Manage the litellm plugin via config/plugins (import existing registration) #90

2026-07-17T23:16:48+10:00

unkinben commented

2026-07-17 23:16:48 +10:00

Bring the litellm plugin under terraform management like the gpg one, using the new plugin-import module (#89).

Why

The litellm plugin was registered manually before terraform owned the catalog. If we just add it to config/plugins/, the first apply tries to create a catalog entry that already exists and fails. So its state must be imported first.

Changes

Add config/plugins/vault-plugin-secrets-litellm.yaml (sha256 = released v0.1.1 openbao binary from the RPM Puppet installs).

Manual pre-step (before apply)

Import the existing registration into state, and verify the sha matches the live catalog:

cd environments/au/syd1
# confirm the live sha first:
bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm
# import into state:
terragrunt import \
  'module.plugin["vault-plugin-secrets-litellm"].vault_plugin.this' \
  secret/vault-plugin-secrets-litellm

If the live sha differs from the yaml, update the yaml to match (or expect a benign re-register to the on-disk v0.1.1 sha). Needs the deployer's plugin-catalog access (#88, already merged).

Bring the litellm plugin under terraform management like the gpg one, using the new plugin-import module (#89). ## Why The litellm plugin was registered **manually** before terraform owned the catalog. If we just add it to `config/plugins/`, the first apply tries to *create* a catalog entry that already exists and fails. So its state must be imported first. ## Changes - Add `config/plugins/vault-plugin-secrets-litellm.yaml` (`sha256` = released **v0.1.1** openbao binary from the RPM Puppet installs). ## Manual pre-step (before apply) Import the existing registration into state, and verify the sha matches the live catalog: ```sh cd environments/au/syd1 # confirm the live sha first: bao read sys/plugins/catalog/secret/vault-plugin-secrets-litellm # import into state: terragrunt import \ 'module.plugin["vault-plugin-secrets-litellm"].vault_plugin.this' \ secret/vault-plugin-secrets-litellm ``` If the live sha differs from the yaml, update the yaml to match (or expect a benign re-register to the on-disk v0.1.1 sha). Needs the deployer's plugin-catalog access (#88, already merged).

unkinben added 1 commit 2026-07-17 23:16:49 +10:00

Manage the litellm plugin via config/plugins (import existing registration)

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/plan Pipeline was successful

Details

f7c738fbc2

Bring the litellm plugin under terraform management like the gpg one. It was
registered manually before terraform owned the catalog, so its state must be
imported before applying, otherwise apply fails creating an entry that already
exists.

- Add config/plugins/vault-plugin-secrets-litellm.yaml (sha256 = released v0.1.1
  openbao binary; verify against the live catalog on import).

Manual pre-step before apply:
  cd environments/au/syd1
  terragrunt import \
    'module.plugin["vault-plugin-secrets-litellm"].vault_plugin.this' \
    secret/vault-plugin-secrets-litellm

unkinben referenced this pull request

2026-07-17 23:38:14 +10:00

Register the rancher plugin in the catalog (import) #92

ci/woodpecker/pr/pre-commit Pipeline was successful

Required

Details

ci/woodpecker/pr/plan Pipeline was successful

Required

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin benvin/import-litellm-plugin:benvin/import-litellm-plugin

git checkout benvin/import-litellm-plugin

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/terraform-vault#90