Secret below holds real
-      # credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those
-      # in flux-system is the exact thing the Konnect PAT comment in
-      # gateway-kustomization.yaml refuses to do. Referencing the ConfigMap
-      # from the llm namespace just fails the build outright
-      # (optional: false), which is why this stack never deployed.
-      # Cost of the duplication: changing the cluster trace backend now takes
-      # an edit here too.
-      OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
     substituteFrom:
+      # Readable again now that k8s-platform places this ConfigMap in every
+      # domain namespace. It used to be flux-system only, which is why this
+      # Kustomization — which must stay here, holding real credentials — had to
+      # inline OTEL_TRACES_ENDPOINT instead. Listed first so the Secret still
+      # wins on any key it defines.
+      - kind: ConfigMap
+        name: dataplane-template-defaults
       - kind: Secret
         name: platform-llm-dev-secrets