From 3671d6b380746aee0f1d50f3f725ab0773de2cd3 Mon Sep 17 00:00:00 2001
From: mrinal-berri <mrinal@berri.ai>
Date: Wed, 11 Nov 2026 14:49:30 -0800
Subject: [PATCH] feat(helm): add scheme and tlsConfig to the gateway
 ServiceMonitor (#50759)

* feat(helm): add scheme and tlsConfig to the gateway ServiceMonitor

The componentized chart rendered scheme: http as a literal, so Prometheus could not scrape the gateway metrics port through a sidecar under STRICT mTLS. gateway.serviceMonitor.scheme defaults to http and tlsConfig is passed through as the Prometheus Operator TLSConfig, so the default render is unchanged

* chore(helm): drop the comments on the new serviceMonitor values
---
 helm/litellm/templates/_workload.tpl          |  6 ++++-
 .../tests/hpa_workload_metrics_tests.yaml     | 26 +++++++++++++++++++
 helm/litellm/values.yaml                      |  2 ++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/helm/litellm/templates/_workload.tpl b/helm/litellm/templates/_workload.tpl
index 8f52cd52f2a..2b6b1434be9 100644
--- a/helm/litellm/templates/_workload.tpl
+++ b/helm/litellm/templates/_workload.tpl
@@ -507,7 +507,11 @@ spec:
       path: /metrics/
       interval: {{ .Values.gateway.serviceMonitor.interval }}
       scrapeTimeout: {{ .Values.gateway.serviceMonitor.scrapeTimeout }}
-      scheme: http
+      scheme: {{ .Values.gateway.serviceMonitor.scheme }}
+      {{- with .Values.gateway.serviceMonitor.tlsConfig }}
+      tlsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.gateway.serviceMonitor.relabelings }}
       relabelings:
         {{- toYaml . | nindent 8 }}
diff --git a/helm/litellm/tests/hpa_workload_metrics_tests.yaml b/helm/litellm/tests/hpa_workload_metrics_tests.yaml
index a6c17942a11..9b790070819 100644
--- a/helm/litellm/tests/hpa_workload_metrics_tests.yaml
+++ b/helm/litellm/tests/hpa_workload_metrics_tests.yaml
@@ -201,6 +201,32 @@ tests:
               scrapeTimeout: 10s
               scheme: http
 
+  - it: scrapes over https with the given tlsConfig, for a mesh with STRICT mTLS
+    template: gateway/servicemonitor.yaml
+    set:
+      gateway.serviceMonitor.enabled: true
+      gateway.metricsServer.enabled: true
+      gateway.serviceMonitor.scheme: https
+      gateway.serviceMonitor.tlsConfig:
+        caFile: /etc/prom-certs/root-cert.pem
+        certFile: /etc/prom-certs/cert-chain.pem
+        keyFile: /etc/prom-certs/key.pem
+        insecureSkipVerify: true
+    asserts:
+      - equal:
+          path: spec.endpoints
+          value:
+            - port: metrics
+              path: /metrics/
+              interval: 15s
+              scrapeTimeout: 10s
+              scheme: https
+              tlsConfig:
+                caFile: /etc/prom-certs/root-cert.pem
+                certFile: /etc/prom-certs/cert-chain.pem
+                keyFile: /etc/prom-certs/key.pem
+                insecureSkipVerify: true
+
   - it: carries litellm-helm annotations, relabelings and namespaceSelector onto the ServiceMonitor
     template: gateway/servicemonitor.yaml
     release:
diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml
index 9bfc3ca32e9..b4795cd9ca6 100644
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@@ -407,6 +407,8 @@ gateway:
     # Empty scrapes the release namespace.
     namespaceSelector:
       matchNames: []
+    scheme: http
+    tlsConfig: {}
   # Opt-in `collector` sidecar (same image, `python -m litellm.proxy.collector`)
   # that runs the post-response spend pipeline (cost calculation, spend logs,
   # spend counters, budget reservation reconciliation) so the uvicorn workers