feat(helm): allow labels and annotations on the proxy ConfigMap

Add proxyConfigMap.labels and proxyConfigMap.annotations, rendered on the
generated <release>-config ConfigMap when proxyConfigMap.create is true.

Secret-injection webhooks (e.g. bank-vaults) resolve placeholders such as
${vault:...} inside the ConfigMap and read their auth settings (role, path,
TLS) from the object's own annotations. The pod already has podAnnotations
and the migration Job has migrationJob.annotations, but the ConfigMap had no
metadata knob, so a proxy_config with placeholders could not be resolved
without forking the chart.

helm/litellm-helm/templates/configmap-litellm.yaml

@@ -16,6 +16,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.fullname" . }}-config
+  {{- with .Values.proxyConfigMap.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.proxyConfigMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ $config | toYaml | indent 6 }}

helm/litellm-helm/tests/configmap_tests.yaml

@@ -0,0 +1,43 @@
+suite: test proxy configmap
+templates:
+  - configmap-litellm.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      proxyConfigMap:
+        create: true
+        labels:
+          vault-injection: enabled
+        annotations:
+          vault.security.banzaicloud.io/vault-role: vault-injector
+          vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      proxyConfigMap:
+        create: false
+        name: my-existing-config
+        labels:
+          vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0

helm/litellm-helm/values.yaml

@@ -171,6 +171,12 @@ billingMetrics:
 proxyConfigMap:
   # when true, creates a new configmap
   create: true
+  # Extra labels and annotations for the generated ConfigMap (only used when
+  # create is true). Useful for tooling that selects or configures objects by
+  # their metadata, e.g. secret-injection webhooks that resolve placeholders
+  # such as ${vault:...} inside proxy_config.
+  labels: {}
+  annotations: {}
   # if create is false and name is set, use existing ConfigMap
   # create: false
   # name: ""