# ExternalSecrets for Gumbo agent.
# These replace the stub Secret blocks that were in gumbo-job-template.yaml.
# Requires: ExternalSecrets operator + infisical ClusterSecretStore in platform-security.
# Infisical paths: create these secrets under your Infisical project before first sync.
#   GUMBO_LITELLM_API_KEY   → your LiteLLM virtual key for gumbo
#   GUMBO_DB_URI            → postgresql://agentic_os:<pass>@agentic-os-pg-rw.platform-data.svc.cluster.local:5432/gumbo?sslmode=require
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gumbo-litellm
  namespace: ai-agents-gumbo
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: infisical
    kind: ClusterSecretStore
  target:
    name: gumbo-litellm
    creationPolicy: Owner
  data:
    - secretKey: api_key
      remoteRef:
        key: GUMBO_LITELLM_API_KEY
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gumbo-checkpoint-db
  namespace: ai-agents-gumbo
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: infisical
    kind: ClusterSecretStore
  target:
    name: gumbo-checkpoint-db
    creationPolicy: Owner
  data:
    - secretKey: uri
      remoteRef:
        key: GUMBO_DB_URI
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gumbo-results-db
  namespace: ai-agents-gumbo
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: infisical
    kind: ClusterSecretStore
  target:
    name: gumbo-results-db
    creationPolicy: Owner
  data:
    - secretKey: dsn
      remoteRef:
        key: GUMBO_DB_URI