From 8ea19dbf70646130f0864e52c2407a79cf7bf452 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Mon, 31 Aug 2026 22:47:34 -0500
Subject: [PATCH] Fix ExternalSecret API format and deployment env vars

- ExternalSecret: use key/property format (not path) for 1Password reference
- Deployment: remove admin password env var (use single vllm-api-key)
- Syncs vLLM API key from op://mk-labs/vllm/api-key
---
 cluster/applications/body-wars/deployment.yaml     |  6 ------
 cluster/applications/body-wars/externalsecret.yaml | 10 ++++------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/cluster/applications/body-wars/deployment.yaml b/cluster/applications/body-wars/deployment.yaml
index fedcce1..178bd56 100644
--- a/cluster/applications/body-wars/deployment.yaml
+++ b/cluster/applications/body-wars/deployment.yaml
@@ -39,12 +39,6 @@ spec:
               name: body-wars-secret
               key: vllm-api-key
               optional: false
-        - name: OAUTH_ADMIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: body-wars-secret
-              key: openwebui-admin-password
-              optional: false
         # Backend configuration for vLLM
         - name: OLLAMA_BASE_URLS
           value: "http://astro-orbiter:8000"
diff --git a/cluster/applications/body-wars/externalsecret.yaml b/cluster/applications/body-wars/externalsecret.yaml
index 3ce70bb..f0d3f28 100644
--- a/cluster/applications/body-wars/externalsecret.yaml
+++ b/cluster/applications/body-wars/externalsecret.yaml
@@ -9,8 +9,8 @@ metadata:
 spec:
   refreshInterval: 1h
   secretStoreRef:
-    name: onepassword-connect
     kind: ClusterSecretStore
+    name: onepassword-connect
   target:
     name: body-wars-secret
     creationPolicy: Owner
@@ -18,11 +18,9 @@ spec:
       engineVersion: v2
       data:
         vllm-api-key: "{{ .vllm_api_key }}"
-        openwebui-admin-password: "{{ .openwebui_admin }}"
   data:
+    # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
     - secretKey: vllm_api_key
       remoteRef:
-        path: mk-labs/vllm/api-key
-    - secretKey: openwebui_admin
-      remoteRef:
-        path: mk-labs/openwebui/admin-password
+        key: vllm
+        property: api-key