Merge pull request 'Wire LiteLLM SSO to Authentik (generic OIDC)' (#268) from benvin/litellm-sso into main

apps/base/litellm/deployment.yaml

@@ -30,6 +30,14 @@ spec:
             - containerPort: 4000
               name: http
               protocol: TCP
+          env:
+            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
+            # litellm-env ConfigMap.
+            - name: GENERIC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
           envFrom:
             - secretRef:
                 name: litellm-credentials

apps/base/litellm/kustomization.yaml

@@ -25,5 +25,17 @@ configMapGenerator:
   - name: litellm-env
     literals:
       - STORE_MODEL_IN_DB=True
+      # Authentik OIDC SSO (generic). Client secret is injected from the
+      # oauth-credentials Secret in the Deployment; endpoints match the other
+      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
+      - GENERIC_CLIENT_ID=litellm
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
+      # litellm_role scope carries the Authentik-computed role claim; LiteLLM
+      # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
+      - GENERIC_SCOPE=openid email profile litellm_role
+      - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
+      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true

apps/base/litellm/vaultstaticsecret.yaml

@@ -18,6 +18,24 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  # Same secret Authentik sets on the litellm OAuth2 provider (key: client_secret).
+  path: kubernetes/namespace/litellm/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: litellm-credentials
   namespace: litellm