Cross-Component Auto-Wiring

Auto-wiring is the capability where the operator provisions and injects credentials across components, so you configure no cross-component secrets by hand. It is a licensed feature (auto-wiring); without it, every reference has a manual fallback that keeps the platform fully running.

What gets wired

Reference	Licensed (auto-wiring)	Community (manual)
Gateway → Postgres	database.mode: postgresCluster resolves the cluster, provisions the litellm DB + role + password, injects litellm-db-credentials	database.mode: external + connectionSecretRef (user/password)
Observability → Postgres / ClickHouse / Redis	each mode: ref resolves the datastore and wires its generated credentials	each mode: external + connectionSecretRef
ChatUI → Gateway	gatewayRef mints a LiteLLMVirtualKey, injects the in-cluster URL + key	gateway.{ url, apiKeySecretRef }
Gateway → Observability (traces)	observabilityRef emits a LangfuseOrganization + LangfuseProject; the langfuse-operator mints a project API key the LiteLLM callback consumes	observability.{ host, callbackSecretRef } (keys publicKey / secretKey)

Generated credentials (virtual keys, callback keys, datastore passwords) are stored as plain owned Kubernetes Secrets.

How a reference resolves

For each *Ref, the controller:

1. Resolves and gates — fetches the target; if it is missing or not ready, it requeues with a clear condition rather than failing.
2. Auto-wires if licensed — when auto-wiring is enabled, it performs the provisioning + injection in the table above.
3. Falls back to manual — when the feature is unlicensed, it skips the auto-fill, uses the explicit fields you supplied, and emits an AutoWiringUnlicensed condition + Event naming exactly what to set.

Because cross-namespace owner references are not allowed in Kubernetes, the operator uses label-based watches (not owner refs) so that changes to a referenced resource in another namespace still re-trigger reconciliation.

A note on Gateway → Observability

Two gates apply to Langfuse key auto-provisioning

Creating the Langfuse organization/project and minting an API key uses Langfuse's Admin API, which is a Langfuse Enterprise feature — independent of the Navique license. So fully automatic key provisioning needs both the Navique auto-wiring feature and a Langfuse EE deployment.

On a community Langfuse, the LangfuseProject cannot mint a key: create the project and key in the Langfuse UI and set Gateway.spec.observability.{ host, callbackSecretRef }. The operator detects this and surfaces an actionable condition. Langfuse tracing is optional — the Gateway serves without it.

The manual path keeps everything running

This is the core promise: the core platform never blocks on the license. Even with no license at all, you can stand up the entire platform by supplying the connection secrets, gateway URL/key, and Langfuse callback yourself. Auto-wiring is a convenience increment, not a gate on whether the platform works.

See Editions & Licensing for which edition includes auto-wiring.