Files

Hermes Agent service account d9e41118f8 feat(openviking): pilot deployment to fastpass (wave 8)

Platform Knowledge Infrastructure pilot - context database for large
file trees, shared skills, and long-term logs to reduce agent token
consumption. Pilot scope: two corpora (hermes/ skills library,
personal/homelab/), two consumer profiles (Wong, Shuri) for before/after
token comparison.

- namespace.yaml: openviking namespace, sync-wave 8 (after Harbor wave 7)
- externalsecret.yaml: credentials from 1Password via onepassword-connect
  ClusterSecretStore (Wong, t_32766900)
- values.yaml: Helm overrides - px-fa-direct-access storage (30Gi),
  embedding (nomic-embed-text-v1.5) + VLM (Llama-3.1-8B) via astro-orbiter
  router (:8002), internal-only ingress
- application.yaml: multi-source ArgoCD Application, Harbor pattern
  (Peter Parker, t_eefdcc17 + reconciled in t_3e54efa8)

Prerequisites verified complete before this commit:
- nomic-embed-text-v1.5-Q4_K_M live on astro-orbiter router (War Machine,
  t_34b96e83, commit ad70b34)
- All 3 1Password items provisioned (root/embedding/vlm api keys)
- Storage class corrected to px-fa-direct-access after live PV audit
  showed pure-block/pure-file have zero provisioned volumes (t_77b3ff79)
- Dry-run validated against live cluster prior to commit

Constraint: vault (~/friday) remains canonical source of truth; OpenViking
index is a derived cache, rebuilt from vault source files.

Honcho/lincoln explicitly out of scope for this work.

2026-08-13 23:33:36 -05:00

4.2 KiB

Raw Blame History

OpenViking Phase 1: ExternalSecret Manifests — Handoff Summary

Status: COMPLETE
Task: Wong, t_32766900
Date: 2026-08-13
Destination: Gitea rblundon/homelab, cluster/platform/openviking/

Deliverables

Primary Manifest

File: externalsecret-phase1.yaml
Purpose: Syncs OpenViking credentials from 1Password mk-labs vault
Status: Validated (kubectl apply --dry-run=client: PASS)

Documentation

File: PHASE-1-HANDOFF.md (this file)
Purpose: Handoff notes for Phase 2 coordination

Manifest Details

ExternalSecret Name: openviking-credentials
Target Namespace: openviking
ClusterSecretStore: onepassword-connect (existing, proven)
Refresh Interval: 1h
Sync Wave: 8 (ArgoCD annotation)
Pattern: Harbor proven pattern (single consolidated manifest)

1Password Item Requirements

The manifest references three 1Password items in the mk-labs vault:

Item 1: openviking-root-api-key

Field: root-api-key (CONCEALED)
Status: EXISTS (per dashboard confirmation)
Purpose: OpenViking server root API key

Item 2: openviking-embedding-api-key

Field: api-key (CONCEALED)
Status: NEEDS CREATION
Recommended Value: local-nomic-embed
Purpose: Embedding model endpoint (nomic-embed-text-v1.5 at astro-orbiter:8002)
Note: Local endpoint, placeholder token only — no cloud authentication needed

Item 3: openviking-vlm-api-key

Field: api-key (CONCEALED)
Status: NEEDS CREATION
Recommended Value: local-llama-vlm
Purpose: VLM endpoint (Llama-3.1-8B at astro-orbiter:8002)
Note: Local endpoint, placeholder token only — no cloud authentication needed

Workaround for Missing 1Password Items

If separate 1Password items cannot be created due to permissions:

Add fields to existing "openviking" item:
- embedding_api_key (CONCEALED): local-nomic-embed
- vlm_api_key (CONCEALED): local-llama-vlm
Update manifest remoteRef.key fields:
- Change from openviking-embedding-api-key to openviking
- Change from openviking-vlm-api-key to openviking
Update manifest remoteRef.property fields:
- Change from api-key to embedding_api_key
- Change from api-key to vlm_api_key

Dependencies & Constraints

Phase 1 Constraints Satisfied:

Vault canonical: acknowledged (vault is canonical source for OpenViking index)
Honcho out of scope: confirmed (no Honcho/lincoln references)
Pilot scope only: confirmed (two corpora, two profiles)

Phase 2 Dependencies:

namespace.yaml must create openviking namespace before ExternalSecret deployment
ExternalSecret must sync before pod startup
1Password items must exist before sync (read-only ClusterSecretStore)

External Dependencies:

Model staging: nomic-embed-text-v1.5 must be staged on astro-orbiter:8002 before pod startup
ClusterSecretStore: onepassword-connect must be healthy

Coordination Notes for Peter Parker (Phase 2)

ClusterSecretStore Naming Discrepancy:

Phase 1 uses: onepassword-connect (proven, existing on cluster)
Your Phase 2 manifests reference: 1password-mk-labs (does not currently exist)

Resolution Options:

Create 1password-mk-labs as alias/new ClusterSecretStore
Update Phase 1 manifest to match your reference
Update Phase 2 manifests to use onepassword-connect

Next Steps:

Clarify ClusterSecretStore naming
Verify/create 1Password items 2 & 3
Create openviking namespace
Deploy Phase 1 ExternalSecret
Deploy Phase 2 (Helm values, ArgoCD Application)

References

Approved plan: ~/friday/inbox/ryan/2026-08-13-openviking-pilot-deployment-plan.md
Phase 0 model recommendation: ~/friday/inbox/ryan/2026-08-13-openviking-model-recommendation.md
Harbor pattern reference: cluster/platform/harbor/externalsecret.yaml

Manifest Validation

kubectl apply --dry-run=client -f externalsecret-phase1.yaml
# Result: externalsecret.external-secrets.io/openviking-credentials created (dry run)

Created by: Wong, Infrastructure Automation Specialist
Task: t_32766900, OpenViking Phase 1
Pattern: Harbor proven approach (consolidated ExternalSecret, template v2)

4.2 KiB Raw Blame History