From 96521620b9d9954dcc1d13bb7c93921e491f422b Mon Sep 17 00:00:00 2001
From: Denis Lisovsky <kirosvi@gmail.com>
Date: Thu, 1 Oct 2026 16:15:31 +0500
Subject: [PATCH] feat(helm): allow labels and annotations on the proxy
 ConfigMap

Add proxyConfigMap.labels and proxyConfigMap.annotations, rendered on the
generated <release>-config ConfigMap when proxyConfigMap.create is true.

Secret-injection webhooks (e.g. bank-vaults) resolve placeholders such as
${vault:...} inside the ConfigMap and read their auth settings (role, path,
TLS) from the object's own annotations. The pod already has podAnnotations
and the migration Job has migrationJob.annotations, but the ConfigMap had no
metadata knob, so a proxy_config with placeholders could not be resolved
without forking the chart.
---
 .../templates/configmap-litellm.yaml          |  8 ++++
 helm/litellm-helm/tests/configmap_tests.yaml  | 43 +++++++++++++++++++
 helm/litellm-helm/values.yaml                 |  6 +++
 3 files changed, 57 insertions(+)
 create mode 100644 helm/litellm-helm/tests/configmap_tests.yaml

diff --git a/helm/litellm-helm/templates/configmap-litellm.yaml b/helm/litellm-helm/templates/configmap-litellm.yaml
index 03e4f620206..d84ccfd0631 100644
--- a/helm/litellm-helm/templates/configmap-litellm.yaml
+++ b/helm/litellm-helm/templates/configmap-litellm.yaml
@@ -16,6 +16,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.fullname" . }}-config
+  {{- with .Values.proxyConfigMap.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.proxyConfigMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ $config | toYaml | indent 6 }}
diff --git a/helm/litellm-helm/tests/configmap_tests.yaml b/helm/litellm-helm/tests/configmap_tests.yaml
new file mode 100644
index 00000000000..5f9b9711428
--- /dev/null
+++ b/helm/litellm-helm/tests/configmap_tests.yaml
@@ -0,0 +1,43 @@
+suite: test proxy configmap
+templates:
+  - configmap-litellm.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      proxyConfigMap:
+        create: true
+        labels:
+          vault-injection: enabled
+        annotations:
+          vault.security.banzaicloud.io/vault-role: vault-injector
+          vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      proxyConfigMap:
+        create: false
+        name: my-existing-config
+        labels:
+          vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml
index 9afce050261..0f2e651b53e 100644
--- a/helm/litellm-helm/values.yaml
+++ b/helm/litellm-helm/values.yaml
@@ -165,6 +165,12 @@ billingMetrics:
 proxyConfigMap:
   # when true, creates a new configmap
   create: true
+  # Extra labels and annotations for the generated ConfigMap (only used when
+  # create is true). Useful for tooling that selects or configures objects by
+  # their metadata, e.g. secret-injection webhooks that resolve placeholders
+  # such as ${vault:...} inside proxy_config.
+  labels: {}
+  annotations: {}
   # if create is false and name is set, use existing ConfigMap
   # create: false
   # name: ""