scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-07 08:26:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 36

Merge 184d1c9662 into 78ff5ac9cd

Browse source
This commit is contained in:
programmerWsy 2026-09-03 09:47:11 +08:00 • committed by GitHub
commit 37283b180a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 41 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
terraform/litellm/gcp/README.md
View file

@ -315,6 +315,25 @@ The `migration_run_command` output is preserved for break-glass manual re-runs.
required APIs must be enabled (run, sqladmin, redis, secretmanager,
vpcaccess, compute, servicenetworking, storage, artifactregistry).
If the organization enforces
`constraints/compute.managed.requireOsConfig`, existing projects also
need VM Manager (OS Config) enabled in project metadata before apply.
The Serverless VPC Access connector creates GCE VMs; without this
metadata the connector operation fails, Terraform's error is vague,
and Cloud operation logs report an org-policy violation. New projects
created after the constraint is already on are usually fine. Existing
projects are not. Set it once per project:
```bash
gcloud compute project-info add-metadata \
--project PROJECT_ID \
--metadata=enable-osconfig=TRUE
```
Do not manage this from the module: project-wide metadata is often
owned by another Terraform root. Google's setup notes:
https://docs.cloud.google.com/compute/vm-manager/docs/setup#set_metadata_values
## TLS
`terraform plan` refuses to provision an HTTP-only LB by default — TLS

17
terraform/litellm/gcp/examples/default/TUTORIAL.md
View file

@ -29,6 +29,23 @@ gcloud services enable \
artifactregistry.googleapis.com
```
## Enable VM Manager (OS Config) on existing projects
Skip this on a brand-new project created after
`constraints/compute.managed.requireOsConfig` is already enforced.
Existing projects that later get that org policy need this metadata, or
`terraform apply` fails while creating the Serverless VPC Access
connector and Terraform's error is vague. Cloud operation logs then
report an OS Config org-policy violation.
```bash
gcloud compute project-info add-metadata \
--project <your-project-id> \
--metadata=enable-osconfig=TRUE
```
See https://docs.cloud.google.com/compute/vm-manager/docs/setup#set_metadata_values
## Create the Artifact Registry passthrough to GHCR
Cloud Run only pulls from Artifact Registry, `gcr.io`, or `docker.io`; it rejects `ghcr.io` URIs at apply time. The four LiteLLM images live on GHCR, so the stack needs a remote Artifact Registry repo pointed at GHCR. This is a one-time setup per project.

5
terraform/litellm/gcp/network.tf
View file

@ -36,6 +36,11 @@ resource "google_service_networking_connection" "psa" {
# machine_type alone). Defaults: 2 e2-micro instances scale up to 3 — fine
# for low-to-moderate Cloud Run egress; bump max if your services push
# heavy private-network traffic.
#
# If constraints/compute.managed.requireOsConfig is enforced, existing
# projects need enable-osconfig=TRUE in project metadata before this
# connector can be created. The module does not set that metadata
# (it is often owned by another root). See README.md Quick start.
resource "google_vpc_access_connector" "this" {
name = "${local.name}-conn"
region = var.region