Add LiteLLM gateway (skyliner) via ArgoCD/Helm

- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1),
  values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services
  for fantasmic/wishes, namespace
- gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate,
  ReferenceGrant for litellm namespace
- cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones
- external-dns: add wdw-labs.cloud zone (Technitium RFC2136)
- onepassword-connect: add wdw-labs vault to ClusterSecretStore

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3

cluster/platform/cert-manager/clusterissuer.yaml

@@ -25,6 +25,7 @@ spec:
         selector:
           dnsZones:
             - mk-labs.cloud
+            - wdw-labs.cloud
 
 ---
 # Production issuer — switch to this once staging certs are working
@@ -47,3 +48,4 @@ spec:
         selector:
           dnsZones:
             - mk-labs.cloud
+            - wdw-labs.cloud

cluster/platform/external-dns/values.yaml

@@ -16,8 +16,6 @@ env:
     value: "10.1.71.32"
   - name: EXTERNAL_DNS_RFC2136_PORT
     value: "53"
-  - name: EXTERNAL_DNS_RFC2136_ZONE
-    value: "local.mk-labs.cloud"
   - name: EXTERNAL_DNS_RFC2136_TSIG_AXFR
     value: "true"
   # TSIG secret key name — must match what's configured in Technitium
@@ -34,6 +32,14 @@ env:
 # Only manage records in this zone
 domainFilters:
   - local.mk-labs.cloud
+  - wdw-labs.cloud
+
+# Multiple Technitium zones (the env var form only supports one zone).
+# wdw-labs.cloud zone must exist in Technitium and the "external-dns" TSIG key
+# must be authorised for dynamic updates + zone transfer on it (added for skyliner).
+extraArgs:
+  - --rfc2136-zone=local.mk-labs.cloud
+  - --rfc2136-zone=wdw-labs.cloud
 
 # Sources: ingress, service, and Gateway API HTTPRoutes
 sources:

cluster/platform/gateway/certificate-skyliner.yaml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# Certificate for skyliner.wdw-labs.cloud (LiteLLM)
+# Single-host cert; referenced by listener "https-skyliner" in gateway.yaml.
+# Requires letsencrypt-prod dnsZones to include wdw-labs.cloud (cert-manager).
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: skyliner-wdw-labs-tls
+  namespace: gateway
+spec:
+  secretName: skyliner-wdw-labs-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - skyliner.wdw-labs.cloud

cluster/platform/gateway/gateway.yaml

@@ -36,3 +36,18 @@ spec:
       allowedRoutes:
         namespaces:
           from: All
+    # Dedicated listener for LiteLLM (skyliner) — wdw-labs.cloud is not covered
+    # by the wildcard cert above. Cert: certificate-skyliner.yaml
+    - name: https-skyliner
+      port: 443
+      protocol: HTTPS
+      hostname: skyliner.wdw-labs.cloud
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: skyliner-wdw-labs-tls
+      allowedRoutes:
+        namespaces:
+          from: All

cluster/platform/gateway/referencegrant.yaml

@@ -16,6 +16,7 @@
 #   - monitoring    (Grafana)
 #   - authentik     (Authentik SSO — future)
 #   - gitea         (Gitea — future)
+#   - litellm       (LiteLLM / skyliner)
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
@@ -45,6 +46,9 @@ spec:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
       namespace: firecrawl
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: litellm
   to:
     - group: gateway.networking.k8s.io
       kind: Gateway

cluster/platform/onepassword-connect/cluster-secret-store.yaml

@@ -24,6 +24,7 @@ spec:
       connectHost: http://onepassword-connect.onepassword-connect.svc.cluster.local:8080
       vaults:
         mk-labs: 1          # vault name in 1Password : priority
+        wdw-labs: 2         # WDW Labs hosts/agents (LiteLLM, host api-keys); Connect token needs read access
       auth:
         secretRef:
           connectTokenSecretRef: