unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Wire LiteLLM SSO to Authentik (generic OIDC) #268

Merged
unkinben merged 2 commits from benvin/litellm-sso into main 2026-07-24 00:18:42 +10:00
Conversation 1 Commits 2 Files Changed 3
+38
unkinben commented 2026-07-19 18:27:47 +10:00
Owner
Copy Link
Copy Source

Why

App-side of the LiteLLM Authentik onboarding (pairs with terraform-authentik#8). Enables LiteLLM's generic OIDC SSO against Authentik so the UI/admin uses Authentik identity.

Change

  • VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (the same secret Authentik sets on the litellm provider, key client_secret) as a k8s Secret.
  • Deployment: GENERIC_CLIENT_SECRET injected from that Secret (reloader annotation already present → restarts on change).
  • litellm-env ConfigMap: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints (identity.unkin.net, matching argocd/grafana), GENERIC_SCOPE, and PROXY_BASE_URL (required for LiteLLM SSO).

Depends on

  • terraform-authentik#8 (creates the litellm OAuth2 provider/application).
  • The client secret seeded in Vault at kv/kubernetes/namespace/litellm/default/oauth-credentials (done).

Validation

kustomize build apps/base/litellm renders the env, secret ref, and VaultStaticSecret; pre-commit clean (no plain Secrets).

Note

This wires SSO authentication. LiteLLM assigns SSO users the default internal-user role; admin/role provisioning (e.g. PROXY_ADMIN_ID or group-based roles) is a separate step if needed.

## Why App-side of the LiteLLM Authentik onboarding (pairs with terraform-authentik#8). Enables LiteLLM's generic OIDC SSO against Authentik so the UI/admin uses Authentik identity. ## Change - **VaultStaticSecret `oauth-credentials`**: surfaces the OIDC client secret (the same secret Authentik sets on the litellm provider, key `client_secret`) as a k8s Secret. - **Deployment**: `GENERIC_CLIENT_SECRET` injected from that Secret (`reloader` annotation already present → restarts on change). - **litellm-env ConfigMap**: `GENERIC_CLIENT_ID`, authorization/token/userinfo endpoints (identity.unkin.net, matching argocd/grafana), `GENERIC_SCOPE`, and `PROXY_BASE_URL` (required for LiteLLM SSO). ## Depends on - terraform-authentik#8 (creates the `litellm` OAuth2 provider/application). - The client secret seeded in Vault at `kv/kubernetes/namespace/litellm/default/oauth-credentials` (done). ## Validation `kustomize build apps/base/litellm` renders the env, secret ref, and VaultStaticSecret; pre-commit clean (no plain Secrets). ## Note This wires SSO *authentication*. LiteLLM assigns SSO users the default internal-user role; admin/role provisioning (e.g. `PROXY_ADMIN_ID` or group-based roles) is a separate step if needed.
unkinben added 1 commit 2026-07-19 18:27:47 +10:00
Wire LiteLLM SSO to Authentik (generic OIDC)
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
5380a9fbf4 
App-side of the LiteLLM Authentik onboarding (terraform-authentik#8). Configures
LiteLLM's generic OIDC SSO against Authentik.

- VaultStaticSecret oauth-credentials: surfaces the OIDC client secret (same
  secret Authentik sets on the provider) as a k8s Secret.
- Deployment: GENERIC_CLIENT_SECRET from that Secret.
- litellm-env: GENERIC_CLIENT_ID, authorization/token/userinfo endpoints, scope,
  and PROXY_BASE_URL (required for SSO). reloader restarts on secret/config change.
unkinben added 1 commit 2026-07-19 18:43:21 +10:00
LiteLLM SSO: request litellm_role scope + map to role
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
91080c1504 
Pairs with terraform-authentik#10: request the litellm_role scope (Authentik
emits the computed role claim) and read it via GENERIC_USER_ROLE_ATTRIBUTE so
akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user.
unkinben commented 2026-07-19 18:43:32 +10:00
Author
Owner
Copy Link
Copy Source

Extended beyond authentication: now also requests the litellm_role scope and sets GENERIC_USER_ROLE_ATTRIBUTE=litellm_role, so LiteLLM roles follow Authentik groups (pairs with terraform-authentik#10: akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user).

Extended beyond authentication: now also requests the `litellm_role` scope and sets `GENERIC_USER_ROLE_ATTRIBUTE=litellm_role`, so LiteLLM roles follow Authentik groups (pairs with terraform-authentik#10: akP-litellm-admin -> proxy_admin, akP-litellm-user -> internal_user).
unkinben merged commit 982bf1c837 into main 2026-07-24 00:18:42 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#268
Delete Branch "benvin/litellm-sso"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?