e80a1dc088
The 'open-webui' item doesn't exist in 1Password yet. webui-secret-key is manually patched in the secret for now. Re-enable ExternalSecret pull once the 1Password item is created.
40 lines
1.4 KiB
YAML
40 lines
1.4 KiB
YAML
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: body-wars-credentials
|
|
namespace: open-webui
|
|
annotations:
|
|
# Sync priority: ExternalSecret fetches from 1Password before other resources deploy
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: body-wars-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
vllm-api-key: "{{ .vllm_api_key }}"
|
|
# NOTE: webui-secret-key is manually managed as a Kubernetes secret patch
|
|
# until the 'open-webui' item exists in 1Password with a 'secret-key' field.
|
|
# To re-enable automatic sync:
|
|
# 1. Add open-webui item to 1Password mk-labs vault
|
|
# 2. Add secret-key field with a strong random value
|
|
# 3. Uncomment the data section below and re-apply this manifest
|
|
webui-secret-key: "{{ .webui_secret_key | default \"PLACEHOLDER\" }}"
|
|
data:
|
|
# vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
|
|
- secretKey: vllm_api_key
|
|
remoteRef:
|
|
key: vllm
|
|
property: api-key
|
|
# WebUI JWT signing secret - TEMPORARILY DISABLED
|
|
# Uncomment and configure once open-webui item exists in 1Password:
|
|
# - secretKey: webui_secret_key
|
|
# remoteRef:
|
|
# key: open-webui
|
|
# property: secret-key
|