loco-operator/internal/reconciler/litellm.go

/*
Copyright 2026 LocoStack.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package reconciler

import (
	"context"
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"maps"

	"github.com/LocoStack/loco-operator/api/v1alpha1"
	"github.com/LocoStack/loco-operator/pkg/templates/litellm"
	"go.yaml.in/yaml/v2"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
)

type LiteLLMReconciler struct {
	*DefaultComponentReconciler
	client    client.Client
	scheme    *runtime.Scheme
	stack     *v1alpha1.Stack
	component *v1alpha1.Component
}

func NewLiteLLMReconciler(client client.Client, scheme *runtime.Scheme, stack *v1alpha1.Stack, component *v1alpha1.Component) *LiteLLMReconciler {
	return &LiteLLMReconciler{
		DefaultComponentReconciler: NewDefaultComponentReconciler(client, scheme, stack, component),
		client:                     client,
		scheme:                     scheme,
		stack:                      stack,
		component:                  component,
	}
}

func (r *LiteLLMReconciler) ReconcileComponent(ctx context.Context, tmpl *v1alpha1.Template, variables map[string]string) ([]client.Object, error) {
	if err := r.ReconcileKey(ctx, "litellm", litellm.LITELLM_AUTH_SECRET_KEY, generateKey); err != nil {
		return nil, fmt.Errorf("Failed to reconcile LiteLLM master key: %w", err)
	}
	configHash, err := r.reconcileConfigMap(ctx)
	if err != nil {
		return nil, fmt.Errorf("Failed to reconcile LiteLLM config: %w", err)
	}
	if tmpl.Metadata.Annotations == nil {
		tmpl.Metadata.Annotations = make(map[string]string)
	}
	maps.Copy(tmpl.Metadata.Annotations, map[string]string{
		"locostack.com/configHash": configHash,
	})
	if _, err := r.DefaultComponentReconciler.ReconcileComponent(ctx, tmpl, variables); err != nil {
		return nil, err
	}
	return nil, nil
}

func (r *LiteLLMReconciler) reconcileConfigMap(ctx context.Context) (string, error) {
	var o11yComp *v1alpha1.Component
	if r.stack.Spec.Observability != nil && r.stack.Spec.Observability.Enabled {
		o11yComp = &v1alpha1.Component{}
		if err := r.client.Get(ctx, client.ObjectKey{Name: fmt.Sprintf("observability-%s", r.stack.Name), Namespace: r.stack.Namespace}, o11yComp); err != nil {
			return "", fmt.Errorf("Failed to get Observability component: %w", err)
		}
	}
	configBuilder := litellm.LiteLLMConfigBuilder{
		MasterKeyEnvName:       litellm.LITELLM_MASTER_KEY_ENV_NAME,
		Stack:                  r.stack,
		ObservabilityComponent: o11yComp,
	}
	config, err := configBuilder.BuildLiteLLMConfig()
	if err != nil {
		return "", fmt.Errorf("Failed to build LiteLLM config: %w", err)
	}
	configData, err := yaml.Marshal(config)
	if err != nil {
		return "", fmt.Errorf("Failed to marshal LiteLLM config: %w", err)
	}
	configDataStr := string(configData)
	h := sha256.Sum256([]byte(configDataStr))
	configHash := hex.EncodeToString(h[:])
	cm := &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: r.ResourceName("config"), Namespace: r.component.GetNamespace()}}
	if _, err := controllerutil.CreateOrUpdate(ctx, r.client, cm, func() error {
		if cm.Labels == nil {
			cm.Labels = map[string]string{}
		}
		maps.Copy(cm.Labels, r.ResourceLabels())
		if cm.Annotations == nil {
			cm.Annotations = make(map[string]string)
		}
		cm.Annotations["hash"] = configHash
		cm.Data = map[string]string{litellm.LITELLM_CONFIG_KEY: configDataStr}
		return controllerutil.SetControllerReference(r.component, cm, r.scheme)
	}); err != nil {
		return "", err
	}
	return configHash, nil
}

func generateKey() (string, error) {
	b := make([]byte, 24)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return "sk-" + hex.EncodeToString(b), nil
}