mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-17 23:51:30 +00:00
b5bf09d22d
* fix(db): carry DATABASE_SSLMODE/DATABASE_SSLROOTCERT into the assembled writer and reader URLs The componentized gateway supervisor starts the in-container PgBouncer from the DATABASE_URL assembled out of the discrete DATABASE_* vars before config.yaml is read, so an IAM URL had no way to request verified TLS: PgBouncer dialed the server with server_tls_sslmode = prefer (no SNI, no verification) and public RDS endpoints rejected the handshake. Two new env vars, exposed by the chart as database.writer.sslMode / sslRootCert, are appended as libpq sslmode/sslrootcert to every writer and reader URL the settings assemble (never to a pinned URL), then translated for Prisma as before. Token refresh now also carries Prisma's sslmode/sslcert/sslaccept over into the re-minted URL Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): keep TLS params on the CLI password URL and the initial IAM reader mint Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(db): treat DATABASE_SSLROOTCERT on its own as verify-full and cover collector and migrations TLS env Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * test(db): type the reader mint TLS test double and drop its mutable capture Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --------- Co-authored-by: yassin <yassin@berri.ai> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
193 lines
6.2 KiB
YAML
193 lines
6.2 KiB
YAML
suite: test database token auth env vars
|
|
templates:
|
|
- gateway/deployment.yaml
|
|
- gateway/configmap.yaml
|
|
- backend/deployment.yaml
|
|
- backend/configmap.yaml
|
|
- migrations-job.yaml
|
|
values:
|
|
- ./values/required.yaml
|
|
tests:
|
|
- it: writer emits DATABASE_PASSWORD and no token toggle by default
|
|
template: gateway/deployment.yaml
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: litellm-writer-secret
|
|
key: password
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: IAM_TOKEN_DB_AUTH
|
|
value: "true"
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: AZURE_POSTGRESQL_AUTH
|
|
value: "true"
|
|
any: true
|
|
|
|
- it: writer emits AZURE_POSTGRESQL_AUTH and omits DATABASE_PASSWORD under Entra auth
|
|
template: gateway/deployment.yaml
|
|
set:
|
|
database.writer.useAzureEntraAuth: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: AZURE_POSTGRESQL_AUTH
|
|
value: "true"
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PASSWORD
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: IAM_TOKEN_DB_AUTH
|
|
value: "true"
|
|
any: true
|
|
|
|
- it: backend gets the same Entra toggle as the gateway
|
|
template: backend/deployment.yaml
|
|
set:
|
|
database.writer.useAzureEntraAuth: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: AZURE_POSTGRESQL_AUTH
|
|
value: "true"
|
|
any: true
|
|
|
|
- it: emits no TLS env by default
|
|
template: gateway/deployment.yaml
|
|
asserts:
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLMODE
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLROOTCERT
|
|
any: true
|
|
|
|
- it: writer sslMode and sslRootCert reach gateway and backend as DATABASE_SSLMODE and DATABASE_SSLROOTCERT
|
|
templates:
|
|
- gateway/deployment.yaml
|
|
- backend/deployment.yaml
|
|
set:
|
|
database.writer.useIAMAuth: true
|
|
database.writer.sslMode: verify-full
|
|
database.writer.sslRootCert: /etc/ssl/certs/ca-certificates.crt
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLMODE
|
|
value: verify-full
|
|
any: true
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLROOTCERT
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
any: true
|
|
|
|
- it: writer sslMode and sslRootCert reach the collector sidecar and the migrations job, which dial Postgres themselves
|
|
set:
|
|
gateway.collector.enabled: true
|
|
database.connectionPool.enabled: true
|
|
database.writer.sslMode: verify-full
|
|
database.writer.sslRootCert: /etc/ssl/certs/ca-certificates.crt
|
|
asserts:
|
|
- equal:
|
|
path: spec.template.spec.containers[1].name
|
|
value: collector
|
|
template: gateway/deployment.yaml
|
|
- contains:
|
|
path: spec.template.spec.containers[1].env
|
|
content:
|
|
name: DATABASE_SSLMODE
|
|
value: verify-full
|
|
any: true
|
|
template: gateway/deployment.yaml
|
|
- contains:
|
|
path: spec.template.spec.containers[1].env
|
|
content:
|
|
name: DATABASE_SSLROOTCERT
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
any: true
|
|
template: gateway/deployment.yaml
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLMODE
|
|
value: verify-full
|
|
any: true
|
|
template: migrations-job.yaml
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_SSLROOTCERT
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
any: true
|
|
template: migrations-job.yaml
|
|
|
|
- it: writer rejects both token sources at once
|
|
template: gateway/deployment.yaml
|
|
set:
|
|
database.writer.useIAMAuth: true
|
|
database.writer.useAzureEntraAuth: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "database.writer.useIAMAuth and database.writer.useAzureEntraAuth are mutually exclusive: the database password can only come from one token source"
|
|
|
|
- it: reader Entra auth without writer Entra auth is rejected
|
|
template: gateway/deployment.yaml
|
|
set:
|
|
database.reader.host: reader.example.com
|
|
database.reader.dbname: litellm
|
|
database.reader.useAzureEntraAuth: true
|
|
asserts:
|
|
- failedTemplate:
|
|
errorMessage: "database.reader.useAzureEntraAuth requires database.writer.useAzureEntraAuth: true (the proxy gates Entra URL minting on AZURE_POSTGRESQL_AUTH, which is only set by the writer)"
|
|
|
|
- it: reader under Entra auth omits DATABASE_PASSWORD_READ_REPLICA
|
|
template: gateway/deployment.yaml
|
|
set:
|
|
database.writer.useAzureEntraAuth: true
|
|
database.reader.host: reader.example.com
|
|
database.reader.dbname: litellm
|
|
database.reader.useAzureEntraAuth: true
|
|
asserts:
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_HOST_READ_REPLICA
|
|
value: reader.example.com
|
|
any: true
|
|
- contains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_USER_READ_REPLICA
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: litellm-reader-secret
|
|
key: username
|
|
any: true
|
|
- notContains:
|
|
path: spec.template.spec.containers[0].env
|
|
content:
|
|
name: DATABASE_PASSWORD_READ_REPLICA
|
|
any: true
|