Deploy Body Wars Observability WebUI (Open WebUI → astro-orbiter vLLM)

- Service: Open WebUI latest (ghcr.io/open-webui/open-webui:latest)
- Backend: http://astro-orbiter:8000/v1 (Gemma-4-26B-A4B-it-AWQ)
- Ingress: body-wars.local.mk-labs.cloud (letsencrypt-prod TLS)
- Auth: vLLM API key from 1Password (op://mk-labs/vllm/api-key)
- ArgoCD wave 9 (post-Hindsight observability)
- ExternalSecret syncs credentials before deployment
- Replicas: 1, Resource limits: 1GB memory, 1 CPU

cluster/applications/body-wars/externalsecret.yaml

@@ -0,0 +1,28 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: body-wars-credentials
+  namespace: body-wars
+  annotations:
+    # Sync priority: ExternalSecret fetches from 1Password before other resources deploy
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-connect
+    kind: ClusterSecretStore
+  target:
+    name: body-wars-secret
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        vllm-api-key: "{{ .vllm_api_key }}"
+        openwebui-admin-password: "{{ .openwebui_admin }}"
+  data:
+    - secretKey: vllm_api_key
+      remoteRef:
+        path: mk-labs/vllm/api-key
+    - secretKey: openwebui_admin
+      remoteRef:
+        path: mk-labs/openwebui/admin-password