Merge e59338afa6 into 0eb6816081

helm/litellm-helm/README.md

@@ -53,6 +53,10 @@ If `db.useStackgresOperator` is used (not yet implemented):
 | `pdb.maxUnavailable`        | Maximum number/percentage of pods that can be unavailable during **voluntary** disruptions (choose **one** of minAvailable/maxUnavailable)                                                                                                    | `null`                    |
 | `pdb.annotations`           | Extra metadata annotations to add to the PDB                                                                                                                                                                                                  | `{}`                      |
 | `pdb.labels`                | Extra metadata labels to add to the PDB                                                                                                                                                                                                       | `{}`                      |
+| `serviceMonitor.enabled`    | Create a Prometheus Operator ServiceMonitor                                                                                                                                                                                                   | `false`                   |
+| `serviceMonitor.authSecret.enabled` | Configure bearer authorization for metrics scraping from an existing Kubernetes Secret                                                                                                                                              | `false`                   |
+| `serviceMonitor.authSecret.name` | Name of the existing Secret containing a valid LiteLLM key                                                                                                                                                                                | `""`                      |
+| `serviceMonitor.authSecret.key` | Key within the existing Secret that contains the LiteLLM key                                                                                                                                                                             | `""`                      |
 
 | `billingMetrics.enabled`    | Enable enterprise billable-request metering. Requires an enterprise license.                                                                                                                                                                  | `false`                   |
 | `billingMetrics.endpoint`   | Collector that the billable-request counter is pushed to.                                                                                                                                                                                    | `https://telemetry.litellm.ai` |
@@ -107,6 +111,42 @@ data:
 type: Opaque
 ```
 
+#### Authenticated Prometheus scraping
+
+The proxy's `/metrics/` endpoint requires authentication by default when proxy authentication is configured. This option is for `metricsServer.enabled: false`, the default. The separate metrics server does not use virtual-key authentication
+
+As a proxy administrator, create a dedicated internal user and a key restricted to the metrics routes. Set `LITELLM_URL` to your proxy URL and `LITELLM_MASTER_KEY` to its administrator credential, then run:
+
+```bash
+curl --fail --silent --show-error "$LITELLM_URL/user/new" \
+  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"user_id":"prometheus-metrics","user_role":"internal_user","auto_create_key":false}'
+
+METRICS_KEY="$(curl --fail --silent --show-error "$LITELLM_URL/key/generate" \
+  -H "Authorization: Bearer $LITELLM_MASTER_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"user_id":"prometheus-metrics","key_alias":"prometheus","allowed_routes":["/metrics","/metrics/"]}' \
+  | jq --exit-status --raw-output .key)"
+
+printf '%s' "$METRICS_KEY" | kubectl --namespace YOUR_RELEASE_NAMESPACE \
+  create secret generic litellm-prometheus-key --from-file=token=/dev/stdin
+unset METRICS_KEY
+```
+
+The Secret must be in the ServiceMonitor namespace and contain the raw key, without a `Bearer ` prefix. The Prometheus Operator must have permission to read it. Reference that Secret in the chart:
+
+```
+serviceMonitor:
+  enabled: true
+  authSecret:
+    enabled: true
+    name: litellm-prometheus-key
+    key: token
+```
+
+The chart does not generate or rotate the LiteLLM key. Keep the key valid and update the Secret when rotating it. If unauthenticated metrics are acceptable for your deployment, leave `authSecret.enabled` set to `false` and set `litellm_settings.require_auth_for_metrics_endpoint: false` in `proxy_config`
+
 #### Enterprise billable-request metering
 
 Enterprise licenses meter billable requests by pushing a counter to LiteLLM's collector with Cognito bearer authentication. Create a Secret with `client-id` and `client-secret` keys, then enable the chart values:

helm/litellm-helm/templates/servicemonitor.yaml

@@ -31,6 +31,12 @@ spec:
     interval: {{ .interval }}
     scrapeTimeout: {{ .scrapeTimeout }}
     scheme: http
+    {{- if .authSecret.enabled }}
+    authorization:
+      credentials:
+        name: {{ required "serviceMonitor.authSecret.name is required when serviceMonitor.authSecret.enabled is true" .authSecret.name | quote }}
+        key: {{ required "serviceMonitor.authSecret.key is required when serviceMonitor.authSecret.enabled is true" .authSecret.key | quote }}
+    {{- end }}
   {{- if .relabelings }}
     relabelings:
 {{- toYaml .relabelings | nindent 4 }}

helm/litellm-helm/tests/servicemonitor_tests.yaml

@@ -0,0 +1,51 @@
+suite: ServiceMonitor Configuration Tests
+templates:
+  - servicemonitor.yaml
+tests:
+  - it: should not create a ServiceMonitor by default
+    asserts:
+      - hasDocuments:
+          count: 0
+
+  - it: should create a ServiceMonitor without authorization when no secret is enabled
+    set:
+      serviceMonitor.enabled: true
+    asserts:
+      - isKind:
+          of: ServiceMonitor
+      - isNull:
+          path: spec.endpoints[0].authorization
+
+  - it: should configure bearer authorization from an existing secret
+    set:
+      serviceMonitor.enabled: true
+      serviceMonitor.authSecret.enabled: true
+      serviceMonitor.authSecret.name: prometheus-litellm-key
+      serviceMonitor.authSecret.key: token
+    asserts:
+      - equal:
+          path: spec.endpoints[0].authorization
+          value:
+            credentials:
+              name: prometheus-litellm-key
+              key: token
+      - isNull:
+          path: spec.endpoints[0].bearerTokenSecret
+
+  - it: should reject an enabled authorization secret without a name
+    set:
+      serviceMonitor.enabled: true
+      serviceMonitor.authSecret.enabled: true
+      serviceMonitor.authSecret.key: token
+    asserts:
+      - failedTemplate:
+          errorMessage: serviceMonitor.authSecret.name is required when serviceMonitor.authSecret.enabled is true
+
+  - it: should reject an enabled authorization secret without a key
+    set:
+      serviceMonitor.enabled: true
+      serviceMonitor.authSecret.enabled: true
+      serviceMonitor.authSecret.name: prometheus-litellm-key
+    asserts:
+      - failedTemplate:
+          errorMessage: serviceMonitor.authSecret.key is required when serviceMonitor.authSecret.enabled is true

helm/litellm-helm/values.yaml

@@ -653,6 +653,10 @@ serviceMonitor:
     # kubernetes.io/test: test
   interval: 15s
   scrapeTimeout: 10s
+  authSecret:
+    enabled: false
+    name: ""
+    key: ""
   relabelings: []
   # - targetLabel: __meta_kubernetes_pod_node_name
   #   replacement: $1

vscode-extension/package.json

@@ -76,6 +76,11 @@
   "dependencies": {
     "openai": "^7.18.0"
   },
+  "overrides": {
+    "@azure/identity": {
+      "@azure/msal-node": "7.1.0"
+    }
+  },
   "devDependencies": {
     "@types/node": "^22.20.3",
     "@types/vscode": "1.115.0",