feat(helm): add scheme and tlsConfig to the gateway ServiceMonitor (#50759)

* feat(helm): add scheme and tlsConfig to the gateway ServiceMonitor

The componentized chart rendered scheme: http as a literal, so Prometheus could not scrape the gateway metrics port through a sidecar under STRICT mTLS. gateway.serviceMonitor.scheme defaults to http and tlsConfig is passed through as the Prometheus Operator TLSConfig, so the default render is unchanged

* chore(helm): drop the comments on the new serviceMonitor values

helm/litellm/templates/_workload.tpl

@@ -507,7 +507,11 @@ spec:
       path: /metrics/
       interval: {{ .Values.gateway.serviceMonitor.interval }}
       scrapeTimeout: {{ .Values.gateway.serviceMonitor.scrapeTimeout }}
-      scheme: http
+      scheme: {{ .Values.gateway.serviceMonitor.scheme }}
+      {{- with .Values.gateway.serviceMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.gateway.serviceMonitor.relabelings }}
       relabelings:
         {{- toYaml . | nindent 8 }}

helm/litellm/tests/hpa_workload_metrics_tests.yaml

@@ -201,6 +201,32 @@ tests:
               scrapeTimeout: 10s
               scheme: http
 
+  - it: scrapes over https with the given tlsConfig, for a mesh with STRICT mTLS
+    template: gateway/servicemonitor.yaml
+    set:
+      gateway.serviceMonitor.enabled: true
+      gateway.metricsServer.enabled: true
+      gateway.serviceMonitor.scheme: https
+      gateway.serviceMonitor.tlsConfig:
+        caFile: /etc/prom-certs/root-cert.pem
+        certFile: /etc/prom-certs/cert-chain.pem
+        keyFile: /etc/prom-certs/key.pem
+        insecureSkipVerify: true
+    asserts:
+      - equal:
+          path: spec.endpoints
+          value:
+            - port: metrics
+              path: /metrics/
+              interval: 15s
+              scrapeTimeout: 10s
+              scheme: https
+              tlsConfig:
+                caFile: /etc/prom-certs/root-cert.pem
+                certFile: /etc/prom-certs/cert-chain.pem
+                keyFile: /etc/prom-certs/key.pem
+                insecureSkipVerify: true
+
   - it: carries litellm-helm annotations, relabelings and namespaceSelector onto the ServiceMonitor
     template: gateway/servicemonitor.yaml
     release:

helm/litellm/values.yaml

@@ -407,6 +407,8 @@ gateway:
     # Empty scrapes the release namespace.
     namespaceSelector:
       matchNames: []
+    scheme: http
+    tlsConfig: {}
   # Opt-in `collector` sidecar (same image, `python -m litellm.proxy.collector`)
   # that runs the post-response spend pipeline (cost calculation, spend logs,
   # spend counters, budget reservation reconciliation) so the uvicorn workers