170a31d090
- Build/push image: the-seas.local.mk-labs.cloud/library/maelstrom-ui:v0.3.17-1 (upstream volcengine/openviking web-studio/, pinned to commit 3cd1d4e9) - Deployment + Service serving the static SPA via nginx (reverse-proxies /api, /health, /ready to openviking backend; /bot deliberately NOT proxied) - Ingress at maelstrom.local.mk-labs.cloud (TLS via letsencrypt-internal) - ExternalSecret wiring scoped maelstrom-ui-key from op://mk-labs/openviking/maelstrom-ui-key into the pod env (MAELSTROM_UI_KEY) Per approved plan: inbox/ryan/2026-08-14-maelstrom-ui-deployment-plan.md Key mint + approval: system/inbox/agents/nick-fury/2026-08-14-maelstrom-ui-key-mint-complete.md Ryan approval: inbox/ryan/2026-08-14-maelstrom-key-approval.md
31 lines
1020 B
YAML
31 lines
1020 B
YAML
# ExternalSecret - maelstrom-ui scoped API key
|
|
# Per inbox/ryan/2026-08-14-maelstrom-key-approval.md: Ryan approved pre-seeding
|
|
# via ExternalSecret (option b) since Ryan is the sole user of the pilot.
|
|
# Scoped key (resources/search/tasks read-only, no bot/admin) minted by Nick Fury,
|
|
# see system/inbox/agents/nick-fury/2026-08-14-maelstrom-ui-key-mint-complete.md
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: maelstrom-ui-credentials
|
|
namespace: openviking
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
description: "Scoped read-only API key for maelstrom (Web Studio UI)"
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: maelstrom-ui-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
maelstrom_ui_key: "{{ .MAELSTROM_UI_KEY }}"
|
|
data:
|
|
- secretKey: MAELSTROM_UI_KEY
|
|
remoteRef:
|
|
key: openviking
|
|
property: maelstrom-ui-key
|