unkin/terraform-authentik
4
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Add LiteLLM OAuth2/OIDC provider #8

Merged
benvin merged 1 commits from benvin/litellm-oidc into main 2026-07-19 18:27:12 +10:00
Conversation 0 Commits 1 Files Changed 1
+18
unkinben commented 2026-07-19 02:19:53 +10:00
Owner
Copy Link
Copy Source

Why

SSO for LiteLLM (litellm.k8s.syd1.au.unkin.net) via Authentik, so the LiteLLM UI/admin uses Authentik identity. Part of the ongoing Authentik onboarding.

Change

  • Add config/providers_oauth2/litellm.yaml: confidential OAuth2 provider + application (slug litellm), openid/email/profile scopes, /sso/callback redirect (LiteLLM generic SSO).
  • Client secret read from Vault at kv/kubernetes/namespace/litellm/default/oauth-credentials (random seeded).

Validation

terragrunt plan: 2 to add (provider + application), litellm resources clean. (A transient Authentik 500 on refresh of existing apps appeared during plan but the API recovered — retry/CI is clean.)

Follow-up (app side)

LiteLLM SSO env wiring in argocd-apps (GENERIC_CLIENT_ID/SECRET/… + VaultStaticSecret, and optional akP-litellm-* RBAC groups) is a separate PR.

## Why SSO for LiteLLM (litellm.k8s.syd1.au.unkin.net) via Authentik, so the LiteLLM UI/admin uses Authentik identity. Part of the ongoing Authentik onboarding. ## Change - Add `config/providers_oauth2/litellm.yaml`: confidential OAuth2 provider + application (slug `litellm`), openid/email/profile scopes, `/sso/callback` redirect (LiteLLM generic SSO). - Client secret read from Vault at `kv/kubernetes/namespace/litellm/default/oauth-credentials` (random seeded). ## Validation `terragrunt plan`: 2 to add (provider + application), litellm resources clean. (A transient Authentik 500 on refresh of existing apps appeared during plan but the API recovered — retry/CI is clean.) ## Follow-up (app side) LiteLLM SSO env wiring in argocd-apps (GENERIC_CLIENT_ID/SECRET/… + VaultStaticSecret, and optional akP-litellm-* RBAC groups) is a separate PR.
unkinben added 1 commit 2026-07-19 02:19:53 +10:00
Add LiteLLM OAuth2/OIDC provider
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
9098c7dcfc 
SSO for LiteLLM (litellm.k8s.syd1.au.unkin.net) via Authentik generic OIDC.
Confidential OAuth2 provider + application, openid/email/profile scopes,
/sso/callback redirect. client_secret read from Vault at
kv/kubernetes/namespace/litellm/default/oauth-credentials (seeded).
benvin merged commit a7ef454fba into main 2026-07-19 18:27:12 +10:00
benvin deleted branch benvin/litellm-oidc 2026-07-19 18:27:12 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-authentik#8
Delete Branch "benvin/litellm-oidc"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?