Skip to content

feat(container): update image ghcr.io/berriai/litellm-database ( v1.91.2 ➔ v1.92.0 ) - #184

Merged
minhtt159 merged 2 commits into
mainfrom
renovate/ghcr.io-berriai-litellm-database-1.x
Jul 12, 2026
Merged

feat(container): update image ghcr.io/berriai/litellm-database ( v1.91.2 ➔ v1.92.0 )#184
minhtt159 merged 2 commits into
mainfrom
renovate/ghcr.io-berriai-litellm-database-1.x

Conversation

@renovate

@renovate renovate Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
ghcr.io/berriai/litellm-database (source) minor v1.91.2 → v1.92.0

Release Notes

BerriAI/litellm (ghcr.io/berriai/litellm-database)

v1.92.0

Compare Source

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.92.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.92.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.92.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/ghcr.io-berriai-litellm-database-1.x branch from 7288e6c to 0ca2e27 Compare July 12, 2026 06:13
@renovate renovate Bot changed the title fix(container): update image ghcr.io/berriai/litellm-database ( v1.91.2 ➔ v1.91.3 ) feat(container): update image ghcr.io/berriai/litellm-database ( v1.91.2 ➔ v1.92.0 ) Jul 12, 2026
@minhtt159

minhtt159 commented Jul 12, 2026

Copy link
Copy Markdown
Owner

@kylin-hnimn-art read the changelog and compare with my configuration, suggest changes if needed.

@kylin-hnimn-art

kylin-hnimn-art Bot commented Jul 12, 2026

Copy link
Copy Markdown

PR #184 — LiteLLM v1.91.2 → v1.92.0

Change: kubernetes/apps/ai/litellm/app/deployment.yaml bumps the image tag only. No breaking changes or migration notes in the v1.92.0 release affect this repo's config surface — safe to merge as-is.

Relevant to your config, worth a follow-up (not blocking)

Your configmap.yaml general_settings block (store_model_in_db, store_prompts_in_spend_logs, maximum_spend_logs_retention_period, allow_requests_on_db_unavailable) is exactly the section extended by #28395 ("expose Prisma idle/connect timeout + extra DB URL params"), new in this release:

general_settings:
  database_connection_pool_limit: 20
  database_socket_timeout: 300   # closes a Prisma connection idle >5min
  database_connect_timeout: 15
  database_extra_connection_params:
    pgbouncer: "true"
    statement_cache_size: 0

Given your deployment comments already call out CNPG restarts and Prisma-migration startup time, database_socket_timeout looks like a natural fit — it caps idle Prisma connections against your single-replica proxy → CNPG litellm DB, which the upstream PR describes as a reported operator pain point. Optional, non-breaking (opt-in keys), no urgency.

Also new but opt-in/non-breaking: #31215 adds general_settings.encryption_algorithm: aes-256-gcm for at-rest credential encryption (model/provider API keys stored via store_model_in_db). Default stays the legacy XSalsa20 cipher until you flip the flag and run the new /credentials/migrate-encryption endpoint — could be a nice fit for your security-conscious setup, but it's a manual, separate action, not something this bump requires.

Not applicable

  • Helm-chart items (fix(helm): drop main- prefix, feat(helm): split per-component ServiceAccounts) — you deploy the raw image directly, not the chart.
  • New Prometheus/OTEL metrics — no ServiceMonitor/OTEL exporter wired up for litellm currently.
  • Docker builder fixes (npm/node restore) — internal to image build, no effect on the -database runtime image you consume.

Bottom line: merge the bump; consider a small separate PR for database_socket_timeout/database_connect_timeout if idle-connection buildup on CNPG is something you've observed.

Kylin · task t_03b386b1

@minhtt159

minhtt159 commented Jul 12, 2026

Copy link
Copy Markdown
Owner

@kylin-hnimn-art research enable prometheus metrics, implement ServiceMonitor and onboard GrafanaDashboard.

ref:

@kylin-hnimn-art

kylin-hnimn-art Bot commented Jul 12, 2026

Copy link
Copy Markdown

Research: LiteLLM Prometheus metrics + ServiceMonitor + GrafanaDashboard

TL;DR — Prometheus support in LiteLLM is OSS (no enterprise license needed): add callbacks: ["prometheus"] to litellm_settings and /metrics is served on the existing proxy port 4000. The one gotcha: since v1.85.0 (we run v1.92.0) /metrics requires LiteLLM API-key auth by default, so the ServiceMonitor must send a Bearer token. Everything else slots into existing repo patterns; 5 small changes, all in kubernetes/apps/ai/litellm/.

Findings

  • Enabling metrics (docs): litellm_settings.callbacks: ["prometheus"]. The reloader.stakater.com/auto annotation already on the Deployment bounces the pod on ConfigMap change. Key metrics: litellm_spend_metric, litellm_*_tokens_metric, litellm_proxy_total/failed_requests_metric, latency + per-deployment success/failure.
  • Scrape auth: rather than require_auth_for_metrics_endpoint: false (which would leave spend/model metrics unauthenticated on litellm.${SECRET_DOMAIN} via the internal gateway), keep auth on and have Prometheus authenticate. The litellm-auth Secret (key LITELLM_MASTER_KEY) already exists in the ai namespace, which is where the ServiceMonitor lives — prometheus-operator reads endpoint credentials from the ServiceMonitor's namespace, so no new secret is needed.
  • Discovery: kube-prometheus-stack sets serviceMonitorSelectorNilUsesHelmValues: false, so any ServiceMonitor is picked up. But the litellm Service currently has no metadata labels (only a pod selector) — a label must be added for the ServiceMonitor to select it.
  • Dashboard: the chart-less deployment means no mixin; LiteLLM's maintained dashboard is cookbook/litellm_proxy_server/grafana_dashboard/dashboard_v2/grafana_dashboard.json (not on grafana.com). That matches the repo's kafka/strimzi pattern: GrafanaDashboard with a tag-pinned raw GitHub url: + Renovate annotation. The JSON declares DS_PROMETHEUS as a datasource template variable; our Grafana datasource is named prometheus (lowercase, default).

Plan

  1. app/configmap.yaml — add under litellm_settings: callbacks: ["prometheus"].
  2. app/service.yaml — add metadata.labels: {app: litellm} so the ServiceMonitor can select the Service.
  3. app/servicemonitor.yaml (new): 
    apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: litellm
spec:
  jobLabel: app
  selector:
    matchLabels:
      app: litellm
  endpoints:
    - port: http
      path: /metrics
      authorization:
        type: Bearer
        credentials:
          name: litellm-auth
          key: LITELLM_MASTER_KEY
  4. app/grafanadashboard.yaml (new) — kafka-style, pinned to the deployed version and Renovate-bumped in lockstep with the image (docker-datasource annotation, same precedent as the prometheus-operator CRD URLs in .renovaterc.json5): 
    apiVersion: grafana.integreatly.org/v1beta1
kind: GrafanaDashboard
metadata:
  name: litellm
spec:
  allowCrossNamespaceImport: true
  instanceSelector:
    matchLabels:
      grafana.internal/instance: grafana
  datasources:
    - inputName: DS_PROMETHEUS
      datasourceName: prometheus
  # renovate: datasource=docker depName=ghcr.io/berriai/litellm-database
  url: https://raw.githubusercontent.com/BerriAI/litellm/v1.92.0/cookbook/litellm_proxy_server/grafana_dashboard/dashboard_v2/grafana_dashboard.json
  5. app/kustomization.yaml — append ./servicemonitor.yaml and ./grafanadashboard.yaml.

No ks.yaml changes needed (kafka ships its GrafanaDashboard from app/ without a grafana dependsOn; both CRDs already exist in the cluster). No Kyverno impact — no new workload containers.

Caveats: master key doubles as the scrape credential (prometheus-operator copies it into Prometheus's generated scrape-config Secret in observability) — if you'd rather isolate it, mint a virtual key in the UI, store it in Vaultwarden, and point a second ExternalSecret/credentials at it. If the proxy is ever run with multiple uvicorn workers, prometheus_multiproc_dir is needed for consistent metrics (single worker today, so not required).

Kylin · task t_ddfd2841

@minhtt159

minhtt159 commented Jul 12, 2026

Copy link
Copy Markdown
Owner

@kylin-hnimn-art apply t_ddfd2841

Kylin[bot] @claude
feat(litellm): enable prometheus metrics, add ServiceMonitor + Grafan…
80f6d9f 
…aDashboard

Turn on the OSS prometheus callback so the proxy serves /metrics on port 4000,
scrape it via an authenticated ServiceMonitor (master key, since /metrics needs
API-key auth by default from v1.85.0), and onboard LiteLLM's maintained
"LiteLLM Prod v2" dashboard tag-pinned + Renovate-tracked alongside the image.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@kylin-hnimn-art

kylin-hnimn-art Bot commented Jul 12, 2026

Copy link
Copy Markdown

Applied the approved plan (task t_c1b4ef15) — updated renovate/ghcr.io-berriai-litellm-database-1.x.

Done. Applied the approved plan (task t_ddfd2841) for PR #184.

What was done

Enabled LiteLLM Prometheus metrics and onboarded monitoring, all in kubernetes/apps/ai/litellm/app/:

  1. configmap.yaml — added callbacks: ["prometheus"] under litellm_settings (serves /metrics on the existing port 4000; OSS, no license needed).
  2. service.yaml — added metadata.labels: {app: litellm} so the ServiceMonitor can select it (the Service previously had no labels).
  3. servicemonitor.yaml (new) — scrapes /metrics with a Bearer token because LiteLLM requires API-key auth on /metrics by default since v1.85.0; credentials come from the existing litellm-auth Secret in the same ai namespace.
  4. grafanadashboard.yaml (new) — LiteLLM's maintained "LiteLL

Kylin · task t_c1b4ef15

@github-actions github-actions Bot added size/S and removed size/XS labels Jul 12, 2026
@renovate

renovate Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@minhtt159
minhtt159 merged commit 6ef1fbb into main Jul 12, 2026
3 checks passed
@minhtt159
minhtt159 deleted the renovate/ghcr.io-berriai-litellm-database-1.x branch July 12, 2026 21:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/kubernetes renovate/container size/S type/patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@minhtt159