From 3dc58cf644e1b9180e5ac8b279545abc42760e3f Mon Sep 17 00:00:00 2001 From: Hermes Agent service account Date: Tue, 1 Sep 2026 13:18:55 -0500 Subject: [PATCH] Fix Open WebUI auth: correct WEBUI_SECRET_KEY and remove Ollama config - WEBUI_SECRET_KEY now uses dedicated webui-secret-key (not vllm-api-key) - ExternalSecret updated to fetch webui_secret_key from 1Password - Remove duplicate OLLAMA_BASE_URLS configuration (vLLM only) --- cluster/applications/open-webui/deployment.yaml | 2 +- cluster/applications/open-webui/externalsecret.yaml | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/cluster/applications/open-webui/deployment.yaml b/cluster/applications/open-webui/deployment.yaml index 241a59c..2978a5a 100644 --- a/cluster/applications/open-webui/deployment.yaml +++ b/cluster/applications/open-webui/deployment.yaml @@ -37,7 +37,7 @@ spec: valueFrom: secretKeyRef: name: body-wars-secret - key: vllm-api-key + key: webui-secret-key optional: false # Backend configuration for vLLM (OpenAI-compatible, NOT Ollama) # OLLAMA_BASE_URLS removed: astro-orbiter runs vLLM, not Ollama diff --git a/cluster/applications/open-webui/externalsecret.yaml b/cluster/applications/open-webui/externalsecret.yaml index 81260d1..93afbf5 100644 --- a/cluster/applications/open-webui/externalsecret.yaml +++ b/cluster/applications/open-webui/externalsecret.yaml @@ -18,9 +18,15 @@ spec: engineVersion: v2 data: vllm-api-key: "{{ .vllm_api_key }}" + webui-secret-key: "{{ .webui_secret_key }}" data: # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field) - secretKey: vllm_api_key remoteRef: key: vllm property: api-key + # WebUI JWT signing secret from 1Password (mk-labs vault, open-webui item, secret-key field) + - secretKey: webui_secret_key + remoteRef: + key: open-webui + property: secret-key