fix(panda-chat): stable API_SERVER_KEY bearer to survive ArgoCD

The OW<->Hermes bearer was minted with randAlphaNum guarded by a
lookup-preserve. Under ArgoCD that guard is a no-op (client-side
`helm template` has no cluster connection), so every re-render mints a
fresh key. Whichever of the OW/Hermes pods doesn't restart is stranded on
the old bearer -> Hermes /v1/models 401s -> empty model picker.

Prefer an explicit, stable credentials.apiServerKey (GitOps supplies it
from sops); keep lookup-preserve + random only as the bare-helm-install
fallback. Bumps chart 0.2.0 -> 0.3.0.

Author: qu0b

charts/panda-chat/Chart.yaml

@@ -3,7 +3,7 @@ name: panda-chat
 description: AI chat for an Ethereum devnet — an Open-WebUI front end backed by a NousResearch Hermes agent wired to the `panda` CLI, giving anyone access to devnet analytics (Xatu/Prometheus/Loki/Dora/Ethnode via panda-proxy), account funding (powfaucet) and join-the-devnet helpers.
 home: https://github.com/ethpandaops/chat
 type: application
-version: 0.2.0
+version: 0.3.0
 # Hermes Agent upstream version (CalVer) baked into the panda-overlay image.
 appVersion: "2026.6.5"
 keywords:

charts/panda-chat/README.md

@@ -1,7 +1,7 @@
 
 # panda-chat
 
-![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2026.6.5](https://img.shields.io/badge/AppVersion-2026.6.5-informational?style=flat-square)
+![Version: 0.3.0](https://img.shields.io/badge/Version-0.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 2026.6.5](https://img.shields.io/badge/AppVersion-2026.6.5-informational?style=flat-square)
 
 AI chat for an Ethereum devnet — an Open-WebUI front end backed by a NousResearch Hermes agent wired to the `panda` CLI, giving anyone access to devnet analytics (Xatu/Prometheus/Loki/Dora/Ethnode via panda-proxy), account funding (powfaucet) and join-the-devnet helpers.
 
@@ -109,6 +109,7 @@ open-webui:
 |-----|------|---------|-------------|
 | affinity | object | `{}` | Affinity for the agent pod |
 | chainId | string | `""` | The devnet chain id (informational; surfaced to the join-devnet skill). |
+| credentials.apiServerKey | string | `""` | Stable OW<->Hermes bearer (`API_SERVER_KEY`). Leave empty for a bare `helm install` (auto-generated + preserved). Under GitOps/ArgoCD you MUST set this to a stable value (sops) — `helm template` can't preserve a generated one, so an empty value drifts OW and Hermes apart on re-render. |
 | credentials.langfuse.publicKey | string | `""` | Langfuse public key (pk-lf-...) |
 | credentials.langfuse.secretKey | string | `""` | Langfuse secret key (sk-lf-...) |
 | credentials.llmApiKey | string | `""` | The LLM API key value (materialized into the Secret under `llm.apiKeyEnv`) |

charts/panda-chat/templates/secret.yaml

@@ -1,21 +1,33 @@
 {{/*
 Two Secrets with a deliberate trust boundary between them:
 
-- <hermes>-secret: API_SERVER_KEY (Hermes bearer, generated once and
-  preserved), <llm.apiKeyEnv> (model key) and HERMES_LANGFUSE_* (tracing
-  keys). envFrom'd ONLY into the unprivileged hermes container.
+- <hermes>-secret: API_SERVER_KEY (Hermes bearer, see below), <llm.apiKeyEnv>
+  (model key) and HERMES_LANGFUSE_* (tracing keys). envFrom'd ONLY into the
+  unprivileged hermes container.
 - <hermes>-panda-secret: PANDA_BOT_USERNAME / PANDA_BOT_TOKEN (the
   Authentik service-account identity panda-server mints client_credentials
   tokens with). envFrom'd ONLY into the panda-server sidecar. Hermes
   executes LLM-driven shell commands, so it must never share an
   environment (or container) with the bot credential.
 */}}
+{{/*
+API_SERVER_KEY (OW <-> Hermes bearer) resolution, in priority order:
+  1. credentials.apiServerKey — an explicit, STABLE value. GitOps supplies it
+     from sops; this is the only source that survives ArgoCD, whose client-side
+     `helm template` has no cluster connection (see 2).
+  2. lookup-preserve of the existing in-cluster Secret. Works under a direct
+     `helm upgrade`, but is a NO-OP under ArgoCD — so it must not be the only
+     source, or every re-render mints a fresh bearer and OW/Hermes drift apart.
+  3. randAlphaNum — first-install fallback for a bare `helm install`.
+*/}}
 {{- $secretName := include "panda-chat.secretName" . -}}
-{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
-{{- $bearer := "" -}}
-{{- if and $existing $existing.data -}}
-  {{- with index $existing.data "API_SERVER_KEY" -}}
-    {{- $bearer = . | b64dec -}}
+{{- $bearer := .Values.credentials.apiServerKey -}}
+{{- if not $bearer -}}
+  {{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
+  {{- if and $existing $existing.data -}}
+    {{- with index $existing.data "API_SERVER_KEY" -}}
+      {{- $bearer = . | b64dec -}}
+    {{- end -}}
   {{- end -}}
 {{- end -}}
 {{- if not $bearer -}}{{- $bearer = randAlphaNum 40 -}}{{- end -}}

charts/panda-chat/values.yaml

@@ -99,6 +99,11 @@ devnetTools:
 
 # Credentials. Injected via vals `<path:...>` on devnets; set directly for standalone use.
 credentials:
+  # -- Stable OW<->Hermes bearer (`API_SERVER_KEY`). Leave empty for a bare
+  # `helm install` (auto-generated + preserved). Under GitOps/ArgoCD you MUST
+  # set this to a stable value (sops) — `helm template` can't preserve a
+  # generated one, so an empty value drifts OW and Hermes apart on re-render.
+  apiServerKey: ""
   # -- The LLM API key value (materialized into the Secret under `llm.apiKeyEnv`)
   llmApiKey: ""
   panda: