From 0c1d2de3e866d0ecdb7afcc03e431fc7dfed5b81 Mon Sep 17 00:00:00 2001
From: Denis Lisovsky <kirosvi@gmail.com>
Date: Thu, 1 Oct 2026 16:15:31 +0500
Subject: [PATCH] feat(helm): allow labels and annotations on the proxy
 ConfigMap

Add proxyConfigMap.labels and proxyConfigMap.annotations, rendered on the
generated <release>-config ConfigMap when proxyConfigMap.create is true.

Secret-injection webhooks (e.g. bank-vaults) resolve placeholders such as
${vault:...} inside the ConfigMap and read their auth settings (role, path,
TLS) from the object's own annotations. The pod already has podAnnotations
and the migration Job has migrationJob.annotations, but the ConfigMap had no
metadata knob, so a proxy_config with placeholders could not be resolved
without forking the chart.
---
 .../templates/configmap-litellm.yaml          |  8 ++++
 helm/litellm-helm/tests/configmap_tests.yaml  | 43 +++++++++++++++++++
 helm/litellm-helm/values.yaml                 |  6 +++
 3 files changed, 57 insertions(+)
 create mode 100644 helm/litellm-helm/tests/configmap_tests.yaml

diff --git a/helm/litellm-helm/templates/configmap-litellm.yaml b/helm/litellm-helm/templates/configmap-litellm.yaml
index 03e4f620206..d84ccfd0631 100644
--- a/helm/litellm-helm/templates/configmap-litellm.yaml
+++ b/helm/litellm-helm/templates/configmap-litellm.yaml
@@ -16,6 +16,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.fullname" . }}-config
+  {{- with .Values.proxyConfigMap.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.proxyConfigMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ $config | toYaml | indent 6 }}
diff --git a/helm/litellm-helm/tests/configmap_tests.yaml b/helm/litellm-helm/tests/configmap_tests.yaml
new file mode 100644
index 00000000000..5f9b9711428
--- /dev/null
+++ b/helm/litellm-helm/tests/configmap_tests.yaml
@@ -0,0 +1,43 @@
+suite: test proxy configmap
+templates:
+  - configmap-litellm.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      proxyConfigMap:
+        create: true
+        labels:
+          vault-injection: enabled
+        annotations:
+          vault.security.banzaicloud.io/vault-role: vault-injector
+          vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      proxyConfigMap:
+        create: false
+        name: my-existing-config
+        labels:
+          vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml
index 199c4595149..5ab6425cd38 100644
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@@ -171,6 +171,12 @@ billingMetrics:
 proxyConfigMap:
   # when true, creates a new configmap
   create: true
+  # Extra labels and annotations for the generated ConfigMap (only used when
+  # create is true). Useful for tooling that selects or configures objects by
+  # their metadata, e.g. secret-injection webhooks that resolve placeholders
+  # such as ${vault:...} inside proxy_config.
+  labels: {}
+  annotations: {}
   # if create is false and name is set, use existing ConfigMap
   # create: false
   # name: ""