- Remove sops section that breaks vanilla kustomize parsing
- SOPS decryption handled by ArgoCD repo-server ksops plugin
- Allows Image Updater to run 'kustomize edit set image' without errors
- Image Updater can now update portfolio:latest tag in images section
- Add images section so kustomize can properly update portfolio image tag
- Keep sops field for ArgoCD's ksops plugin to decrypt secrets
- Allows Image Updater to detect and sync latest image builds
- Add images section to properly track portfolio image for kustomize
- Remove problematic sops field that breaks kustomize edit commands
- Allows Image Updater to properly update image tags via kustomize
- SOPS decryption should be handled by ArgoCD plugin, not kustomization
- Add argocd-image-updater annotations to auto-detect :latest image changes
- Updater will poll registry and trigger ArgoCD sync when new build pushed
- Deployment pulls latest image on pod restart
Enables automatic updates without manual ArgoCD sync
Problem: LLM_API_URL was hardcoded to external endpoint
- Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin)
- Not externalizable for CI/different environments
Solution: Move to encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS, no nginx hairpin, direct cluster communication
- Encrypted with SOPS for security
- CI can update values.yaml and auto-deploy
Changes:
- Create configmap.enc.yaml (SOPS-encrypted)
- Update deployment.yaml to use configMapKeyRef
- Add SOPS config to kustomization.yaml
- Deployment now references portfolio-llm-config ConfigMap
Missing env vars caused LLM calls to fail even with valid OAuth tokens.
Now pod has:
- Auth credentials (Authentik client_id/secret/token_url) ✅
- LLM endpoint (api.riotpiao.com/v1/chat/completions) ✅
- Model (qwen2.5:3b-instruct) ✅
Chat API will now successfully authenticate and call LLM gateway.
- Add lib/auth.ts: OAuth client with token caching
- Use client_credentials grant with portfolio-agent service account
- Mount portfolio-agent-oidc secret for credentials
- Remove static LLM_API_TOKEN dependency
Story Crater Bot
rock