rblundonandClaude Sonnet 5.5
ebe4681438
- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1), values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services for fantasmic/wishes, namespace - gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate, ReferenceGrant for litellm namespace - cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones - external-dns: add wdw-labs.cloud zone (Technitium RFC2136) - onepassword-connect: add wdw-labs vault to ClusterSecretStore Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3
83 lines
2.9 KiB
YAML
83 lines
2.9 KiB
YAML
# ExternalSecrets - LiteLLM
|
|
# Store: onepassword-connect ClusterSecretStore (vaults: mk-labs, wdw-labs)
|
|
#
|
|
# 1Password, vault wdw-labs:
|
|
# Item "litellm" (CONCEALED fields):
|
|
# master-key LiteLLM admin/master key (must start with "sk-")
|
|
# salt-key LITELLM_SALT_KEY — encrypts stored provider creds. NEVER ROTATE.
|
|
# db-password Postgres password for user "litellm" (use alphanumerics,
|
|
# e.g. `openssl rand -hex 24`; it is embedded in a URL)
|
|
# db-admin-password Postgres "postgres" superuser password
|
|
# Items "illuminations", "fantasmic", "wishes" — field "api-key"
|
|
#
|
|
# Wave -1: secrets exist before the Deployment / migration job / Postgres.
|
|
---
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: litellm-credentials
|
|
namespace: litellm
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: litellm-credentials
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
# Chart masterkeySecretName/Key
|
|
master-key: "{{ .MASTER_KEY }}"
|
|
# Chart db.secret + bundled Postgres existingSecret
|
|
username: litellm
|
|
password: "{{ .DB_PASSWORD }}"
|
|
postgres-password: "{{ .DB_ADMIN_PASSWORD }}"
|
|
data:
|
|
- secretKey: MASTER_KEY
|
|
remoteRef: { key: litellm, property: master-key }
|
|
- secretKey: DB_PASSWORD
|
|
remoteRef: { key: litellm, property: db-password }
|
|
- secretKey: DB_ADMIN_PASSWORD
|
|
remoteRef: { key: litellm, property: db-admin-password }
|
|
---
|
|
# Exported wholesale as env vars via chart `environmentSecrets`
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: litellm-env
|
|
namespace: litellm
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-1"
|
|
spec:
|
|
refreshInterval: "1h"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: onepassword-connect
|
|
target:
|
|
name: litellm-env
|
|
creationPolicy: Owner
|
|
template:
|
|
engineVersion: v2
|
|
data:
|
|
LITELLM_SALT_KEY: "{{ .SALT_KEY }}"
|
|
# Full URL for the proxy Deployment (see values.yaml environmentSecrets note)
|
|
DATABASE_URL: "postgresql://litellm:{{ .DB_PASSWORD | urlquery }}@litellm-postgresql:5432/litellm"
|
|
ILLUMINATIONS_API_KEY: "{{ .ILLUMINATIONS_API_KEY }}"
|
|
FANTASMIC_API_KEY: "{{ .FANTASMIC_API_KEY }}"
|
|
WISHES_API_KEY: "{{ .WISHES_API_KEY }}"
|
|
data:
|
|
- secretKey: DB_PASSWORD
|
|
remoteRef: { key: litellm, property: db-password }
|
|
- secretKey: SALT_KEY
|
|
remoteRef: { key: litellm, property: salt-key }
|
|
- secretKey: ILLUMINATIONS_API_KEY
|
|
remoteRef: { key: illuminations, property: api-key }
|
|
- secretKey: FANTASMIC_API_KEY
|
|
remoteRef: { key: fantasmic, property: api-key }
|
|
- secretKey: WISHES_API_KEY
|
|
remoteRef: { key: wishes, property: api-key }
|