Stéphane Tailland
e01b15f14c
ai-gateway-kustomization sat in flux-system, so the team's own bootstrap was writing into a namespace the team has no access to — the thing the move was meant to end. It follows the others into llm, with an explicit sourceRef namespace since k8s-platform stays in flux-system. The control-plane ExternalSecret goes with it, for the same reason it did in the dataplane repos: it only lived in flux-system because substituteFrom resolves in the Kustomization's own namespace. And this retires a workaround. proxy-kustomization inlined OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be copied into flux-system — and could therefore not read dataplane-template-defaults, which existed only there. k8s-platform now places that ConfigMap in every domain namespace, so the reference works and the duplicated value goes. Changing the cluster trace backend is one edit again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
|
|
# can substitute it instead of carrying a hardcoded UUID.
|
|
#
|
|
# Why a second ExternalSecret rather than extra keys on the existing one:
|
|
# substituteFrom requires the Secret to sit in the same namespace as the Flux
|
|
# Kustomization, which is flux-system — a shared, broadly-readable namespace.
|
|
# The Konnect token must never go there. A Control Plane id is not a secret;
|
|
# it is visible in the Konnect UI URL.
|
|
#
|
|
# Terraform writes this path (see konnect-platform). Moving to a new Konnect
|
|
# org then needs no edit here at all.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: llm-dev-control-plane
|
|
namespace: llm
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-kong-v2
|
|
target:
|
|
name: llm-dev-control-plane
|
|
data:
|
|
# Key names are the Flux substitution variables verbatim: substituteFrom
|
|
# exposes each key as ${KEY}.
|
|
- secretKey: CONTROL_PLANE_ID
|
|
remoteRef:
|
|
key: kong-v2/llm/dev/control-plane
|
|
property: CONTROL_PLANE_ID
|
|
- secretKey: CONTROL_PLANE_NAME
|
|
remoteRef:
|
|
key: kong-v2/llm/dev/control-plane
|
|
property: CONTROL_PLANE_NAME
|