mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-11 22:51:28 +00:00
b0041f32a2
The generated masterkey Secret rendered a fresh randAlphaNum value on every release, so any helm upgrade with masterkeySecretName and masterkey unset rotated the master key and invalidated every client holding the old one. Look up the existing Secret in the release namespace and reuse its value, falling back to a random key only on first install. Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
suite: test masterkey secret
|
|
templates:
|
|
- secret-masterkey.yaml
|
|
tests:
|
|
- it: should create a secret if masterkeySecretName is not set. should start with sk-xxxx (base64 encoded as c2st*)
|
|
template: secret-masterkey.yaml
|
|
set:
|
|
masterkeySecretName: ""
|
|
asserts:
|
|
- isKind:
|
|
of: Secret
|
|
- matchRegex:
|
|
path: data.masterkey
|
|
pattern: ^c2st
|
|
# Note: The masterkey is generated as "sk-<18-random-chars>" in plain text,
|
|
# but stored as base64 encoded in Kubernetes secret (requirement).
|
|
# "sk-" base64 encodes to "c2st", so we check for "^c2st" pattern.
|
|
- it: should reuse the master key already stored in the cluster instead of generating a new one on upgrade
|
|
template: secret-masterkey.yaml
|
|
set:
|
|
masterkeySecretName: ""
|
|
kubernetesProvider:
|
|
scheme:
|
|
"v1/Secret":
|
|
gvr:
|
|
version: "v1"
|
|
resource: "secrets"
|
|
namespaced: true
|
|
objects:
|
|
- kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: RELEASE-NAME-litellm-masterkey
|
|
namespace: NAMESPACE
|
|
data:
|
|
masterkey: c2stZXhpc3Rpbmcta2V5
|
|
asserts:
|
|
- equal:
|
|
path: data.masterkey
|
|
value: c2stZXhpc3Rpbmcta2V5
|
|
- it: should let an explicit masterkey value override the one already stored in the cluster
|
|
template: secret-masterkey.yaml
|
|
set:
|
|
masterkeySecretName: ""
|
|
masterkey: sk-explicit
|
|
kubernetesProvider:
|
|
scheme:
|
|
"v1/Secret":
|
|
gvr:
|
|
version: "v1"
|
|
resource: "secrets"
|
|
namespaced: true
|
|
objects:
|
|
- kind: Secret
|
|
apiVersion: v1
|
|
metadata:
|
|
name: RELEASE-NAME-litellm-masterkey
|
|
namespace: NAMESPACE
|
|
data:
|
|
masterkey: c2stZXhpc3Rpbmcta2V5
|
|
asserts:
|
|
- equal:
|
|
path: data.masterkey
|
|
value: c2stZXhwbGljaXQ=
|
|
- it: should not create a secret if masterkeySecretName is set
|
|
template: secret-masterkey.yaml
|
|
set:
|
|
masterkeySecretName: my-secret
|
|
asserts:
|
|
- hasDocuments:
|
|
count: 0
|