From 6294e07cd33803e134948d0280d0cddec8ff4722 Mon Sep 17 00:00:00 2001
From: Denis Lisovsky <kirosvi@gmail.com>
Date: Fri, 16 Oct 2026 23:00:59 +0500
Subject: [PATCH] feat(helm): allow labels and annotations on the litellm chart
 gateway ConfigMap

Add gateway.config.labels and gateway.config.annotations to the
componentized helm/litellm chart, rendered on the generated
<gateway>-config ConfigMap when gateway.config.create is true. Same knob as
proxyConfigMap.labels/annotations in litellm-helm, so secret-injection
webhooks (e.g. bank-vaults) can resolve ${vault:...} placeholders in
proxy_config on either chart.
---
 helm/litellm/templates/gateway/configmap.yaml |  8 ++++
 .../tests/gateway_configmap_tests.yaml        | 46 +++++++++++++++++++
 helm/litellm/values.yaml                      |  6 +++
 3 files changed, 60 insertions(+)
 create mode 100644 helm/litellm/tests/gateway_configmap_tests.yaml

diff --git a/helm/litellm/templates/gateway/configmap.yaml b/helm/litellm/templates/gateway/configmap.yaml
index d262bf25b87..67bd8e060f2 100644
--- a/helm/litellm/templates/gateway/configmap.yaml
+++ b/helm/litellm/templates/gateway/configmap.yaml
@@ -3,6 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.gateway.fullname" . }}-config
+  {{- with .Values.gateway.config.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.gateway.config.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ .Values.gateway.config.proxy_config | toYaml | indent 6 }}
diff --git a/helm/litellm/tests/gateway_configmap_tests.yaml b/helm/litellm/tests/gateway_configmap_tests.yaml
new file mode 100644
index 00000000000..0f478dd5892
--- /dev/null
+++ b/helm/litellm/tests/gateway_configmap_tests.yaml
@@ -0,0 +1,46 @@
+suite: test gateway configmap
+templates:
+  - gateway/configmap.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      gateway:
+        config:
+          create: true
+          labels:
+            vault-injection: enabled
+          annotations:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      gateway:
+        config:
+          create: false
+          labels:
+            vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml
index aa6ee7a6056..d403d1ba468 100644
--- a/helm/litellm/values.yaml
+++ b/helm/litellm/values.yaml
@@ -314,6 +314,12 @@ gateway:
   config:
     create: true
     proxy_config: {}
+    # Extra labels and annotations for the generated ConfigMap (only used when
+    # create is true). Useful for tooling that selects or configures objects by
+    # their metadata, e.g. secret-injection webhooks that resolve placeholders
+    # such as ${vault:...} inside proxy_config.
+    labels: {}
+    annotations: {}
   # Serve Prometheus /metrics from a `metrics` sidecar container (same image,
   # `python -m litellm.proxy.prometheus_metrics_server`) that aggregates the
   # workers' PROMETHEUS_MULTIPROC_DIR samples over a shared emptyDir, so a