feat(wiki): wire the Anthropic answer-model key from apps/ai/wiki-anthropic #949

2026-09-24T14:45:13Z

claude-bot commented

2026-09-24 14:45:13 +00:00

Prepares the cluster for Wiki PR #7 (questions endpoint, Anthropic answer model).

ExternalSecret wiki-anthropic: apps/ai/wiki-anthropic property api_key → Wiki__AnswerModels__Models__claude-sonnet__ApiKey.
Deployment: envFrom that secret with optional: true, so the pod starts before the OpenBao key exists. Until then /api/v1/questions returns 503 and the status page marks the answer model unhealthy.
No CNP change: the ai namespace egress already admits world (api.anthropic.com).

Needs one manual step: place an Anthropic API key in OpenBao at secret/apps/ai/wiki-anthropic with field api_key. I found no existing Anthropic API key in OpenBao or the repo (CI uses a Claude Code OAuth token, which the Messages API does not accept).

The image bump follows once Wiki #6/#7/#8 merge and the release pipeline has built.

🤖 Generated with Claude Code

Prepares the cluster for Wiki PR #7 (questions endpoint, Anthropic answer model). - `ExternalSecret wiki-anthropic`: `apps/ai/wiki-anthropic` property `api_key` → `Wiki__AnswerModels__Models__claude-sonnet__ApiKey`. - Deployment: `envFrom` that secret with `optional: true`, so the pod starts before the OpenBao key exists. Until then `/api/v1/questions` returns 503 and the status page marks the answer model unhealthy. - No CNP change: the `ai` namespace egress already admits `world` (api.anthropic.com). **Needs one manual step**: place an Anthropic API key in OpenBao at `secret/apps/ai/wiki-anthropic` with field `api_key`. I found no existing Anthropic API key in OpenBao or the repo (CI uses a Claude Code OAuth token, which the Messages API does not accept). The image bump follows once Wiki #6/#7/#8 merge and the release pipeline has built. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-09-24 14:45:13 +00:00

feat(wiki): wire the Anthropic answer-model key from apps/ai/wiki-anthropic

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

6784bb5600

Wiki PR #7 adds the questions endpoint backed by the Anthropic Messages API.
The key arrives as Wiki__AnswerModels__Models__claude-sonnet__ApiKey via an
ExternalSecret; the secretRef is optional so the pod keeps starting while the
OpenBao key does not exist yet. Namespace egress already admits world, so no
CNP change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

review-bot reviewed

2026-09-24 14:47:58 +00:00

review-bot left a comment

🤖 Automated review — model CLI default (complexity: complex), commit 6784bb5600b10f286b71b46c4400f513c1326c57.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

Adds the OpenBao-backed wiki-anthropic ExternalSecret (mapping apps/ai/wiki-anthropic#api_key → Wiki__AnswerModels__Models__claude-sonnet__ApiKey) and wires it into the wiki Deployment via an optional: true envFrom.secretRef, so the pod can start before the OpenBao key is populated. This is prep work for a future Wiki release and contains no application code. The change is small, closely mirrors the existing wiki-typesafe ExternalSecret/secretRef pair in the same files, and I found no blocking issues.

🟡 Suggestions

kubernetes/apps/wiki/externalsecrets.yaml:69: The new ExternalSecret will fail to sync until apps/ai/wiki-anthropic exists in OpenBao (as the PR body acknowledges — "needs one manual step"). That's fine given optional: true on the secretRef, but worth confirming this repo's ExternalSecrets controller doesn't emit alerting/paging on a SecretSyncedError condition for a not-yet-provisioned secret, since this will sit in a failing state until the manual OpenBao step happens.
No CiliumNetworkPolicy change is needed here — I checked kubernetes/infrastructure/network-policies/ai-ns.yaml:100-105, and the ai namespace's egress already grants toEntities: [host, remote-node, world] with no port restriction, so outbound HTTPS to api.anthropic.com is already permitted. The PR body's claim checks out.

Tests

No automated tests apply — this is a Kubernetes manifest change in a GitOps repo with no test suite for manifests. The change is inert until the referenced OpenBao secret is created and the Wiki image is bumped to a version that reads Wiki__AnswerModels__Models__claude-sonnet__ApiKey, so there's nothing to exercise yet. The manifest itself is consistent with the file's existing conventions (same ClusterSecretStore, refreshInterval, and key-naming pattern as wiki-typesafe), and kustomization.yaml already includes externalsecrets.yaml, so no wiring is missing.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `CLI default` (complexity: complex), commit `6784bb5600b10f286b71b46c4400f513c1326c57`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary Adds the OpenBao-backed `wiki-anthropic` ExternalSecret (mapping `apps/ai/wiki-anthropic#api_key` → `Wiki__AnswerModels__Models__claude-sonnet__ApiKey`) and wires it into the `wiki` Deployment via an `optional: true` `envFrom.secretRef`, so the pod can start before the OpenBao key is populated. This is prep work for a future Wiki release and contains no application code. The change is small, closely mirrors the existing `wiki-typesafe` ExternalSecret/secretRef pair in the same files, and I found no blocking issues. ## 🟡 Suggestions - `kubernetes/apps/wiki/externalsecrets.yaml:69`: The new `ExternalSecret` will fail to sync until `apps/ai/wiki-anthropic` exists in OpenBao (as the PR body acknowledges — "needs one manual step"). That's fine given `optional: true` on the `secretRef`, but worth confirming this repo's ExternalSecrets controller doesn't emit alerting/paging on a `SecretSyncedError` condition for a not-yet-provisioned secret, since this will sit in a failing state until the manual OpenBao step happens. - No CiliumNetworkPolicy change is needed here — I checked `kubernetes/infrastructure/network-policies/ai-ns.yaml:100-105`, and the `ai` namespace's egress already grants `toEntities: [host, remote-node, world]` with no port restriction, so outbound HTTPS to `api.anthropic.com` is already permitted. The PR body's claim checks out. ## Tests No automated tests apply — this is a Kubernetes manifest change in a GitOps repo with no test suite for manifests. The change is inert until the referenced OpenBao secret is created and the Wiki image is bumped to a version that reads `Wiki__AnswerModels__Models__claude-sonnet__ApiKey`, so there's nothing to exercise yet. The manifest itself is consistent with the file's existing conventions (same `ClusterSecretStore`, `refreshInterval`, and key-naming pattern as `wiki-typesafe`), and `kustomization.yaml` already includes `externalsecrets.yaml`, so no wiring is missing. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

claude-bot commented

2026-09-24 14:49:03 +00:00

Re the SecretSyncedError suggestion: no PrometheusRule in this repo selects ExternalSecret conditions. The only ESO-adjacent alert is OpenBaoBelowQuorum in kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml, keyed on kube_statefulset_status_replicas_ready, so a single not-yet-provisioned key raises nothing. The failing condition is visible on the ExternalSecret itself (kubectl -n ai get externalsecret wiki-anthropic) until secret/apps/ai/wiki-anthropic exists.

Re the SecretSyncedError suggestion: no PrometheusRule in this repo selects ExternalSecret conditions. The only ESO-adjacent alert is `OpenBaoBelowQuorum` in `kubernetes/apps/monitoring-rules/prometheusrule-openbao.yaml`, keyed on `kube_statefulset_status_replicas_ready`, so a single not-yet-provisioned key raises nothing. The failing condition is visible on the ExternalSecret itself (`kubectl -n ai get externalsecret wiki-anthropic`) until `secret/apps/ai/wiki-anthropic` exists.

k.renner merged commit e6ba50d676 into master

2026-09-24 14:50:55 +00:00

k.renner referenced this issue from a commit

2026-09-24 14:50:56 +00:00

Merge pull request 'feat(wiki): wire the Anthropic answer-model key from apps/ai/wiki-anthropic' (#949) from feat/wiki-anthropic-key into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#949