From a51727b6de75d7c6b3414b8dc58385610567ddca Mon Sep 17 00:00:00 2001 From: Waldemar Majkowski Date: Wed, 3 Jun 2026 18:29:40 +0200 Subject: [PATCH 1/2] feat(helm): support configurable httpGet scheme on health probes Add an optional `scheme` field (HTTP/HTTPS) to livenessProbe, readinessProbe and startupProbe, wired into each probe's httpGet.scheme and defaulting to HTTP. When the proxy terminates TLS on the container port (--ssl_keyfile_path / --ssl_certfile_path), the kubelet's plain-HTTP probes fail the TLS handshake (EOF) and the pod never becomes Ready. There was previously no way to make the probes use HTTPS. Default stays HTTP so rendered output is unchanged for existing users. Adds helm-unittest cases asserting the HTTP default and the HTTPS override on all three probes. Co-Authored-By: Claude Opus 4.8 --- helm/litellm-helm/Chart.yaml | 2 +- helm/litellm-helm/templates/deployment.yaml | 3 ++ helm/litellm-helm/tests/deployment_tests.yaml | 31 +++++++++++++++++++ helm/litellm-helm/values.yaml | 8 +++++ 4 files changed, 43 insertions(+), 1 deletion(-) diff --git a/helm/litellm-helm/Chart.yaml b/helm/litellm-helm/Chart.yaml index a3cb388ffc6..7c1ac121286 100644 --- a/helm/litellm-helm/Chart.yaml +++ b/helm/litellm-helm/Chart.yaml @@ -18,7 +18,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.1.3 +version: 1.2.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml index cf7b3f8a38d..f8f7a6898ae 100644 --- a/helm/litellm-helm/templates/deployment.yaml +++ b/helm/litellm-helm/templates/deployment.yaml @@ -97,6 +97,7 @@ spec: httpGet: path: {{ .Values.livenessProbe.path | quote }} port: "http" + scheme: {{ .Values.livenessProbe.scheme | default "HTTP" }} initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} @@ -106,6 +107,7 @@ spec: httpGet: path: {{ .Values.readinessProbe.path | quote }} port: "http" + scheme: {{ .Values.readinessProbe.scheme | default "HTTP" }} initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} @@ -115,6 +117,7 @@ spec: httpGet: path: {{ .Values.startupProbe.path | quote }} port: "http" + scheme: {{ .Values.startupProbe.scheme | default "HTTP" }} initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }} periodSeconds: {{ .Values.startupProbe.periodSeconds }} timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }} diff --git a/helm/litellm-helm/tests/deployment_tests.yaml b/helm/litellm-helm/tests/deployment_tests.yaml index ee946038202..844ecd40a90 100644 --- a/helm/litellm-helm/tests/deployment_tests.yaml +++ b/helm/litellm-helm/tests/deployment_tests.yaml @@ -492,3 +492,34 @@ tests: - equal: path: spec.template.metadata.annotations["example.com/literal"] value: "plain-string-value" + - it: should default probe httpGet scheme to HTTP + template: deployment.yaml + set: + image.tag: test + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.httpGet.scheme + value: HTTP + - equal: + path: spec.template.spec.containers[0].readinessProbe.httpGet.scheme + value: HTTP + - equal: + path: spec.template.spec.containers[0].startupProbe.httpGet.scheme + value: HTTP + - it: should set probe httpGet scheme to HTTPS when configured + template: deployment.yaml + set: + image.tag: test + livenessProbe.scheme: HTTPS + readinessProbe.scheme: HTTPS + startupProbe.scheme: HTTPS + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.httpGet.scheme + value: HTTPS + - equal: + path: spec.template.spec.containers[0].readinessProbe.httpGet.scheme + value: HTTPS + - equal: + path: spec.template.spec.containers[0].startupProbe.httpGet.scheme + value: HTTPS diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index fcee331a5aa..9466ac56864 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -92,6 +92,10 @@ service: # Probes for LiteLLM gateway container livenessProbe: path: /health/liveliness + # Scheme for the probe request: HTTP (default) or HTTPS. Set to HTTPS when the + # proxy terminates TLS on the container port (ssl_keyfile_path/ssl_certfile_path), + # otherwise the kubelet's plain-HTTP probe fails the TLS handshake. + scheme: HTTP initialDelaySeconds: 0 periodSeconds: 15 timeoutSeconds: 5 @@ -100,6 +104,8 @@ livenessProbe: readinessProbe: path: /health/readiness + # See livenessProbe.scheme. HTTP (default) or HTTPS. + scheme: HTTP initialDelaySeconds: 0 periodSeconds: 10 timeoutSeconds: 5 @@ -108,6 +114,8 @@ readinessProbe: startupProbe: path: /health/readiness + # See livenessProbe.scheme. HTTP (default) or HTTPS. + scheme: HTTP initialDelaySeconds: 0 periodSeconds: 10 timeoutSeconds: 5 From c87d257d31a63ceb4b5effa813004a94c700e5bd Mon Sep 17 00:00:00 2001 From: Waldemar Majkowski Date: Wed, 3 Jun 2026 18:35:42 +0200 Subject: [PATCH 2/2] fix(helm): upper-case probe scheme to tolerate lowercase input Pipe the probe scheme through `| upper` so values like `https` or `Http` render as valid Kubernetes httpGet.scheme values instead of being rejected by the API server at apply time. No-op for already upper-case values. Adds a helm-unittest case for lowercase input. Addresses Greptile review feedback on #29596. Co-Authored-By: Claude Opus 4.8 --- helm/litellm-helm/templates/deployment.yaml | 6 +++--- helm/litellm-helm/tests/deployment_tests.yaml | 17 +++++++++++++++++ helm/litellm-helm/values.yaml | 1 + 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/helm/litellm-helm/templates/deployment.yaml b/helm/litellm-helm/templates/deployment.yaml index f8f7a6898ae..5c943a27755 100644 --- a/helm/litellm-helm/templates/deployment.yaml +++ b/helm/litellm-helm/templates/deployment.yaml @@ -97,7 +97,7 @@ spec: httpGet: path: {{ .Values.livenessProbe.path | quote }} port: "http" - scheme: {{ .Values.livenessProbe.scheme | default "HTTP" }} + scheme: {{ .Values.livenessProbe.scheme | default "HTTP" | upper }} initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.livenessProbe.periodSeconds }} timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} @@ -107,7 +107,7 @@ spec: httpGet: path: {{ .Values.readinessProbe.path | quote }} port: "http" - scheme: {{ .Values.readinessProbe.scheme | default "HTTP" }} + scheme: {{ .Values.readinessProbe.scheme | default "HTTP" | upper }} initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} periodSeconds: {{ .Values.readinessProbe.periodSeconds }} timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} @@ -117,7 +117,7 @@ spec: httpGet: path: {{ .Values.startupProbe.path | quote }} port: "http" - scheme: {{ .Values.startupProbe.scheme | default "HTTP" }} + scheme: {{ .Values.startupProbe.scheme | default "HTTP" | upper }} initialDelaySeconds: {{ .Values.startupProbe.initialDelaySeconds }} periodSeconds: {{ .Values.startupProbe.periodSeconds }} timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }} diff --git a/helm/litellm-helm/tests/deployment_tests.yaml b/helm/litellm-helm/tests/deployment_tests.yaml index 844ecd40a90..2f7f28a2683 100644 --- a/helm/litellm-helm/tests/deployment_tests.yaml +++ b/helm/litellm-helm/tests/deployment_tests.yaml @@ -523,3 +523,20 @@ tests: - equal: path: spec.template.spec.containers[0].startupProbe.httpGet.scheme value: HTTPS + - it: should upper-case a lowercase probe scheme + template: deployment.yaml + set: + image.tag: test + livenessProbe.scheme: https + readinessProbe.scheme: https + startupProbe.scheme: https + asserts: + - equal: + path: spec.template.spec.containers[0].livenessProbe.httpGet.scheme + value: HTTPS + - equal: + path: spec.template.spec.containers[0].readinessProbe.httpGet.scheme + value: HTTPS + - equal: + path: spec.template.spec.containers[0].startupProbe.httpGet.scheme + value: HTTPS diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index 9466ac56864..a88f8a855d1 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -95,6 +95,7 @@ livenessProbe: # Scheme for the probe request: HTTP (default) or HTTPS. Set to HTTPS when the # proxy terminates TLS on the container port (ssl_keyfile_path/ssl_certfile_path), # otherwise the kubelet's plain-HTTP probe fails the TLS handshake. + # Case-insensitive — the value is upper-cased before rendering. scheme: HTTP initialDelaySeconds: 0 periodSeconds: 15