fix(terraform/gcp): prompt for image_registry in DeployStack one-click

[yassin-berriai]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Deployed the GCP stack from terraform/litellm/gcp/examples/default/ against litellm-internal end-to-end, exactly mirroring the DeployStack click-through path (manual AR remote repo create, then the same prompts the installer asks). Apply was 42/42 in ~18 min; LB came up at http://34.36.252.37.

Curl against the live LB hitting real provider APIs (OpenAI gpt-4o-mini, real billed call):

$ MK=$(gcloud secrets versions access latest --secret=ykortam-litellm-dev-master-key --project=litellm-internal)

$ curl -sS -H "Authorization: Bearer $MK" http://34.36.252.37/v1/models
{"data":[{"id":"gpt-4o-mini","object":"model","created":1677610602,"owned_by":"openai"}],"object":"list"}

$ curl -sS -H "Authorization: Bearer $MK" -H "Content-Type: application/json" \
    http://34.36.252.37/v1/chat/completions \
    -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"reply with exactly: pong"}],"max_tokens":5}'
{"id":"chatcmpl-DnrWIWbDMcuXncPgMJE2LyOx3RGsc","created":1780776174,"model":"gpt-4o-mini","object":"chat.completion","system_fingerprint":"fp_ec7cd23eb0","choices":[{"finish_reason":"stop","index":0,"message":{"content":"pong","role":"assistant"...},"usage":{"completion_tokens":1,"prompt_tokens":12,"total_tokens":13...}}

UI also serves via the same LB:

$ curl -sSI http://34.36.252.37/ui | head -3
HTTP/1.1 200 OK
content-type: text/html

That run is the one where I caught the bug this PR fixes; the installer never asked for image_registry, so without pre-editing terraform.tfvars the default would have been ghcr.io/berriai, which Cloud Run rejects after Cloud SQL has already provisioned (~10 min sunk before the failure).

Type

🐛 Bug Fix

Changes

deploystack.json previously only prompted for tenant, env, image_tag, and allow_plaintext_lb. Cloud Run rejects ghcr.io URIs at apply time, so the default image_registry = "ghcr.io/berriai" shipped by variables.tf makes a click-through DeployStack install fail late, after Cloud SQL has already provisioned. Added image_registry as a fifth custom_setting with a PROJECT_ID-placeholder default and a description that flags the ghcr.io rejection, so the user has to enter the AR path the tutorial already had them create. TUTORIAL.md is reworded to tell the user what to enter at the new prompt instead of "edit terraform.tfvars before applying".

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR fixes a late-apply failure in the GCP DeployStack one-click installer by surfacing image_registry as an explicit prompt, preventing users from unknowingly using the module's ghcr.io/berriai default, which Cloud Run rejects.

• deploystack.json: Adds image_registry as a fifth custom_settings entry with a REGION-docker.pkg.dev/PROJECT_ID/litellm/berriai placeholder default and a description that flags the ghcr.io rejection, forcing the user to supply their Artifact Registry path before apply.
• TUTORIAL.md: Rewrites the AR setup section to instruct users to enter the correct registry path at the DeployStack prompt instead of pre-editing terraform.tfvars; also updates the installer step listing to include image_registry.

Confidence Score: 5/5

Safe to merge — the change is additive (a new prompt entry and documentation wording) with no risk to existing deployments.

Both changed files are Terraform installer configuration and tutorial prose. The fix is correct: adding the prompt prevents the ghcr.io late-failure. The only issue is a documentation wording gap where the tutorial mentions only the PROJECT_ID placeholder while the default also contains a REGION placeholder, but users are guided clearly in the prompt description itself.

TUTORIAL.md line 45 mentions only the PROJECT_ID placeholder while the default has two (REGION and PROJECT_ID).

Important Files Changed

Filename	Overview
terraform/litellm/gcp/examples/default/deploystack.json	Adds image_registry as a fifth custom_setting prompt with a two-placeholder default (REGION-docker.pkg.dev/PROJECT_ID/litellm/berriai) and a descriptive warning about ghcr.io rejection, preventing late-apply failures in DeployStack click-through installs.
terraform/litellm/gcp/examples/default/TUTORIAL.md	Updates walkthrough text to direct users to fill in image_registry at the DeployStack prompt instead of editing terraform.tfvars manually; the placeholder warning only names PROJECT_ID while the actual default also has a REGION placeholder.

_{Reviews (2): Last reviewed commit: "fix(terraform/gcp): generalize image_reg..." | Re-trigger Greptile}

[greptile-apps]

tenant and env both carry a validation regex, but image_registry has none. A pattern like ^[a-z0-9-]+-docker\.pkg\.dev/ would reject a bare ghcr.io/berriai entry at prompt-time rather than letting it survive to apply — exactly the failure mode this PR is trying to prevent.

Suggested change

	{
	"name": "image_registry",
	"description": "Artifact Registry path prefix for the four litellm-* images. Format: <region>-docker.pkg.dev/<project>/litellm/berriai, pointing at the remote repo you created above. The ghcr.io/berriai default does NOT work; Cloud Run rejects ghcr.io URIs at apply time",
	"default": "us-central1-docker.pkg.dev/PROJECT_ID/litellm/berriai"
	},
	{
	"name": "image_registry",
	"description": "Artifact Registry path prefix for the four litellm-* images. Format: <region>-docker.pkg.dev/<project>/litellm/berriai, pointing at the remote repo you created above. The ghcr.io/berriai default does NOT work; Cloud Run rejects ghcr.io URIs at apply time",
	"default": "REGION-docker.pkg.dev/PROJECT_ID/litellm/berriai",
	"validation": "^[a-z0-9-]+-docker\\.pkg\\.dev/"
	},

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yassin-berriai]

Good catch. Replaced the hardcoded us-central1 with a REGION placeholder and tightened the description so both REGION and PROJECT_ID are clearly placeholders to substitute. Pushed as 1abf838.

[yassin-berriai]

@greptileai