fix: extract auth config to ConfigMap + SOPS secret, update slug to poimen

- Add k8s/app/config.yaml (ConfigMap) for non-sensitive env vars - Add k8s/app/auth.enc.yaml (SOPS-encrypted) for AUTHENTIK_ISSUER, AUDIENCE - Add k8s/app/secret-generator.yaml (KSOPS generator for ArgoCD) - Deployment uses envFrom instead of inline env vars - Update Authentik slug from poimen-memory to poimen (404 on OIDC discovery) - Update OpenSearch JWKS/issuer URLs to match new slug - Reloader (auto-reload-all=true) triggers rollout on config change
2026-09-07 22:25:44 -07:00
parent d8c3b06cb0
commit c538397db4
6 changed files with 74 additions and 4 deletions
@@ -66,11 +66,16 @@ spec:
                secretKeyRef:
                  name: poimen-memory-secrets
                  key: llm-api-key
-            # Server config
+            # Server config (from ConfigMap)
            - name: MEM_PORT
              value: "8080"
            - name: MEM_HOME
              value: "/tmp"
+          envFrom:
+            - configMapRef:
+                name: poimen-memory-config
+            - secretRef:
+                name: poimen-memory-auth
          args:
            - serve
            - --port