feat(helm): wire agent chat env + move credentials to Secret - #30
Merged
Conversation
shimoncohen
force-pushed
the
feat/helm-agent-env-secrets
branch
2 times, most recently
from
July 30, 2026 14:58
bc670a2 to
edb5254
Compare
Chat panel (LiteLLM) config was never added to the chart. Add an agent block to values and render AGENT_ENABLED, LITELLM_BASE_URL, AGENT_MODEL, DEVELOPER_PORTAL_URL and optional AGENT_ALLOWED_ORIGIN. Move the AWS access/secret keys and LITELLM_API_KEY out of the ConfigMap into Secrets, one resource per template file: s3-secret and agent-secret (the latter only when agent.enabled). Consume via envFrom secretRefs. Support external Secrets: set s3.existingSecret / agent.litellm.existingSecret to reference a pre-existing Secret instead of creating one. When unset, the chart creates the Secret from values. Per-secret checksum annotations roll pods on change (chart-created Secrets only). Drop the hardcoded default key. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
shimoncohen
force-pushed
the
feat/helm-agent-env-secrets
branch
from
July 30, 2026 15:06
edb5254 to
0be6fd7
Compare
INDEX_KEY, ITEMS_TIMEOUT, ITEMS_STALE, AWS_REGION and the PUBLIC_*_HREF nav links were hardcoded in the ConfigMap, so no environment could override them and every deploy shipped the literal placeholder URLs. Drive them from new values (s3.region, items.*, links.*); defaults keep the previous rendered output. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
shimoncohen
force-pushed
the
feat/helm-agent-env-secrets
branch
from
July 30, 2026 15:24
3540241 to
b077b02
Compare
route.wildcardPolicy was never read by route.yaml (Route defaults it to None anyway). Remove from all values files. env.protocol is HTTP-only here. Hardcode protocol: TCP in the service and deployment and drop the value entirely. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
shimoncohen
force-pushed
the
feat/helm-agent-env-secrets
branch
from
July 30, 2026 15:26
b077b02 to
2071033
Compare
Base values.yaml shipped environment: production as the default; a plain install with no env-specific values file rendered production labels. Flip the default to development. values-prod.yaml still sets production. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The app always listens on 8080; the port was never meant to vary per environment. Hardcode 8080 in the service, deployment and ingress and remove the env.port/env.targetPort values from all values files. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chat panel (LiteLLM) config was never added to the chart. Add an agent block to values and render AGENT_ENABLED, LITELLM_BASE_URL, AGENT_MODEL, DEVELOPER_PORTAL_URL and optional AGENT_ALLOWED_ORIGIN.
Move LITELLM_API_KEY and the AWS access/secret keys out of the ConfigMap into a new Opaque Secret, consumed via envFrom secretRef. Add a checksum/secret annotation so pods roll when the Secret changes.