From 5380a9fbf4939dbb3cffb26920d0bd7bcac2d923 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 19 Jul 2026 18:27:31 +1000
Subject: [PATCH 1/2] Wire LiteLLM SSO to Authentik (generic OIDC)

App-side of the LiteLLM Authentik onboarding (terraform-authentik#8). Configures
LiteLLM's generic OIDC SSO against Authentik.

- VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (same
  secret Authentik sets on the provider) as a k8s Secret.
- Deployment: GENERIC_CLIENT_SECRET from that Secret.
- litellm-env: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints, scope,
  and PROXY_BASE_URL (required for SSO). reloader restarts on secret/config change.
---
 apps/base/litellm/deployment.yaml        |  8 ++++++++
 apps/base/litellm/kustomization.yaml     |  9 +++++++++
 apps/base/litellm/vaultstaticsecret.yaml | 18 ++++++++++++++++++
 3 files changed, 35 insertions(+)

diff --git a/apps/base/litellm/deployment.yaml b/apps/base/litellm/deployment.yaml
index 6039b10..68230d6 100644
--- a/apps/base/litellm/deployment.yaml
+++ b/apps/base/litellm/deployment.yaml
@@ -30,6 +30,14 @@ spec:
             - containerPort: 4000
               name: http
               protocol: TCP
+          env:
+            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
+            # litellm-env ConfigMap.
+            - name: GENERIC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth-credentials
+                  key: client_secret
           envFrom:
             - secretRef:
                 name: litellm-credentials
diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml
index 3b22566..b4780fe 100644
--- a/apps/base/litellm/kustomization.yaml
+++ b/apps/base/litellm/kustomization.yaml
@@ -25,5 +25,14 @@ configMapGenerator:
   - name: litellm-env
     literals:
       - STORE_MODEL_IN_DB=True
+      # Authentik OIDC SSO (generic). Client secret is injected from the
+      # oauth-credentials Secret in the Deployment; endpoints match the other
+      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
+      - GENERIC_CLIENT_ID=litellm
+      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
+      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
+      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
+      - GENERIC_SCOPE=openid email profile
+      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true
diff --git a/apps/base/litellm/vaultstaticsecret.yaml b/apps/base/litellm/vaultstaticsecret.yaml
index be33d93..148a1ec 100644
--- a/apps/base/litellm/vaultstaticsecret.yaml
+++ b/apps/base/litellm/vaultstaticsecret.yaml
@@ -18,6 +18,24 @@ spec:
 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultStaticSecret
+metadata:
+  name: oauth-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: oauth-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  # Same secret Authentik sets on the litellm OAuth2 provider (key: client_secret).
+  path: kubernetes/namespace/litellm/default/oauth-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
 metadata:
   name: litellm-credentials
   namespace: litellm

From 91080c150497ce306f8e21a03eb06f572475179c Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 19 Jul 2026 18:43:13 +1000
Subject: [PATCH 2/2] LiteLLM SSO: request litellm_role scope + map to role

Pairs with terraform-authentik#10: request the litellm_role scope (Authentik
emits the computed role claim) and read it via GENERIC_USER_ROLE_ATTRIBUTE so
akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user.
---
 apps/base/litellm/kustomization.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/base/litellm/kustomization.yaml b/apps/base/litellm/kustomization.yaml
index b4780fe..61754ea 100644
--- a/apps/base/litellm/kustomization.yaml
+++ b/apps/base/litellm/kustomization.yaml
@@ -32,7 +32,10 @@ configMapGenerator:
       - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
       - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
       - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
-      - GENERIC_SCOPE=openid email profile
+      # litellm_role scope carries the Authentik-computed role claim; LiteLLM
+      # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
+      - GENERIC_SCOPE=openid email profile litellm_role
+      - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
       - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
     options:
       disableNameSuffixHash: true