OpenWebUI

OpenWebUI is exposed at https://openwebui.noxxos.nl and connects to LiteLLM at http://litellm.litellm.svc.cluster.local:4000/v1.

LiteLLM then routes requests to the OpenAI-compatible llama.cpp endpoint at http://framework-llm.open-webui.svc.cluster.local:8080/v1.

Authentik

Create an Authentik OAuth2/OIDC provider and application with slug open-webui.

Allowed redirect URI:

https://openwebui.noxxos.nl/oauth/oidc/callback

Create the OIDC client secret in Kubernetes before syncing the app:

kubectl create namespace open-webui
kubectl -n open-webui create secret generic open-webui-oidc \
  --from-literal=client-id='<authentik-client-id>' \
  --from-literal=client-secret='<authentik-client-secret>'

OpenWebUI also reads its OpenAI-compatible API keys from the litellm-secrets Secret in the open-webui namespace. Keep it in sync with the litellm namespace copy:

kubectl -n open-webui create secret generic litellm-secrets \
  --from-literal=openwebui-api-keys='0p3n-w3bu!;sk-<litellm-master-key>'

1.0 KiB Raw Blame History

OpenWebUI

Authentik

1.0 KiB

Raw Blame History