Wire LiteLLM SSO to Authentik (generic OIDC)

App-side of the LiteLLM Authentik onboarding (terraform-authentik#8). Configures
LiteLLM's generic OIDC SSO against Authentik.

- VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (same
  secret Authentik sets on the provider) as a k8s Secret.
- Deployment: GENERIC_CLIENT_SECRET from that Secret.
- litellm-env: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints, scope,
  and PROXY_BASE_URL (required for SSO). reloader restarts on secret/config change.

apps/base/litellm/deployment.yaml

@@ -30,6 +30,14 @@ spec:
             - containerPort: 4000
               name: http
               protocol: TCP
+          env:
+            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
+            # litellm-env ConfigMap.
+            - name: GENERIC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
           envFrom:
             - secretRef:
                 name: litellm-credentials

apps/base/litellm/kustomization.yaml

@@ -25,5 +25,14 @@ configMapGenerator:
   - name: litellm-env
     literals:
       - STORE_MODEL_IN_DB=True
+      # Authentik OIDC SSO (generic). Client secret is injected from the
+      # oauth-credentials Secret in the Deployment; endpoints match the other
+      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
+      - GENERIC_CLIENT_ID=litellm
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
+      - GENERIC_SCOPE=openid email profile
+      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true

apps/base/litellm/vaultstaticsecret.yaml

@@ -18,6 +18,24 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  # Same secret Authentik sets on the litellm OAuth2 provider (key: client_secret).
+  path: kubernetes/namespace/litellm/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: litellm-credentials
   namespace: litellm