Stéphane Tailland
b83a41c0d2
This Kustomization pulled dataplane-template-defaults via substituteFrom with optional: false, but that ConfigMap is deliberately single-instance in flux-system and this object lives in the llm namespace, so the build failed outright: configmaps "dataplane-template-defaults" not found. That is why the stack was never in the cluster and the llm KongService, KongRoute and plugin bindings had been applied by hand instead. Moving the Kustomization to flux-system would fix the lookup and break something worse: its substitution Secret holds OPENROUTER_BEARER and LIBRECHAT_APIKEY, and copying real credentials into flux-system is exactly what the Konnect PAT comment in gateway-kustomization.yaml refuses to do. OTEL_TRACES_ENDPOINT was the only key this stack took from that ConfigMap, so inline it and drop the reference. The trade-off is recorded next to the value: changing the cluster trace backend now takes an edit here too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
2.3 KiB
YAML
52 lines
2.3 KiB
YAML
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: platform-llm-dev
|
|
namespace: llm
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: platform-llm-dev
|
|
path: ./kong
|
|
prune: true
|
|
dependsOn:
|
|
- name: llm-dev-ai-gateway
|
|
namespace: flux-system
|
|
postBuild:
|
|
substitute:
|
|
NAME: llm-dev
|
|
NAMESPACE: llm
|
|
CONTROL_PLANE_REF_NAME: llm-dev-cp
|
|
OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
|
|
AGENT_AUDIENCE: '["llm-proxy"]'
|
|
OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions
|
|
OPENROUTER_EMBEDDINGS_UPSTREAM_URL: https://openrouter.ai/api/v1/embeddings
|
|
VECTORDB_HOST: llm-dev-vectordb
|
|
VECTORDB_PORT: "6379"
|
|
RATE_LIMIT_GLOBAL_TOKENS_PER_MINUTE: "500000"
|
|
RATE_LIMIT_PER_CLIENT_TOKENS_PER_MINUTE: "50000"
|
|
# Looked up after consumer.yaml's llm-anonymous KongConsumer first
|
|
# reconciled — config.anonymous needs the real Consumer ID, not the
|
|
# username (Konnect stores it as a literal string otherwise, silently
|
|
# never resolving — verified live, request-termination never fired).
|
|
LLM_ANONYMOUS_CONSUMER_ID: "1efd79ee-fd2d-4f2d-beb8-e6e9b24185a1"
|
|
# The URI path is the collector's routing key: Fluent Bit tags the
|
|
# record `llm` and turns that into the Loki label domain=llm.
|
|
AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/llm
|
|
# Duplicated from k8s-platform's dataplane-template-defaults ConfigMap
|
|
# rather than pulled via substituteFrom, because that ConfigMap is
|
|
# deliberately single-instance in flux-system and this Kustomization
|
|
# cannot live there: its substitution Secret below holds real
|
|
# credentials (OPENROUTER_BEARER, LIBRECHAT_APIKEY), and putting those
|
|
# in flux-system is the exact thing the Konnect PAT comment in
|
|
# gateway-kustomization.yaml refuses to do. Referencing the ConfigMap
|
|
# from the llm namespace just fails the build outright
|
|
# (optional: false), which is why this stack never deployed.
|
|
# Cost of the duplication: changing the cluster trace backend now takes
|
|
# an edit here too.
|
|
OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
|
|
substituteFrom:
|
|
- kind: Secret
|
|
name: platform-llm-dev-secrets
|