ai-gateway-kustomization sat in flux-system, so the team's own bootstrap
was writing into a namespace the team has no access to — the thing the
move was meant to end. It follows the others into llm, with an explicit
sourceRef namespace since k8s-platform stays in flux-system.
The control-plane ExternalSecret goes with it, for the same reason it did
in the dataplane repos: it only lived in flux-system because
substituteFrom resolves in the Kustomization's own namespace.
And this retires a workaround. proxy-kustomization inlined
OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a
Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be
copied into flux-system — and could therefore not read
dataplane-template-defaults, which existed only there. k8s-platform now
places that ConfigMap in every domain namespace, so the reference works
and the duplicated value goes. Changing the cluster trace backend is one
edit again.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland
e01b15f14c