From b180640dfb12fc719ac18347f9634f1d0741cdda Mon Sep 17 00:00:00 2001
From: Antigravity <bot@antigravity.ai>
Date: Tue, 19 May 2026 22:54:33 -0400
Subject: [PATCH] fix: dual infisical store configuration

---
 ai-core/litellm/external-secret-api-keys.yaml |  4 ++--
 ...luster-secret-store-infisical-litellm.yaml | 22 +++++++++++++++++++
 .../cluster-secret-store-infisical.yaml       |  2 +-
 platform/security/kustomization.yaml          |  1 +
 4 files changed, 26 insertions(+), 3 deletions(-)
 create mode 100644 platform/security/external-secrets/cluster-secret-store-infisical-litellm.yaml

diff --git a/ai-core/litellm/external-secret-api-keys.yaml b/ai-core/litellm/external-secret-api-keys.yaml
index fc7cba5..306af07 100644
--- a/ai-core/litellm/external-secret-api-keys.yaml
+++ b/ai-core/litellm/external-secret-api-keys.yaml
@@ -7,7 +7,7 @@ spec:
   refreshInterval: 1h
   secretStoreRef:
     kind: ClusterSecretStore
-    name: infisical
+    name: infisical-litellm
   target:
     name: litellm-master
     creationPolicy: Owner
@@ -31,7 +31,7 @@ spec:
   refreshInterval: 1h
   secretStoreRef:
     kind: ClusterSecretStore
-    name: infisical
+    name: infisical-litellm
   target:
     name: litellm-langfuse
     creationPolicy: Owner
diff --git a/platform/security/external-secrets/cluster-secret-store-infisical-litellm.yaml b/platform/security/external-secrets/cluster-secret-store-infisical-litellm.yaml
new file mode 100644
index 0000000..7947aa7
--- /dev/null
+++ b/platform/security/external-secrets/cluster-secret-store-infisical-litellm.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: infisical-litellm
+spec:
+  provider:
+    infisical:
+      hostAPI: https://app.infisical.com
+      auth:
+        universalAuthCredentials:
+          clientId:
+            key: clientId
+            namespace: platform-security
+            name: infisical-universal-auth
+          clientSecret:
+            key: clientSecret
+            namespace: platform-security
+            name: infisical-universal-auth
+      secretsScope:
+        projectSlug: agentic-os
+        environmentSlug: production
+        secretsPath: "/agentic-os/litellm"
diff --git a/platform/security/external-secrets/cluster-secret-store-infisical.yaml b/platform/security/external-secrets/cluster-secret-store-infisical.yaml
index c10907f..23a22f8 100644
--- a/platform/security/external-secrets/cluster-secret-store-infisical.yaml
+++ b/platform/security/external-secrets/cluster-secret-store-infisical.yaml
@@ -20,4 +20,4 @@ spec:
       secretsScope:
         projectSlug: agentic-os
         environmentSlug: production
-        secretsPath: "/litellm"
+        secretsPath: "/agentic-os"
diff --git a/platform/security/kustomization.yaml b/platform/security/kustomization.yaml
index 09e642f..a4fd676 100644
--- a/platform/security/kustomization.yaml
+++ b/platform/security/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - external-secrets/cluster-secret-store-infisical.yaml
+  - external-secrets/cluster-secret-store-infisical-litellm.yaml
   - external-secrets/cluster-secret-store-vault.yaml
   - cert-manager/cluster-issuer-stub.yaml
   - network-policies.yaml