---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: litellm
  namespace: litellm
spec:
  selector:
    matchLabels:
      app: litellm
  template:
    metadata:
      annotations:
        configmap.reloader.stakater.com/auto: "true"
        secret.reloader.stakater.com/reload: "vault-ca-cert"
      labels:
        app: litellm
    spec:
      # LiteLLM's SSO client reaches identity.unkin.net, whose cert is signed by
      # the internal unkin.net CA. Combine the image's public roots with the
      # reflected vault-ca-cert into one bundle (SSL_CERT_FILE/REQUESTS_CA_BUNDLE
      # in litellm-env point at it) so internal OIDC and public HTTPS both work.
      initContainers:
        - name: combine-certs
          image: alpine:3
          command:
            - sh
            - -c
            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
          volumeMounts:
            - name: vault-ca-cert
              mountPath: /custom-ca
              readOnly: true
            - name: combined-certs
              mountPath: /combined-certs
      containers:
        - name: litellm
          image: docker.litellm.ai/berriai/litellm-database:main-stable
          imagePullPolicy: Always
          args:
            - --config
            - /app/config.yaml
            - --port
            - "4000"
            - --num_workers
            - "8"
          ports:
            - containerPort: 4000
              name: http
              protocol: TCP
          env:
            # Authentik OIDC client secret (SSO); non-secret SSO config is in the
            # litellm-env ConfigMap.
            - name: GENERIC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: oauth-credentials
                  key: client_secret
          envFrom:
            - secretRef:
                name: litellm-credentials
            - configMapRef:
                name: litellm-env
          livenessProbe:
            httpGet:
              path: /health/liveliness
              port: 4000
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 5
          readinessProbe:
            httpGet:
              path: /health/readiness
              port: 4000
            failureThreshold: 3
            initialDelaySeconds: 10
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 5
          resources:
            limits:
              cpu: "2"
              memory: 8Gi
            requests:
              cpu: 250m
              memory: 6Gi
          volumeMounts:
            - mountPath: /app/config.yaml
              name: config
              subPath: config.yaml
            - name: combined-certs
              mountPath: /etc/ssl/combined
              readOnly: true
      restartPolicy: Always
      volumes:
        - name: config
          configMap:
            name: litellm-config
        - name: vault-ca-cert
          secret:
            secretName: vault-ca-cert
            items:
              - key: ca.crt
                path: ca.crt
        - name: combined-certs
          emptyDir: {}