unkinben
95e7a81b2e
ci/woodpecker/push/apply Pipeline failed
## Why The `vault-plugin-secrets-litellm` engine (mints LiteLLM virtual keys) is registered in Vault, but nothing in this repo declared its mount, config, or roles. This wires in the companion `litellm` provider (`git.unkin.net/unkin/litellmvaultsecret`) so the mount is managed as code alongside the other secret backends. ## Changes - Add `litellm_secret_backend` module that mounts the engine and writes its config (`base_url`, `request_timeout_seconds`); reads the sensitive `master_key` from KV at `kv/service/vault/<country>/<region>/secret_backend/<path>`, matching the consul/kubernetes backend convention. - Add `litellm_secret_backend_role` module that manages roles (`models`, `max_budget`, `key_alias_prefix`, `ttl`/`max_ttl` in seconds, `metadata`). - Register both modules in `vault_cluster` `main.tf` and add typed variables in `variables.tf`. - Discover `litellm_secret_backend[_role]` YAML in `config.hcl` and pass the maps through the terragrunt inputs. - Declare the `litellm` provider (pinned `0.1.0`) and a `provider "litellm"` block in the generated root `backend.tf`. - Add example config for the `litellm` mount and a sample `team-a` role. ## Notes - Requires the `master_key` KV secret to exist at `kv/service/vault/au/syd1/secret_backend/litellm` before apply (the module reads it, does not create it). - Assumes provider `git.unkin.net/unkin/litellmvaultsecret` `0.1.0` is published to the artifactapi `terraform-unkin` registry. Reviewed-on: #83 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
11 lines
175 B
YAML
11 lines
175 B
YAML
---
|
|
models:
|
|
- claude-haiku-4-5
|
|
- claude-sonnet-4-6
|
|
max_budget: 50
|
|
ttl: 3600 # seconds (1h)
|
|
max_ttl: 86400 # seconds (24h)
|
|
metadata:
|
|
team: mailfiltering
|
|
env: prod
|