unkinben
95e7a81b2e
ci/woodpecker/push/apply Pipeline failed
## Why The `vault-plugin-secrets-litellm` engine (mints LiteLLM virtual keys) is registered in Vault, but nothing in this repo declared its mount, config, or roles. This wires in the companion `litellm` provider (`git.unkin.net/unkin/litellmvaultsecret`) so the mount is managed as code alongside the other secret backends. ## Changes - Add `litellm_secret_backend` module that mounts the engine and writes its config (`base_url`, `request_timeout_seconds`); reads the sensitive `master_key` from KV at `kv/service/vault/<country>/<region>/secret_backend/<path>`, matching the consul/kubernetes backend convention. - Add `litellm_secret_backend_role` module that manages roles (`models`, `max_budget`, `key_alias_prefix`, `ttl`/`max_ttl` in seconds, `metadata`). - Register both modules in `vault_cluster` `main.tf` and add typed variables in `variables.tf`. - Discover `litellm_secret_backend[_role]` YAML in `config.hcl` and pass the maps through the terragrunt inputs. - Declare the `litellm` provider (pinned `0.1.0`) and a `provider "litellm"` block in the generated root `backend.tf`. - Add example config for the `litellm` mount and a sample `team-a` role. ## Notes - Requires the `master_key` KV secret to exist at `kv/service/vault/au/syd1/secret_backend/litellm` before apply (the module reads it, does not create it). - Assumes provider `git.unkin.net/unkin/litellmvaultsecret` `0.1.0` is published to the artifactapi `terraform-unkin` registry. Reviewed-on: #83 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
38 lines
960 B
Terraform
38 lines
960 B
Terraform
variable "country" {
|
|
description = "Country identifier (used to locate the KV secret holding the master key)"
|
|
type = string
|
|
}
|
|
|
|
variable "region" {
|
|
description = "Region identifier (used to locate the KV secret holding the master key)"
|
|
type = string
|
|
}
|
|
|
|
variable "path" {
|
|
description = "Mount path of the LiteLLM secrets engine"
|
|
type = string
|
|
}
|
|
|
|
variable "plugin" {
|
|
description = "Registered plugin name/type to mount"
|
|
type = string
|
|
default = "vault-plugin-secrets-litellm"
|
|
}
|
|
|
|
variable "description" {
|
|
description = "Human-friendly description of the mount"
|
|
type = string
|
|
default = null
|
|
}
|
|
|
|
variable "base_url" {
|
|
description = "Base URL of the LiteLLM proxy (e.g. http://litellm.litellm.svc:4000)"
|
|
type = string
|
|
}
|
|
|
|
variable "request_timeout_seconds" {
|
|
description = "HTTP timeout in seconds for calls from the plugin to the LiteLLM proxy"
|
|
type = number
|
|
default = 30
|
|
}
|