feat(wiki): API key and network path for Paperclip agents #974

2026-09-25T17:35:36Z

claude-bot commented

2026-09-25 17:35:36 +00:00

Gives Paperclip agents their own wiki machine identity.

Auth__ApiKeys__paperclip ← OpenBao apps/ai/wiki-api-keys field paperclip (already written, version 5; Reloader rolls the wiki).
Agents call http://wiki.ai.svc.cluster.local:8080 in-cluster (like CI agents), so only the API key applies; no BasicAuth user.
CNPs: ai/wiki admits the paperclip pod on 8080; the paperclip egress CNP allows exactly that pod and port.

After merge: store the key as a Paperclip company secret and set it on the agents (X-Api-Key or Authorization: Bearer).

🤖 Generated with Claude Code

Gives Paperclip agents their own wiki machine identity. - `Auth__ApiKeys__paperclip` ← OpenBao `apps/ai/wiki-api-keys` field `paperclip` (already written, version 5; Reloader rolls the wiki). - Agents call `http://wiki.ai.svc.cluster.local:8080` in-cluster (like CI agents), so only the API key applies; no BasicAuth user. - CNPs: `ai/wiki` admits the `paperclip` pod on 8080; the paperclip egress CNP allows exactly that pod and port. After merge: store the key as a Paperclip company secret and set it on the agents (`X-Api-Key` or `Authorization: Bearer`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-25 17:35:36 +00:00

feat(wiki): API key and network path for Paperclip agents

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

157b102519

Paperclip agents get their own wiki machine identity: OpenBao
apps/ai/wiki-api-keys field `paperclip` (already written, version 5),
mapped to Auth__ApiKeys__paperclip. Reloader rolls the wiki on the new
key.

Agents reach the service in-cluster at wiki.ai.svc.cluster.local:8080,
like the CI agents, so only the app-level API key applies (no Traefik
BasicAuth user needed). The wiki CNP admits the paperclip pod on 8080
and the paperclip egress CNP allows exactly that pod and port.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

review-bot reviewed

2026-09-25 17:38:17 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 157b1025191f05e5950d40f2b906dc2ca0b4d2e8.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Gives Paperclip agents their own machine identity to call the Notes wiki API: a new Auth__ApiKeys__paperclip entry in the wiki-api-keys ExternalSecret, a matching egress rule from paperclip to ai/wiki:8080, and the corresponding ingress grant on the wiki CiliumNetworkPolicy. The change is small, symmetric, and follows the existing patterns in this repo closely — no blocking issues found.

🟡 Suggestions

kubernetes/infrastructure/network-policies/ai-ns.yaml:154 — the comment line "# Gitea (push webhook) and Paperclip agents (API key) may reach it. Gitea and wiki-embed are reached through" is ~110 characters, noticeably longer than the ~78-80 char wrap used by every other comment line in this file (including the two lines directly above and below it). Rewrapping keeps the block visually consistent.

Tests

No tests apply here — this is declarative Kubernetes config (Cilium CiliumNetworkPolicy + ExternalSecret), and the repo doesn't appear to carry policy-level tests for these manifests. I verified consistency by cross-checking the checkout rather than by running anything:

kubernetes/apps/wiki/deployment.yaml:76-85 already does envFrom: secretRef: wiki-api-keys (whole-secret, not per-key) and the pod's Reloader annotation (deployment.yaml:27) already lists wiki-api-keys — so the new Auth__ApiKeys__paperclip key requires no deployment change and will trigger a roll on rotation, matching the PR description.
kubernetes/apps/paperclip/paperclip.yaml confirms the paperclip pod carries namespace: paperclip / app.kubernetes.io/name: paperclip, matching the new matchLabels added in both paperclip/network-policy.yaml and ai-ns.yaml's wiki ingress rule.
kubernetes/infrastructure/network-policies/paperclip-ns.yaml (the namespace-wide default-deny-ingress CNP, not touched by this PR) doesn't separately list ai/wiki in its own egress block, but per its own comment ("Cilium unions allows across CNPs") that's fine — the new rule in paperclip/network-policy.yaml's paperclip-egress CNP is additive, same pattern already used for kube-apiserver and the Traefik :8443 rule that also aren't duplicated there.
The OpenBao side (apps/ai/wiki-api-keys field paperclip, version 5) is external state I can't verify from the checkout; taken on the PR author's word.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `157b1025191f05e5950d40f2b906dc2ca0b4d2e8`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Gives Paperclip agents their own machine identity to call the Notes wiki API: a new `Auth__ApiKeys__paperclip` entry in the `wiki-api-keys` ExternalSecret, a matching egress rule from `paperclip` to `ai/wiki:8080`, and the corresponding ingress grant on the `wiki` CiliumNetworkPolicy. The change is small, symmetric, and follows the existing patterns in this repo closely — no blocking issues found. ## 🟡 Suggestions - `kubernetes/infrastructure/network-policies/ai-ns.yaml:154` — the comment line "`# Gitea (push webhook) and Paperclip agents (API key) may reach it. Gitea and wiki-embed are reached through`" is ~110 characters, noticeably longer than the ~78-80 char wrap used by every other comment line in this file (including the two lines directly above and below it). Rewrapping keeps the block visually consistent. ## Tests No tests apply here — this is declarative Kubernetes config (Cilium `CiliumNetworkPolicy` + `ExternalSecret`), and the repo doesn't appear to carry policy-level tests for these manifests. I verified consistency by cross-checking the checkout rather than by running anything: - `kubernetes/apps/wiki/deployment.yaml:76-85` already does `envFrom: secretRef: wiki-api-keys` (whole-secret, not per-key) and the pod's Reloader annotation (`deployment.yaml:27`) already lists `wiki-api-keys` — so the new `Auth__ApiKeys__paperclip` key requires no deployment change and will trigger a roll on rotation, matching the PR description. - `kubernetes/apps/paperclip/paperclip.yaml` confirms the paperclip pod carries `namespace: paperclip` / `app.kubernetes.io/name: paperclip`, matching the new `matchLabels` added in both `paperclip/network-policy.yaml` and `ai-ns.yaml`'s `wiki` ingress rule. - `kubernetes/infrastructure/network-policies/paperclip-ns.yaml` (the namespace-wide `default-deny-ingress` CNP, not touched by this PR) doesn't separately list `ai`/`wiki` in its own egress block, but per its own comment ("Cilium unions allows across CNPs") that's fine — the new rule in `paperclip/network-policy.yaml`'s `paperclip-egress` CNP is additive, same pattern already used for `kube-apiserver` and the Traefik `:8443` rule that also aren't duplicated there. - The OpenBao side (`apps/ai/wiki-api-keys` field `paperclip`, version 5) is external state I can't verify from the checkout; taken on the PR author's word. ## Recommendation Looks reasonable — no blocking issues; comment above is optional.

k.renner merged commit d36ffc80c2 into master

2026-09-25 17:42:32 +00:00

k.renner referenced this issue from a commit

2026-09-25 17:42:32 +00:00

Merge pull request 'feat(wiki): API key and network path for Paperclip agents' (#974) from feat/paperclip-wiki-key into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#974