Clean up duplicate OPENAI_BASE_URL env vars; keep only one

Set OPENAI_API_BASE_URLS (plural) for model discovery
Fix: Use local astro-orbiter endpoint, not OpenAI API
2026-09-01 13:58:44 -05:00 · 2026-09-01 13:49:20 -05:00 · 2026-09-01 13:48:37 -05:00 · 2026-09-01 13:44:41 -05:00 · 2026-09-01 13:39:14 -05:00 · 2026-09-01 13:38:11 -05:00
5 changed files with 69 additions and 6 deletions
--- a/cluster/applications/open-webui/application.yaml
+++ b/cluster/applications/open-webui/application.yaml
@@ -38,7 +38,7 @@ spec:

  destination:
    server: https://kubernetes.default.svc
-    namespace: body-wars
+    namespace: open-webui

  syncPolicy:
    automated:
--- a/cluster/applications/open-webui/deployment.yaml
+++ b/cluster/applications/open-webui/deployment.yaml
@@ -39,9 +39,8 @@ spec:
              name: body-wars-secret
              key: vllm-api-key
              optional: false
-        # Backend configuration for vLLM
-        - name: OLLAMA_BASE_URLS
-          value: "http://astro-orbiter:8000"
+        # Backend configuration for vLLM (OpenAI-compatible, NOT Ollama)
+        # OLLAMA_BASE_URLS removed: astro-orbiter runs vLLM, not Ollama
        - name: OPENAI_BASE_URL
          value: "http://astro-orbiter:8000/v1"
        - name: OPENAI_API_KEY
@@ -52,6 +51,9 @@ spec:
              optional: false
        - name: OPENAI_MODEL_FALLBACK
          value: "Gemma-4-26B-A4B-it-AWQ"
+        # Disable OpenAI API key validation (we're using vLLM, not OpenAI)
+        - name: OPENAI_VALIDATE_ENDPOINT
+          value: "false"
        # Allow access from ingress
        - name: WEBUI_URL
          value: "https://body-wars.local.mk-labs.cloud"
@@ -60,6 +62,9 @@ spec:
          value: "true"
        - name: ENABLE_MODEL_FILTER
          value: "false"
+        # Disable Ollama model detection (we use vLLM/OpenAI-compatible only)
+        - name: ENABLE_OLLAMA_API
+          value: "false"
        # Storage
        - name: DATA_DIR
          value: "/app/backend/data"
@@ -83,5 +88,5 @@ spec:
          mountPath: /app/backend/data
      volumes:
      - name: data
-        emptyDir:
-          sizeLimit: 1Gi
+        persistentVolumeClaim:
+          claimName: open-webui-data
--- a/cluster/applications/open-webui/externalsecret.yaml
+++ b/cluster/applications/open-webui/externalsecret.yaml
@@ -24,3 +24,9 @@ spec:
      remoteRef:
        key: vllm
        property: api-key
+    # WebUI JWT signing secret - TEMPORARILY DISABLED
+    # Uncomment and configure once open-webui item exists in 1Password:
+    # - secretKey: webui_secret_key
+    #   remoteRef:
+    #     key: open-webui
+    #     property: secret-key
--- a/cluster/applications/open-webui/pvc.yaml
+++ b/cluster/applications/open-webui/pvc.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: open-webui-data
+  namespace: open-webui
+  labels:
+    app.kubernetes.io/name: open-webui
+    app.kubernetes.io/component: data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-emporium
+  resources:
+    requests:
+      storage: 10Gi
--- a/cluster/platform/astro-orbiter-gateway/externalname-service.yaml
+++ b/cluster/platform/astro-orbiter-gateway/externalname-service.yaml
@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: astro-orbiter
+  namespace: default
+  labels:
+    app.kubernetes.io/name: astro-orbiter-gateway
+    app.kubernetes.io/component: llm-inference
+spec:
+  type: ExternalName
+  externalName: 10.1.71.130
+  ports:
+  - name: vllm-8000
+    port: 8000
+    protocol: TCP
+  - name: llama-cpp-8001
+    port: 8001
+    protocol: TCP
+  - name: router-8002
+    port: 8002
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: astro-orbiter-vllm
+  namespace: default
+  labels:
+    app.kubernetes.io/name: astro-orbiter-gateway
+    app.kubernetes.io/component: llm-inference
+spec:
+  type: ExternalName
+  externalName: 10.1.71.130
+  ports:
+  - name: vllm
+    port: 8000
+    protocol: TCP
Author	SHA1	Message	Date
Hermes Agent service account	7e4b103e68	Clean up duplicate OPENAI_BASE_URL env vars; keep only one	2026-09-01 13:58:44 -05:00
Hermes Agent service account	404ff3d91d	Set OPENAI_API_BASE_URLS (plural) for model discovery	2026-09-01 13:49:20 -05:00
Hermes Agent service account	3c6f6dfe2e	Fix: Use local astro-orbiter endpoint, not OpenAI API Set OPENAI_API_BASE_URL (config.py default) to our local vLLM endpoint. Open WebUI was using hardcoded 'https://api.openai.com/v1' for model discovery.	2026-09-01 13:48:37 -05:00
Hermes Agent service account	56db1b94ee	Disable OpenAI API key validation for local vLLM endpoint Open WebUI was validating API keys against OpenAI's servers. For local vLLM backend, disable this validation.	2026-09-01 13:44:41 -05:00
Hermes Agent service account	f0387c1033	Simplify: use vllm-api-key for WEBUI_SECRET_KEY ExternalSecret only provides vllm-api-key from 1Password. Using same key for both purposes is acceptable for now. Avoids need for manual secret patching.	2026-09-01 13:39:14 -05:00
Hermes Agent service account	dd5ce10910	Fix ExternalSecret template: remove webui-secret-key reference The open-webui item doesn't exist in 1Password yet. webui-secret-key is manually managed via Kubernetes secret patch. Template now only pulls vllm-api-key from 1Password.	2026-09-01 13:38:11 -05:00
Hermes Agent service account	1e537cf5f7	Add storageClassName to PVC manifest for explicit NFS declaration	2026-09-01 13:31:18 -05:00
Hermes Agent service account	f4b1fc9e71	Fix ArgoCD Application destination namespace Change namespace from 'body-wars' to 'open-webui' to match actual deployment	2026-09-01 13:30:24 -05:00
Hermes Agent service account	f51d1c16ac	Fix Open WebUI storage and model detection - Change emptyDir to persistent volume (open-webui-data PVC) Fixes data loss on pod restart (admin user disappears) - Add ENABLE_OLLAMA_API=false Disable broken Ollama endpoint probing vLLM uses OpenAI-compatible API, not Ollama - Create pvc.yaml for persistent data storage 10Gi NFS-backed storage via nfs-emporium StorageClass	2026-09-01 13:28:21 -05:00
Hermes Agent service account	e80a1dc088	Temporarily disable webui-secret-key from ExternalSecret The 'open-webui' item doesn't exist in 1Password yet. webui-secret-key is manually patched in the secret for now. Re-enable ExternalSecret pull once the 1Password item is created.	2026-09-01 13:19:18 -05:00
Hermes Agent service account	3dc58cf644	Fix Open WebUI auth: correct WEBUI_SECRET_KEY and remove Ollama config - WEBUI_SECRET_KEY now uses dedicated webui-secret-key (not vllm-api-key) - ExternalSecret updated to fetch webui_secret_key from 1Password - Remove duplicate OLLAMA_BASE_URLS configuration (vLLM only)	2026-09-01 13:18:57 -05:00
Hermes Agent service account	d95477fc3b	Fix Open WebUI connectivity to astro-orbiter - Add ExternalName Service for astro-orbiter (10.1.71.130:8000) - Remove Ollama-specific configuration (OLLAMA_BASE_URLS) - Keep only OpenAI-compatible configuration (OPENAI_BASE_URL) Fixes: Open WebUI pod was attempting to use Ollama endpoints (/api/tags) against vLLM which only supports OpenAI-compatible API (/v1/models). Pod now reaches astro-orbiter via Kubernetes Service DNS name. Resolves: HTTP 404 errors from Upstream ollama request failed	2026-09-01 13:18:57 -05:00