From a5b0f7cf2cf4e720a067a5a444b1f3c996a61c0f Mon Sep 17 00:00:00 2001 From: Yassin Kortam Date: Thu, 9 Jul 2026 19:57:39 +0300 Subject: [PATCH] test(helm): pin that the migrations job never mounts the billing cert The componentized chart's suite asserts the backend Deployment stays clear of the billing wiring, since only the gateway serves billable traffic. The classic chart has no backend, but it does have a second pod: the migrations Job, which renders its own env from envVars and extraEnvVars. Nothing today wires the billing include into it, and nothing stopped a future edit from doing so. Asserts absence of the env, and that the Job grows no volumes or volumeMounts at all. Both are notExists rather than notContains because the Job renders neither key by default, so a notContains would fail on an unknown path instead of checking the absence it looks like it is checking. --- .../tests/billing_metrics_tests.yaml | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/helm/litellm-helm/tests/billing_metrics_tests.yaml b/helm/litellm-helm/tests/billing_metrics_tests.yaml index da96824c30a..71803df378c 100644 --- a/helm/litellm-helm/tests/billing_metrics_tests.yaml +++ b/helm/litellm-helm/tests/billing_metrics_tests.yaml @@ -2,6 +2,7 @@ suite: test billingMetrics wiring on the proxy deployment templates: - deployment.yaml - configmap-litellm.yaml + - migrations-job.yaml tests: - it: is off by default, adding no env, volume, or mount template: deployment.yaml @@ -256,6 +257,25 @@ tests: mountPath: /etc/litellm/config.yaml subPath: config.yaml + # Only the proxy serves billable traffic. The migrations Job must never mount + # the client certificate, and it renders its own env and volumes, so nothing + # stops a future edit from wiring the billing include into it by mistake. + - it: does not touch the migrations job when enabled + template: migrations-job.yaml + set: + billingMetrics: + enabled: true + asserts: + - notContains: + path: spec.template.spec.containers[0].env + content: + name: LITELLM_BILLING_METRICS_ENDPOINT + value: https://telemetry.litellm.ai + - notExists: + path: spec.template.spec.containers[0].volumeMounts + - notExists: + path: spec.template.spec.volumes + - it: fails loudly when enabled with an emptied secretName template: deployment.yaml set: