refactor: Migrate to .env-based secret management

components/open-webui-llm/.gitignore

@@ -3,6 +3,9 @@
 *.env
 !.env.example
 
+# Secrets manifests (use secretGenerator with .env instead)
+overlays/*/secrets.yaml
+
 # Backup files
 *.bak
 backup*.tar.gz

components/open-webui-llm/Makefile

@@ -20,8 +20,8 @@ help:
 	@echo "  2. API key configured (edit: overlays/phase1-kind/secrets.yaml)"
 	@echo ""
 	@echo "Access:"
-	@echo "  Docker: http://vteam.local/chat"
-	@echo "  Podman: http://vteam.local:8080/chat"
+	@echo "  Docker: http://ambient.local/chat"
+	@echo "  Podman: http://ambient.local:8080/chat"
 
 phase1-deploy:
 	@echo "Deploying Phase 1 (Kind)..."
@@ -39,8 +39,8 @@ phase1-deploy:
 	@echo "✅ Phase 1 deployed!"
 	@echo ""
 	@echo "Access Open WebUI:"
-	@echo "  Docker: http://vteam.local/chat"
-	@echo "  Podman: http://vteam.local:8080/chat"
+	@echo "  Docker: http://ambient.local/chat"
+	@echo "  Podman: http://ambient.local:8080/chat"
 
 phase1-clean:
 	@echo "Removing Phase 1 deployment..."

components/open-webui-llm/README.md

@@ -26,9 +26,11 @@ A phased deployment of Open WebUI with LiteLLM proxy for chatting with Claude mo
    ```bash
    cd overlays/phase1-kind
 
-   # Edit secrets.yaml and replace sk-ant-YOUR-KEY-HERE with your actual key
-   # Or use sed:
-   sed -i.bak 's/sk-ant-YOUR-KEY-HERE/sk-ant-api01-YOUR-ACTUAL-KEY/g' secrets.yaml
+   # Create .env from template
+   cp .env.example .env
+
+   # Edit .env and add your actual Anthropic API key
+   # ANTHROPIC_API_KEY=sk-ant-api01-YOUR-ACTUAL-KEY
    ```
 
 2. **Deploy to Kind**:
@@ -43,8 +45,8 @@ A phased deployment of Open WebUI with LiteLLM proxy for chatting with Claude mo
    ```
 
 4. **Access Open WebUI**:
-   - **Docker**: http://vteam.local/chat
-   - **Podman**: http://vteam.local:8080/chat
+   - **Docker**: http://ambient.local/chat
+   - **Podman**: http://ambient.local:8080/chat
 
 ### Usage
 
@@ -103,17 +105,17 @@ kubectl describe pod -n openwebui -l app=openwebui
 
 **Docker** (ports 80/443):
 ```bash
-# Verify vteam.local resolves to 127.0.0.1
-grep vteam.local /etc/hosts
+# Verify ambient.local resolves to 127.0.0.1
+grep ambient.local /etc/hosts
 
 # Test ingress
-curl http://vteam.local/chat
+curl http://ambient.local/chat
 ```
 
 **Podman** (ports 8080/8443):
 ```bash
 # Use port 8080
-curl http://vteam.local:8080/chat
+curl http://ambient.local:8080/chat
 ```
 
 **Fallback - Port forwarding**:
@@ -173,7 +175,7 @@ kubectl get sc
 ## Data Flow
 
 ```
-User Browser → vteam.local/chat → Nginx Ingress → Open WebUI Service
+User Browser → ambient.local/chat → Nginx Ingress → Open WebUI Service
   → Open WebUI Pod → LiteLLM Service → LiteLLM Pod → Anthropic API
 ```
 
@@ -206,7 +208,7 @@ kubectl delete namespace openwebui
 ## Next Steps
 
 1. Try chatting with different Claude models
-2. Explore Open WebUI settings (http://vteam.local/chat/settings)
+2. Explore Open WebUI settings (http://ambient.local/chat/settings)
 3. Review LiteLLM logs to see API calls: `make phase1-logs-litellm`
 4. Plan for Phase 2 migration (see `docs/PHASE2.md`)
 

components/open-webui-llm/base/litellm/deployment.yaml

@@ -49,10 +49,10 @@ spec:
         resources:
           requests:
             cpu: 200m
-            memory: 512Mi
+            memory: 1Gi
           limits:
             cpu: 1000m
-            memory: 2Gi
+            memory: 3Gi
         livenessProbe:
           httpGet:
             path: /health/liveliness

components/open-webui-llm/docs/PHASE1.md

@@ -44,21 +44,23 @@ This guide covers Phase 1 deployment of Open WebUI + LiteLLM on Kind cluster wit
 
 ### 1. Configure API Key
 
-Edit the secrets file:
+Create a `.env` file from the template:
 
 ```bash
 cd components/open-webui-llm/overlays/phase1-kind
-vi secrets.yaml
+cp .env.example .env
 ```
 
-Replace `sk-ant-YOUR-KEY-HERE` with your actual Anthropic API key:
+Edit `.env` and replace the placeholder with your actual Anthropic API key:
 
-```yaml
-stringData:
-  ANTHROPIC_API_KEY: "sk-ant-api01-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+```bash
+ANTHROPIC_API_KEY=sk-ant-api01-xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+LITELLM_MASTER_KEY=sk-litellm-dev-master-key
+WEBUI_AUTH=false
+OPENAI_API_BASE_URL=http://litellm-service:4000/v1
 ```
 
-**Security Note**: This file is excluded from git via `.gitignore`. Never commit actual API keys.
+**Security Note**: The `.env` file is excluded from git via `.gitignore`. Never commit actual API keys.
 
 ### 2. Deploy
 
@@ -104,12 +106,12 @@ All pods should show `Running` and `1/1 Ready`.
 
 **Docker users**:
 ```
-http://vteam.local/chat
+http://ambient.local/chat
 ```
 
 **Podman users**:
 ```
-http://vteam.local:8080/chat
+http://ambient.local:8080/chat
 ```
 
 **First visit**:
@@ -227,13 +229,15 @@ kubectl get secret litellm-secrets -n openwebui
 kubectl get secret litellm-secrets -n openwebui -o jsonpath='{.data.ANTHROPIC_API_KEY}' | base64 -d
 # Should show: sk-ant-api01-...
 
-# If wrong, update secrets.yaml and redeploy
+# If wrong, update .env file and redeploy
+cd overlays/phase1-kind
+# Edit .env with correct API key
 make phase1-deploy
 ```
 
 ### Issue: Ingress returns 404
 
-**Symptom**: `curl http://vteam.local/chat` returns 404
+**Symptom**: `curl http://ambient.local/chat` returns 404
 
 **Solution**:
 ```bash
@@ -243,12 +247,12 @@ kubectl get ingress -n openwebui
 # Check ingress-nginx logs
 kubectl logs -n ingress-nginx deployment/ingress-nginx-controller
 
-# Verify vteam.local in /etc/hosts
-grep vteam.local /etc/hosts
-# Should show: 127.0.0.1 vteam.local
+# Verify ambient.local in /etc/hosts
+grep ambient.local /etc/hosts
+# Should show: 127.0.0.1 ambient.local
 
 # If using Podman, try port 8080
-curl http://vteam.local:8080/chat
+curl http://ambient.local:8080/chat
 ```
 
 ### Issue: Open WebUI loads but can't connect to LiteLLM

components/open-webui-llm/overlays/phase1-kind/ingress.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: vteam.local
+  - host: ambient.local
     http:
       paths:
       - path: /chat(/|$)(.*)

components/open-webui-llm/overlays/phase1-kind/kustomization.yaml

@@ -6,9 +6,28 @@ namespace: openwebui
 # Resources (base + phase1-specific)
 resources:
 - ../../base
-- secrets.yaml
 - ingress.yaml
 
+# Generate secrets from .env file
+secretGenerator:
+- name: litellm-secrets
+  namespace: openwebui
+  envs:
+  - .env
+  behavior: create
+  options:
+    labels:
+      app: litellm
+
+- name: openwebui-secrets
+  namespace: openwebui
+  envs:
+  - .env
+  behavior: create
+  options:
+    labels:
+      app: openwebui
+
 # Patches for Phase 1 environment
 patches:
 - path: pvc-patch.yaml
@@ -19,6 +38,6 @@ patches:
 # Use specific image tags for reproducibility in Phase 1
 images:
 - name: ghcr.io/berriai/litellm
-  newTag: main-latest
+  newTag: v1.80.10.rc.5
 - name: ghcr.io/open-webui/open-webui
-  newTag: main
+  newTag: v0.6.41

components/open-webui-llm/overlays/phase1-kind/secrets.yaml.example

@@ -0,0 +1,32 @@
+# DEPRECATED: Use .env file instead (see .env.example)
+# This file is kept for reference only
+#
+# To configure secrets:
+# 1. Copy .env.example to .env
+# 2. Fill in your actual API keys
+# 3. Deploy with: make phase1-deploy
+#
+# The secretGenerator in kustomization.yaml will create secrets from .env
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: litellm-secrets
+  namespace: openwebui
+  labels:
+    app: litellm
+type: Opaque
+stringData:
+  ANTHROPIC_API_KEY: "sk-ant-YOUR-KEY-HERE"
+  LITELLM_MASTER_KEY: "sk-litellm-dev-master-key"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: openwebui-secrets
+  namespace: openwebui
+  labels:
+    app: openwebui
+type: Opaque
+stringData:
+  OPENAI_API_KEY: "sk-litellm-dev-master-key"