Use Infisical ExternalSecret for Gemini API key

k8s/agents-api.yaml

@@ -33,6 +33,11 @@ spec:
         env:
         - name: PYTHONPATH
           value: "/app"
+        - name: GOOGLE_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: agents-api-secrets
+              key: GOOGLE_API_KEY
         ports:
         - containerPort: 8000
         volumeMounts:
@@ -42,6 +47,24 @@ spec:
         - name: app-volume
           emptyDir: {}
 ---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: agents-api-secrets
+  namespace: ai-agents
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: infisical
+  target:
+    name: agents-api-secrets
+    creationPolicy: Owner
+  data:
+  - secretKey: GOOGLE_API_KEY
+    remoteRef:
+      key: GOOGLE_API_KEY
+---
 apiVersion: v1
 kind: Service
 metadata:

src/agent.py

@@ -7,7 +7,6 @@ from langchain_google_genai import ChatGoogleGenerativeAI
 from langgraph.prebuilt import create_react_agent
 from temporalio import activity
 
-os.environ["GOOGLE_API_KEY"] = "AIzaSyDKYcgVPN2oJirwzf_td3sBYMnXHWfVphU"
 WHATSAPP_GATEWAY_URL = "http://whatsapp-gateway.ai-agents.svc.cluster.local:5001/api/send-message"
 
 @tool