- .env.example: template with all service URIs for local development
- LOCAL_DEV.md: guide for running poimen locally
- Production: config.yaml (SOPS-encrypted K8s ConfigMap)
- Local: .env file (gitignored, never committed)
- Application reads from ENV in both cases (K8s ConfigMap + local dotenv)
- Simplifies prod/dev: same code, different config sources
- config.yaml: prod config with cluster-internal DNS (LLM, OpenSearch, Authentik, Temporal, API-GW)
- config.local.yaml: dev config with external URLs via ingress
- deployment.yaml: remove hardcoded URIs, read all from ConfigMap envFrom
- All downstream service URIs now configurable per environment
- Production config encrypted with SOPS (Age-based)
- Application code reads LLM_ENDPOINT, OPENSEARCH_HOST, AUTHENTIK_ISSUER, etc. from ENV
- Simplifies prod/dev switching: just swap ConfigMap, no code changes
## Problem
JWT validation failing with `error decoding response body: expected value at line 6 column 1`.
Root cause: `AUTHENTIK_ISSUER` pointed to slug `poimen-memory` which returns 404 on OIDC discovery. Slug was renamed to `poimen` in Authentik.
Secondary issue: auth env vars were set via `kubectl set env` (not in git), so every ArgoCD sync reverted them.
## Changes
- **k8s/app/config.yaml** — ConfigMap for non-sensitive env (auth mode, rate limits, OpenSearch/Obsidian URLs)
- **k8s/app/auth.enc.yaml** — SOPS-encrypted Secret with `AUTHENTIK_ISSUER`, `AUTHENTIK_AUDIENCE`, `JWT_CACHE_TTL_SECS`
- **k8s/app/secret-generator.yaml** — KSOPS generator for ArgoCD decryption
- **k8s/app/deployment.yaml** — `envFrom` referencing ConfigMap + Secret
- **k8s/app/kustomization.yaml** — Added config.yaml + KSOPS generator
- **k8s/app/opensearch-deployment.yaml** — Updated JWKS/issuer URLs to `poimen` slug
## Rollout
Reloader (`--auto-reload-all=true`) triggers rolling restart when ConfigMap/Secret change. Merge and ArgoCD sync handles everything.Reviewed-on: rock/poimen-memory#40
Co-authored-by: rock <[email protected]>
Memory service stores in pgvector, not local files.
PVC was RWO causing multi-node scheduling failures with 2 replicas.
MEM_HOME points to /tmp (emptyDir) for any scratch needs.
rock
poimenandrock
Story Crater Bot