fix: dual infisical store configuration

ai-core/litellm/external-secret-api-keys.yaml

@@ -7,7 +7,7 @@ spec:
   refreshInterval: 1h
   secretStoreRef:
     kind: ClusterSecretStore
-    name: infisical
+    name: infisical-litellm
   target:
     name: litellm-master
     creationPolicy: Owner
@@ -31,7 +31,7 @@ spec:
   refreshInterval: 1h
   secretStoreRef:
     kind: ClusterSecretStore
-    name: infisical
+    name: infisical-litellm
   target:
     name: litellm-langfuse
     creationPolicy: Owner

platform/security/external-secrets/cluster-secret-store-infisical-litellm.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: infisical-litellm
+spec:
+  provider:
+    infisical:
+      hostAPI: https://app.infisical.com
+      auth:
+        universalAuthCredentials:
+          clientId:
+            key: clientId
+            namespace: platform-security
+            name: infisical-universal-auth
+          clientSecret:
+            key: clientSecret
+            namespace: platform-security
+            name: infisical-universal-auth
+      secretsScope:
+        projectSlug: agentic-os
+        environmentSlug: production
+        secretsPath: "/agentic-os/litellm"

platform/security/external-secrets/cluster-secret-store-infisical.yaml

@@ -20,4 +20,4 @@ spec:
       secretsScope:
         projectSlug: agentic-os
         environmentSlug: production
-        secretsPath: "/litellm"
+        secretsPath: "/agentic-os"

platform/security/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - external-secrets/cluster-secret-store-infisical.yaml
+  - external-secrets/cluster-secret-store-infisical-litellm.yaml
   - external-secrets/cluster-secret-store-vault.yaml
   - cert-manager/cluster-issuer-stub.yaml
   - network-policies.yaml