tegwick
661176e37a
CoulombCore is being retired, so the docs stop using it as the reference host: state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface playbook no longer attributes bao.coulomb.social to it — that resolves to 92.205.62.239, which is railiance01. The openrouter lane keeps its factual note about ESO on the CoulombCore cluster, with a retirement flag for its owner. Also corrects this session's own error. The WP-0031 evidence blamed the Unauthorized on a local-port collision between k3s-api-coulombcore and k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward, where local_port is a destination rather than a listener, so they never competed. 16443 was simply CoulombCore's k3s — a different cluster whose client CA does not know that cert. The wrong reason had already gone to flex-auth, so it is corrected in the file rather than quietly dropped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
113 lines
No EOL
4 KiB
Markdown
113 lines
No EOL
4 KiB
Markdown
# OpenRouter API Key — llm-connect in activity-core
|
|
|
|
Date: 2026-06-24 (promoted active 2026-07-02)
|
|
Workplan: WARDEN-WP-0012 T4 · RAILIANCE-WP-0010 / CCR-2026-0003
|
|
Catalog: `openrouter-llm-connect` (**active** — OpenBao path live, ESO delivering)
|
|
|
|
Pointer playbook for LLM provider credentials consumed by `llm-connect` in the
|
|
`activity-core` namespace. ops-warden issues SSH certs only — API keys are an
|
|
OpenBao → Kubernetes Secret action owned by `railiance-platform` and
|
|
`activity-core` deployment repos.
|
|
|
|
---
|
|
|
|
## Owners
|
|
|
|
| Concern | Owner repo | Authoritative doc |
|
|
| --- | --- | --- |
|
|
| OpenBao path and ESO delivery | `railiance-platform` | `docs/openbao.md` — path convention |
|
|
| llm-connect K8s overlay and smoke | `llm-connect` | `deploy/k8s/activity-core-llm-connect/README.md` |
|
|
| activity-core runtime config (`LLM_CONNECT_URL`) | `activity-core` | `llm-connect/docs/activity-core-llm-endpoint.md` |
|
|
|
|
---
|
|
|
|
## Do not ask ops-warden
|
|
|
|
```bash
|
|
warden route show openbao-api-key --json
|
|
warden route show openrouter-llm-connect --json
|
|
```
|
|
|
|
`OPENROUTER_API_KEY` must not appear in Git, State Hub, workplans, logs, or chat.
|
|
|
|
---
|
|
|
|
## Custody shape (live since 2026-07-02)
|
|
|
|
```text
|
|
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
|
|
```
|
|
|
|
Property name: `OPENROUTER_API_KEY`
|
|
|
|
Delivery: `ExternalSecret activity-core/llm-connect-provider-secrets`
|
|
(ClusterSecretStore `openbao-activity-core`, read policy
|
|
`workload-kv-read-llm-connect-provider-secrets`, k8s auth role
|
|
`external-secrets-activity-core`) syncs to Secret
|
|
`llm-connect-provider-secrets`; the llm-connect Deployment consumes it.
|
|
Positive + negative access verified with OpenBao audit evidence
|
|
(RAILIANCE-WP-0010 T05). Lifecycle (deactivate/rotate/compromise):
|
|
`railiance-platform/docs/credential-lane-lifecycle-runbook.md`.
|
|
|
|
**Promotion gate (met 2026-07-02):** the OpenBao path exists and ESO delivers
|
|
the Secret in cluster. The earlier manually created bootstrap Secret has been
|
|
taken over by ESO on the CoulombCore cluster; the railiance01 k3s llm-connect
|
|
instance still uses its bootstrap Secret (separate migration, not this lane).
|
|
|
|
**Retirement note (2026-08-19):** CoulombCore is being retired, so the ESO-backed
|
|
side of this lane needs to move to railiance01 rather than being the reference
|
|
implementation. Owner is railiance-platform; ops-warden only routes here.
|
|
|
|
---
|
|
|
|
## Worker checklist
|
|
|
|
### 1. Confirm need
|
|
|
|
- [ ] Consumer is `llm-connect` in `activity-core` namespace (not a generic OpenRouter client)
|
|
- [ ] Default profile uses `provider=openrouter` (`llm-connect/docs/activity-core-llm-endpoint.md`)
|
|
- [ ] flex-auth policy applies if your tenant requires pre-approval for secret reads
|
|
|
|
### 2. Platform path (production)
|
|
|
|
- [ ] Path provisioned under `platform/workloads/activity-core/...`
|
|
- [ ] Workload KV read policy scoped to `llm-connect` service account
|
|
- [ ] ExternalSecret syncs to Secret `llm-connect-provider-secrets`
|
|
|
|
### 3. Deployment wiring
|
|
|
|
- [ ] `kubectl apply -k deploy/k8s/activity-core-llm-connect` (llm-connect repo)
|
|
- [ ] Deployment mounts provider Secret; env provides `OPENROUTER_API_KEY`
|
|
- [ ] activity-core sets `LLM_CONNECT_URL` to in-cluster service URL
|
|
|
|
### 4. Smoke
|
|
|
|
```bash
|
|
# From llm-connect repo — cluster smoke after apply
|
|
kubectl -n activity-core rollout status deployment/llm-connect
|
|
# See deploy/k8s/activity-core-llm-connect/README.md for endpoint smoke script
|
|
```
|
|
|
|
### 5. Rotation
|
|
|
|
- [ ] Update OpenBao KV value
|
|
- [ ] ESO refresh or rollout restart llm-connect Deployment
|
|
- [ ] Run cluster smoke; confirm activity-core triage profile still reaches provider
|
|
|
|
---
|
|
|
|
## Owner-repo next actions
|
|
|
|
| Repo | Action |
|
|
| --- | --- |
|
|
| `railiance-platform` | Provision OpenBao path + policy for activity-core llm-connect |
|
|
| `llm-connect` | Maintain K8s overlay and document Secret key names |
|
|
| `activity-core` | Set `LLM_CONNECT_URL` and triage profile after llm-connect is live |
|
|
|
|
---
|
|
|
|
## See also
|
|
|
|
- `llm-connect/docs/activity-core-llm-endpoint.md`
|
|
- `wiki/CredentialRouting.md#examples-do-not-ask-ops-warden`
|
|
- `net-kingdom/docs/platform-identity-security-architecture.md` |