# ExternalSecret - OpenViking Credentials
# Wong, Phase 1, t_32766900
#
# Syncs OpenViking credentials from 1Password mk-labs vault
# Pattern: Harbor proven pattern (cluster/platform/harbor/externalsecret.yaml)
# Store: onepassword-connect ClusterSecretStore
# Namespace: openviking (created by Peter Parker in Phase 2)
# Wave: 8 (after Harbor Wave 7)

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: openviking-credentials
  namespace: openviking
  annotations:
    argocd.argoproj.io/sync-wave: "8"
    description: "Phase 1 secrets for OpenViking deployment"
spec:
  refreshInterval: "1h"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: openviking-credentials
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        root_api_key: "{{ .OPENVIKING_ROOT_API_KEY }}"
        embedding_api_key: "{{ .OPENVIKING_EMBEDDING_API_KEY }}"
        vlm_api_key: "{{ .OPENVIKING_VLM_API_KEY }}"

  data:
    # OpenViking root API key - server administration
    # Source: 1Password item "openviking-root-api-key", field "root-api-key"
    - secretKey: OPENVIKING_ROOT_API_KEY
      remoteRef:
        key: openviking-root-api-key
        property: root-api-key

    # Embedding model endpoint token (nomic-embed-text-v1.5 at astro-orbiter:8002)
    # Source: 1Password item "openviking-embedding-api-key", field "api-key"
    # Phase 0 recommendation: placeholder token for local endpoint
    - secretKey: OPENVIKING_EMBEDDING_API_KEY
      remoteRef:
        key: openviking-embedding-api-key
        property: api-key

    # VLM endpoint token (Llama-3.1-8B at astro-orbiter:8002)
    # Source: 1Password item "openviking-vlm-api-key", field "api-key"
    # Phase 0 recommendation: placeholder token for local endpoint
    - secretKey: OPENVIKING_VLM_API_KEY
      remoteRef:
        key: openviking-vlm-api-key
        property: api-key