From 934d6ee72c2d38aa2ba2ddad3593542236bf0638 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 12 Oct 2026 00:18:44 +1100
Subject: [PATCH] feat: scope rspamd litellm role to haiku and bind mail/rspamd

---
 config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml    | 10 ++++++++++
 config/litellm_secret_backend_role/litellm/rspamd.yaml |  1 -
 policies/litellm/creds/rspamd.yaml                     | 10 ++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml
 create mode 100644 policies/litellm/creds/rspamd.yaml

diff --git a/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml b/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml
new file mode 100644
index 0000000..ec6b78b
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml
@@ -0,0 +1,10 @@
+---
+# Kubernetes auth role for rspamd: the rspamd service account in the mail
+# namespace, used by VaultDynamicSecret to read litellm/creds/rspamd.
+bound_service_account_names:
+  - rspamd
+bound_service_account_namespaces:
+  - mail
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/config/litellm_secret_backend_role/litellm/rspamd.yaml b/config/litellm_secret_backend_role/litellm/rspamd.yaml
index 340fb58..29fe2ec 100644
--- a/config/litellm_secret_backend_role/litellm/rspamd.yaml
+++ b/config/litellm_secret_backend_role/litellm/rspamd.yaml
@@ -1,7 +1,6 @@
 ---
 models:
   - claude-haiku-4-5
-  - claude-sonnet-4-6
 max_budget: 50
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
diff --git a/policies/litellm/creds/rspamd.yaml b/policies/litellm/creds/rspamd.yaml
new file mode 100644
index 0000000..c022f9b
--- /dev/null
+++ b/policies/litellm/creds/rspamd.yaml
@@ -0,0 +1,10 @@
+# Lets rspamd mint a Haiku-scoped LiteLLM virtual key for its GPT/LLM module.
+---
+rules:
+  - path: "litellm/creds/rspamd"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - rspamd