fee9965d0a
Remove resource-level sync-wave annotations that caused ArgoCD deadlock. The wave 8 annotation was meant for platform-level ordering (apps-of-apps) but was incorrectly applied to individual resources within the Application. This caused ArgoCD to apply Deployment (wave 0) before ExternalSecret (wave 8), resulting in CreateContainerConfigError since the pod needed the secret first. Changes: - namespace.yaml: Remove sync-wave annotation, add clarifying comment - externalsecret.yaml: Change sync-wave from 8 to -1 (must sync before Deployment at wave 0) - application.yaml: Remove sync-wave annotation, document as platform-level only in comments This ensures: 1. ExternalSecret syncs first (wave -1) 2. Deployment uses it immediately (implicit wave 0) 3. No deadlock Task: t_3906c41a
58 lines
2.0 KiB
YAML
58 lines
2.0 KiB
YAML
# ExternalSecret - OpenViking Credentials
|
|
# Wong, Phase 1, t_32766900
|
|
#
|
|
# Syncs OpenViking credentials from 1Password mk-labs vault
|
|
# Pattern: Harbor proven pattern (cluster/platform/harbor/externalsecret.yaml)
|
|
# Store: onepassword-connect ClusterSecretStore
|
|
# Namespace: openviking (created by Peter Parker in Phase 2)
|
|
# Wave: 8 (after Harbor Wave 7)
|
|
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: openviking-credentials
|
|
namespace: openviking
|
|
annotations:
|
|
# Wave -1: Ensure ExternalSecret syncs BEFORE the Deployment (wave 0)
|
|
# This guarantees the secret exists before the pod tries to mount it
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
description: "Phase 1 secrets for OpenViking deployment"
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: openviking-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
root_api_key: "{{ .OPENVIKING_ROOT_API_KEY }}"
|
|
embedding_api_key: "{{ .OPENVIKING_EMBEDDING_API_KEY }}"
|
|
vlm_api_key: "{{ .OPENVIKING_VLM_API_KEY }}"
|
|
|
|
data:
|
|
# OpenViking root API key - server administration
|
|
# Source: 1Password item "openviking-root-api-key", field "root-api-key"
|
|
- secretKey: OPENVIKING_ROOT_API_KEY
|
|
remoteRef:
|
|
key: openviking-root-api-key
|
|
property: root-api-key
|
|
|
|
# Embedding model endpoint token (nomic-embed-text-v1.5 at astro-orbiter:8002)
|
|
# Source: 1Password item "openviking-embedding-api-key", field "api-key"
|
|
# Phase 0 recommendation: placeholder token for local endpoint
|
|
- secretKey: OPENVIKING_EMBEDDING_API_KEY
|
|
remoteRef:
|
|
key: openviking-embedding-api-key
|
|
property: api-key
|
|
|
|
# VLM endpoint token (Llama-3.1-8B at astro-orbiter:8002)
|
|
# Source: 1Password item "openviking-vlm-api-key", field "api-key"
|
|
# Phase 0 recommendation: placeholder token for local endpoint
|
|
- secretKey: OPENVIKING_VLM_API_KEY
|
|
remoteRef:
|
|
key: openviking-vlm-api-key
|
|
property: api-key
|