prod deployment

deploy/k8s/prod/secrets/gateway-secrets.tpl.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: gateway-secrets
+  namespace: ai
+type: Opaque
+stringData:
+  secrets.yaml: |
+    # Gateway Secrets (production)
+
+    # Authentication secret for JWT signing
+    auth:
+      secret: "{{ op://AI Prod/Gateway/jwt_secret }}"
+
+    # LLM Provider API Keys
+    llm_providers:
+      anthropic_api_key: "{{ op://AI Prod/Gateway/anthropic_api_key }}"
+      openai_api_key: "{{ op://AI Prod/Gateway/openai_api_key }}"
+      google_api_key: "{{ op://AI Prod/Gateway/google_api_key }}"
+      openrouter_api_key: "{{ op://AI Prod/Gateway/openrouter_api_key }}"
+
+    # Telegram (optional)
+    telegram:
+      bot_token: "{{ op://AI Prod/Telegram/bot_token }}"
+
+    # Email service (optional)
+    email:
+      service_key: ""
+
+    # Push notification service (optional)
+    push:
+      service_key: ""
+
+    # Qdrant API key (optional, for hosted Qdrant)
+    qdrant:
+      api_key: ""
+
+    # Iceberg S3 credentials (must match minio-secret)
+    iceberg:
+      s3_access_key: "{{ op://AI Prod/MinIO/access_key }}"
+      s3_secret_key: "{{ op://AI Prod/MinIO/secret_key }}"
+
+    # Embedding API key (if using external provider)
+    embedding:
+      api_key: ""