feat(helm): allow labels and annotations on the litellm chart gateway ConfigMap

Add gateway.config.labels and gateway.config.annotations to the
componentized helm/litellm chart, rendered on the generated
<gateway>-config ConfigMap when gateway.config.create is true. Same knob as
proxyConfigMap.labels/annotations in litellm-helm, so secret-injection
webhooks (e.g. bank-vaults) can resolve ${vault:...} placeholders in
proxy_config on either chart.

helm/litellm/templates/gateway/configmap.yaml

@@ -3,6 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.gateway.fullname" . }}-config
+  {{- with .Values.gateway.config.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.gateway.config.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ .Values.gateway.config.proxy_config | toYaml | indent 6 }}

helm/litellm/tests/gateway_configmap_tests.yaml

@@ -0,0 +1,46 @@
+suite: test gateway configmap
+templates:
+  - gateway/configmap.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      gateway:
+        config:
+          create: true
+          labels:
+            vault-injection: enabled
+          annotations:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      gateway:
+        config:
+          create: false
+          labels:
+            vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0

helm/litellm/values.yaml

@@ -314,6 +314,12 @@ gateway:
   config:
     create: true
     proxy_config: {}
+    # Extra labels and annotations for the generated ConfigMap (only used when
+    # create is true). Useful for tooling that selects or configures objects by
+    # their metadata, e.g. secret-injection webhooks that resolve placeholders
+    # such as ${vault:...} inside proxy_config.
+    labels: {}
+    annotations: {}
   # Serve Prometheus /metrics from a `metrics` sidecar container (same image,
   # `python -m litellm.proxy.prometheus_metrics_server`) that aggregates the
   # workers' PROMETHEUS_MULTIPROC_DIR samples over a shared emptyDir, so a