scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-16 04:29:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 139

feat(helm): expose Redis TLS settings in the litellm chart redis values (#46536)

Browse source 
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
Yassin Kortam 2026-10-15 15:13:48 -07:00 • committed by GitHub
parent 40187731b7
commit 8036a08078
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 198 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
helm/litellm/templates/_helpers.tpl
View file

@ -475,6 +475,27 @@ harmless no-op for the Job and authoritative for the app pods.
{{- end }}
{{- end }}
{{- end }}
{{- $sslCertReqs := $root.Values.redis.sslCertReqs }}
{{- if and $sslCertReqs (not (has $sslCertReqs (list "none" "optional" "required"))) }}
{{- fail (printf "redis.sslCertReqs must be one of none, optional, required (got %q)" $sslCertReqs) }}
{{- end }}
{{- if and $urlKey (or $root.Values.redis.ssl $sslCertReqs $root.Values.redis.sslCaCerts) }}
{{- fail "redis.ssl, redis.sslCertReqs and redis.sslCaCerts cannot be combined with redis.passwordSecret.urlKey, use a rediss:// URL with ssl_cert_reqs / ssl_ca_certs query parameters instead" }}
{{- end }}
{{- if or $root.Values.redis.host $hostKey }}
{{- if $root.Values.redis.ssl }}
- name: REDIS_SSL
value: "true"
{{- end }}
{{- if $sslCertReqs }}
- name: REDIS_SSL_CERT_REQS
value: {{ $sslCertReqs | quote }}
{{- end }}
{{- if $root.Values.redis.sslCaCerts }}
- name: REDIS_SSL_CA_CERTS
value: {{ $root.Values.redis.sslCaCerts | quote }}
{{- end }}
{{- end }}
{{- with $component.extraEnv }}
{{ toYaml . }}
{{- end }}

166
helm/litellm/tests/redis_env_tests.yaml
View file

@ -3,6 +3,7 @@ templates:
- gateway/deployment.yaml
- gateway/configmap.yaml
- backend/deployment.yaml
- migrations-job.yaml
values:
- ./values/required.yaml
tests:
@ -320,3 +321,168 @@ tests:
asserts:
- failedTemplate:
errorMessage: "redis.passwordSecret.name is required when hostKey or urlKey is set"
- it: redis omits TLS env vars by default
template: gateway/deployment.yaml
set:
redis.host: redis.example.com
asserts:
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
any: true
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
any: true
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CA_CERTS
any: true
- it: redis ssl false omits REDIS_SSL
template: gateway/deployment.yaml
set:
redis.host: redis.example.com
redis.ssl: false
redis.sslCertReqs: required
asserts:
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
any: true
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
value: "required"
- it: gateway renders redis TLS env vars
template: gateway/deployment.yaml
set:
redis.host: redis.example.com
redis.ssl: true
redis.sslCertReqs: none
redis.sslCaCerts: /etc/redis-tls/ca.crt
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
value: "true"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
value: "none"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CA_CERTS
value: "/etc/redis-tls/ca.crt"
- it: backend renders redis TLS env vars
template: backend/deployment.yaml
set:
redis.host: redis.example.com
redis.ssl: true
redis.sslCertReqs: required
redis.sslCaCerts: /etc/redis-tls/ca.crt
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
value: "true"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
value: "required"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CA_CERTS
value: "/etc/redis-tls/ca.crt"
- it: migration job renders redis TLS env vars
template: migrations-job.yaml
set:
db.deployStandalone: false
db.useExisting: true
db.endpoint: postgres.example.com
db.secret.name: pg-secret
redis.host: redis.example.com
redis.ssl: true
redis.sslCertReqs: optional
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
value: "true"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
value: "optional"
- it: redis TLS values reject a secret-backed URL
template: gateway/deployment.yaml
set:
redis.passwordSecret.name: redis-secret
redis.passwordSecret.urlKey: connection-url
redis.sslCaCerts: /etc/redis-tls/ca.crt
asserts:
- failedTemplate:
errorMessage: "redis.ssl, redis.sslCertReqs and redis.sslCaCerts cannot be combined with redis.passwordSecret.urlKey, use a rediss:// URL with ssl_cert_reqs / ssl_ca_certs query parameters instead"
- it: hostKey mode renders redis TLS env vars
template: gateway/deployment.yaml
set:
redis.passwordSecret.name: redis-secret
redis.passwordSecret.hostKey: hostname
redis.ssl: true
redis.sslCaCerts: /etc/redis-tls/ca.crt
asserts:
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
value: "true"
- contains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CA_CERTS
value: "/etc/redis-tls/ca.crt"
- it: redis TLS env vars are omitted when redis is not configured
template: gateway/deployment.yaml
set:
redis.ssl: true
redis.sslCertReqs: none
asserts:
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL
any: true
- notContains:
path: spec.template.spec.containers[0].env
content:
name: REDIS_SSL_CERT_REQS
any: true
- it: redis sslCertReqs rejects unknown values
template: gateway/deployment.yaml
set:
redis.host: redis.example.com
redis.ssl: true
redis.sslCertReqs: strict
asserts:
- failedTemplate:
errorMessage: 'redis.sslCertReqs must be one of none, optional, required (got "strict")'

11
helm/litellm/values.yaml
View file

@ -275,10 +275,21 @@ database:
# self-hosted Redis Cluster). The chart emits REDIS_CLUSTER_NODES from
# `host` / `port` as the single seed; the cluster client discovers the
# remaining nodes from CLUSTER SLOTS at startup.
#
# For a TLS Redis endpoint set `ssl: true`, which the chart emits as REDIS_SSL.
# `sslCertReqs` (none / optional / required) becomes REDIS_SSL_CERT_REQS and
# `sslCaCerts` (path to a CA bundle mounted in the pod, e.g. via
# `extraVolumeMounts`) becomes REDIS_SSL_CA_CERTS. All three are omitted when
# unset. They apply to `host` / `hostKey` mode only. With `passwordSecret.urlKey`
# the proxy reads TLS settings from the URL itself, so use `rediss://` and the
# `ssl_cert_reqs` / `ssl_ca_certs` query parameters there instead.
redis:
cluster: false
host: ""
port: 6379
ssl: false
sslCertReqs: ""
sslCaCerts: ""
passwordSecret:
name: "" # Leave empty for auth-less Redis
passwordKey: password