Merge branch 'main' into benvin/ceph-saml

config/permissions/akP-litellm-admin.yaml

@@ -0,0 +1,3 @@
+# Permission group akP-litellm-admin (name = filename). Grants admin
+# access to litellm: bound to the litellm application and mapped to its role.
+application: litellm

config/permissions/akP-litellm-user.yaml

@@ -0,0 +1,3 @@
+# Permission group akP-litellm-user (name = filename). Grants user
+# access to litellm: bound to the litellm application and mapped to its role.
+application: litellm

config/providers_oauth2/litellm.yaml

@@ -0,0 +1,29 @@
+# OAuth2/OIDC provider + application for LiteLLM
+# (litellm.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
+# LiteLLM's generic SSO redirects back to /sso/callback.
+name: LiteLLM
+authorization_flow: default-provider-authorization-implicit-consent
+invalidation_flow: default-provider-invalidation-flow
+client_type: confidential
+client_id: litellm
+client_secret_vault:
+  mount: kv
+  path: kubernetes/namespace/litellm/default/oauth-credentials
+scope_mappings:
+  - goauthentik.io/providers/oauth2/scope-openid
+  - goauthentik.io/providers/oauth2/scope-email
+  - goauthentik.io/providers/oauth2/scope-profile
+redirect_uris:
+  - matching_mode: strict
+    url: https://litellm.k8s.syd1.au.unkin.net/sso/callback
+# Emit a `litellm_role` claim from group membership (rules in privilege order).
+# LiteLLM requests the `litellm_role` scope and reads it via
+# GENERIC_USER_ROLE_ATTRIBUTE. akP-litellm-admin is inherited by akR-global-admin.
+role_mappings:
+  claim: litellm_role
+  default: internal_user_view_only
+  rules:
+    - group: akP-litellm-admin
+      role: proxy_admin
+    - group: akP-litellm-user
+      role: internal_user

config/roles/akR-global-admin.yaml

@@ -3,3 +3,4 @@ permissions:
   - akP-grafana-admin
   - akP-argocd-admin
   - akP-rancher-admin
+  - akP-litellm-admin

config/roles/akR-standard-user.yaml

@@ -3,3 +3,4 @@ permissions:
   - akP-grafana-user
   - akP-argocd-user
   - akP-rancher-user
+  - akP-litellm-user