nxtgauge-gitops/apps/litellm/overlays/prod/kustomization.yaml at be1efb983bf16513444fc95fb84b717bd6712398 - ashwin/nxtgauge-gitops - Forgejo: Beyond coding. We Forge.

ashwin/nxtgauge-gitops

Ashwin Kumar Sivakumar b4f371d415 Encrypt all secrets with SOPS, add Flux decryption support, rotate JWT_SECRET/AI_SERVICE_KEY

- Add .sops.yaml (age) and encrypt every plaintext Secret manifest in apps/
- Commit the Flux GitRepository/Kustomization (previously only applied manually)
  with a decryption stanza referencing the sops-age key (created out-of-band,
  not committed)
- Rotate JWT_SECRET (previously exposed in plaintext) and set a real
  AI_SERVICE_KEY (was an empty placeholder), shared between
  nxtgauge-backend-rust and nxtgauge-ai-assistant
- Wire JWT_SECRET into the ai-assistant deployment (was missing entirely,
  causing every authenticated request to fail)
- Redact the leaked LiteLLM production master key from README/OPENCODE_CONNECT
  docs; move the litellm prod overlay off a plaintext secretGenerator onto an
  encrypted patch

2026-07-02 17:56:28 +05:30

11 lines

237 B

YAML

Raw Blame History

 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: nxtgauge-ai
 resources:
   - ../../base
 # Overrides the placeholder LITELLM_MASTER_KEY from base/secret.yaml via strategic merge.
 patches:
   - path: secret.yaml