tegwick
661176e37a
CoulombCore is being retired, so the docs stop using it as the reference host: state-hub-coulombcore examples become state-hub-railiance01, and the reuse-surface playbook no longer attributes bao.coulomb.social to it — that resolves to 92.205.62.239, which is railiance01. The openrouter lane keeps its factual note about ESO on the CoulombCore cluster, with a retirement flag for its owner. Also corrects this session's own error. The WP-0031 evidence blamed the Unauthorized on a local-port collision between k3s-api-coulombcore and k3s-api-haskelseed. That was wrong: the haskelseed tunnel is a reverse forward, where local_port is a destination rather than a listener, so they never competed. 16443 was simply CoulombCore's k3s — a different cluster whose client CA does not know that cert. The wrong reason had already gone to flex-auth, so it is corrected in the file rather than quietly dropped. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
4 KiB
OpenRouter API Key — llm-connect in activity-core
Date: 2026-06-24 (promoted active 2026-07-02)
Workplan: WARDEN-WP-0012 T4 · RAILIANCE-WP-0010 / CCR-2026-0003
Catalog: openrouter-llm-connect (active — OpenBao path live, ESO delivering)
Pointer playbook for LLM provider credentials consumed by llm-connect in the
activity-core namespace. ops-warden issues SSH certs only — API keys are an
OpenBao → Kubernetes Secret action owned by railiance-platform and
activity-core deployment repos.
Owners
| Concern | Owner repo | Authoritative doc |
|---|---|---|
| OpenBao path and ESO delivery | railiance-platform |
docs/openbao.md — path convention |
| llm-connect K8s overlay and smoke | llm-connect |
deploy/k8s/activity-core-llm-connect/README.md |
activity-core runtime config (LLM_CONNECT_URL) |
activity-core |
llm-connect/docs/activity-core-llm-endpoint.md |
Do not ask ops-warden
warden route show openbao-api-key --json
warden route show openrouter-llm-connect --json
OPENROUTER_API_KEY must not appear in Git, State Hub, workplans, logs, or chat.
Custody shape (live since 2026-07-02)
platform/workloads/activity-core/llm-connect/llm-connect-provider-secrets
Property name: OPENROUTER_API_KEY
Delivery: ExternalSecret activity-core/llm-connect-provider-secrets
(ClusterSecretStore openbao-activity-core, read policy
workload-kv-read-llm-connect-provider-secrets, k8s auth role
external-secrets-activity-core) syncs to Secret
llm-connect-provider-secrets; the llm-connect Deployment consumes it.
Positive + negative access verified with OpenBao audit evidence
(RAILIANCE-WP-0010 T05). Lifecycle (deactivate/rotate/compromise):
railiance-platform/docs/credential-lane-lifecycle-runbook.md.
Promotion gate (met 2026-07-02): the OpenBao path exists and ESO delivers the Secret in cluster. The earlier manually created bootstrap Secret has been taken over by ESO on the CoulombCore cluster; the railiance01 k3s llm-connect instance still uses its bootstrap Secret (separate migration, not this lane).
Retirement note (2026-08-19): CoulombCore is being retired, so the ESO-backed side of this lane needs to move to railiance01 rather than being the reference implementation. Owner is railiance-platform; ops-warden only routes here.
Worker checklist
1. Confirm need
- Consumer is
llm-connectinactivity-corenamespace (not a generic OpenRouter client) - Default profile uses
provider=openrouter(llm-connect/docs/activity-core-llm-endpoint.md) - flex-auth policy applies if your tenant requires pre-approval for secret reads
2. Platform path (production)
- Path provisioned under
platform/workloads/activity-core/... - Workload KV read policy scoped to
llm-connectservice account - ExternalSecret syncs to Secret
llm-connect-provider-secrets
3. Deployment wiring
kubectl apply -k deploy/k8s/activity-core-llm-connect(llm-connect repo)- Deployment mounts provider Secret; env provides
OPENROUTER_API_KEY - activity-core sets
LLM_CONNECT_URLto in-cluster service URL
4. Smoke
# From llm-connect repo — cluster smoke after apply
kubectl -n activity-core rollout status deployment/llm-connect
# See deploy/k8s/activity-core-llm-connect/README.md for endpoint smoke script
5. Rotation
- Update OpenBao KV value
- ESO refresh or rollout restart llm-connect Deployment
- Run cluster smoke; confirm activity-core triage profile still reaches provider
Owner-repo next actions
| Repo | Action |
|---|---|
railiance-platform |
Provision OpenBao path + policy for activity-core llm-connect |
llm-connect |
Maintain K8s overlay and document Secret key names |
activity-core |
Set LLM_CONNECT_URL and triage profile after llm-connect is live |
See also
llm-connect/docs/activity-core-llm-endpoint.mdwiki/CredentialRouting.md#examples-do-not-ask-ops-wardennet-kingdom/docs/platform-identity-security-architecture.md