d9e41118f8
Platform Knowledge Infrastructure pilot - context database for large
file trees, shared skills, and long-term logs to reduce agent token
consumption. Pilot scope: two corpora (hermes/ skills library,
personal/homelab/), two consumer profiles (Wong, Shuri) for before/after
token comparison.
- namespace.yaml: openviking namespace, sync-wave 8 (after Harbor wave 7)
- externalsecret.yaml: credentials from 1Password via onepassword-connect
ClusterSecretStore (Wong, t_32766900)
- values.yaml: Helm overrides - px-fa-direct-access storage (30Gi),
embedding (nomic-embed-text-v1.5) + VLM (Llama-3.1-8B) via astro-orbiter
router (:8002), internal-only ingress
- application.yaml: multi-source ArgoCD Application, Harbor pattern
(Peter Parker, t_eefdcc17 + reconciled in t_3e54efa8)
Prerequisites verified complete before this commit:
- nomic-embed-text-v1.5-Q4_K_M live on astro-orbiter router (War Machine,
t_34b96e83, commit ad70b34)
- All 3 1Password items provisioned (root/embedding/vlm api keys)
- Storage class corrected to px-fa-direct-access after live PV audit
showed pure-block/pure-file have zero provisioned volumes (t_77b3ff79)
- Dry-run validated against live cluster prior to commit
Constraint: vault (~/friday) remains canonical source of truth; OpenViking
index is a derived cache, rebuilt from vault source files.
Honcho/lincoln explicitly out of scope for this work.
119 lines
4.2 KiB
Markdown
119 lines
4.2 KiB
Markdown
# OpenViking Phase 1: ExternalSecret Manifests — Handoff Summary
|
|
|
|
**Status:** COMPLETE
|
|
**Task:** Wong, t_32766900
|
|
**Date:** 2026-08-13
|
|
**Destination:** Gitea rblundon/homelab, cluster/platform/openviking/
|
|
|
|
## Deliverables
|
|
|
|
### Primary Manifest
|
|
- **File:** `externalsecret-phase1.yaml`
|
|
- **Purpose:** Syncs OpenViking credentials from 1Password mk-labs vault
|
|
- **Status:** Validated (kubectl apply --dry-run=client: PASS)
|
|
|
|
### Documentation
|
|
- **File:** `PHASE-1-HANDOFF.md` (this file)
|
|
- **Purpose:** Handoff notes for Phase 2 coordination
|
|
|
|
## Manifest Details
|
|
|
|
**ExternalSecret Name:** openviking-credentials
|
|
**Target Namespace:** openviking
|
|
**ClusterSecretStore:** onepassword-connect (existing, proven)
|
|
**Refresh Interval:** 1h
|
|
**Sync Wave:** 8 (ArgoCD annotation)
|
|
**Pattern:** Harbor proven pattern (single consolidated manifest)
|
|
|
|
## 1Password Item Requirements
|
|
|
|
The manifest references three 1Password items in the mk-labs vault:
|
|
|
|
### Item 1: openviking-root-api-key
|
|
- **Field:** root-api-key (CONCEALED)
|
|
- **Status:** EXISTS (per dashboard confirmation)
|
|
- **Purpose:** OpenViking server root API key
|
|
|
|
### Item 2: openviking-embedding-api-key
|
|
- **Field:** api-key (CONCEALED)
|
|
- **Status:** NEEDS CREATION
|
|
- **Recommended Value:** local-nomic-embed
|
|
- **Purpose:** Embedding model endpoint (nomic-embed-text-v1.5 at astro-orbiter:8002)
|
|
- **Note:** Local endpoint, placeholder token only — no cloud authentication needed
|
|
|
|
### Item 3: openviking-vlm-api-key
|
|
- **Field:** api-key (CONCEALED)
|
|
- **Status:** NEEDS CREATION
|
|
- **Recommended Value:** local-llama-vlm
|
|
- **Purpose:** VLM endpoint (Llama-3.1-8B at astro-orbiter:8002)
|
|
- **Note:** Local endpoint, placeholder token only — no cloud authentication needed
|
|
|
|
## Workaround for Missing 1Password Items
|
|
|
|
If separate 1Password items cannot be created due to permissions:
|
|
|
|
1. Add fields to existing "openviking" item:
|
|
- `embedding_api_key` (CONCEALED): local-nomic-embed
|
|
- `vlm_api_key` (CONCEALED): local-llama-vlm
|
|
|
|
2. Update manifest remoteRef.key fields:
|
|
- Change from `openviking-embedding-api-key` to `openviking`
|
|
- Change from `openviking-vlm-api-key` to `openviking`
|
|
|
|
3. Update manifest remoteRef.property fields:
|
|
- Change from `api-key` to `embedding_api_key`
|
|
- Change from `api-key` to `vlm_api_key`
|
|
|
|
## Dependencies & Constraints
|
|
|
|
**Phase 1 Constraints Satisfied:**
|
|
- Vault canonical: acknowledged (vault is canonical source for OpenViking index)
|
|
- Honcho out of scope: confirmed (no Honcho/lincoln references)
|
|
- Pilot scope only: confirmed (two corpora, two profiles)
|
|
|
|
**Phase 2 Dependencies:**
|
|
- namespace.yaml must create `openviking` namespace before ExternalSecret deployment
|
|
- ExternalSecret must sync before pod startup
|
|
- 1Password items must exist before sync (read-only ClusterSecretStore)
|
|
|
|
**External Dependencies:**
|
|
- Model staging: nomic-embed-text-v1.5 must be staged on astro-orbiter:8002 before pod startup
|
|
- ClusterSecretStore: onepassword-connect must be healthy
|
|
|
|
## Coordination Notes for Peter Parker (Phase 2)
|
|
|
|
**ClusterSecretStore Naming Discrepancy:**
|
|
- Phase 1 uses: `onepassword-connect` (proven, existing on cluster)
|
|
- Your Phase 2 manifests reference: `1password-mk-labs` (does not currently exist)
|
|
|
|
**Resolution Options:**
|
|
1. Create `1password-mk-labs` as alias/new ClusterSecretStore
|
|
2. Update Phase 1 manifest to match your reference
|
|
3. Update Phase 2 manifests to use `onepassword-connect`
|
|
|
|
**Next Steps:**
|
|
1. Clarify ClusterSecretStore naming
|
|
2. Verify/create 1Password items 2 & 3
|
|
3. Create openviking namespace
|
|
4. Deploy Phase 1 ExternalSecret
|
|
5. Deploy Phase 2 (Helm values, ArgoCD Application)
|
|
|
|
## References
|
|
|
|
- Approved plan: ~/friday/inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
|
|
- Phase 0 model recommendation: ~/friday/inbox/ryan/2026-08-13-openviking-model-recommendation.md
|
|
- Harbor pattern reference: cluster/platform/harbor/externalsecret.yaml
|
|
|
|
## Manifest Validation
|
|
|
|
```bash
|
|
kubectl apply --dry-run=client -f externalsecret-phase1.yaml
|
|
# Result: externalsecret.external-secrets.io/openviking-credentials created (dry run)
|
|
```
|
|
|
|
---
|
|
|
|
**Created by:** Wong, Infrastructure Automation Specialist
|
|
**Task:** t_32766900, OpenViking Phase 1
|
|
**Pattern:** Harbor proven approach (consolidated ExternalSecret, template v2)
|