39c5fdca69
Companion commit to 6bfcc76 (vllm permanent residency cutover). Now that
llama-swap is stopped+disabled and vLLM is the permanent serving layer:
- HINDSIGHT_API_LLM_BASE_URL: llama-swap :8001 -> vLLM :8000
- HINDSIGHT_API_LLM_MODEL: Qwen3.8-27B-Q4_K_M -> Qwen2.5-32B-Instruct-AWQ
- Added HINDSIGHT_API_RETAIN_MAX_COMPLETION_TOKENS=4096 (vLLM's
max_model_len=8192 is far below the 64000 Hindsight retain default;
uncapped this 400s on long retains -- found in t_e6facb19's validation)
- ExternalSecret HINDSIGHT_API_LLM_API_KEY source: 1Password 'nous' item
(unused fallback) -> 1Password 'vllm' item's api-key (vLLM validates
its bearer token, unlike llama-swap which accepted anything)
Embeddings intentionally UNCHANGED -- Hindsight stays on its bundled
local 384-dim embedder (HINDSIGHT_API_EMBEDDINGS_PROVIDER still unset).
Switching to vLLM's nomic-embed (768-dim) is a separate, destructive,
explicitly-approved-only migration (~1300 rows across ~20 banks) --
out of scope here, not part of the dashboard's 'stop llama-swap /
start vLLM' instruction.
93 lines
4.5 KiB
YAML
93 lines
4.5 KiB
YAML
# ============================================================================
|
|
# ExternalSecret - Hindsight Credentials
|
|
# Peter Parker, Phase C, t_6d47a360
|
|
#
|
|
# Syncs Hindsight credentials from the 1Password `mk-labs` vault (item
|
|
# "hindsight", UUID q6pwoohexogdyvitt7sm2xcusu).
|
|
# Pattern: openviking proven pattern (cluster/platform/openviking/externalsecret.yaml).
|
|
# Store: onepassword-connect ClusterSecretStore.
|
|
# Namespace: hindsight.
|
|
#
|
|
# Wave: -1 — must sync BEFORE the chart's Deployments (which default to wave 0)
|
|
# so the materialized Secret exists before the api / control-plane pods attempt
|
|
# envFrom / secretKeyRef injection.
|
|
#
|
|
# The materialized Secret (hindsight-credentials) must carry keys in TWO shapes
|
|
# (Phase B record: inbox/ryan/2026-08-24-hindsight-phase-b-secrets.md):
|
|
# 1. `postgres-password` (lowercase, hyphenated) — read by the chart's EXPLICIT
|
|
# secretKeyRef for POSTGRES_PASSWORD, NOT via envFrom. A naming error here
|
|
# silently drops the DB password (pod starts, then fails to connect).
|
|
# 2. `HINDSIGHT_API_LLM_API_KEY` / `HINDSIGHT_API_MCP_AUTH_TOKEN` — env-var-named,
|
|
# injected via envFrom (always runs when existingSecret is set).
|
|
#
|
|
# 1Password item "hindsight" fields (all CONCEALED):
|
|
# - postgres-password (32 chars, letters+digits only, URL-safe)
|
|
# - HINDSIGHT_API_MCP_AUTH_TOKEN (48 chars urlsafe bearer token)
|
|
# HINDSIGHT_API_LLM_API_KEY now sourced from 1Password item "vllm" (vault
|
|
# mk-labs), field "api-key" -- vLLM DOES validate its bearer token (unlike
|
|
# llama-swap, which never checked one), so this must be a real matching
|
|
# secret post-cutover (t_5508360a, 2026-08-31). See values.yaml api.env
|
|
# comment and roles/deploy-vllm/README.md for the full cutover writeup.
|
|
# ============================================================================
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: hindsight-credentials
|
|
namespace: hindsight
|
|
annotations:
|
|
# Wave -1: ensure the ExternalSecret syncs BEFORE the chart's Deployments
|
|
# (wave 0). Guarantees the Secret exists before the api / control-plane
|
|
# pods attempt envFrom / secretKeyRef injection.
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
description: "Phase C secrets for Hindsight deployment (1Password mk-labs item: hindsight)"
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: hindsight-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
# LOWERCASE, HYPHENATED — read by the chart's explicit secretKeyRef for
|
|
# POSTGRES_PASSWORD. Must be exactly "postgres-password".
|
|
postgres-password: "{{ .postgresPassword }}"
|
|
# env-var-named keys injected via envFrom
|
|
HINDSIGHT_API_MCP_AUTH_TOKEN: "{{ .HINDSIGHT_API_MCP_AUTH_TOKEN }}"
|
|
HINDSIGHT_API_LLM_API_KEY: "{{ .HINDSIGHT_API_LLM_API_KEY }}"
|
|
# NOTE: no HINDSIGHT_API_EMBEDDINGS_OPENAI_API_KEY here — Hindsight's
|
|
# embeddings stayed on its bundled local provider after the vLLM
|
|
# embeddings cutover attempt crash-looped the API on an embedding
|
|
# dimension mismatch (384 existing vs 768 nomic-embed). See
|
|
# values.yaml's api.env comment for the full incident writeup
|
|
# (t_e6facb19, 2026-08-31).
|
|
data:
|
|
# 1Password item "hindsight", field "postgres-password".
|
|
# letters+digits only / URL-safe: required because the chart interpolates the
|
|
# value RAW into HINDSIGHT_API_DATABASE_URL (no URL-encoding).
|
|
- secretKey: postgresPassword
|
|
remoteRef:
|
|
key: hindsight
|
|
property: postgres-password
|
|
# 1Password item "hindsight", field "HINDSIGHT_API_MCP_AUTH_TOKEN"
|
|
# (MCP bearer token, D6 — enables bearer-auth on the /mcp endpoint)
|
|
- secretKey: HINDSIGHT_API_MCP_AUTH_TOKEN
|
|
remoteRef:
|
|
key: hindsight
|
|
property: HINDSIGHT_API_MCP_AUTH_TOKEN
|
|
# CUT OVER to vLLM's real auth key (t_5508360a, 2026-08-31): llama-swap
|
|
# is now stopped+disabled on astro-orbiter (dashboard-approved breaking
|
|
# change) and Hindsight's LLM path points at vLLM :8000
|
|
# (Qwen2.5-32B-Instruct-AWQ), which DOES validate its API key (unlike
|
|
# llama-swap, which ignored it). Source is the same 1Password item
|
|
# deploy-vllm's Ansible role reads at deploy time
|
|
# (op://mk-labs/vllm/api-key) -- keeps exactly one source of truth for
|
|
# the vLLM auth key across the Ansible-deployed server and this
|
|
# Kubernetes-deployed consumer.
|
|
- secretKey: HINDSIGHT_API_LLM_API_KEY
|
|
remoteRef:
|
|
key: vllm
|
|
property: api-key
|