llm-connect/deploy/k8s/activity-core-llm-connect/externalsecret.yaml
tegwick 08850d0aaf
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 6s
fix(security): prevent ESO copying source annotations (CUST-WP-0073)
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
2026-09-28 15:56:50 +02:00

27 lines
826 B
YAML

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: llm-connect-provider-secrets
namespace: activity-core
labels:
app.kubernetes.io/name: llm-connect
app.kubernetes.io/part-of: railiance-gitops
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: openbao-activity-core
target:
# Explicit target metadata prevents ESO copying source last-applied annotations.
template:
metadata:
labels:
app.kubernetes.io/name: llm-connect
app.kubernetes.io/part-of: railiance-gitops
name: llm-connect-provider-secrets
creationPolicy: Owner
data:
- secretKey: OPENROUTER_API_KEY
remoteRef:
key: platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
property: OPENROUTER_API_KEY