unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:1c56ce5d985db8d8c07977c30b8cd6311ff68d06
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access
..
compare: unkin/terraform-vault:benvin/litellm-secrets-engine
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:benvin/litellm-secrets-engine unkin/terraform-vault:feature/forgebot-vault-access

2 Commits
1c56ce5d98 .. benvin/litellm-secrets-engine

Author SHA1 Message Date
unkinben ecee4b4432 fix: grant vault deployer access to manage the litellm engine 
Applying the litellm mount failed with 403 permission denied on
PUT litellm/config: the deployer identity (tf_vault approle /
woodpecker_terraform_vault k8s role) could enable the mount via
sys/mounts/admin but had no policy covering the engine's own data paths.

Add a litellm/admin policy granting create/read/update/delete on
litellm/config and litellm/roles/*, assigned to the same auth roles as the
other secret-engine admin policies.
 2026-07-07 00:23:20 +10:00
unkinben 9e2c21131f feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is
now registered in Vault, but nothing declared its mount/config or roles in
this repo. Wire in the companion litellm provider so the mount is managed
as code alongside the other secret backends.

- Add litellm_secret_backend module: mounts the engine and writes its
  config (base_url, request_timeout_seconds); reads master_key from KV
- Add litellm_secret_backend_role module: manages roles (models,
  max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata)
- Register both modules in vault_cluster main.tf and variables.tf
- Discover litellm_secret_backend[_role] YAML in config.hcl and pass them
  through terragrunt inputs
- Declare the litellm provider (litellmvaultsecret) and
  a provider block in the generated root backend.tf
- Add example config for the litellm mount and a sample role
 2026-07-07 00:15:07 +10:00
3 changed files with 36 additions and 11 deletions
Expand all files Collapse all files
config/litellm_secret_backend_role/litellm/rspamd.yaml
+10
View File
@@ -0,0 +1,10 @@
---
models:
- claude-haiku-4-5
- claude-sonnet-4-6
max_budget: 50
ttl: 3600 # seconds (1h)
max_ttl: 86400 # seconds (24h)
metadata:
team: mailfiltering
env: prod
config/litellm_secret_backend_role/litellm/team-a.yaml
-11
View File
@@ -1,11 +0,0 @@
# Role on the "litellm" mount (directory name = backend mount path).
# Constrains the virtual keys generated from creds/team-a.
models:
- gpt-4
- gpt-3.5-turbo
max_budget: 50
ttl: 3600 # seconds (1h)
max_ttl: 86400 # seconds (24h)
metadata:
team: a
env: prod
policies/litellm/admin.yaml
+26
View File
@@ -0,0 +1,26 @@
# Allow management of the LiteLLM secrets engine (config and roles)
---
rules:
- path: "litellm/config"
capabilities:
- create
- update
- read
- delete
- path: "litellm/roles/*"
capabilities:
- create
- update
- delete
- read
- list
- path: "litellm/roles"
capabilities:
- read
- list
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault