fix: grant vault deployer access to manage the litellm engine

Applying the litellm mount failed with 403 permission denied on PUT litellm/config: the deployer identity (tf_vault approle / woodpecker_terraform_vault k8s role) could enable the mount via sys/mounts/admin but had no policy covering the engine's own data paths. Add a litellm/admin policy granting create/read/update/delete on litellm/config and litellm/roles/*, assigned to the same auth roles as the other secret-engine admin policies.
feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret
2026-07-07 00:23:20 +10:00 · 2026-07-07 00:15:07 +10:00 · 2026-07-06 23:41:03 +10:00 · 2026-07-06 23:05:20 +10:00 · 2026-06-28 22:03:25 +10:00 · 2026-06-28 01:17:51 +10:00
149 changed files with 1039 additions and 54 deletions
@@ -0,0 +1,23 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: apply
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -0,0 +1,21 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -1,10 +1,19 @@
 .PHONY: init plan apply format

+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_vault
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
+
 # Define vault_env function to set up vault environment
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
-	export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
-	export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
 endef

 init:
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - artifactapi
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -5,4 +5,5 @@ bound_service_account_namespaces:
  - csi-cephrbd
  - csi-cephfs
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - cert-manager
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -0,0 +1,6 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces: ['*']
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - externaldns
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - identity
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - media-apps
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - puppet
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - cattle-system
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -3,4 +3,5 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - repoflow
 token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -0,0 +1,8 @@
+# rpmbuilder is deployed in woodpeckerci
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-artifactapi
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-authentik
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-git
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-prowlarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-radarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-sonarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-vault
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -185,5 +185,18 @@ locals {
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "pki_mount_only/")
    }
+    litellm_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "litellm_secret_backend/")
+    }
+    litellm_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "litellm_secret_backend_role/")
+    }
  }
 }
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-artifactapi
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-authentik
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-git
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-prowlarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-radarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-sonarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,6 @@
+# Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
+# The master key is sensitive and read from KV, not stored here:
+#   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
+description: "LiteLLM dynamic virtual keys"
+base_url: "http://litellm.litellm.svc:4000"
+request_timeout_seconds: 30
@@ -0,0 +1,10 @@
+---
+models:
+  - claude-haiku-4-5
+  - claude-sonnet-4-6
+max_budget: 50
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: mailfiltering
+  env: prod
@@ -68,6 +68,8 @@ inputs = {
  kubernetes_secret_backend      = local.config.kubernetes_secret_backend
  kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
  pki_mount_only                 = local.config.pki_mount_only
+  litellm_secret_backend         = local.config.litellm_secret_backend
+  litellm_secret_backend_role    = local.config.litellm_secret_backend_role

  # Pass policy maps to vault_cluster module
  policy_auth_map  = local.policies.policy_auth_map
@@ -11,6 +11,12 @@ provider "vault" {
  address = local.vault_addr
 }

+# The LiteLLM secrets engine is managed through its own provider, which talks to
+# the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
+provider "litellm" {
+  address = local.vault_addr
+}
+
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -29,6 +35,10 @@ terraform {
      source  = "hashicorp/consul"
      version = "2.23.0"
    }
+    litellm = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
+      version = "0.1.0"
+    }
  }
 }
 EOF
@@ -0,0 +1,11 @@
+rule "terraform_required_providers" {
+  enabled = false
+}
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "terraform_unused_declarations" {
+  enabled = false
+}
@@ -3,8 +3,6 @@ module "auth_approle_backend" {

  for_each = var.auth_approle_backend

-  country            = var.country
-  region             = var.region
  path               = each.key
  listing_visibility = each.value.listing_visibility
  default_lease_ttl  = each.value.default_lease_ttl
@@ -92,6 +90,7 @@ module "auth_kubernetes_role" {
  bound_service_account_names      = each.value.bound_service_account_names
  bound_service_account_namespaces = each.value.bound_service_account_namespaces
  token_ttl                        = each.value.token_ttl
+  token_max_ttl                    = each.value.token_max_ttl
  token_policies                   = var.policy_auth_map[each.value.backend][each.value.role_name]
  audience                         = each.value.audience

@@ -185,7 +184,6 @@ module "pki_secret_backend" {
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
  enable_templating             = each.value.enable_templating
-  default_issuer_ref            = each.value.default_issuer_ref
  default_follows_latest_issuer = each.value.default_follows_latest_issuer
  crl_expiry                    = each.value.crl_expiry
  crl_disable                   = each.value.crl_disable
@@ -265,12 +263,11 @@ module "consul_secret_backend_role" {

  for_each = var.consul_secret_backend_role

-  name         = each.value.name
-  backend      = each.value.backend
-  consul_roles = each.value.consul_roles
-  ttl          = each.value.ttl
-  max_ttl      = each.value.max_ttl
-  local        = each.value.local
+  name    = each.value.name
+  backend = each.value.backend
+  ttl     = each.value.ttl
+  max_ttl = each.value.max_ttl
+  local   = each.value.local

  depends_on = [module.consul_secret_backend, module.consul_acl_management]
 }
@@ -306,6 +303,37 @@ module "kubernetes_secret_backend_role" {
  depends_on = [module.kubernetes_secret_backend]
 }

+module "litellm_secret_backend" {
+  source = "./modules/litellm_secret_backend"
+
+  for_each = var.litellm_secret_backend
+
+  country                 = var.country
+  region                  = var.region
+  path                    = each.key
+  plugin                  = each.value.plugin
+  description             = each.value.description
+  base_url                = each.value.base_url
+  request_timeout_seconds = each.value.request_timeout_seconds
+}
+
+module "litellm_secret_backend_role" {
+  source = "./modules/litellm_secret_backend_role"
+
+  for_each = var.litellm_secret_backend_role
+
+  name             = each.value.name
+  backend          = each.value.backend
+  models           = each.value.models
+  max_budget       = each.value.max_budget
+  key_alias_prefix = each.value.key_alias_prefix
+  ttl              = each.value.ttl
+  max_ttl          = each.value.max_ttl
+  metadata         = each.value.metadata
+
+  depends_on = [module.litellm_secret_backend]
+}
+
 module "vault_policy" {
  source = "./modules/vault_policy"

@@ -323,7 +351,6 @@ module "pki_mount_only" {
  path                          = each.key
  description                   = each.value.description
  max_lease_ttl_seconds         = each.value.max_lease_ttl_seconds
-  issuer_ref                    = each.value.issuer_ref
  issuing_certificates          = each.value.issuing_certificates
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
@@ -8,4 +8,4 @@ resource "vault_auth_backend" "approle" {
    max_lease_ttl      = var.max_lease_ttl
    listing_visibility = var.listing_visibility
  }
-}
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -1,13 +1,3 @@
-variable "country" {
-  description = "Country identifier"
-  type        = string
-}
-
-variable "region" {
-  description = "Region identifier"
-  type        = string
-}
-
 variable "path" {
  description = "Mount path of the AppRole auth backend"
  type        = string
@@ -34,4 +24,4 @@ variable "max_lease_ttl" {
  description = "Specifies the maximum time-to-live. If set, this overrides the global default. Must be a valid duration string"
  type        = string
  default     = null
-}
+}
@@ -16,7 +16,7 @@ data "vault_kv_secret_v2" "role_config" {
 locals {
  salt                  = data.vault_kv_secret_v2.salt_config.data["salt"]
  role_id_input         = "${local.salt}-${var.approle_name}-${var.mount_path}"
-  deterministic_role_id = uuidv5("dns", "${local.role_id_input}")
+  deterministic_role_id = uuidv5("dns", local.role_id_input)

  # Use deterministic role-id by default, or read from KV if specified
  role_id = var.use_deterministic_role_id ? local.deterministic_role_id : data.vault_kv_secret_v2.role_config[0].data["role_id"]
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -4,6 +4,7 @@ resource "vault_kubernetes_auth_backend_role" "role" {
  bound_service_account_names      = var.bound_service_account_names
  bound_service_account_namespaces = var.bound_service_account_namespaces
  token_ttl                        = var.token_ttl
+  token_max_ttl                    = var.token_max_ttl
  token_policies                   = var.token_policies
  audience                         = var.audience
 }
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -24,6 +24,12 @@ variable "token_ttl" {
  default     = 3600
 }

+variable "token_max_ttl" {
+  description = "The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time."
+  type        = number
+  default     = 86400
+}
+
 variable "token_policies" {
  description = "List of policies to assign to the role (passed from policy_auth_map)"
  type        = list(string)
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -4,4 +4,4 @@ rule "terraform_required_providers" {

 rule "terraform_required_version" {
  enabled = false
-}
+}
@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+    consul = {
+      source  = "hashicorp/consul"
+      version = "2.23.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -9,12 +9,6 @@ variable "name" {
 }


-variable "consul_roles" {
-  description = "List of Consul roles to attach to tokens"
-  type        = list(string)
-  default     = []
-}
-

 variable "ttl" {
  description = "TTL for generated tokens"
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,14 @@
+# Expected keys in KV secret: master_key
+data "vault_kv_secret_v2" "secret_backend_config" {
+  mount = "kv"
+  name  = "service/vault/${var.country}/${var.region}/secret_backend/${var.path}"
+}
+
+resource "litellm_secret_backend" "this" {
+  path                    = var.path
+  plugin                  = var.plugin
+  description             = var.description
+  base_url                = var.base_url
+  master_key              = data.vault_kv_secret_v2.secret_backend_config.data["master_key"]
+  request_timeout_seconds = var.request_timeout_seconds
+}
@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+    litellm = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
+      version = "0.1.0"
+    }
+  }
+}
@@ -0,0 +1,37 @@
+variable "country" {
+  description = "Country identifier (used to locate the KV secret holding the master key)"
+  type        = string
+}
+
+variable "region" {
+  description = "Region identifier (used to locate the KV secret holding the master key)"
+  type        = string
+}
+
+variable "path" {
+  description = "Mount path of the LiteLLM secrets engine"
+  type        = string
+}
+
+variable "plugin" {
+  description = "Registered plugin name/type to mount"
+  type        = string
+  default     = "vault-plugin-secrets-litellm"
+}
+
+variable "description" {
+  description = "Human-friendly description of the mount"
+  type        = string
+  default     = null
+}
+
+variable "base_url" {
+  description = "Base URL of the LiteLLM proxy (e.g. http://litellm.litellm.svc:4000)"
+  type        = string
+}
+
+variable "request_timeout_seconds" {
+  description = "HTTP timeout in seconds for calls from the plugin to the LiteLLM proxy"
+  type        = number
+  default     = 30
+}
@@ -0,0 +1,10 @@
+resource "litellm_secret_backend_role" "this" {
+  backend          = var.backend
+  name             = var.name
+  models           = var.models
+  max_budget       = var.max_budget
+  key_alias_prefix = var.key_alias_prefix
+  ttl              = var.ttl
+  max_ttl          = var.max_ttl
+  metadata         = var.metadata
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    litellm = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
+      version = "0.1.0"
+    }
+  }
+}
@@ -0,0 +1,45 @@
+variable "name" {
+  description = "Name of the role"
+  type        = string
+}
+
+variable "backend" {
+  description = "Mount path of the LiteLLM secrets engine this role belongs to"
+  type        = string
+}
+
+variable "models" {
+  description = "Models a generated key may access. Empty means unrestricted"
+  type        = list(string)
+  default     = null
+}
+
+variable "max_budget" {
+  description = "Spending limit applied to each generated key. 0 means unlimited"
+  type        = number
+  default     = null
+}
+
+variable "key_alias_prefix" {
+  description = "Prefix for the auto-generated key alias"
+  type        = string
+  default     = null
+}
+
+variable "ttl" {
+  description = "Default lease TTL in seconds for keys generated from this role"
+  type        = number
+  default     = null
+}
+
+variable "max_ttl" {
+  description = "Maximum lease TTL in seconds for keys generated from this role"
+  type        = number
+  default     = null
+}
+
+variable "metadata" {
+  description = "Metadata attached to each generated key"
+  type        = map(string)
+  default     = null
+}
@@ -5,11 +5,6 @@ resource "vault_mount" "pki" {
  max_lease_ttl_seconds = var.max_lease_ttl_seconds
 }

-data "vault_pki_secret_backend_issuer" "issuer" {
-  backend    = vault_mount.pki.path
-  issuer_ref = var.issuer_ref
-}
-
 resource "vault_pki_secret_backend_config_urls" "config_urls" {
  backend = vault_mount.pki.path

@@ -35,4 +30,4 @@ resource "vault_pki_secret_backend_crl_config" "crl" {
  auto_rebuild           = var.auto_rebuild
  enable_delta           = var.enable_delta
  delta_rebuild_interval = var.delta_rebuild_interval
-}
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -13,11 +13,6 @@ variable "max_lease_ttl_seconds" {
  type        = number
 }

-variable "issuer_ref" {
-  description = "Reference to the PKI issuer (default, or issuer ID/name)"
-  type        = string
-  default     = "default"
-}

 variable "issuing_certificates" {
  description = "List of URLs for issuing certificates"
@@ -89,4 +84,4 @@ variable "delta_rebuild_interval" {
  description = "Delta CRL rebuild interval"
  type        = string
  default     = null
-}
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -61,12 +61,6 @@ variable "enable_templating" {
  default     = false
 }

-variable "default_issuer_ref" {
-  description = "Reference to the default issuer"
-  type        = string
-  default     = null
-}
-
 variable "default_follows_latest_issuer" {
  description = "Whether the default issuer should follow the latest issuer"
  type        = bool
@@ -107,4 +101,4 @@ variable "delta_rebuild_interval" {
  description = "Delta CRL rebuild interval"
  type        = string
  default     = null
-}
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -83,6 +83,7 @@ variable "auth_kubernetes_role" {
    bound_service_account_names      = list(string)
    bound_service_account_namespaces = list(string)
    token_ttl                        = optional(number, 3600)
+    token_max_ttl                    = optional(number, 86400)
    audience                         = optional(string, "vault")
  }))
  default = {}
@@ -165,7 +166,6 @@ variable "pki_secret_backend" {
    crl_distribution_points       = optional(list(string), [])
    ocsp_servers                  = optional(list(string), [])
    enable_templating             = optional(bool, false)
-    default_issuer_ref            = optional(string)
    default_follows_latest_issuer = optional(bool, false)
    crl_expiry                    = optional(string, "72h")
    crl_disable                   = optional(bool, false)
@@ -203,7 +203,6 @@ variable "pki_mount_only" {
  type = map(object({
    description                   = optional(string)
    max_lease_ttl_seconds         = optional(number, 315360000)
-    issuer_ref                    = optional(string, "default")
    issuing_certificates          = optional(list(string), [])
    crl_distribution_points       = optional(list(string), [])
    ocsp_servers                  = optional(list(string), [])
@@ -290,6 +289,32 @@ variable "kubernetes_secret_backend_role" {
  default = {}
 }

+variable "litellm_secret_backend" {
+  description = "Map of LiteLLM secret engines to create (mount + config). The master key is read from KV"
+  type = map(object({
+    plugin                  = optional(string, "vault-plugin-secrets-litellm")
+    description             = optional(string)
+    base_url                = string
+    request_timeout_seconds = optional(number, 30)
+  }))
+  default = {}
+}
+
+variable "litellm_secret_backend_role" {
+  description = "Map of LiteLLM roles to create"
+  type = map(object({
+    name             = string
+    backend          = string
+    models           = optional(list(string))
+    max_budget       = optional(number)
+    key_alias_prefix = optional(string)
+    ttl              = optional(number)
+    max_ttl          = optional(number)
+    metadata         = optional(map(string))
+  }))
+  default = {}
+}
+
 variable "policy_auth_map" {
  description = "Map of auth mounts -> auth roles -> policy names"
  type        = map(map(list(string)))
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -21,3 +21,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -15,3 +15,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -9,3 +9,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -14,3 +14,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-artifactapi"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_artifactapi
+  k8s/au/syd1:
+    - woodpecker_terraform_artifactapi
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-authentik"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_authentik
+  k8s/au/syd1:
+    - woodpecker_terraform_authentik
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-git"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_git
+  k8s/au/syd1:
+    - woodpecker_terraform_git
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-prowlarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_prowlarr
+  k8s/au/syd1:
+    - woodpecker_terraform_prowlarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-radarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_radarr
+  k8s/au/syd1:
+    - woodpecker_terraform_radarr
@@ -0,0 +1,11 @@
+---
+rules:
+  - path: "consul_root/au/syd1/creds/terraform-sonarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_sonarr
+  k8s/au/syd1:
+    - woodpecker_terraform_sonarr
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -12,3 +12,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -15,3 +15,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
@@ -8,3 +8,5 @@ rules:
 auth:
  approle:
    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
unkinben	ecee4b4432	fix: grant vault deployer access to manage the litellm engine Applying the litellm mount failed with 403 permission denied on PUT litellm/config: the deployer identity (tf_vault approle / woodpecker_terraform_vault k8s role) could enable the mount via sys/mounts/admin but had no policy covering the engine's own data paths. Add a litellm/admin policy granting create/read/update/delete on litellm/config and litellm/roles/*, assigned to the same auth roles as the other secret-engine admin policies.	2026-07-07 00:23:20 +10:00
unkinben	9e2c21131f	feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret ci/woodpecker/pr/plan Pipeline was successful Details ci/woodpecker/pr/pre-commit Pipeline was successful Details The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is now registered in Vault, but nothing declared its mount/config or roles in this repo. Wire in the companion litellm provider so the mount is managed as code alongside the other secret backends. - Add litellm_secret_backend module: mounts the engine and writes its config (base_url, request_timeout_seconds); reads master_key from KV - Add litellm_secret_backend_role module: manages roles (models, max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata) - Register both modules in vault_cluster main.tf and variables.tf - Discover litellm_secret_backend[_role] YAML in config.hcl and pass them through terragrunt inputs - Declare the litellm provider (litellmvaultsecret) and a provider block in the generated root backend.tf - Add example config for the litellm mount and a sample role	2026-07-07 00:15:07 +10:00
unkinben	bbde79d2a6	policies: let terraform-authentik read its provider API token (#82 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik's provider needs an Authentik API token (`TF_VAR_authentik_token`), now sourced from Vault at `kv/service/terraform/authentik` (Makefile wiring in terraform-authentik #2). The CI role needs read access to that path. ## Change Extend `policies/kv/service/terraform/authentik.yaml` to also grant read on `kv/data/service/terraform/authentik` for the `terraform_authentik` approle + `woodpecker_terraform_authentik` k8s role. Reviewed-on: #82 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:41:03 +10:00
unkinben	f2c54888de	policies: let terraform-authentik read oauth client secrets from kv (#81 ) ci/woodpecker/push/apply Pipeline was successful Details ## Why terraform-authentik now reads OAuth2 client secrets from Vault (`data.vault_kv_secret_v2`) rather than committing them (terraform-authentik #2). But the `terraform_authentik` approle / `woodpecker_terraform_authentik` k8s role only had the consul-creds policy, so `plan` fails with permission denied on the grafana oauth path. ## Change Add `policies/kv/service/terraform/authentik.yaml` granting read on `kv/data/kubernetes/namespace/+/default/oauth-credentials` for both the approle and the woodpecker k8s role. Reviewed-on: #81 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-07-06 23:05:20 +10:00
unkinben	36d7afbb65	feat: add vault/consul config for media terraform repos (#79 ) ci/woodpecker/push/apply Pipeline was successful Details Add Kubernetes auth roles, AppRole configs, Consul secret backend roles, Consul ACL policies, and Vault kv read policies for terraform-sonarr, terraform-radarr, and terraform-prowlarr. Reviewed-on: #79 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 22:03:25 +10:00
unkinben	c33dcdc447	Add auth and state access for terraform-authentik (#78 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - K8s auth role for Woodpecker CI (`terraform-authentik` SA in `woodpecker` namespace) - AppRole for local terraform runs - Consul secret backend role (`terraform-authentik`, TTL 120/300) - Consul ACL policy for `infra/terraform/authentik/` key prefix - Vault policy granting both auth methods access to Consul creds Reviewed-on: #78 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-28 01:17:51 +10:00
benvin	be9bd96cf3	feat: enable consul state store for artifactapi (#77 ) ci/woodpecker/push/apply Pipeline was successful Details enable the terraform-artifactapi system to manage its state in consul using dynamic credentials from kubernetes ci jobs in woodpecker --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #77	2026-06-17 21:42:25 +10:00
unkinben	bb5f6922fa	feat: add vault policy for terraform-git webhook secrets (#75 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add read policy for kv/data/service/gitea/webhook/* path - Assigned to terraform_git approle and woodpecker_terraform_git k8s auth role - Webhook URLs are stored in Vault KV and read at plan/apply time ## Test plan - [ ] Verify terragrunt plan succeeds for terraform-git after merge Reviewed-on: #75 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-08 22:56:30 +10:00
benvin	346cf9fa43	feat: manage gitadmin token (#74 ) ci/woodpecker/push/apply Pipeline was successful Details - add approle for terraform-git - add policy to read gitadmin token - update access to the terraform-git consul token --------- Co-authored-by: Ben Vincent <ben@unkin.net> Reviewed-on: #74	2026-06-08 15:17:58 +10:00
unkinben	1288057b81	feat: add vault and consul roles for terraform-git (#73 ) ci/woodpecker/push/apply Pipeline was successful Details ## Summary - Add K8s auth role woodpecker_terraform_git for CI pipeline authentication - Add consul secret backend role terraform-git for consul state storage tokens - Add consul ACL policy granting write access to infra/terraform/git/ key prefix - Add vault policy for reading consul creds at consul_root/au/syd1/creds/terraform-git ## Test plan - [ ] Verify terragrunt plan succeeds - [ ] Verify consul ACL policy is created correctly - [ ] Verify K8s auth role can authenticate from woodpecker namespace Reviewed-on: #73 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 20:36:35 +10:00
unkinben	3876fa818d	chore: bump almalinux9 image tags (#72 ) ci/woodpecker/push/apply Pipeline was successful Details Bump almalinux9 image tags to 20260606 Reviewed-on: #72 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>	2026-06-07 00:35:30 +10:00
unkinben	a548bf1cb1	fix: apply requires plan (#71 ) ci/woodpecker/push/apply Pipeline was successful Details - ensure make plan runs before make apply when deploying Reviewed-on: #71	2026-05-22 00:03:08 +10:00
unkinben	93ba86baf3	feat: add apply workflow (#70 ) ci/woodpecker/push/apply Pipeline was successful Details Reviewed-on: #70	2026-05-21 23:57:25 +10:00
unkinben	098830c10b	Merge pull request 'feat: add plan workflow' (#69 ) from benvin/make-plan-buildwq into master Reviewed-on: #69	2026-05-21 23:54:07 +10:00
unkinben	9cbac6d3ef	feat: add plan workflow ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/plan Pipeline was successful Details - update makefile to enable kubernetes auth or roleid auth - add plan workflow - update all policies to allow the terraform-vault kubernetes role	2026-05-21 23:52:30 +10:00
unkinben	73aaaaeb99	Merge pull request 'chore: enable access to gateway.networking.k8s.io' (#68 ) from benvin/gatewayapi into master Reviewed-on: #68	2026-05-21 22:42:28 +10:00
unkinben	7c60a5fd53	chore: enable access to gateway.networking.k8s.io ci/woodpecker/pr/pre-commit Pipeline was successful Details	2026-05-21 22:39:57 +10:00
unkinben	27f12f183e	Merge pull request 'chore: change to specific ci image' (#67 ) from benvin/ci_image into master Reviewed-on: #67	2026-03-09 01:16:59 +11:00
unkinben	c61434b692	chore: change to specific ci image ci/woodpecker/pr/pre-commit Pipeline was successful Details - almalinux9-opentofu image contains all required tools	2026-03-09 01:14:41 +11:00
unkinben	172ceac2fc	Merge pull request 'feat: add templated policies for kubernetes' (#66 ) from benvin/kubernetes_structured_paths into master Reviewed-on: #66	2026-03-08 12:57:58 +11:00
unkinben	48a4fd0dd1	feat: add templated policies for kubernetes ci/woodpecker/pr/pre-commit Pipeline was successful Details - add default kubernetes auth role - add templated access kv/kubernetes/*	2026-03-08 12:48:08 +11:00
unkinben	4dc09547ef	Merge pull request 'fix: update audience for rpmbuilder' (#65 ) from benvin/default_aud into master Reviewed-on: #65	2026-03-08 12:29:43 +11:00
unkinben	546a9efe44	fix: update audience for rpmbuilder ci/woodpecker/pr/pre-commit Pipeline was successful Details when using using the service account jwt directly, the default audience is the api servers url	2026-03-07 11:31:36 +11:00
unkinben	679cec4bc1	Merge pull request 'feat: add rpmbuilder k8s role' (#64 ) from benvin/rpmbuilder-in-k8s into master Reviewed-on: #64	2026-03-07 11:11:23 +11:00
unkinben	71789f9f32	feat: add rpmbuilder k8s role ci/woodpecker/pr/pre-commit Pipeline was successful Details - create rpmbuilder role - enable access to gitea/github ro-tokens - enable access to rpmbuilder role from woodpeckerci	2026-03-07 11:06:27 +11:00
unkinben	4cbcec58d3	Merge pull request 'feat: enable woodpecker access to ro tokens' (#63 ) from benvin/woodpecker_task_access into master Reviewed-on: #63	2026-03-07 10:52:38 +11:00
unkinben	9c93e185f8	feat: enable woodpecker access to ro tokens ci/woodpecker/pr/pre-commit Pipeline was successful Details - enable woodpecker tasks to access gitea/github read-only tokens	2026-03-07 10:49:39 +11:00
unkinben	d6c8474bd3	Merge pull request 'chore: move pgsql password to vault' (#62 ) from benvin/artifactapi_postgrespassword into master Reviewed-on: #62	2026-03-06 19:51:25 +11:00
unkinben	42351000ee	chore: move pgsql password to vault ci/woodpecker/pr/pre-commit Pipeline was successful Details - no more storing secrets in configmaps	2026-03-06 19:39:36 +11:00
unkinben	f7d1330c37	Merge pull request 'chore: add artifactapi k8s role' (#61 ) from benvin/artifactapi into master Reviewed-on: #61	2026-03-06 18:57:05 +11:00
unkinben	d9e07e432e	chore: add artifactapi k8s role ci/woodpecker/pr/pre-commit Pipeline was successful Details - enable access to read artifactapi secrets	2026-03-06 18:53:42 +11:00
unkinben	14a258de7d	Merge pull request 'chore: enable access woodpecker-agent-secret' (#60 ) from benvin/woodpecker_agent_secret into master Reviewed-on: #60	2026-03-03 23:34:32 +11:00
unkinben	be8bcc3743	chore: enable access woodpecker-agent-secret ci/woodpecker/pr/pre-commit Pipeline was successful Details - add policy to access woodpecker-agent-secret	2026-03-03 23:30:49 +11:00
unkinben	dc257b1bcd	Merge pull request 'feat: add pre-commit check in ci' (#59 ) from benvin/woodpecker_integration into master Reviewed-on: #59	2026-02-28 22:28:21 +11:00
unkinben	66119e5207	feat: add pre-commit check in ci ci/woodpecker/pr/pre-commit Pipeline was successful Details - add a ci workflow to verify pre-commit passes - fix pre-commit errors/warnings: - missing required_version - missing required_providers - fixed terraform_deprecated_interpolation - removed terraform_unused_declarations	2026-02-28 21:42:47 +11:00
unkinben	9e6de4dc32	Merge pull request 'feat: set max token life for auth_kubernetes_role' (#58 ) from benvin/token_max_ttl into master Reviewed-on: #58	2026-02-22 22:30:18 +11:00
unkinben	7cafafd483	feat: set max token life for auth_kubernetes_role found kubernetes vaultauth resources never picking up new policies, because they would infinitely renew their token. - set default max token length for roles to 1 day - changed all existing role token_max_ttl to match their token_ttl	2026-02-22 22:28:21 +11:00
unkinben	c94b2af196	Merge pull request 'feat: add woodpecker secrets' (#57 ) from benvin/woodpecker into master Reviewed-on: #57	2026-02-22 22:27:50 +11:00
unkinben	dd44146d88	feat: add woodpecker secrets - add secrets required to integrate woodpecker into gitea/pgsql	2026-02-22 22:27:30 +11:00
unkinben	18a62332f6	Merge pull request 'chore: enable access to openldap admin creds' (#56 ) from benvin/ldap_admin_pass_terraform_ldap into master Reviewed-on: #56	2026-02-15 20:17:35 +11:00
unkinben	8fa68e2670	chore: enable access to openldap admin creds - ensure terraform_ldap can read ldap admin credentials	2026-02-15 20:16:58 +11:00
unkinben	4cad39989f	Merge pull request 'chore: add default_user_password credentials policy' (#55 ) from benvin/openldap_default_pass into master Reviewed-on: #55	2026-02-15 13:45:45 +11:00
unkinben	c825962490	chore: add default_user_password credentials policy - fix the comment for ldap_admin_password - add policy to read default_user_password	2026-02-15 13:43:02 +11:00