Only persist Hashicorp Vault config to DB after successful init, roll back env vars on failure

litellm/proxy/management_endpoints/config_override_endpoints.py

@@ -183,10 +183,27 @@ async def update_hashicorp_vault_config(
             },
         )
 
-    # Encrypt sensitive fields before storing in DB
-    encrypted_data = _encrypt_sensitive_fields(config_data, HASHICORP_SENSITIVE_FIELDS)
+    # Set env vars and verify the secret manager can initialize before persisting
+    _set_env_vars(config_data)
 
-    # Upsert to DB first — only mutate env vars after DB write succeeds
+    try:
+        proxy_config.initialize_secret_manager(
+            key_management_system="hashicorp_vault"
+        )
+    except Exception as e:
+        _set_env_vars({})
+        verbose_proxy_logger.exception(
+            "Error reinitializing Hashicorp Vault secret manager: %s", str(e)
+        )
+        raise HTTPException(
+            status_code=500,
+            detail={
+                "error": f"Failed to initialize secret manager: {str(e)}"
+            },
+        )
+
+    # Only persist to DB after successful init
+    encrypted_data = _encrypt_sensitive_fields(config_data, HASHICORP_SENSITIVE_FIELDS)
     await prisma_client.db.litellm_configoverrides.upsert(
         where={"config_type": "hashicorp_vault"},
         data={
@@ -200,25 +217,6 @@ async def update_hashicorp_vault_config(
         },
     )
 
-    # Set environment variables after DB write succeeds
-    _set_env_vars(config_data)
-
-    # Reinitialize the secret manager on this pod
-    try:
-        proxy_config.initialize_secret_manager(
-            key_management_system="hashicorp_vault"
-        )
-    except Exception as e:
-        verbose_proxy_logger.exception(
-            "Error reinitializing Hashicorp Vault secret manager: %s", str(e)
-        )
-        raise HTTPException(
-            status_code=500,
-            detail={
-                "error": f"Config saved but failed to initialize secret manager: {str(e)}"
-            },
-        )
-
     return {
         "message": "Hashicorp Vault configuration updated successfully",
         "status": "success",

litellm/proxy/proxy_server.py

@@ -4581,9 +4581,14 @@ class ProxyConfig:
             _set_env_vars(decrypted_data)
 
             # Reinitialize the secret manager
-            self.initialize_secret_manager(
-                key_management_system="hashicorp_vault"
-            )
+            try:
+                self.initialize_secret_manager(
+                    key_management_system="hashicorp_vault"
+                )
+            except Exception:
+                # Roll back env vars so the broken config doesn't affect secret lookups
+                _set_env_vars({})
+                raise
 
             verbose_proxy_logger.debug(
                 "Hashicorp Vault config override loaded from DB"