[Feature]: Add private/internal-only ingress mode for terraform/litellm/gcp load balancer

[lorengordon]

Check for existing issues

• I have searched the existing issues and checked that my issue is not a duplicate.

The Feature

Add a private/internal-only ingress mode to the Terraform module at terraform/litellm/gcp so operators can deploy LiteLLM without a public internet-facing load balancer endpoint.

Today the module provisions an external global HTTP(S) load balancer. Many users need a deployment posture where ingress is only reachable from private network paths, while preserving the module's existing path-based routing behavior across gateway/backend/ui.

Requested behavior:

• Support a private/internal load balancer mode in terraform/litellm/gcp
• Preserve current URL-map path routing semantics
• Keep this capability generic (not tied to any single overlay network or vendor-specific connectivity product)
• Document migration guidance from external/public mode

User Flow

Before this feature (today): the operator can deploy the module, but ingress ends up internet-facing when they need private-only ingress

1. Operator configures and applies terraform/litellm/gcp/examples/default
2. Terraform provisions LB frontend resources and outputs a public LB endpoint (lb_ip / lb_url)
3. End users can reach the LiteLLM ingress endpoint from internet-routed clients
4. Operator's required outcome (private-only ingress posture) is not achievable without forking module behavior

After this feature (ideal user flow): the same operator deploys the module with a private ingress mode and gets private-only LB exposure

1. Operator configures and applies terraform/litellm/gcp/examples/default with a private/internal ingress mode
2. Terraform provisions private/internal LB frontend resources for the same routing stack
3. End users can reach ingress only through approved private network paths
4. Operator obtains private-only ingress posture without forking module behavior

How far you got

Config / setup the proxy ran with:

• Module path: terraform/litellm/gcp
• Terraform example path: terraform/litellm/gcp/examples/default

Version or commit:

• Current repository state at time of issue filing

Commands and their full output, up to the step that dead-ends:

# reviewed module resources and outputs
# observed external/public LB resource shape in terraform/litellm/gcp/load_balancer.tf
# observed public LB-oriented outputs in terraform/litellm/gcp/outputs.tf

What stopped me there:

• The current module behavior is centered on external/public LB frontend resources and public endpoint outputs, and there is no first-class private/internal-only ingress mode in the module interface.

What part of LiteLLM is this about?

Proxy

LiteLLM is hiring a founding backend engineer, are you interested in joining us and shipping to all our users?

No

Twitter / LinkedIn details

N/A

[lorengordon]

I am happy to work on the implementation and open a PR. Haven't contributed to the project yet, so wanted to check in first and see if there were any particular concerns or feedback on the feature request...

[lorengordon]

Eh, I'll go ahead and open a PR so we have some code to talk around and scope out the dimensions and impact of the request...