ai-workspace-services/litellm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(vault): remove approle_role_id from sensitive fields, use async HTTP for test_connection

Browse Source 
- approle_role_id is a non-secret identifier (like a username) per
  Vault's AppRole model; masking it hinders admin auditing
- Use async httpx client for the token lookup-self call to avoid
  blocking the event loop
This commit is contained in:
Ryan Crabbe 2026-03-05 17:21:05 -08:00
parent 537be618d4
commit c953388927
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
litellm/proxy/_types.py
View File

@ -77,6 +77,7 @@ class SupportedDBObjectType(str, enum.Enum):
PASS_THROUGH_ENDPOINTS = "pass_through_endpoints"
PROMPTS = "prompts"
MODEL_COST_MAP = "model_cost_map"
TOOLS = "tools"
CONFIG_OVERRIDES = "config_overrides"
def __str__(self):
@ -2127,7 +2128,7 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase):
user_header_mappings: Optional[List[UserHeaderMapping]] = None
supported_db_objects: Optional[List[SupportedDBObjectType]] = Field(
None,
description="Fine-grained control over which object types to load from the database when store_model_in_db is True. Available types: 'models', 'mcp', 'guardrails', 'vector_stores', 'pass_through_endpoints', 'prompts', 'model_cost_map', 'config_overrides'. If not set, all objects are loaded (default behavior).",
description="Fine-grained control over which object types to load from the database when store_model_in_db is True. Available types: 'models', 'mcp', 'guardrails', 'vector_stores', 'pass_through_endpoints', 'prompts', 'model_cost_map', 'tools', 'config_overrides'. If not set, all objects are loaded (default behavior).",
)
user_mcp_management_mode: Optional[UserMCPManagementMode] = Field(
None,

8
litellm/proxy/management_endpoints/config_override_endpoints.py
View File

@ -8,7 +8,8 @@ from pydantic import TypeAdapter
import litellm
from litellm._logging import verbose_proxy_logger
from litellm.llms.custom_httpx.http_handler import _get_httpx_client
from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
from litellm.llms.custom_httpx.httpx_handler import httpxSpecialProvider
from litellm.litellm_core_utils.sensitive_data_masker import SensitiveDataMasker
from litellm.proxy._types import CommonProxyErrors, KeyManagementSystem, LitellmUserRoles, UserAPIKeyAuth
from litellm.proxy.auth.user_api_key_auth import user_api_key_auth
@ -37,7 +38,6 @@ HASHICORP_ENV_VAR_MAPPING: Dict[str, str] = {
HASHICORP_SENSITIVE_FIELDS: Set[str] = {
"vault_token",
"approle_role_id",
"approle_secret_id",
"client_key",
}
@ -387,11 +387,11 @@ async def test_hashicorp_vault_connection(
# Step 2: Verify the token is valid via token/lookup-self
try:
sync_client = _get_httpx_client()
async_client = get_async_httpx_client(llm_provider=httpxSpecialProvider.ProxyServer)
lookup_url = f"{client.vault_addr}/v1/auth/token/lookup-self"
if client.vault_namespace:
headers["X-Vault-Namespace"] = client.vault_namespace
response = sync_client.get(lookup_url, headers=headers)
response = await async_client.get(lookup_url, headers=headers)
response.raise_for_status()
except Exception as e:
raise HTTPException(