From 66c930a230f12edcc2108e8a17bf3971bf97aa41 Mon Sep 17 00:00:00 2001
From: tsushanth <t.sushanth@gmail.com>
Date: Sat, 8 Aug 2026 06:05:41 -0700
Subject: [PATCH] fix(helm): wire envFrom secrets and configmaps into
 migrations job (closes #30311)

---
 .../templates/migrations-job.yaml             |  9 +++
 .../tests/migrations-job_tests.yaml           | 55 +++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/helm/litellm-helm/templates/migrations-job.yaml b/helm/litellm-helm/templates/migrations-job.yaml
index 7bc1a133883..5460184c106 100644
--- a/helm/litellm-helm/templates/migrations-job.yaml
+++ b/helm/litellm-helm/templates/migrations-job.yaml
@@ -89,6 +89,15 @@ spec:
             {{- end }}
             - name: DISABLE_SCHEMA_UPDATE
               value: "false" # always run the migration from the Helm PreSync hook, override the value set
+          envFrom:
+          {{- range .Values.environmentSecrets }}
+            - secretRef:
+                name: {{ . }}
+          {{- end }}
+          {{- range .Values.environmentConfigMaps }}
+            - configMapRef:
+                name: {{ . }}
+          {{- end }}
           {{- with .Values.volumeMounts }}
           volumeMounts:
             {{- toYaml . | nindent 12 }}
diff --git a/helm/litellm-helm/tests/migrations-job_tests.yaml b/helm/litellm-helm/tests/migrations-job_tests.yaml
index 6bfc1f38adc..be2963163e5 100644
--- a/helm/litellm-helm/tests/migrations-job_tests.yaml
+++ b/helm/litellm-helm/tests/migrations-job_tests.yaml
@@ -223,6 +223,61 @@ tests:
             name: init-tpl
             image: "ghcr.io/berriai/litellm-database:test"
             command: ["echo", "hello"]
+  - it: should work with environmentSecrets
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+      environmentSecrets:
+        - litellm-env-secret
+        - litellm-extra-secret
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: litellm-env-secret
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: litellm-extra-secret
+
+  - it: should work with environmentConfigMaps
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+      environmentConfigMaps:
+        - litellm-env-configmap
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: litellm-env-configmap
+
+  - it: should work with both environmentSecrets and environmentConfigMaps
+    template: migrations-job.yaml
+    set:
+      migrationJob:
+        enabled: true
+      environmentSecrets:
+        - litellm-env-secret
+      environmentConfigMaps:
+        - litellm-env-configmap
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            secretRef:
+              name: litellm-env-secret
+      - contains:
+          path: spec.template.spec.containers[0].envFrom
+          content:
+            configMapRef:
+              name: litellm-env-configmap
+
   - it: should work with extraContainers
     template: migrations-job.yaml
     set: