Fix e2e secret reference schema failures

cluster/test/litellm/deploy.yaml

@@ -20,6 +20,62 @@ data:
 ---
 apiVersion: apps/v1
 kind: Deployment
+metadata:
+  name: postgresql
+  namespace: litellm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgresql
+  template:
+    metadata:
+      labels:
+        app: postgresql
+    spec:
+      containers:
+      - name: postgresql
+        image: postgres:16-alpine
+        env:
+        - name: POSTGRES_DB
+          value: litellm
+        - name: POSTGRES_USER
+          value: litellm
+        - name: POSTGRES_PASSWORD
+          value: litellm
+        ports:
+        - containerPort: 5432
+        readinessProbe:
+          exec:
+            command:
+            - pg_isready
+            - -U
+            - litellm
+            - -d
+            - litellm
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql/data
+      volumes:
+      - name: data
+        emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgresql
+  namespace: litellm
+spec:
+  selector:
+    app: postgresql
+  ports:
+  - port: 5432
+    targetPort: 5432
+---
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: litellm
   namespace: litellm
@@ -33,6 +89,16 @@ spec:
       labels:
         app: litellm
     spec:
+      initContainers:
+      - name: wait-for-postgresql
+        image: postgres:16-alpine
+        command:
+        - sh
+        - -c
+        - until pg_isready -h postgresql -U litellm -d litellm; do sleep 2; done
+        env:
+        - name: PGPASSWORD
+          value: litellm
       containers:
       - name: litellm
         image: ghcr.io/berriai/litellm:main-stable
@@ -46,6 +112,12 @@ spec:
         env:
         - name: LITELLM_MASTER_KEY
           value: "sk-e2e-master-key"
+        - name: POSTGRES_USER
+          value: litellm
+        - name: POSTGRES_PASSWORD
+          value: litellm
+        - name: DATABASE_URL
+          value: "postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@postgresql:5432/litellm"
         - name: STORE_MODEL_IN_DB
           value: "False"
         ports:
@@ -61,6 +133,12 @@ spec:
           initialDelaySeconds: 30
           periodSeconds: 10
           failureThreshold: 18
+        startupProbe:
+          httpGet:
+            path: /health/liveliness
+            port: 4000
+          periodSeconds: 10
+          failureThreshold: 60
         livenessProbe:
           httpGet:
             path: /health/liveliness

cluster/test/setup.sh

@@ -12,8 +12,11 @@ LITELLM_API_KEY="sk-e2e-master-key"
 echo "Deploying LiteLLM in-cluster..."
 kubectl apply -f "${REPO_ROOT}/cluster/test/litellm/deploy.yaml"
 
-echo "Waiting for LiteLLM to become ready (up to 5 minutes)..."
-kubectl -n litellm rollout status deployment/litellm --timeout=300s
+echo "Waiting for PostgreSQL to become ready (up to 3 minutes)..."
+kubectl -n litellm rollout status deployment/postgresql --timeout=180s
+
+echo "Waiting for LiteLLM to become ready (up to 10 minutes)..."
+kubectl -n litellm rollout status deployment/litellm --timeout=600s
 
 echo "Creating upbound-system namespace..."
 kubectl get namespace upbound-system >/dev/null 2>&1 || kubectl create namespace upbound-system

config/provider.go

@@ -26,6 +26,7 @@ import (
 	ujconfig "github.com/crossplane/upjet/v2/pkg/config"
 	conversiontfjson "github.com/crossplane/upjet/v2/pkg/types/conversion/tfjson"
 	"github.com/crossplane/upjet/v2/pkg/types/name"
+	"github.com/crossplane/upjet/v2/pkg/types/structtag"
 	tfjson "github.com/hashicorp/terraform-json"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/pkg/errors"
@@ -92,7 +93,13 @@ func GetProvider(generationProvider bool) (*ujconfig.Provider, error) {
 	)
 
 	for _, configure := range []func(provider *ujconfig.Provider){
-		// add custom config functions here per resource group
+		func(provider *ujconfig.Provider) {
+			provider.Resources["litellm_credential"].SchemaElementOptions.SetInitProviderOverrides("credential_values", &ujconfig.InitProviderOverrides{
+				TagOverrides: ujconfig.TagOverrides{
+					JSONTag: structtag.NewJSON(structtag.WithOmit(structtag.OmitEmpty)),
+				},
+			})
+		},
 	} {
 		configure(pc)
 	}

examples/litellm/vectorstore.yaml

@@ -33,7 +33,6 @@ spec:
     litellmParamsSecretRef:
       name: e2e-vectorstore-values
       namespace: upbound-system
-      key: OPENAI_API_KEY
     vectorStoreName: e2e-vectorstore
     vectorStoreDescription: e2e vector store
   providerConfigRef:

internal/clients/litellm.go

@@ -28,6 +28,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	litellmProvider "github.com/BerriAI/terraform-provider-litellm/litellm"
 	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 	"github.com/crossplane/crossplane-runtime/v2/pkg/errors"
 	"github.com/crossplane/crossplane-runtime/v2/pkg/resource"
@@ -87,13 +88,21 @@ func TerraformSetupBuilder() terraform.SetupFn {
 			ps.Configuration[k] = v
 		}
 
-		if _, ok := ps.Configuration["api_base"]; !ok {
+		apiBase, ok := ps.Configuration["api_base"].(string)
+		if !ok || apiBase == "" {
 			return ps, errors.New(errMissingAPIBase)
 		}
-		if _, ok := ps.Configuration["api_key"]; !ok {
+		apiKey, ok := ps.Configuration["api_key"].(string)
+		if !ok || apiKey == "" {
 			return ps, errors.New(errMissingAPIKey)
 		}
 
+		ps.Meta = litellmProvider.NewClient(
+			apiBase,
+			apiKey,
+			false,
+		)
+
 		return ps, nil
 	}
 }

internal/clients/litellm_test.go

@@ -27,6 +27,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 
+	litellmProvider "github.com/BerriAI/terraform-provider-litellm/litellm"
 	xpv1 "github.com/crossplane/crossplane-runtime/v2/apis/common/v1"
 
 	litellmv1alpha1 "github.com/corewire/provider-litellm/apis/litellm/v1alpha1"
@@ -111,6 +112,22 @@ func TestTerraformSetupBuilder(t *testing.T) {
 			mg:      model("default"),
 			wantErr: errMissingAPIKey,
 		},
+		"InvalidAPIBase": {
+			objects: []client.Object{
+				providerConfig("credentials"),
+				secret(map[string][]byte{"credentials": []byte(`{"api_base":123,"api_key":"k"}`)}),
+			},
+			mg:      model("default"),
+			wantErr: errMissingAPIBase,
+		},
+		"InvalidAPIKey": {
+			objects: []client.Object{
+				providerConfig("credentials"),
+				secret(map[string][]byte{"credentials": []byte(`{"api_base":"http://litellm:4000","api_key":123}`)}),
+			},
+			mg:      model("default"),
+			wantErr: errMissingAPIKey,
+		},
 		"JSONCredentials": {
 			objects: []client.Object{
 				providerConfig("credentials"),
@@ -151,6 +168,13 @@ func TestTerraformSetupBuilder(t *testing.T) {
 					t.Errorf("configuration[%q]: want %v, got %v", k, v, ps.Configuration[k])
 				}
 			}
+			got, ok := ps.Meta.(*litellmProvider.Client)
+			if !ok {
+				t.Fatalf("setup metadata: want *litellm.Client, got %T", ps.Meta)
+			}
+			if got.APIBase != tc.want["api_base"] || got.APIKey != tc.want["api_key"] {
+				t.Errorf("setup metadata client: want api_base %q and api_key %q, got %#v", tc.want["api_base"], tc.want["api_key"], got)
+			}
 		})
 	}
 }

package/crds/litellm.crossplane.io_credentials.yaml

@@ -141,8 +141,6 @@ spec:
                       Model ID associated with this credential.
                       Model ID associated with this credential
                     type: string
-                required:
-                - credentialValuesSecretRef
                 type: object
               managementPolicies:
                 default: