Add LiteLLM dynamic secrets engine implementation

Populate the repo with the Vault/OpenBao dynamic secrets engine that mints
LiteLLM virtual keys scoped by model, spending limit, and lease TTL.

- Secrets backend: config, roles, creds paths and a revocable litellm_key type
- LiteLLM API client (generate/update/delete/info) with master-key auth
- Unit tests (mock LiteLLM) and a docker-compose e2e against both Vault and
  OpenBao proving the same binary works on each
- Makefile, woodpecker CI (build/test/pre-commit), pre-commit config

secret_keys.go

@@ -0,0 +1,101 @@
+package litellm
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/hashicorp/vault/sdk/framework"
+	"github.com/hashicorp/vault/sdk/logical"
+)
+
+// litellmKeyType is the identifier for the dynamic secret produced by this
+// backend.
+const litellmKeyType = "litellm_key"
+
+func (b *litellmBackend) litellmKey() *framework.Secret {
+	return &framework.Secret{
+		Type: litellmKeyType,
+		Fields: map[string]*framework.FieldSchema{
+			"key": {
+				Type:        framework.TypeString,
+				Description: "The LiteLLM virtual key.",
+			},
+			"key_alias": {
+				Type:        framework.TypeString,
+				Description: "The alias assigned to the virtual key.",
+			},
+		},
+		Revoke: b.keyRevoke,
+		Renew:  b.keyRenew,
+	}
+}
+
+// keyRevoke deletes the virtual key from the LiteLLM proxy when the lease is
+// revoked.
+func (b *litellmBackend) keyRevoke(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	rawKey, ok := req.Secret.InternalData["key"]
+	if !ok {
+		return nil, errors.New("secret is missing internal key data")
+	}
+	key, ok := rawKey.(string)
+	if !ok {
+		return nil, errors.New("secret internal key data is not a string")
+	}
+
+	client, err := b.getClient(ctx, req.Storage)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := client.DeleteKey(ctx, key); err != nil {
+		return nil, fmt.Errorf("revoking litellm key: %w", err)
+	}
+	return nil, nil
+}
+
+// keyRenew extends the lease and, when a TTL is set, pushes the new expiry to
+// LiteLLM so the virtual key and the Vault lease stay in sync.
+func (b *litellmBackend) keyRenew(ctx context.Context, req *logical.Request, _ *framework.FieldData) (*logical.Response, error) {
+	rawRole, ok := req.Secret.InternalData["role"]
+	if !ok {
+		return nil, errors.New("secret is missing internal role data")
+	}
+	roleName, ok := rawRole.(string)
+	if !ok {
+		return nil, errors.New("secret internal role data is not a string")
+	}
+
+	role, err := b.getRole(ctx, req.Storage, roleName)
+	if err != nil {
+		return nil, err
+	}
+	if role == nil {
+		return nil, fmt.Errorf("role %q no longer exists; cannot renew", roleName)
+	}
+
+	resp := &logical.Response{Secret: req.Secret}
+	if role.TTL > 0 {
+		resp.Secret.TTL = role.TTL
+	}
+	if role.MaxTTL > 0 {
+		resp.Secret.MaxTTL = role.MaxTTL
+	}
+
+	// Best-effort: extend the key's own expiry in LiteLLM to match the renewed
+	// lease. A failure here should not fail the renew, since the authoritative
+	// lifetime is the Vault lease.
+	if role.TTL > 0 {
+		if rawKey, ok := req.Secret.InternalData["key"].(string); ok {
+			client, err := b.getClient(ctx, req.Storage)
+			if err == nil {
+				_ = client.UpdateKey(ctx, updateKeyRequest{
+					Key:      rawKey,
+					Duration: durationToLiteLLM(role.TTL),
+				})
+			}
+		}
+	}
+
+	return resp, nil
+}