# ExternalSecrets - LiteLLM
# Store: onepassword-connect ClusterSecretStore (vaults: mk-labs, wdw-labs)
#
# 1Password, vault wdw-labs:
#   Item "litellm" (CONCEALED fields):
#     master-key         LiteLLM admin/master key (must start with "sk-")
#     salt-key           LITELLM_SALT_KEY — encrypts stored provider creds. NEVER ROTATE.
#     db-password        Postgres password for user "litellm" (use alphanumerics,
#                        e.g. `openssl rand -hex 24`; it is embedded in a URL)
#     db-admin-password  Postgres "postgres" superuser password
#   Items "illuminations", "fantasmic", "wishes" — field "api-key"
#
# Wave -1: secrets exist before the Deployment / migration job / Postgres.
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: litellm-credentials
  namespace: litellm
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: "1h"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: litellm-credentials
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        # Chart masterkeySecretName/Key
        master-key: "{{ .MASTER_KEY }}"
        # Chart db.secret + bundled Postgres existingSecret
        username: litellm
        password: "{{ .DB_PASSWORD }}"
        postgres-password: "{{ .DB_ADMIN_PASSWORD }}"
  data:
    - secretKey: MASTER_KEY
      remoteRef: { key: litellm, property: master-key }
    - secretKey: DB_PASSWORD
      remoteRef: { key: litellm, property: db-password }
    - secretKey: DB_ADMIN_PASSWORD
      remoteRef: { key: litellm, property: db-admin-password }
---
# Exported wholesale as env vars via chart `environmentSecrets`
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: litellm-env
  namespace: litellm
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: "1h"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: litellm-env
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        LITELLM_SALT_KEY: "{{ .SALT_KEY }}"
        # Full URL for the proxy Deployment (see values.yaml environmentSecrets note)
        DATABASE_URL: "postgresql://litellm:{{ .DB_PASSWORD | urlquery }}@litellm-postgresql:5432/litellm"
        ILLUMINATIONS_API_KEY: "{{ .ILLUMINATIONS_API_KEY }}"
        FANTASMIC_API_KEY: "{{ .FANTASMIC_API_KEY }}"
        WISHES_API_KEY: "{{ .WISHES_API_KEY }}"
  data:
    - secretKey: DB_PASSWORD
      remoteRef: { key: litellm, property: db-password }
    - secretKey: SALT_KEY
      remoteRef: { key: litellm, property: salt-key }
    - secretKey: ILLUMINATIONS_API_KEY
      remoteRef: { key: illuminations, property: api-key }
    - secretKey: FANTASMIC_API_KEY
      remoteRef: { key: fantasmic, property: api-key }
    - secretKey: WISHES_API_KEY
      remoteRef: { key: wishes, property: api-key }