Add terraform-provider-litellmvaultsecret implementation #1

Merged

benvin merged 6 commits from benvin/initial-implementation into main 2026-07-03 14:18:58 +10:00

Conversation 0 Commits 6 Files Changed 25

+2079 -1

unkinben commented 2026-07-02 23:23:31 +10:00

Owner

Copy Link

Copy Source

Why

Populate the newly-created repo with the Terraform/OpenTofu provider that manages
the LiteLLM dynamic secrets engine on Vault/OpenBao, for use from
terraform-vault.

Changes

• Add the provider (auth via VAULT_ADDR/VAULT_TOKEN).
• Add litellmvaultsecret_secret_backend (mounts the engine and writes its
  connection config) and litellmvaultsecret_secret_backend_role (models,
  max_budget, ttl/max_ttl in seconds, metadata).
• Add unit tests against a mock Vault API.
• Add an end-to-end test that builds the sibling plugin, boots Vault + LiteLLM +
  Postgres, and runs a real terraform apply/destroy asserting a working key is
  generated from the managed role.
• Add Makefile, woodpecker CI (build/test/pre-commit), examples, and README.

## Why Populate the newly-created repo with the Terraform/OpenTofu provider that manages the LiteLLM dynamic secrets engine on Vault/OpenBao, for use from `terraform-vault`. ## Changes - Add the provider (auth via `VAULT_ADDR`/`VAULT_TOKEN`). - Add `litellmvaultsecret_secret_backend` (mounts the engine and writes its connection config) and `litellmvaultsecret_secret_backend_role` (models, `max_budget`, `ttl`/`max_ttl` in seconds, `metadata`). - Add unit tests against a mock Vault API. - Add an end-to-end test that builds the sibling plugin, boots Vault + LiteLLM + Postgres, and runs a real `terraform apply`/`destroy` asserting a working key is generated from the managed role. - Add Makefile, woodpecker CI (build/test/pre-commit), examples, and README.

unkinben added 2 commits 2026-07-02 23:23:31 +10:00

Add terraform-provider-litellmvaultsecret implementation ... 8ca6c39c66

Populate the repo with the Terraform/OpenTofu provider that manages the LiteLLM
dynamic secrets engine on Vault/OpenBao via the Vault API.

- Provider (VAULT_ADDR/VAULT_TOKEN) with resources litellmvaultsecret_secret_backend
  (mount + config) and litellmvaultsecret_secret_backend_role (models, max_budget,
  ttl/max_ttl in seconds, metadata)
- Unit tests against a mock Vault API
- End-to-end test: builds the sibling plugin, boots Vault + LiteLLM + Postgres,
  and runs a real terraform apply/destroy asserting key generation works
- Makefile, woodpecker CI (build/test/pre-commit), examples, README

Base on repository initial commit c43e1bf5d4

unkinben added 1 commit 2026-07-03 12:29:40 +10:00

Rename resources to litellm_secret_* prefix ... 4e57e2dba7

Use the shorter, cleaner litellm_ resource prefix instead of
litellmvaultsecret_. The provider source stays git.unkin.net/unkin/
litellmvaultsecret; only the resource prefix (provider Metadata TypeName)
changes to litellm, declared under the local name litellm in
required_providers — the same pattern google-beta uses to ship google_*.

- Provider TypeName litellmvaultsecret -> litellm
- Resources: litellm_secret_backend, litellm_secret_backend_role
- Update examples (dirs + contents), README, and the e2e terraform config

unkinben added 1 commit 2026-07-03 12:34:53 +10:00

Add on-tag release pipeline to upload the provider to artifactapi ... 1c58360d3c

Publish the provider so it can be consumed from terraform-vault: on a tag,
package the linux_amd64 build into a versioned zip and PUT it to the artifactapi
terraform registry, mirroring terraform-provider-artifactapi's release flow.

- Add .woodpecker/release.yml (event: tag) running make package + curl upload to
  remotes/terraform-unkin/files/unkin/litellmvaultsecret/

unkinben added 1 commit 2026-07-03 13:06:43 +10:00

Use reachable artifactapi host in release upload ... 59448a5bd2

Point the on-tag upload at artifactapi.k8s.syd1.au.unkin.net instead of the
unresolvable artifactapi3 name, matching the host used elsewhere (rpmbuilder,
terragrunt env).

unkinben added 1 commit 2026-07-03 13:13:01 +10:00

Set kubernetes backend options on all woodpecker steps ... db3d4c3956

Give every CI step explicit resource requests/limits and the default service
account (matching the pre-commit step), so the k8s woodpecker backend schedules
them with bounded resources.

- build/test/lint/package steps: 512Mi/1cpu requests, 2Gi/2cpu limits
- upload step: lighter 128Mi/100m requests, 512Mi/500m limits

benvin merged commit 30cb219d18 into main 2026-07-03 14:18:58 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-provider-litellmvaultsecret#1