secrets.yaml.example

apiVersion: v1
kind: Secret
metadata:
  name: open-llm-proxy-secrets
type: Opaque
stringData:
  # Required: NRP API key for the ELLM endpoint (most deployments only need this provider)
  nrp-api-key: "your-nrp-api-key-here"

  # Required: proxy key for client authentication — generate a random token
  proxy-key: "your-proxy-key-here"

  # Optional: isolates NRP cached responses from other tenants
  # Generate with: python3 -c "import secrets,base64; print(base64.b64encode(secrets.token_bytes(32)).decode())"
  cache-salt: "your-base64-cache-salt-here"

# NOTE: This is an EXAMPLE file showing the structure of the secrets.
#
# DO NOT commit the actual secrets file to git!
#
# To create the secret with kubectl:
#   kubectl create secret generic open-llm-proxy-secrets \
#     --from-literal=nrp-api-key='your-nrp-api-key' \
#     --from-literal=proxy-key='your-proxy-key' \
#     -n <your-namespace>
#
# S3 logging (optional):
#   If your namespace has an `aws` secret with AWS_ACCESS_KEY_ID and
#   AWS_SECRET_ACCESS_KEY, the proxy will flush logs to S3 automatically.
#   Set the LOG_BUCKET env var in deployment.yaml to your bucket name.
#   If no S3 credentials are present, logs go to pod stdout only.
#
# Additional providers (optional):
#   Most deployments only need NRP. To add OpenRouter or Nimbus, create
#   these secrets in your namespace and uncomment the corresponding env
#   vars in deployment.yaml:
#
#   kubectl create secret generic openrouter-key \
#     --from-literal=OPENROUTER_KEY='your-key' -n <your-namespace>
#
#   kubectl create secret generic nimbus-api-key \
#     --from-literal=NIMBUS_API_KEY='your-key' -n <your-namespace>
#
#   Anthropic (direct, OpenAI-compatible endpoint — bills the Developer
#   Platform API, NOT the Claude.ai Team plan; create the key in the
#   Console under the same org as an org admin):
#
#   kubectl create secret generic anthropic-api-key \
#     --from-literal=ANTHROPIC_API_KEY='sk-ant-...' -n <your-namespace>