mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
786899700f
The gateway could reach exactly one remote provider, through a bare
OPENROUTER_API_KEY group_var with an empty-string default and an `{% if %}`
around a single hardcoded model entry. OpenAI and Anthropic had no path at all.
All three are now declared in roles/svc-ai-litellm/meta/secrets.yml, which
mapping.py already calls the application config schema, so a key lands at
applications.svc-ai-litellm.secrets.credentials.<provider>_api_key like every
other credential. Each carries the `type` and `regex` its value must satisfy and
defaults to the central API.<provider>.api_key block, which keeps one
operator-facing place to fill a provider in while the role owns the shape.
type and regex had to become real to be worth declaring. 192 `validation:`
blocks sit in the role schemas today and not one line of Python enforces them,
so a `regex` would have joined a pile of decoration. validate_supplied_value
now runs on every path a value arrives from outside — the --set override, a
value already in the inventory, and the value standing next to a `default:`.
A generated value stays exempt because the algorithm that produced it is named
by the same schema and generate_value takes no schema argument. min_length is
deliberately left unenforced: the generators ignore it, so holding them to it
would fail where nothing is wrong.
The pattern is written for the paste, not for the vendor. OpenAI moved issuance
from sk- to sk-proj- without notice and Anthropic issues sk-ant-api03-; a schema
pinning a prefix would reject a valid key and abort inventory creation. `\S{20,}`
accepts every form those three issue today and one nobody has announced, and
rejects a trailing newline, an embedded space, a truncated copy and a
<placeholder>. A key pasted into the wrong provider's slot is caught at deploy
instead, where the route it publishes answers nothing.
The gateway iterates one LITELLM_REMOTE_BACKENDS list instead of three `{% if %}`
blocks; config.yaml.j2 and env.j2 read the same list and selectattr('key')
decides. LITELLM_CHAT_MODEL falls back to the first configured remote alias
rather than to a hardcoded openrouter/auto.
For CI the keys travel as INFINITO_API_{OPENAI,ANTHROPIC,OPENROUTER}_KEY through
default.env, the passthrough allowlist, the infinito service in compose.yml, the
workflow env block and the development inventory. The compose leg is not
optional: the env lint rejected the change without it, because a key the
inventory reads but compose does not forward resolves to empty inside the
container with no error. The workflow reads `secrets.X || vars.X` so a variable
works as asked while a secret wins, which matters because a variable is not
masked and the development inventory sets MASK_CREDENTIALS_IN_LOGS: false.
An unset key is not an error anywhere: the provider's routes stay unpublished
and the CLI test asserts their absence rather than skipping.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
2.9 KiB
Bash
81 lines
2.9 KiB
Bash
#!/usr/bin/env bash
|
|
# shellcheck shell=bash
|
|
#
|
|
# svc-ai-litellm routing test. Runs probe.py inside the gateway container, where
|
|
# the API answers on loopback and the backends resolve by container name, and
|
|
# asserts the published model list matches the backends this deployment enabled.
|
|
#
|
|
# Env (rendered into test.env from templates/test.env.j2):
|
|
# LITELLM_CONTAINER resolved gateway container (CLI_LOCAL_CID)
|
|
# LITELLM_PORT gateway http port inside the container
|
|
# LITELLM_MASTER_KEY_B64 base64 master key (avoids shell-quoting issues)
|
|
# LITELLM_CHAT_MODEL the model every consumer asks for
|
|
# LITELLM_CHAT_MODEL_SERVED true|false
|
|
# LITELLM_EXPECTED_MODELS JSON list the config template published
|
|
# LITELLM_LMSTUDIO_ALIASES JSON list of aliases only LM Studio provides
|
|
# LITELLM_REMOTE_ALIASES JSON list of aliases a configured provider key adds
|
|
# LITELLM_OLLAMA_ENABLED true|false
|
|
# LITELLM_LMSTUDIO_ENABLED true|false
|
|
# READY_RETRIES gateway readiness attempts (default 30)
|
|
# READY_SLEEP_SECONDS wait between attempts (default 5)
|
|
|
|
set -uo pipefail
|
|
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
READY_RETRIES="${READY_RETRIES:-30}"
|
|
READY_SLEEP_SECONDS="${READY_SLEEP_SECONDS:-5}"
|
|
|
|
MASTER_KEY="$(printf '%s' "${LITELLM_MASTER_KEY_B64}" | base64 -d 2>/dev/null)"
|
|
[ -n "${MASTER_KEY}" ] || {
|
|
echo "[FATAL] LITELLM_MASTER_KEY_B64 missing or undecodable" >&2
|
|
exit 2
|
|
}
|
|
[ -n "${LITELLM_CONTAINER}" ] || {
|
|
echo "[FATAL] LITELLM_CONTAINER unset; the gateway container was not resolved" >&2
|
|
exit 2
|
|
}
|
|
|
|
# The image ships the litellm app, so a python interpreter is present, but the
|
|
# upstream tag has changed which of the two names is on PATH.
|
|
interpreter() {
|
|
# nocheck: container-exec-resolver address resolved by the caller and passed in
|
|
if container exec -i "${LITELLM_CONTAINER}" python3 -c '' 2>/dev/null; then
|
|
echo python3
|
|
else
|
|
echo python
|
|
fi
|
|
}
|
|
|
|
probe() {
|
|
# nocheck: container-exec-resolver address resolved by the caller and passed in
|
|
container exec -i \
|
|
-e "PORT=${LITELLM_PORT}" \
|
|
-e "MASTER_KEY=${MASTER_KEY}" \
|
|
-e "CHAT_MODEL=${LITELLM_CHAT_MODEL}" \
|
|
-e "CHAT_MODEL_SERVED=${LITELLM_CHAT_MODEL_SERVED}" \
|
|
-e "EXPECTED_MODELS=${LITELLM_EXPECTED_MODELS}" \
|
|
-e "LMSTUDIO_ALIASES=${LITELLM_LMSTUDIO_ALIASES}" \
|
|
-e "REMOTE_ALIASES=${LITELLM_REMOTE_ALIASES}" \
|
|
-e "OLLAMA_ENABLED=${LITELLM_OLLAMA_ENABLED}" \
|
|
-e "LMSTUDIO_ENABLED=${LITELLM_LMSTUDIO_ENABLED}" \
|
|
"${LITELLM_CONTAINER}" "$(interpreter)" - <"${here}/probe.py"
|
|
}
|
|
|
|
attempt=1
|
|
while [ "${attempt}" -le "${READY_RETRIES}" ]; do
|
|
output="$(probe 2>&1)"
|
|
rc=$?
|
|
case "${output}" in
|
|
*"gateway answered /v1/models"*)
|
|
echo "${output}"
|
|
exit "${rc}"
|
|
;;
|
|
esac
|
|
attempt=$((attempt + 1))
|
|
[ "${attempt}" -le "${READY_RETRIES}" ] && sleep "${READY_SLEEP_SECONDS}"
|
|
done
|
|
|
|
echo "[FAIL] the gateway never answered /v1/models after ${READY_RETRIES} attempts" >&2
|
|
echo "${output}" >&2
|
|
exit 1
|