From a400e5dc7e653985bdd2a245f38f3eb0e577fb89 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Tue, 7 Jul 2026 20:10:43 +1000 Subject: [PATCH] fix: grant vault deployer access to manage the litellm engine (#84) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Why Applying the newly-merged litellm mount (#83) failed at apply time with: ``` Error: failed to write litellm config URL: PUT https://vault.service.consul:8200/v1/litellm/config Code: 403. * permission denied ``` The deployer identity (`tf_vault` approle / `woodpecker_terraform_vault` k8s role) can enable the mount via `sys/mounts/admin`, but no policy grants it access to the engine's own data paths, so writing the config and roles is denied. ## Changes - Add `policies/litellm/admin.yaml` granting `create`/`read`/`update`/`delete` on `litellm/config` and `litellm/roles/*` (plus `read`/`list` on `litellm/roles`), assigned to the same auth roles as the other secret-engine admin policies (`tf_vault`, `woodpecker_terraform_vault`). ## Note The policy attaches to the deployer's auth roles, so it takes effect on the next token issuance — a re-run of the apply (fresh Vault login) will have the permission and can write `litellm/config` and the roles. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/84 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- policies/litellm/admin.yaml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 policies/litellm/admin.yaml diff --git a/policies/litellm/admin.yaml b/policies/litellm/admin.yaml new file mode 100644 index 0000000..321df20 --- /dev/null +++ b/policies/litellm/admin.yaml @@ -0,0 +1,26 @@ +# Allow management of the LiteLLM secrets engine (config and roles) +--- +rules: + - path: "litellm/config" + capabilities: + - create + - update + - read + - delete + - path: "litellm/roles/*" + capabilities: + - create + - update + - delete + - read + - list + - path: "litellm/roles" + capabilities: + - read + - list + +auth: + approle: + - tf_vault + k8s/au/syd1: + - woodpecker_terraform_vault