---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - cnpg_cluster.yaml
  - cnpg_backup.yaml
  - cnpg_pooler.yaml
  - deployment.yaml
  - hpa.yaml
  - gateway.yaml
  - httproute.yaml
  - namespace.yaml
  - redis-deployment.yaml
  - redis-pvc.yaml
  - services.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
  - vmpodscrape.yaml
  - vpa.yaml

configMapGenerator:
  - name: litellm-config
    files:
      - config.yaml=resources/config.yaml
    options:
      disableNameSuffixHash: true
  - name: litellm-env
    literals:
      - STORE_MODEL_IN_DB=True
      # Emit structured JSON logs so the Tier-2 vector litellm pipeline can parse
      # model/tokens/latency/key/status (logs.k8s.litellm.*).
      - JSON_LOGS=True
      # Authentik OIDC SSO (generic). Client secret is injected from the
      # oauth-credentials Secret in the Deployment; endpoints match the other
      # apps (identity.unkin.net). PROXY_BASE_URL is required for SSO.
      - GENERIC_CLIENT_ID=litellm
      - GENERIC_AUTHORIZATION_ENDPOINT=https://identity.unkin.net/application/o/authorize/
      - GENERIC_TOKEN_ENDPOINT=https://identity.unkin.net/application/o/token/
      - GENERIC_USERINFO_ENDPOINT=https://identity.unkin.net/application/o/userinfo/
      # litellm_role scope carries the Authentik-computed role claim; LiteLLM
      # reads it via GENERIC_USER_ROLE_ATTRIBUTE and maps to proxy_admin/etc.
      - GENERIC_SCOPE=openid email profile litellm_role
      - GENERIC_USER_ROLE_ATTRIBUTE=litellm_role
      - PROXY_BASE_URL=https://litellm.k8s.syd1.au.unkin.net
      # Trust the internal unkin.net CA (identity.unkin.net) via the combined
      # bundle assembled by the combine-certs init container.
      - SSL_CERT_FILE=/etc/ssl/combined/ca-certificates.crt
      - REQUESTS_CA_BUNDLE=/etc/ssl/combined/ca-certificates.crt
    options:
      disableNameSuffixHash: true