config/auth_kubernetes_role/k8s/au/syd1/rspamd.yaml

@@ -0,0 +1,10 @@
+---
+# Kubernetes auth role for rspamd: the rspamd service account in the mail
+# namespace, used by VaultDynamicSecret to read litellm/creds/rspamd.
+bound_service_account_names:
+  - rspamd
+bound_service_account_namespaces:
+  - mail
+token_ttl: 600
+token_max_ttl: 600
+audience: vault

config/litellm_secret_backend_role/litellm/rspamd.yaml

@@ -1,7 +1,6 @@
 ---
 models:
   - claude-haiku-4-5
-  - claude-sonnet-4-6
 max_budget: 50
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)

policies/litellm/creds/rspamd.yaml

@@ -0,0 +1,10 @@
+# Lets rspamd mint a Haiku-scoped LiteLLM virtual key for its GPT/LLM module.
+---
+rules:
+  - path: "litellm/creds/rspamd"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - rspamd