konairius/homelab
10
0
Fork 0
Code Issues 8 Pull Requests 5 Packages Projects Releases 1 Wiki Activity

chore(wiki): build.1790257176 (read API and pages); TypeSafe key as ExternalSecret #944

Merged
k.renner merged 1 commits from chore/wiki-phase2-image into master 2026-09-24 13:45:05 +00:00
Conversation 1 Commits 1 Files Changed 2
+23 -2
claude-bot commented 2026-09-24 13:42:31 +00:00
Member
Copy Link
Copy Source

Pins the image from Wiki PR #4 (read API, MudBlazor pages). Adds the ExternalSecret wiki-typesafe (OpenBao apps/ai/wiki-typesafe, field api_key, stored) as Wiki__Judges__Models__typesafe__ApiKey, which the ask phase (Wiki PR #5) reads; until that image is deployed the variable is unused. TypeSafe is reached via the namespace's world egress, no policy change.

🤖 Generated with Claude Code

Pins the image from Wiki PR #4 (read API, MudBlazor pages). Adds the ExternalSecret `wiki-typesafe` (OpenBao `apps/ai/wiki-typesafe`, field `api_key`, stored) as `Wiki__Judges__Models__typesafe__ApiKey`, which the ask phase (Wiki PR #5) reads; until that image is deployed the variable is unused. TypeSafe is reached via the namespace's world egress, no policy change. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
claude-bot added 1 commit 2026-09-24 13:42:31 +00:00
chore(wiki): build.1790257176 (read API and pages); TypeSafe key as ExternalSecret
ci/woodpecker/pr/ci-manifests-test Pipeline was successful
Details
ci/woodpecker/pr/ci-scripts-test Pipeline was successful
Details
ci/woodpecker/pr/pr-review Pipeline was successful
Details
edc07f2543 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
review-bot left a comment
Member
Copy Link
Copy Source

🤖 Automated review — model CLI default (complexity: complex), commit edc07f254321e033ab8222b95caff3455fc9f54f.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Bumps the wiki deployment image to build.1790257176 and adds a new wiki-typesafe ExternalSecret that injects Wiki__Judges__Models__typesafe__ApiKey from OpenBao (apps/ai/wiki-typesafe/api_key). Small, well-scoped change that follows the existing conventions in this app exactly; I verified the networking claim in the PR description and it holds up.

No blocking issues.

🟡 Suggestions

  • kubernetes/apps/wiki/externalsecrets.yaml:45: the new wiki-typesafe ExternalSecret is env-injected via envFrom on the Deployment — like the other two secrets in this file, a key rotation in OpenBao won't take effect until the pod restarts (ESO updates the underlying Secret, but envFrom doesn't hot-reload). This matches the existing wiki-gitea/wiki-api-keys pattern, so it's consistent, not a regression — just flagging since it's a new credential path.

Tests

None expected or needed — this is a GitOps manifest change (image pin + secret wiring), consistent with how the sibling image bumps and ExternalSecrets in this repo are handled without tests.

Verification notes

  • Confirmed the PR body's claim that "TypeSafe is reached via the namespace's world egress, no policy change" is accurate: kubernetes/infrastructure/network-policies/ai-ns.yaml grants the ai namespace toEntities: [host, remote-node, world] egress, which already covers the new outbound call from the wiki pod — no CiliumNetworkPolicy change was needed or made.
  • The new ExternalSecret (kubernetes/apps/wiki/externalsecrets.yaml:44-62) matches the shape, namespace (ai), secretStoreRef (ClusterSecretStore/openbao), and naming conventions of the two existing ExternalSecrets in the same file (wiki-gitea, wiki-api-keys).
  • The Deployment's new envFrom entry (kubernetes/apps/wiki/deployment.yaml:80-81) correctly references the new secret's target.name: wiki-typesafe.
  • No kustomization.yaml change was needed since both edited files were already tracked there.

Recommendation

Looks reasonable — no blocking issues; comment above is optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `edc07f254321e033ab8222b95caff3455fc9f54f`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Bumps the `wiki` deployment image to `build.1790257176` and adds a new `wiki-typesafe` ExternalSecret that injects `Wiki__Judges__Models__typesafe__ApiKey` from OpenBao (`apps/ai/wiki-typesafe`/`api_key`). Small, well-scoped change that follows the existing conventions in this app exactly; I verified the networking claim in the PR description and it holds up. No blocking issues. ## 🟡 Suggestions - `kubernetes/apps/wiki/externalsecrets.yaml:45`: the new `wiki-typesafe` ExternalSecret is env-injected via `envFrom` on the Deployment — like the other two secrets in this file, a key rotation in OpenBao won't take effect until the pod restarts (ESO updates the underlying `Secret`, but `envFrom` doesn't hot-reload). This matches the existing `wiki-gitea`/`wiki-api-keys` pattern, so it's consistent, not a regression — just flagging since it's a new credential path. ## Tests None expected or needed — this is a GitOps manifest change (image pin + secret wiring), consistent with how the sibling image bumps and ExternalSecrets in this repo are handled without tests. ## Verification notes - Confirmed the PR body's claim that "TypeSafe is reached via the namespace's world egress, no policy change" is accurate: `kubernetes/infrastructure/network-policies/ai-ns.yaml` grants the `ai` namespace `toEntities: [host, remote-node, world]` egress, which already covers the new outbound call from the `wiki` pod — no CiliumNetworkPolicy change was needed or made. - The new ExternalSecret (`kubernetes/apps/wiki/externalsecrets.yaml:44-62`) matches the shape, namespace (`ai`), `secretStoreRef` (`ClusterSecretStore/openbao`), and naming conventions of the two existing ExternalSecrets in the same file (`wiki-gitea`, `wiki-api-keys`). - The Deployment's new `envFrom` entry (`kubernetes/apps/wiki/deployment.yaml:80-81`) correctly references the new secret's `target.name: wiki-typesafe`. - No `kustomization.yaml` change was needed since both edited files were already tracked there. ## Recommendation Looks reasonable — no blocking issues; comment above is optional. <!-- pr-review:sha=edc07f254321e033ab8222b95caff3455fc9f54f -->
k.renner merged commit 3f20dddc22 into master 2026-09-24 13:45:05 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
review-bot
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#944