rblundonandClaude Sonnet 5.5
ebe4681438
- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1), values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services for fantasmic/wishes, namespace - gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate, ReferenceGrant for litellm namespace - cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones - external-dns: add wdw-labs.cloud zone (Technitium RFC2136) - onepassword-connect: add wdw-labs vault to ClusterSecretStore Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3
85 lines
3.5 KiB
YAML
85 lines
3.5 KiB
YAML
# ============================================================================
|
|
# ArgoCD Application: LiteLLM proxy (skyliner)
|
|
# Wave: 8 (same tier as hindsight / openviking)
|
|
# Deployment method: GitOps (Gitea -> ArgoCD)
|
|
# ============================================================================
|
|
#
|
|
# Multi-source: upstream OCI Helm chart (pinned) + local values + manifests
|
|
# from repo (namespace, ExternalSecrets, HTTPRoute, ExternalName Services,
|
|
# ServiceMonitor). Follows the openviking / hindsight pattern.
|
|
#
|
|
# Chart: oci://ghcr.io/berriai/litellm-helm (version == appVersion)
|
|
# Includes bundled Bitnami PostgreSQL (db.deployStandalone: true).
|
|
#
|
|
# NOTE (ArgoCD + OCI): repoURL has NO "oci://" prefix. If the OCI registry is not
|
|
# already usable by ArgoCD, register it once (public repo, no creds needed):
|
|
# argocd repo add ghcr.io/berriai --type helm --name berriai-oci --enable-oci
|
|
#
|
|
# Platform changes required BEFORE this syncs (see DEPLOYMENT GATE below).
|
|
# ============================================================================
|
|
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: litellm
|
|
namespace: argocd
|
|
labels:
|
|
app.kubernetes.io/name: litellm
|
|
app.kubernetes.io/part-of: mk-labs
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "8"
|
|
description: |
|
|
LiteLLM OpenAI-compatible gateway for Paperclip/OpenCode and Hermes agents.
|
|
Host: skyliner.wdw-labs.cloud (fastpass-gateway, HTTPRoute). Admin UI at /ui.
|
|
Backends: illuminations vLLM (Gemma-4-26B); Mac Studio (fantasmic) and
|
|
Mac Mini (wishes) as placeholders.
|
|
spec:
|
|
project: default
|
|
|
|
sources:
|
|
# Source 1: upstream OCI Helm chart, pinned
|
|
- repoURL: ghcr.io/berriai
|
|
chart: litellm-helm
|
|
targetRevision: 1.106.1
|
|
helm:
|
|
releaseName: litellm
|
|
valueFiles:
|
|
- $values/cluster/applications/litellm/values.yaml
|
|
|
|
# Source 2: homelab repo — values ref + manifests
|
|
- repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
|
|
targetRevision: main
|
|
path: cluster/applications/litellm
|
|
ref: values
|
|
directory:
|
|
# Not Kubernetes manifests
|
|
exclude: "{application.yaml,values.yaml}"
|
|
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: litellm
|
|
|
|
syncPolicy:
|
|
automated:
|
|
prune: true
|
|
selfHeal: true
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
- ServerSideApply=true
|
|
|
|
# ============================================================================
|
|
# DEPLOYMENT GATE: DO NOT MERGE/SYNC UNTIL
|
|
# ============================================================================
|
|
# 1. 1Password vault wdw-labs has item "litellm" (master-key, salt-key, db-password,
|
|
# db-admin-password) and items "illuminations", "fantasmic",
|
|
# "wishes" (field "api-key"); the onepassword-connect token can read
|
|
# wdw-labs and the ClusterSecretStore lists it (platform/onepassword-connect).
|
|
# (master-key must start with "sk-"; salt-key is PERMANENT — never rotate it
|
|
# after models/keys are stored, or stored credentials become undecryptable).
|
|
# 2. Platform changes are live: cert-manager dnsZones (wdw-labs.cloud), gateway
|
|
# listener + skyliner Certificate, ReferenceGrant for litellm, and external-dns
|
|
# (Technitium) can write to the wdw-labs.cloud zone (zone exists + TSIG key
|
|
# authorized for it).
|
|
# 3. DNS names fantasmic.wdw-labs.cloud / wishes.wdw-labs.cloud resolve from pods.
|
|
# 4. Verified with `helm template` (see README / hand-off notes).
|
|
# ============================================================================
|