fix(litellm): remove pre-call hook, use native OAuth via ANTHROPIC_API_KEY

[binary64]

Context

PR #51 added a custom async_pre_call_hook to handle Anthropic OAuth tokens, working around upstream bug #19618.

What changed upstream

PR #19912 was merged Feb 17 into LiteLLM, fixing optionally_handle_anthropic_oauth() to correctly:

• Detect sk-ant-oat* tokens in api_key
• Remove x-api-key header automatically
• Set Authorization: Bearer <token> correctly

This is present in our current image (v1.81.15-nightly), confirmed via kubectl exec.

Fix

Remove async_pre_call_hook and custom_llm_provider from Anthropic models. LiteLLM now handles OAuth natively when ANTHROPIC_API_KEY contains the OAuth token (sk-ant-oat*).

The ANTHROPIC_API_KEY secret has been updated to contain the real OAuth token (patched directly on the cluster).

---

Summary by cubic

Removed Anthropic pre-call hook and custom provider in LiteLLM to use native OAuth via ANTHROPIC_API_KEY, fixing call errors and simplifying config.

• Bug Fixes
  • Removed async_pre_call_hook and custom_llm_provider for claude-opus-4-6, claude-sonnet-4-6, and claude-haiku-4-5.
  • LiteLLM v1.81.15 now sets Authorization using the OAuth token; no x-api-key header needed.
  • ANTHROPIC_API_KEY updated to the OAuth token; resolves “Extra inputs are not permitted” errors.

^{Written for commit fb3c7a0. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="infra/manifests/litellm/configmap.yaml">

<violation number="1" location="infra/manifests/litellm/configmap.yaml:46">
P2: The `litellm-hooks` ConfigMap (with `hooks.py`) and its deployment artifacts are now dead code. Since all `async_pre_call_hook` references have been removed, the following should also be cleaned up in this PR:
- The `litellm-hooks` ConfigMap in this file (lines ~183-218)
- The volume mount, volume definition, and `PYTHONPATH` env var in `deployment.yaml`

Leaving these behind adds confusion for future maintainers and needlessly mounts unused code into the container.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: The litellm-hooks ConfigMap (with hooks.py) and its deployment artifacts are now dead code. Since all async_pre_call_hook references have been removed, the following should also be cleaned up in this PR:

• The litellm-hooks ConfigMap in this file (lines ~183-218)
• The volume mount, volume definition, and PYTHONPATH env var in deployment.yaml

Leaving these behind adds confusion for future maintainers and needlessly mounts unused code into the container.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At infra/manifests/litellm/configmap.yaml, line 46:

<comment>The `litellm-hooks` ConfigMap (with `hooks.py`) and its deployment artifacts are now dead code. Since all `async_pre_call_hook` references have been removed, the following should also be cleaned up in this PR:
- The `litellm-hooks` ConfigMap in this file (lines ~183-218)
- The volume mount, volume definition, and `PYTHONPATH` env var in `deployment.yaml`

Leaving these behind adds confusion for future maintainers and needlessly mounts unused code into the container.</comment>

<file context>
@@ -42,20 +42,14 @@ data:
-          custom_llm_provider: anthropic
-          async_pre_call_hook: hooks.async_pre_call_hook
 
       - model_name: claude-sonnet-4-6
         litellm_params:
           model: anthropic/claude-sonnet-4-6
</file context>

[binary64]

Addressed Cubic's P2 feedback in 800c448:

• Removed the litellm-hooks ConfigMap (dead hooks.py / async_pre_call_hook code)
• Removed the OAUTH_TOKEN env var, PYTHONPATH=/hooks env var, hooks volume mount, and hooks volume definition from deployment.yaml
• Updated stale comment from "OAuth via custom hook" → "native OAuth via ANTHROPIC_API_KEY"

All hook-related artifacts are now fully cleaned up.