rock/riotpiao.com
0
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: move LLM config to encrypted ConfigMap (CI-friendly) #2

Closed
rock wants to merge 1 commits from fix/llm-config-encrypted into main
pull from: fix/llm-config-encrypted
merge into: :main
Conversation 0 Commits 1 Files Changed 3
+41 -3
rock commented 2026-09-07 06:25:46 +00:00
Owner
Copy Link
Copy Source

Problem

LLM_API_URL was hardcoded in deployment.yaml to the external HTTPS endpoint:

LLM_API_URL: https://api.riotpiao.com/v1/chat/completions

Issues:

  • TLS hairpin overhead: DNS resolves to nginx, which proxies back in-cluster
  • Not externalizable: CI cannot update config without app redeployment
  • Environment coupling: Same URL for dev/staging/prod
  • Plain text in git: Config not encrypted (not a secret but sensitive)

Solution

Move LLM configuration to SOPS-encrypted ConfigMap with in-cluster endpoint.

Changes

  1. Create configmap.enc.yaml (SOPS-encrypted)

    • LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
    • LLM_MODEL: qwen2.5:3b-instruct
    • Encrypted with age key from .sops.yaml

  2. Update deployment.yaml

    • Replace hardcoded value: with valueFrom: configMapKeyRef
    • Reference portfolio-llm-config ConfigMap

  3. Update kustomization.yaml

    • Add configmap.enc.yaml to resources
    • Add sops: version: 3 for auto-decryption

Benefits

✅ No TLS overhead: In-cluster endpoint, direct communication
✅ Externalizable: CI can update ConfigMap without app redeployment
✅ Environment-aware: Different config per environment (update kustomization overlay)
✅ Encrypted in git: Secrets encrypted with SOPS, never plain text
✅ ArgoCD-friendly: Auto-decrypts via SOPS before applying

Testing

After merge:

  1. ArgoCD syncs → SOPS decrypts → ConfigMap created
  2. Portfolio pod mounts ConfigMap values
  3. Verify: kubectl -n portfolio get cm portfolio-llm-config
  4. Verify pod env: kubectl -n portfolio exec deploy/portfolio -- env | grep LLM
## Problem LLM_API_URL was hardcoded in deployment.yaml to the external HTTPS endpoint: ``` LLM_API_URL: https://api.riotpiao.com/v1/chat/completions ``` Issues: - **TLS hairpin overhead**: DNS resolves to nginx, which proxies back in-cluster - **Not externalizable**: CI cannot update config without app redeployment - **Environment coupling**: Same URL for dev/staging/prod - **Plain text in git**: Config not encrypted (not a secret but sensitive) ## Solution Move LLM configuration to SOPS-encrypted ConfigMap with in-cluster endpoint. ### Changes 1. **Create configmap.enc.yaml** (SOPS-encrypted) - LLM_API_URL: `http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions` - LLM_MODEL: `qwen2.5:3b-instruct` - Encrypted with age key from .sops.yaml 2. **Update deployment.yaml** - Replace hardcoded `value:` with `valueFrom: configMapKeyRef` - Reference `portfolio-llm-config` ConfigMap 3. **Update kustomization.yaml** - Add `configmap.enc.yaml` to resources - Add `sops: version: 3` for auto-decryption ### Benefits ✅ **No TLS overhead**: In-cluster endpoint, direct communication ✅ **Externalizable**: CI can update ConfigMap without app redeployment ✅ **Environment-aware**: Different config per environment (update kustomization overlay) ✅ **Encrypted in git**: Secrets encrypted with SOPS, never plain text ✅ **ArgoCD-friendly**: Auto-decrypts via SOPS before applying ### Testing After merge: 1. ArgoCD syncs → SOPS decrypts → ConfigMap created 2. Portfolio pod mounts ConfigMap values 3. Verify: `kubectl -n portfolio get cm portfolio-llm-config` 4. Verify pod env: `kubectl -n portfolio exec deploy/portfolio -- env | grep LLM`
rock added 1 commit 2026-09-07 06:25:48 +00:00
fix: move LLM config to encrypted ConfigMap (CI-friendly)
Build & Push Portfolio Image / Test (pull_request) Failing after 34s
Details
Build & Push Portfolio Image / Build & Push Image (pull_request) Skipped
Details
4ad8a4f4a4 
Problem: LLM_API_URL hardcoded to external HTTPS endpoint
- https://api.riotpiao.com/v1/chat/completions (TLS hairpin through nginx)
- Not externalizable for CI or environment-specific deployment

Solution: Move to SOPS-encrypted ConfigMap with in-cluster endpoint
- LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions
- No TLS overhead, direct cluster communication
- Encrypted for security (SOPS + age key)
- Externalizable: CI can update values without app redeployment

Changes:
1. Create configmap.enc.yaml (SOPS-encrypted)
   - Data: LLM_API_URL, LLM_MODEL
   - Encrypted with .sops.yaml age key
2. Update deployment.yaml
   - Change from 'value:' to 'valueFrom: configMapKeyRef'
   - Reference portfolio-llm-config ConfigMap
3. Update kustomization.yaml
   - Add configmap.enc.yaml to resources
   - Add sops: version: 3 for decryption

Benefits:
- ArgoCD auto-decrypts via SOPS before applying
- CI can auto-patch ConfigMap without app changes
- Environment-specific config (dev/staging/prod)
- Secrets encrypted in git (never plain text)
rock closed this pull request 2026-09-07 06:39:28 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
rock (Rock)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: rock/riotpiao.com#2