unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret #83

Merged
benvin merged 1 commits from benvin/litellm-secrets-engine into master 2026-07-07 00:18:29 +10:00
Conversation 0 Commits 1 Files Changed 13
+226
unkinben commented 2026-07-07 00:00:58 +10:00
Owner
Copy Link
Copy Source

Why

The vault-plugin-secrets-litellm engine (mints LiteLLM virtual keys) is registered in Vault, but nothing in this repo declared its mount, config, or roles. This wires in the companion litellm provider (git.unkin.net/unkin/litellmvaultsecret) so the mount is managed as code alongside the other secret backends.

Changes

  • Add litellm_secret_backend module that mounts the engine and writes its config (base_url, request_timeout_seconds); reads the sensitive master_key from KV at kv/service/vault/<country>/<region>/secret_backend/<path>, matching the consul/kubernetes backend convention.
  • Add litellm_secret_backend_role module that manages roles (models, max_budget, key_alias_prefix, ttl/max_ttl in seconds, metadata).
  • Register both modules in vault_cluster main.tf and add typed variables in variables.tf.
  • Discover litellm_secret_backend[_role] YAML in config.hcl and pass the maps through the terragrunt inputs.
  • Declare the litellm provider (pinned 0.1.0) and a provider "litellm" block in the generated root backend.tf.
  • Add example config for the litellm mount and a sample team-a role.

Notes

  • Requires the master_key KV secret to exist at kv/service/vault/au/syd1/secret_backend/litellm before apply (the module reads it, does not create it).
  • Assumes provider git.unkin.net/unkin/litellmvaultsecret 0.1.0 is published to the artifactapi terraform-unkin registry.
## Why The `vault-plugin-secrets-litellm` engine (mints LiteLLM virtual keys) is registered in Vault, but nothing in this repo declared its mount, config, or roles. This wires in the companion `litellm` provider (`git.unkin.net/unkin/litellmvaultsecret`) so the mount is managed as code alongside the other secret backends. ## Changes - Add `litellm_secret_backend` module that mounts the engine and writes its config (`base_url`, `request_timeout_seconds`); reads the sensitive `master_key` from KV at `kv/service/vault/<country>/<region>/secret_backend/<path>`, matching the consul/kubernetes backend convention. - Add `litellm_secret_backend_role` module that manages roles (`models`, `max_budget`, `key_alias_prefix`, `ttl`/`max_ttl` in seconds, `metadata`). - Register both modules in `vault_cluster` `main.tf` and add typed variables in `variables.tf`. - Discover `litellm_secret_backend[_role]` YAML in `config.hcl` and pass the maps through the terragrunt inputs. - Declare the `litellm` provider (pinned `0.1.0`) and a `provider "litellm"` block in the generated root `backend.tf`. - Add example config for the `litellm` mount and a sample `team-a` role. ## Notes - Requires the `master_key` KV secret to exist at `kv/service/vault/au/syd1/secret_backend/litellm` before apply (the module reads it, does not create it). - Assumes provider `git.unkin.net/unkin/litellmvaultsecret` `0.1.0` is published to the artifactapi `terraform-unkin` registry.
unkinben force-pushed benvin/litellm-secrets-engine from bf2c553716 to 2f0123eff8 2026-07-07 00:04:25 +10:00 Compare
unkinben added 1 commit 2026-07-07 00:15:30 +10:00
feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
9e2c21131f 
The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is
now registered in Vault, but nothing declared its mount/config or roles in
this repo. Wire in the companion litellm provider so the mount is managed
as code alongside the other secret backends.

- Add litellm_secret_backend module: mounts the engine and writes its
  config (base_url, request_timeout_seconds); reads master_key from KV
- Add litellm_secret_backend_role module: manages roles (models,
  max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata)
- Register both modules in vault_cluster main.tf and variables.tf
- Discover litellm_secret_backend[_role] YAML in config.hcl and pass them
  through terragrunt inputs
- Declare the litellm provider (litellmvaultsecret) and
  a provider block in the generated root backend.tf
- Add example config for the litellm mount and a sample role
unkinben force-pushed benvin/litellm-secrets-engine from 1c56ce5d98 to 9e2c21131f 2026-07-07 00:15:30 +10:00 Compare
benvin merged commit 95e7a81b2e into master 2026-07-07 00:18:29 +10:00
benvin deleted branch benvin/litellm-secrets-engine 2026-07-07 00:18:30 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#83
Delete Branch "benvin/litellm-secrets-engine"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?