Manage the litellm plugin via config/plugins (import existing registration)

Bring the litellm plugin under terraform management like the gpg one. It was registered manually before terraform owned the catalog, so its state must be imported before applying, otherwise apply fails creating an entry that already exists. - Add config/plugins/vault-plugin-secrets-litellm.yaml (sha256 = released v0.1.1 openbao binary; verify against the live catalog on import). Manual pre-step before apply: cd environments/au/syd1 terragrunt import \ 'module.plugin["vault-plugin-secrets-litellm"].vault_plugin.this' \ secret/vault-plugin-secrets-litellm
Grant vault deployer access to import + manage the gpg engine (#88 )
2026-07-17 23:16:32 +10:00 · 2026-07-17 23:09:31 +10:00 · 2026-07-17 23:08:04 +10:00 · 2026-07-15 21:37:45 +10:00 · 2026-07-09 23:47:32 +10:00 · 2026-07-07 20:10:43 +10:00
219 changed files with 1853 additions and 188 deletions
@@ -9,8 +9,8 @@ repos:
  - repo: https://github.com/gruntwork-io/pre-commit
    rev: v0.1.30
    hooks:
-      - id: terraform-fmt
-      - id: terraform-validate
+      - id: tofu-fmt
+      - id: tofu-validate
      - id: tflint
      - id: terragrunt-hcl-fmt
  - repo: https://github.com/adrienverge/yamllint.git
@@ -0,0 +1,23 @@
+when:
+  - event: push
+    branch: master
+
+steps:
+  - name: apply
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+      - make apply
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -0,0 +1,21 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: plan
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    environment:
+      VAULT_AUTH_METHOD: kubernetes
+    commands:
+      - dnf install vault -y
+      - make plan
+    backend_options:
+      kubernetes:
+        serviceAccountName: terraform-vault
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -0,0 +1,18 @@
+when:
+  - event: pull_request
+
+steps:
+  - name: pre-commit
+    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
+    commands:
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -1,29 +1,35 @@
 .PHONY: init plan apply format

-#init:
-#	@echo "Sourcing environment and initializing Terraform..."
-#	@source ./env && terraform init
-#
-#plan:
-#	@echo "Sourcing environment and planning Terraform changes..."
-#	@source ./env && terraform plan
-#
-#apply:
-#	@echo "Sourcing environment and applying Terraform changes..."
-#	@source ./env && terraform apply -auto-approve
+VAULT_AUTH_METHOD ?= approle
+VAULT_K8S_ROLE ?= woodpecker_terraform_vault
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token

+# Define vault_env function to set up vault environment
+define vault_env
+	@export VAULT_ADDR="https://vault.service.consul:8200" && \
+	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
+		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
+	else \
+		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
+	fi && \
+	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
+endef

 init:
-	@terragrunt run --all --non-interactive init -- -upgrade
+	@$(call vault_env) && \
+	terragrunt run --all --non-interactive init -- -upgrade

 plan: init
-	@terragrunt run --all --parallelism 4 --non-interactive plan
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 4 --non-interactive plan

 apply: init
-	@terragrunt run --all --parallelism 2 --non-interactive apply
+	@$(call vault_env) && \
+	terragrunt run --all --parallelism 2 --non-interactive apply

 format:
-	@echo "Formatting Terraform files..."
-	@terraform fmt -recursive .
+	@echo "Formatting OpenTofu files..."
+	@tofu fmt -recursive .
 	@echo "Formatting Terragrunt files..."
 	@terragrunt hcl fmt
@@ -1,5 +1,3 @@
-token_policies:
-  - "pki_int/certmanager"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,6 +1,3 @@
-token_policies:
-  - "default_access"
-  - "kv/service/incus/incus-cluster-join-tokens"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -1,6 +1,3 @@
-token_policies:
-  - "default_access"
-  - "kv/service/packer/packer_builder"
 token_ttl: 300
 token_max_ttl: 600
 bind_secret_id: false
@@ -1,5 +1,3 @@
-token_policies:
-  - "kv/service/puppetapi/puppetapi_read_tokens"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,6 +1,3 @@
-token_policies:
-  - "kv/service/github/neoloc/tokens/read-only-token/read"
-  - "kv/service/gitea/unkinben/tokens/read-only-packages/read"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,5 +1,3 @@
-token_policies:
-  - "rundeck/rundeck"
 token_ttl: 3600
 token_max_ttl: 14400
 bind_secret_id: true
@@ -1,6 +1,3 @@
-token_policies:
-  - "ssh-host-signer/sshsigner"
-  - "sshca_signhost"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -1,7 +1,3 @@
-token_policies:
-  - "default_access"
-  - "kv/service/terraform/incus"
-  - "kv/service/puppet/certificates/terraform_puppet_cert"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 60
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -1,6 +1,3 @@
-token_policies:
-  - "default_access"
-  - "kv/service/terraform/nomad"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -1,7 +1,3 @@
-token_policies:
-  - "default_access"
-  - "kv/service/repoflow/unkinadmin/tokens/terraform/read"
-  - "kv/service/terraform/repoflow"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
+token_ttl: 120
+token_max_ttl: 120
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+  - "198.18.25.102/32"
+  - "198.18.26.91/32"
+  - "198.18.27.40/32"
+use_deterministic_role_id: true
@@ -1,27 +1,3 @@
-token_policies:
-  - "default_access"
-  - "approle_token_create"
-  - "auth/approle/approle_role_admin"
-  - "auth/approle/approle_role_login"
-  - "auth/kubernetes/k8s_auth_admin"
-  - "auth/ldap/ldap_admin"
-  - "auth/token/auth_token_create"
-  - "auth/token/auth_token_self"
-  - "auth/token/auth_token_roles_admin"
-  - "kubernetes/au/config_admin"
-  - "kubernetes/au/roles_admin"
-  - "kv/service/glauth/services/svc_vault_read"
-  - "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read"
-  - "kv/service/kubernetes/au/syd1/service_account_jwt/read"
-  - "kv/service/vault/auth_backends_read"
-  - "pki_int/pki_int_roles_admin"
-  - "pki_root/pki_root_roles_admin"
-  - "ssh-host-signer/ssh-host-signer_roles_admin"
-  - "sshca/sshca_roles_admin"
-  - "sys/sys_auth_admin"
-  - "sys/sys_mounts_admin"
-  - "sys/sys_policy_admin"
-  - "transit/keys/admin"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -1,5 +1,5 @@
 kubernetes_host: https://api-k8s.service.consul:6443
 disable_iss_validation: true
-use_annotations_as_alias_metadata: true
+use_annotations_as_alias_metadata: false # doesnt work with openbao yet
 default_lease_ttl: 1h
 max_lease_ttl: 24h
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - artifactapi
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -4,8 +4,6 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - csi-cephrbd
  - csi-cephfs
-token_ttl: 60
-token_policies:
-  - kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read
-  - kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read
+token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -2,8 +2,6 @@ bound_service_account_names:
  - cert-manager-vault-issuer
 bound_service_account_namespaces:
  - cert-manager
-token_ttl: 60
-token_policies:
-  - pki_int/sign/servers_default
-  - pki_int/issue/servers_default
+token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -0,0 +1,6 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces: ['*']
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -2,7 +2,6 @@ bound_service_account_names:
  - externaldns
 bound_service_account_namespaces:
  - externaldns
-token_ttl: 60
-token_policies:
-  - kv/service/kubernetes/au/syd1/externaldns/tsig/read
+token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -2,8 +2,5 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - huntarr
-token_ttl: 60
-token_policies:
-  - pki_int/sign/servers_default
-  - pki_int/issue/servers_default
+token_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - identity
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -2,8 +2,6 @@ bound_service_account_names:
  - media-apps-vault-reader
 bound_service_account_namespaces:
  - media-apps
-token_ttl: 60
-token_policies:
-  - kv/service/media-apps/radarr/read
-  - kv/service/media-apps/sonarr/read
+token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - puppet
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - rancher
+bound_service_account_namespaces:
+  - cattle-system
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -2,11 +2,6 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - repoflow
-token_ttl: 60
-token_policies:
-  - kv/service/repoflow/au/syd1/ceph-s3/read
-  - kv/service/repoflow/au/syd1/elasticsearch/read
-  - kv/service/repoflow/au/syd1/hasura/read
-  - kv/service/repoflow/au/syd1/postgres/read
-  - kv/service/repoflow/au/syd1/repoflow-server/read
+token_ttl: 600
+token_max_ttl: 600
 audience: vault
@@ -0,0 +1,8 @@
+# rpmbuilder is deployed in woodpeckerci
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-artifactapi
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-authentik
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-git
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-prowlarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-radarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-rancher
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-sonarr
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
+bound_service_account_names:
+  - terraform-vault
+bound_service_account_namespaces:
+  - woodpecker
+token_ttl: 600
+token_max_ttl: 600
+audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo
@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo
@@ -0,0 +1,3 @@
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo
@@ -1,2 +0,0 @@
-policies:
-  - "default_access"
@@ -1,3 +1,3 @@
-policies:
-  - "default_access"
-  - "global-admin"
+---
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
+description: foo
@@ -169,7 +169,7 @@ locals {
    }
    consul_secret_backend = {
      for file_path, content in local.all_configs :
-      trimsuffix(basename(file_path), ".yaml") => content
+      trimsuffix(replace(file_path, "consul_secret_backend/", ""), ".yaml") => content
      if startswith(file_path, "consul_secret_backend/")
    }
    consul_secret_backend_role = {
@@ -185,5 +185,25 @@ locals {
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "pki_mount_only/")
    }
+    litellm_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "litellm_secret_backend/")
+    }
+    litellm_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "litellm_secret_backend_role/")
+    }
+    plugins = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => merge(content, {
+        name = trimsuffix(basename(file_path), ".yaml")
+      })
+      if startswith(file_path, "plugins/")
+    }
  }
 }
@@ -0,0 +1,7 @@
+description: "consul secret engine for au-syd1 cluster"
+default_lease_ttl_seconds: 600
+max_lease_ttl_seconds: 86400
+address: "consul.service.au-syd1.consul"
+scheme: https
+bootstrap: false
+datacenter: au-syd1
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-artifactapi
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-authentik
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-git
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-incus
+ttl: 300
+max_ttl: 600
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-k8s
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-ldap
+ttl: 60
+max_ttl: 60
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-nomad
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-prowlarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-radarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-rancher
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-repoflow
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-sonarr
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -0,0 +1,5 @@
+consul_roles:
+  - terraform-vault
+ttl: 120
+max_ttl: 300
+datacenters: []
@@ -1,4 +1,3 @@
-backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
-backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
-backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
-backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "media-apps"
 kubernetes_role_type: "Role"
@@ -0,0 +1,6 @@
+# Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
+# The master key is sensitive and read from KV, not stored here:
+#   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
+description: "LiteLLM dynamic virtual keys"
+base_url: "https://litellm.k8s.syd1.au.unkin.net"
+request_timeout_seconds: 30
@@ -0,0 +1,9 @@
+---
+models:
+  - claude-opus-4-7
+max_budget: 5
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: testuser
+  env: prod
@@ -0,0 +1,10 @@
+---
+models:
+  - claude-haiku-4-5
+  - claude-sonnet-4-6
+max_budget: 50
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: mailfiltering
+  env: prod
@@ -1,4 +1,3 @@
-backend: "pki/au/syd1"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -1,4 +1,3 @@
-backend: "pki_int"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -1,4 +1,3 @@
-backend: "pki_root"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -0,0 +1,10 @@
+# config/plugins/vault-plugin-secrets-gpg.yaml
+# Imports (registers) the gpg secrets plugin in the catalog. Filename = catalog
+# name = mount type. The binary is installed on the OpenBao nodes by Puppet
+# (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
+#
+# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
+# upgrade or OpenBao will refuse to launch the plugin.
+type: secret
+command: vault-plugin-secrets-gpg
+sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"
@@ -0,0 +1,13 @@
+# config/plugins/vault-plugin-secrets-litellm.yaml
+# Imports (registers) the litellm secrets plugin in the catalog. This plugin was
+# registered manually before terraform managed the catalog, so its state must be
+# imported before the first apply (see the PR description) — otherwise apply
+# tries to create an entry that already exists.
+#
+# sha256 is the released v0.1.1 openbao binary
+# (openbao-plugin-secrets-litellm RPM -> /opt/openbao-plugins/vault-plugin-secrets-litellm),
+# which Puppet installs floating. Verify against the live catalog during import
+# (`bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm`).
+type: secret
+command: vault-plugin-secrets-litellm
+sha256: "2263ebcb3498877a87ddcf31a9cbc6efca6b81702a5faecf7fe7e40200ca7a1f"
@@ -13,6 +13,11 @@ include "policies" {
  expose = true
 }

+include "resources" {
+  path   = "${get_repo_root()}/resources/resources.hcl"
+  expose = true
+}
+
 locals {
  # Extract country and region from path
  path_parts = split("/", dirname(get_terragrunt_dir()))
@@ -24,6 +29,16 @@ locals {

  # Include policies from policies.hcl
  policies = include.policies.locals
+
+  # Include resources from resources.hcl
+  resources = include.resources.locals
+
+  # Create sanitized backend name mapping for Consul providers
+  # Provider aliases can't contain slashes, so replace them with underscores
+  consul_backend_aliases = {
+    for backend_name, _ in local.config.consul_secret_backend :
+    backend_name => replace(backend_name, "/", "_")
+  }
 }

 terraform {
@@ -53,8 +68,14 @@ inputs = {
  kubernetes_secret_backend      = local.config.kubernetes_secret_backend
  kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
  pki_mount_only                 = local.config.pki_mount_only
+  litellm_secret_backend         = local.config.litellm_secret_backend
+  litellm_secret_backend_role    = local.config.litellm_secret_backend_role
+  plugins                        = local.config.plugins

  # Pass policy maps to vault_cluster module
  policy_auth_map  = local.policies.policy_auth_map
  policy_rules_map = local.policies.policy_rules_map
+
+  # Pass sanitized consul backend aliases for provider configuration
+  consul_backend_aliases = local.consul_backend_aliases
 }
@@ -3,27 +3,20 @@ generate "backend" {
  path      = "backend.tf"
  if_exists = "overwrite"
  contents  = <<EOF
-#-------------------------------------------
-# locals
-#-------------------------------------------
 locals {
  vault_addr = "https://vault.service.consul:8200"
 }

-#-----------------------------------------------------------------------------
-# Configure this provider through the environment variables:
-#    - VAULT_ADDR
-#    - VAULT_TOKEN
-#-----------------------------------------------------------------------------
 provider "vault" {
  address = local.vault_addr
 }

-#------------------------------------------------------------------------------
-# Use remote state file and encrypt it since your state files may contains
-# sensitive data.
-# export CONSUL_HTTP_TOKEN=<your-token>
-#------------------------------------------------------------------------------
+# The LiteLLM secrets engine is managed through its own provider, which talks to
+# the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
+provider "litellm" {
+  address = local.vault_addr
+}
+
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -38,6 +31,14 @@ terraform {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
+    consul = {
+      source  = "hashicorp/consul"
+      version = "2.23.0"
+    }
+    litellm = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
+      version = "0.1.0"
+    }
  }
 }
 EOF
@@ -0,0 +1,11 @@
+rule "terraform_required_providers" {
+  enabled = false
+}
+
+rule "terraform_required_version" {
+  enabled = false
+}
+
+rule "terraform_unused_declarations" {
+  enabled = false
+}
@@ -3,8 +3,6 @@ module "auth_approle_backend" {

  for_each = var.auth_approle_backend

-  country            = var.country
-  region             = var.region
  path               = each.key
  listing_visibility = each.value.listing_visibility
  default_lease_ttl  = each.value.default_lease_ttl
@@ -61,7 +59,7 @@ module "auth_ldap_group" {

  groupname = each.value.groupname
  backend   = each.value.backend
-  policies  = each.value.policies
+  policies  = var.policy_auth_map[each.value.backend][each.value.groupname]

  depends_on = [module.auth_ldap_backend]
 }
@@ -92,6 +90,7 @@ module "auth_kubernetes_role" {
  bound_service_account_names      = each.value.bound_service_account_names
  bound_service_account_namespaces = each.value.bound_service_account_namespaces
  token_ttl                        = each.value.token_ttl
+  token_max_ttl                    = each.value.token_max_ttl
  token_policies                   = var.policy_auth_map[each.value.backend][each.value.role_name]
  audience                         = each.value.audience

@@ -185,7 +184,6 @@ module "pki_secret_backend" {
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
  enable_templating             = each.value.enable_templating
-  default_issuer_ref            = each.value.default_issuer_ref
  default_follows_latest_issuer = each.value.default_follows_latest_issuer
  crl_expiry                    = each.value.crl_expiry
  crl_disable                   = each.value.crl_disable
@@ -237,6 +235,29 @@ module "consul_secret_backend" {
  max_lease_ttl_seconds     = each.value.max_lease_ttl_seconds
 }

+# Create data sources for consul backend tokens
+data "vault_kv_secret_v2" "consul_backend_configs" {
+  for_each = {
+    for k, v in var.consul_secret_backend : k => v
+    if !v.bootstrap
+  }
+
+  mount = "kv"
+  name  = "service/vault/${var.country}/${var.region}/secret_backend/${each.key}"
+}
+
+# Create Consul ACL management module
+module "consul_acl_management" {
+  source = "./modules/consul_acl_management"
+
+  country                = var.country
+  region                 = var.region
+  consul_backends        = var.consul_secret_backend
+  consul_roles           = var.consul_secret_backend_role
+  consul_backend_aliases = var.consul_backend_aliases
+}
+
+# Create consul secret backend roles (Vault resources only)
 module "consul_secret_backend_role" {
  source = "./modules/consul_secret_backend_role"

@@ -244,12 +265,11 @@ module "consul_secret_backend_role" {

  name    = each.value.name
  backend = each.value.backend
-  consul_roles = each.value.consul_roles
  ttl     = each.value.ttl
  max_ttl = each.value.max_ttl
  local   = each.value.local

-  depends_on = [module.consul_secret_backend]
+  depends_on = [module.consul_secret_backend, module.consul_acl_management]
 }

 module "kubernetes_secret_backend" {
@@ -283,6 +303,49 @@ module "kubernetes_secret_backend_role" {
  depends_on = [module.kubernetes_secret_backend]
 }

+module "litellm_secret_backend" {
+  source = "./modules/litellm_secret_backend"
+
+  for_each = var.litellm_secret_backend
+
+  country                 = var.country
+  region                  = var.region
+  path                    = each.key
+  plugin                  = each.value.plugin
+  description             = each.value.description
+  base_url                = each.value.base_url
+  request_timeout_seconds = each.value.request_timeout_seconds
+}
+
+module "litellm_secret_backend_role" {
+  source = "./modules/litellm_secret_backend_role"
+
+  for_each = var.litellm_secret_backend_role
+
+  name             = each.value.name
+  backend          = each.value.backend
+  models           = each.value.models
+  max_budget       = each.value.max_budget
+  key_alias_prefix = each.value.key_alias_prefix
+  ttl              = each.value.ttl
+  max_ttl          = each.value.max_ttl
+  metadata         = each.value.metadata
+
+  depends_on = [module.litellm_secret_backend]
+}
+
+module "plugin" {
+  source = "./modules/plugin"
+
+  for_each = var.plugins
+
+  name           = each.value.name
+  type           = each.value.type
+  command        = each.value.command
+  sha256         = each.value.sha256
+  plugin_version = each.value.version
+}
+
 module "vault_policy" {
  source = "./modules/vault_policy"

@@ -300,7 +363,6 @@ module "pki_mount_only" {
  path                          = each.key
  description                   = each.value.description
  max_lease_ttl_seconds         = each.value.max_lease_ttl_seconds
-  issuer_ref                    = each.value.issuer_ref
  issuing_certificates          = each.value.issuing_certificates
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
@@ -314,3 +376,4 @@ module "pki_mount_only" {
  enable_delta                  = each.value.enable_delta
  delta_rebuild_interval        = each.value.delta_rebuild_interval
 }
+
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -1,13 +1,3 @@
-variable "country" {
-  description = "Country identifier"
-  type        = string
-}
-
-variable "region" {
-  description = "Region identifier"
-  type        = string
-}
-
 variable "path" {
  description = "Mount path of the AppRole auth backend"
  type        = string
@@ -16,7 +16,7 @@ data "vault_kv_secret_v2" "role_config" {
 locals {
  salt                  = data.vault_kv_secret_v2.salt_config.data["salt"]
  role_id_input         = "${local.salt}-${var.approle_name}-${var.mount_path}"
-  deterministic_role_id = uuidv5("dns", "${local.role_id_input}")
+  deterministic_role_id = uuidv5("dns", local.role_id_input)

  # Use deterministic role-id by default, or read from KV if specified
  role_id = var.use_deterministic_role_id ? local.deterministic_role_id : data.vault_kv_secret_v2.role_config[0].data["role_id"]
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -4,6 +4,7 @@ resource "vault_kubernetes_auth_backend_role" "role" {
  bound_service_account_names      = var.bound_service_account_names
  bound_service_account_namespaces = var.bound_service_account_namespaces
  token_ttl                        = var.token_ttl
+  token_max_ttl                    = var.token_max_ttl
  token_policies                   = var.token_policies
  audience                         = var.audience
 }
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -24,6 +24,12 @@ variable "token_ttl" {
  default     = 3600
 }

+variable "token_max_ttl" {
+  description = "The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time."
+  type        = number
+  default     = 86400
+}
+
 variable "token_policies" {
  description = "List of policies to assign to the role (passed from policy_auth_map)"
  type        = list(string)
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -0,0 +1,7 @@
+rule "terraform_required_providers" {
+  enabled = false
+}
+
+rule "terraform_required_version" {
+  enabled = false
+}
@@ -0,0 +1,58 @@
+# Get consul backend tokens from Vault
+data "vault_kv_secret_v2" "consul_backend_configs" {
+  for_each = var.consul_backends
+
+  mount = "kv"
+  name  = "service/vault/${var.country}/${var.region}/secret_backend/${each.key}"
+}
+
+# Create consul provider instances for each consul backend
+provider "consul" {
+  alias    = "by_backend"
+  for_each = var.consul_backend_aliases
+
+  address = var.consul_backends[each.key].address
+  scheme  = var.consul_backends[each.key].scheme
+  ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
+  token   = data.vault_kv_secret_v2.consul_backend_configs[each.key].data["token"]
+}
+
+# Create Consul ACL policies
+resource "consul_acl_policy" "policies" {
+  for_each = var.consul_roles
+
+  provider = consul.by_backend[each.value.backend]
+
+  name        = each.value.name
+  description = each.value.description != null ? each.value.description : "Auto-generated policy for Vault role ${each.value.name}"
+  rules       = file("${path.module}/../../../../../../../../resources/secret_backend/${each.value.backend}/${each.value.name}.hcl")
+  datacenters = each.value.datacenters
+}
+
+# Create Consul ACL roles
+resource "consul_acl_role" "roles" {
+  for_each = var.consul_roles
+
+  provider = consul.by_backend[each.value.backend]
+
+  name        = each.value.name
+  description = each.value.description != null ? each.value.description : "Auto-generated role for Vault role ${each.value.name}"
+
+  policies = [consul_acl_policy.policies[each.key].name]
+
+  dynamic "service_identities" {
+    for_each = each.value.service_identities != null ? each.value.service_identities : []
+    content {
+      service_name = service_identities.value.service_name
+      datacenters  = service_identities.value.datacenters
+    }
+  }
+
+  dynamic "node_identities" {
+    for_each = each.value.node_identities != null ? each.value.node_identities : []
+    content {
+      node_name  = node_identities.value.node_name
+      datacenter = node_identities.value.datacenter
+    }
+  }
+}
@@ -0,0 +1,9 @@
+output "consul_acl_policies" {
+  description = "Map of created Consul ACL policies"
+  value       = consul_acl_policy.policies
+}
+
+output "consul_acl_roles" {
+  description = "Map of created Consul ACL roles"
+  value       = consul_acl_role.roles
+}
@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+    consul = {
+      source  = "hashicorp/consul"
+      version = "2.23.0"
+    }
+  }
+}
@@ -0,0 +1,46 @@
+variable "consul_backends" {
+  description = "Map of consul secret backends"
+  type = map(object({
+    address         = string
+    scheme          = string
+    bootstrap       = bool
+    bootstrap_token = optional(string)
+    ca_cert         = optional(string)
+    client_cert     = optional(string)
+    client_key      = optional(string)
+  }))
+}
+
+variable "consul_roles" {
+  description = "Map of consul secret backend roles"
+  type = map(object({
+    name        = string
+    backend     = string
+    description = optional(string)
+    datacenters = optional(list(string))
+    service_identities = optional(list(object({
+      service_name = string
+      datacenters  = optional(list(string))
+    })))
+    node_identities = optional(list(object({
+      node_name  = string
+      datacenter = string
+    })))
+  }))
+}
+
+variable "consul_backend_aliases" {
+  description = "Map of consul backend names to sanitized provider aliases"
+  type        = map(string)
+  default     = {}
+}
+
+variable "country" {
+  description = "Country identifier"
+  type        = string
+}
+
+variable "region" {
+  description = "Region identifier"
+  type        = string
+}
@@ -0,0 +1,9 @@
+terraform {
+  required_version = ">= 1.10"
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.6.0"
+    }
+  }
+}
@@ -1,7 +1,8 @@
+# Create Vault Consul secret backend role
 resource "vault_consul_secret_backend_role" "role" {
  backend      = var.backend
  name         = var.name
-  consul_roles = var.consul_roles
+  consul_roles = [var.name] # Use the role name created by consul_acl_management module
  ttl          = var.ttl
  max_ttl      = var.max_ttl
  local        = var.local
--- a/Show More
+++ b/Show More