From 5933294f10f63f70fe2bccdaacfcf98ef5830442 Mon Sep 17 00:00:00 2001 From: Yassin Kortam Date: Thu, 9 Jul 2026 21:10:33 +0300 Subject: [PATCH] docs(terraform): record why the billing guard sits on the gateway resource The precondition cannot live on the cert secret, which is count-gated on the cert itself and so has zero instances in exactly the case the guard must catch. That makes the guard's correctness depend on this resource staying unconditional, which nothing else records and no test enforces --- terraform/litellm/aws/ecs.tf | 5 +++++ terraform/litellm/gcp/cloudrun.tf | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/terraform/litellm/aws/ecs.tf b/terraform/litellm/aws/ecs.tf index e6848421779..0fe5fe3762a 100644 --- a/terraform/litellm/aws/ecs.tf +++ b/terraform/litellm/aws/ecs.tf @@ -213,6 +213,11 @@ resource "aws_ecs_task_definition" "gateway" { # never exporting. ca_cert_pem stays optional: empty means fall back to the # system trust store. # + # The guard lives here, on an unconditional resource, rather than on the cert + # secret: that secret is count-gated on the cert itself, so it has zero + # instances in exactly the case this must catch. Adding count or for_each to + # this resource would silently stop the guard from evaluating. + # # endpoint cert key -> result # "" any any -> metering off, no secrets created # set set set -> metering on diff --git a/terraform/litellm/gcp/cloudrun.tf b/terraform/litellm/gcp/cloudrun.tf index 5b47f1e08f4..fa66d71f077 100644 --- a/terraform/litellm/gcp/cloudrun.tf +++ b/terraform/litellm/gcp/cloudrun.tf @@ -171,6 +171,11 @@ resource "google_cloud_run_v2_service" "gateway" { # never exporting. ca_cert_pem stays optional: empty means fall back to the # system trust store. # + # The guard lives here, on an unconditional resource, rather than on the cert + # secret: that secret is count-gated on the cert itself, so it has zero + # instances in exactly the case this must catch. Adding count or for_each to + # this resource would silently stop the guard from evaluating. + # # endpoint cert key -> result # "" any any -> metering off, no secrets created # set set set -> metering on