litellm/helm/litellm
mateo-berri 5c213127e8 feat(proxy): authenticate to Azure Postgres with Microsoft Entra ID tokens
Azure Database for PostgreSQL Flexible Server takes a Microsoft Entra ID access
token as the connection password, and those tokens last about an hour, so a
proxy pointed at one dies shortly after boot unless something keeps minting
fresh ones

Set AZURE_POSTGRESQL_AUTH=True (or pass --azure_postgresql_auth) alongside
DATABASE_HOST, DATABASE_USER, and DATABASE_NAME, and the proxy mints a token at
startup, assembles the connection URL around it, and refreshes it in the
background for as long as the process runs. That is the same shape
IAM_TOKEN_DB_AUTH already had for AWS RDS, so the two now share one code path:
a tagged union picks the minting strategy once, and the wrapper, the read
replica, and the refresh loop all read the choice off it instead of each
guessing from the environment. Setting both toggles is a startup error, in the
chart as well as in Python

The helm chart gets database.writer.useAzureEntraAuth and the matching reader
knob next to the existing useIAMAuth

Fixes #29661

Co-authored-by: David Balatoni <balcsida@gmail.com>
2026-08-20 11:50:16 -07:00
..
templates feat(proxy): authenticate to Azure Postgres with Microsoft Entra ID tokens 2026-08-20 11:50:16 -07:00
tests feat(proxy): authenticate to Azure Postgres with Microsoft Entra ID tokens 2026-08-20 11:50:16 -07:00
Chart.yaml feat: add componentized proxy deployment with gateway, backend, ui, and migrations (#27557) 2026-05-16 09:25:17 -07:00
values.yaml feat(proxy): authenticate to Azure Postgres with Microsoft Entra ID tokens 2026-08-20 11:50:16 -07:00