feat(wiki): roll the pod when one of its Secrets changes

All credentials reach the service via envFrom, which is read once at pod start. Reloader watches the four Secrets and restarts the Deployment on a change, so a corrected or rotated key takes effect without a manual restart. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Merge pull request 'feat(wiki): wire the Anthropic answer-model key from apps/ai/wiki-anthropic' (#949 ) from feat/wiki-anthropic-key into master
2026-09-24 17:11:45 +02:00 · 2026-09-24 14:50:55 +00:00 · 2026-09-24 14:50:45 +00:00 · 2026-09-24 16:28:55 +02:00
2 changed files with 7 additions and 3 deletions
@@ -23,6 +23,9 @@ kind: Deployment
 metadata:
  name: wiki
  namespace: ai
+  annotations:
+    # Keys, tokens and the Anthropic key arrive via envFrom; a rotated Secret rolls the pod.
+    secret.reloader.stakater.com/reload: wiki-gitea,wiki-api-keys,wiki-typesafe,wiki-anthropic
  labels:
    app.kubernetes.io/name: wiki
 spec:
@@ -1,6 +1,7 @@
 ---
-# Gitea read token and webhook secret, shared with the Python wiki-index until
-# that is retired. Secret keys are the configuration paths the host reads.
+# Gitea token (claude-bot, write:repository: the service creates raw/ files for
+# deposited facts) and the notes webhook secret. Secret keys are the
+# configuration paths the host reads.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -16,7 +17,7 @@ spec:
  data:
    - secretKey: Wiki__NoteStore__Gitea__Token
      remoteRef:
-        key: apps/ai/wiki-index
+        key: apps/ai/wiki-service
        property: gitea_token
    - secretKey: Wiki__Webhook__Secret
      remoteRef:
Author	SHA1	Message	Date
claude-botandClaude Fable 5.1	251f8cd87e	feat(wiki): roll the pod when one of its Secrets changes ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details All credentials reach the service via envFrom, which is read once at pod start. Reloader watches the four Secrets and restarts the Deployment on a change, so a corrected or rotated key takes effect without a manual restart. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-24 17:11:45 +02:00
k.renner	e6ba50d676	Merge pull request 'feat(wiki): wire the Anthropic answer-model key from apps/ai/wiki-anthropic' (#949 ) from feat/wiki-anthropic-key into master ci/woodpecker/cron/alert-monitor Pipeline was successful Details Reviewed-on: k.renner/homelab#949	2026-09-24 14:50:55 +00:00
k.renner	1431c74fda	Merge pull request 'chore(wiki): the service's Gitea token comes from apps/ai/wiki-service (write:repository)' (#948 ) from feat/wiki-service-write-token into master Reviewed-on: k.renner/homelab#948	2026-09-24 14:50:45 +00:00
claude-botandClaude Fable 5.1	64fdb568b4	chore(wiki): the service's Gitea token comes from apps/ai/wiki-service (write:repository) ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/pr-review Pipeline was successful Details Facts deposited through POST /api/v1/facts are committed as raw/ files. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-24 16:28:55 +02:00