fix(data-platform): promote litellm to 1.101.0 in pre-production and production

[muhammad9970]

Summary

Promotes preproduction and production LiteLLM AI Gateway images directly to 1.101.0 (the latest stable release), the same target being rolled out to development/test in #19123 and to data-platform-app's Compose config in data-platform-app#271.

Prior state: production was pinned to 1.97.0 while preproduction was on 1.98.0 — a pre-existing drift between the two. Rather than reconciling to the older 1.98.0 first and promoting separately later, this PR moves both preproduction and production straight to 1.101.0 at the explicit request of the requester, in parallel with the development/test upgrade in #19123. development and test are unchanged here (updated separately in #19123).

Note: this intentionally does not wait for the normal staged validation window (dev/test soak before promotion), since the requester explicitly asked to bring preprod/production onto 1.101.0 now rather than staying on the intermediate 1.98.0.

Additional change (at requester's instruction): gemini-3-5-transcribe-preview in terraform/environments/data-platform/ai-gateway/configuration/configuration.yml had environments_available: ["development", "production"]. This is changed to ["development"] so the model is no longer enabled for production (this model list is applied globally across environments per locals.tf's yamldecode/environment filter, so it also affects preproduction/test/development gating consistently — it was only ever opted in for development and production, and is now opted in for development only).

Data Platform client compatibility

Reviewed ministryofjustice/data-platform-app's ai_gateway/client.py (main) against the full LiteLLM changelog and every intervening release between the currently-deployed versions and 1.101.0:

• production: 1.97.0 → 1.98.0 → 1.99.0 → 1.99.1 → 1.100.0 → 1.101.0
• preproduction: 1.98.0 → 1.99.0 → 1.99.1 → 1.100.0 → 1.101.0

Endpoints used by the client: GET /v1/access_group, GET /organization/list, GET /v1/model/info, POST /team/new, POST /team/delete, GET /team/info, POST /team/update, POST /key/generate, POST /key/{key}/regenerate, POST /key/delete, GET /key/info, GET /key/list, POST /key/update.

No breaking changes affecting the Data Platform AI Gateway client were identified across this range. Findings reviewed per release, all evidenced against BerriAI/litellm release notes and linked PRs:

• 1.97.0→1.98.0: #35773 restores management_v1 query-param validation (client only sends documented params, unaffected); #36488 adds additive config_updated_at to key responses; #36843/#36825 sync additive assigned_key_ids/assigned_team_ids fields the client doesn't consume; #36837 was merged and reverted same release (#36982) — net no-op; #34211 touches /v2/model/info, not the /v1/model/info the client calls.
• 1.98.0→1.99.0: #37962 reintroduces a fail-closed fix for stale team fallback (re-applying reverted #36837) — internal auth hardening, not a contract change for /team/* or /key/* the client calls; #37959 makes /team/member_delete atomic — an endpoint the client does not call.
• 1.99.0→1.99.1: patch release, no proxy/API changes (cosign signing metadata only).
• 1.99.1→1.100.0: #38308 fixes /key/update failing on cache-eviction errors — bug fix benefiting the client's update_key_models, no contract change; #38463 changes MCP-grant handling on /key/update — the client only ever sends models, unaffected; #37918 adds Terraform provider fields for litellm_team — informational only, this repo manages LiteLLM via the app's own Terraform module, not the upstream provider.
• 1.100.0→1.101.0: #39218 adds stricter team-id validation only on GET/PUT /v1/access_group/{id}, not called by the client; #36328 fixes POST /team/update partial updates no longer wiping metadata — a bug fix that benefits update_team_access_groups's existing usage pattern; #39051 changes key_type preset transitions on /key/update, the client only sends models so is unaffected; #37044 adds an additive budget-window field to GET /key/info; #39045 touches GET /v2/team/list, a different endpoint from GET /team/info.

This PR promotion reuses and extends the compatibility evidence already documented in #19123 (development/test) and the earlier reconciliation review, and adds review of the additional 1.98.0→1.99.0→1.99.1→1.100.0 hops needed to cover production's longer upgrade path.

Other breaking changes

None identified against this repository's Terraform/Helm configuration across the full range. Notable non-breaking infra items: #36975 bounds the Helm migrations Job so a blocked migration cannot stall a release (operational hardening); #39219 reuses the generated master-key Secret on helm upgrade; #39365/#39506 harden prisma migrate deploy timeout/retry behaviour — all proxy-image-internal, not changes to externally-supplied Helm values/config used by this repository's Terraform.

Release notes

• LiteLLM 1.101.0 release notes
• Full upstream comparison (production: 1.97.0...1.101.0)
• Full upstream comparison (preproduction: 1.98.0...1.101.0)

---

Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com

[Gary Henderson (Gary-H9)]

LGTM

[github-actions]

---

Checkov Scan Success

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/data-platform/ai-gateway

*****************************

Running Checkov in terraform/environments/data-platform/ai-gateway
terraform scan results:

Passed checks: 91, Failed checks: 0, Skipped checks: 0, Parsing errors: 1


checkov_exitcode=0

---

TFLint Scan Success

Show Output

*****************************

Using default config
Installing "terraform" plugin...
The plugin was signed using a legacy PGP signing key. Please update the plugin to the latest version
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.15.0)
tflint checking:
terraform/environments/data-platform/ai-gateway

*****************************

Running tflint in terraform/environments/data-platform/ai-gateway
tflint_exitcode=0

[Gary Henderson (Gary-H9)]

LGTM