# OpenViking Phase 1: ExternalSecret Manifests — Handoff Summary

**Status:** COMPLETE  
**Task:** Wong, t_32766900  
**Date:** 2026-08-13  
**Destination:** Gitea rblundon/homelab, cluster/platform/openviking/

## Deliverables

### Primary Manifest
- **File:** `externalsecret-phase1.yaml`
- **Purpose:** Syncs OpenViking credentials from 1Password mk-labs vault
- **Status:** Validated (kubectl apply --dry-run=client: PASS)

### Documentation
- **File:** `PHASE-1-HANDOFF.md` (this file)
- **Purpose:** Handoff notes for Phase 2 coordination

## Manifest Details

**ExternalSecret Name:** openviking-credentials  
**Target Namespace:** openviking  
**ClusterSecretStore:** onepassword-connect (existing, proven)  
**Refresh Interval:** 1h  
**Sync Wave:** 8 (ArgoCD annotation)  
**Pattern:** Harbor proven pattern (single consolidated manifest)

## 1Password Item Requirements

The manifest references three 1Password items in the mk-labs vault:

### Item 1: openviking-root-api-key
- **Field:** root-api-key (CONCEALED)
- **Status:** EXISTS (per dashboard confirmation)
- **Purpose:** OpenViking server root API key

### Item 2: openviking-embedding-api-key
- **Field:** api-key (CONCEALED)
- **Status:** NEEDS CREATION
- **Recommended Value:** local-nomic-embed
- **Purpose:** Embedding model endpoint (nomic-embed-text-v1.5 at astro-orbiter:8002)
- **Note:** Local endpoint, placeholder token only — no cloud authentication needed

### Item 3: openviking-vlm-api-key
- **Field:** api-key (CONCEALED)
- **Status:** NEEDS CREATION
- **Recommended Value:** local-llama-vlm
- **Purpose:** VLM endpoint (Llama-3.1-8B at astro-orbiter:8002)
- **Note:** Local endpoint, placeholder token only — no cloud authentication needed

## Workaround for Missing 1Password Items

If separate 1Password items cannot be created due to permissions:

1. Add fields to existing "openviking" item:
   - `embedding_api_key` (CONCEALED): local-nomic-embed
   - `vlm_api_key` (CONCEALED): local-llama-vlm

2. Update manifest remoteRef.key fields:
   - Change from `openviking-embedding-api-key` to `openviking`
   - Change from `openviking-vlm-api-key` to `openviking`

3. Update manifest remoteRef.property fields:
   - Change from `api-key` to `embedding_api_key`
   - Change from `api-key` to `vlm_api_key`

## Dependencies & Constraints

**Phase 1 Constraints Satisfied:**
- Vault canonical: acknowledged (vault is canonical source for OpenViking index)
- Honcho out of scope: confirmed (no Honcho/lincoln references)
- Pilot scope only: confirmed (two corpora, two profiles)

**Phase 2 Dependencies:**
- namespace.yaml must create `openviking` namespace before ExternalSecret deployment
- ExternalSecret must sync before pod startup
- 1Password items must exist before sync (read-only ClusterSecretStore)

**External Dependencies:**
- Model staging: nomic-embed-text-v1.5 must be staged on astro-orbiter:8002 before pod startup
- ClusterSecretStore: onepassword-connect must be healthy

## Coordination Notes for Peter Parker (Phase 2)

**ClusterSecretStore Naming Discrepancy:**
- Phase 1 uses: `onepassword-connect` (proven, existing on cluster)
- Your Phase 2 manifests reference: `1password-mk-labs` (does not currently exist)

**Resolution Options:**
1. Create `1password-mk-labs` as alias/new ClusterSecretStore
2. Update Phase 1 manifest to match your reference
3. Update Phase 2 manifests to use `onepassword-connect`

**Next Steps:**
1. Clarify ClusterSecretStore naming
2. Verify/create 1Password items 2 & 3
3. Create openviking namespace
4. Deploy Phase 1 ExternalSecret
5. Deploy Phase 2 (Helm values, ArgoCD Application)

## References

- Approved plan: ~/friday/inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
- Phase 0 model recommendation: ~/friday/inbox/ryan/2026-08-13-openviking-model-recommendation.md
- Harbor pattern reference: cluster/platform/harbor/externalsecret.yaml

## Manifest Validation

```bash
kubectl apply --dry-run=client -f externalsecret-phase1.yaml
# Result: externalsecret.external-secrets.io/openviking-credentials created (dry run)
```

---

**Created by:** Wong, Infrastructure Automation Specialist  
**Task:** t_32766900, OpenViking Phase 1  
**Pattern:** Harbor proven approach (consolidated ExternalSecret, template v2)