From 6506a639c9d276701a3e3cc570cdac02aa5ea861 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Sun, 6 Sep 2026 23:24:12 -0700
Subject: [PATCH] fix: move LLM config to encrypted ConfigMap (CI-friendly)

Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments

Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy

Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap
---
 infra/portfolio/base/configmap.enc.yaml | 27 +++++++++++++++++++++++++
 infra/portfolio/base/deployment.yaml    | 12 ++++++++---
 infra/portfolio/base/kustomization.yaml |  5 +++++
 3 files changed, 41 insertions(+), 3 deletions(-)
 create mode 100644 infra/portfolio/base/configmap.enc.yaml

diff --git a/infra/portfolio/base/configmap.enc.yaml b/infra/portfolio/base/configmap.enc.yaml
new file mode 100644
index 0000000..058748a
--- /dev/null
+++ b/infra/portfolio/base/configmap.enc.yaml
@@ -0,0 +1,27 @@
+apiVersion: ENC[AES256_GCM,data:Qv8=,iv:v6kMpvgzkpGdOzuwurpWhVJG8dqjHG55mZebDs0PeWs=,tag:9W00OTNe1kQ9mA/l0eSINg==,type:str]
+kind: ENC[AES256_GCM,data:TUqF1gRXmGmc,iv:ettHZPLG+Jw29TuSmeUNi4DsK944JNgvmu6hry3osSo=,tag:CbtvTOVxpWivW6UyO7MrLA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:0YEEc2oqKeGjWr7C0eAzz0dZft0=,iv:BnCIMRZAsDdW3IxIAhsj/WrZNCipG5qT1kfnuQykt20=,tag:EFjanh4e6T5bQX6dupXRgw==,type:str]
+    namespace: ENC[AES256_GCM,data:MheF93lBY58x,iv:Mp64W8Beu+q8NiQTtUhpAxwcfT4JPkLenjh7ljJaGak=,tag:ves1LGuzj1QGY1OpqF560g==,type:str]
+    labels:
+        app.kubernetes.io/name: ENC[AES256_GCM,data:i+aoOfomVrFm,iv:/g+F6ZaWDvzjjv4P35rgcBMSSAyrTyWymm//KVRrpYg=,tag:UIn8tKERKolTYq/bVdQ+iA==,type:str]
+data:
+    #ENC[AES256_GCM,data:9whKTa+VQQtYnOrrTanXJpPZltIEiAh029xIu9YhAqcaXQ2I6XTmCU8LqyNrQKNw5CWJJg0F,iv:Sm5T9g2aJQz0qrNzA1B8QBGRkio6u5AAc+hWoUIs0bU=,tag:jxZ0llX6pKYBsvtRxCdgaA==,type:comment]
+    #ENC[AES256_GCM,data:XLVVNIgolPDi5pkm/S6IZJHZIj+84b/1VTwLCnrePwFmDrIfRdJAG7LbxWFmRJtaO2TEHnd2FEHIEg==,iv:YkfB3Q26+PHqd+51gAZOXoJKPpvIeT5wN0Ye10spdYM=,tag:spTTVuE52SvDuTo3LQXqOw==,type:comment]
+    LLM_API_URL: ENC[AES256_GCM,data:dJRd+J1ovECOIctWhwMYuhv3rReqmwUHkcN8fxtxLfohIqg8/LOsPw5FE2B9GrEzjnYwTcku6vyvb+CCCJMLmDE=,iv:23Jo8dgWeMLX+uYyFQXPa1cHqKVTPs6qHI4i/Go6lTY=,tag:KuRtrTdzKk3uf9ph5Qp5Nw==,type:str]
+    LLM_MODEL: ENC[AES256_GCM,data:lRDaz2Fey+2czl3K1Qju/82XNw==,iv:nJR+wNNGKDCkYdToEfERqYZdVS34TmVvMVRjLHYFgE8=,tag:XOiZmi9k+54yJm4ofUiXFw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWEpWNFQ4TXNlSG5NcVFB
+            Tll2OUFFUjV4RDAvOE5ZSWRZZE5YL2xGYkY4CjI4SFp5OXJlcHd0WG9vTVFwM2do
+            YVVleVhCam9qeGVhL05xMG5mMWorNWMKLS0tIHU4MVNuSjkwNkNKTi93OXFkQlJh
+            Y28wbW9uK21zYzNWUzE2MzJKN0t2cFUKlgVpvion4Qg7DFw/arUZupyy1d7I59P4
+            njaeu0pTj6StNiZfHhCguVWpYBECnSaF5A4aoLFbUFVpdL/JC8V2GQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    lastmodified: "2026-09-07T06:23:56Z"
+    mac: ENC[AES256_GCM,data:2ufxupBbFbV08JJoN3ySbehsCqmAfNt6anUeaWg4JlxvTN+51yd8NeW76HJ8yo0MSf7FjjnX83CHeuVmcJaIXcTTFjKW4Dp3Ww5LYq9PESQu6ywoeXSfsrYH+T1WKAUCJq/HJOYHTvnpS4zSnHfDA8madHWjJI3/Hl1haC0cKyE=,iv:/Xv//b2mBrr+Rye01YNjvdUp4zLi/+Ly+4RCqG2RO+s=,tag:g+7rr4dxXbkATSBVQ4l0Wg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2
diff --git a/infra/portfolio/base/deployment.yaml b/infra/portfolio/base/deployment.yaml
index 31e8a0a..bc86b5f 100644
--- a/infra/portfolio/base/deployment.yaml
+++ b/infra/portfolio/base/deployment.yaml
@@ -42,11 +42,17 @@ spec:
             secretKeyRef:
               name: portfolio-agent-oidc
               key: TOKEN_URL
-        # LLM API configuration
+        # LLM API configuration (from encrypted ConfigMap)
         - name: LLM_API_URL
-          value: "https://api.riotpiao.com/v1/chat/completions"
+          valueFrom:
+            configMapKeyRef:
+              name: portfolio-llm-config
+              key: LLM_API_URL
         - name: LLM_MODEL
-          value: "qwen2.5:3b-instruct"
+          valueFrom:
+            configMapKeyRef:
+              name: portfolio-llm-config
+              key: LLM_MODEL
         ports:
         - name: http
           containerPort: 3000
diff --git a/infra/portfolio/base/kustomization.yaml b/infra/portfolio/base/kustomization.yaml
index 99d0a86..7b1cf24 100644
--- a/infra/portfolio/base/kustomization.yaml
+++ b/infra/portfolio/base/kustomization.yaml
@@ -3,6 +3,11 @@ kind: Kustomization
 namespace: portfolio
 resources:
 - namespace.yaml
+- configmap.enc.yaml
 - deployment.yaml
 - service.yaml
 - ingress.yaml
+
+# Decrypt secrets via SOPS before applying
+sops:
+  version: 3