Problem: LLM_API_URL was hardcoded to external endpoint - Uses https://api.riotpiao.com/v1/chat/completions (TLS hairpin) - Not externalizable for CI/different environments Solution: Move to encrypted ConfigMap with in-cluster endpoint - LLM_API_URL: http://api-gateway.api.svc.cluster.local:8080/v1/chat/completions - No TLS, no nginx hairpin, direct cluster communication - Encrypted with SOPS for security - CI can update values.yaml and auto-deploy Changes: - Create configmap.enc.yaml (SOPS-encrypted) - Update deployment.yaml to use configMapKeyRef - Add SOPS config to kustomization.yaml - Deployment now references portfolio-llm-config ConfigMap