llm-connect/deploy/k8s/activity-core-llm-connect/externalsecret.yaml

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: llm-connect-provider-secrets
  namespace: activity-core
  labels:
    app.kubernetes.io/name: llm-connect
    app.kubernetes.io/part-of: railiance-gitops
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-activity-core
  target:
    # Explicit target metadata prevents ESO copying source last-applied annotations.
    template:
      metadata:
        labels:
          app.kubernetes.io/name: llm-connect
          app.kubernetes.io/part-of: railiance-gitops
    name: llm-connect-provider-secrets
    creationPolicy: Owner
  data:
    - secretKey: OPENROUTER_API_KEY
      remoteRef:
        key: platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
        property: OPENROUTER_API_KEY