From 193c17d1bc022b94d2e46add87b37a62a757f732 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 14:55:33 +1000 Subject: [PATCH] Manage the litellm plugin via config/plugins (import existing registration) (#90) Bring the litellm plugin under terraform management like the gpg one, using the new plugin-import module (#89). ## Why The litellm plugin was registered **manually** before terraform owned the catalog. If we just add it to `config/plugins/`, the first apply tries to *create* a catalog entry that already exists and fails. So its state must be imported first. ## Changes - Add `config/plugins/vault-plugin-secrets-litellm.yaml` (`sha256` = released **v0.1.1** openbao binary from the RPM Puppet installs). ## Manual pre-step (before apply) Import the existing registration into state, and verify the sha matches the live catalog: ```sh cd environments/au/syd1 # confirm the live sha first: bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm # import into state: terragrunt import \ 'module.plugin["vault-plugin-secrets-litellm"].vault_plugin.this' \ secret/vault-plugin-secrets-litellm ``` If the live sha differs from the yaml, update the yaml to match (or expect a benign re-register to the on-disk v0.1.1 sha). Needs the deployer's plugin-catalog access (#88, already merged). Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/90 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- config/plugins/vault-plugin-secrets-litellm.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 config/plugins/vault-plugin-secrets-litellm.yaml diff --git a/config/plugins/vault-plugin-secrets-litellm.yaml b/config/plugins/vault-plugin-secrets-litellm.yaml new file mode 100644 index 0000000..1bdff8a --- /dev/null +++ b/config/plugins/vault-plugin-secrets-litellm.yaml @@ -0,0 +1,13 @@ +# config/plugins/vault-plugin-secrets-litellm.yaml +# Imports (registers) the litellm secrets plugin in the catalog. This plugin was +# registered manually before terraform managed the catalog, so its state must be +# imported before the first apply (see the PR description) — otherwise apply +# tries to create an entry that already exists. +# +# sha256 is the released v0.1.1 openbao binary +# (openbao-plugin-secrets-litellm RPM -> /opt/openbao-plugins/vault-plugin-secrets-litellm), +# which Puppet installs floating. Verify against the live catalog during import +# (`bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm`). +type: secret +command: vault-plugin-secrets-litellm +sha256: "2263ebcb3498877a87ddcf31a9cbc6efca6b81702a5faecf7fe7e40200ca7a1f"