scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-10 22:41:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 82

fix: PASSTHROUGH TLS protocol and configurable httpsRedirect

Browse source 
- PASSTHROUGH/AUTO_PASSTHROUGH modes now render protocol: TLS and name: tls
  (was incorrectly using HTTPS/https)
- httpsRedirect is now configurable via istio.gateway.tls.httpsRedirect
  using hasKey pattern to properly support false values
- httpsRedirect automatically omitted for PASSTHROUGH/AUTO_PASSTHROUGH modes
- Added 5 new test cases for PASSTHROUGH protocol, httpsRedirect=false,
  AUTO_PASSTHROUGH, and PASSTHROUGH HTTP server behavior
- Updated README with httpsRedirect, minProtocolVersion, maxProtocolVersion
  documentation
This commit is contained in:
StyleTang 2026-03-13 16:07:23 +08:00
parent d06dd204a3
commit b7afd3dad6
4 changed files with 92 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
deploy/charts/litellm-helm/README.md
View file

@ -168,10 +168,13 @@ Use these **instead of** `ingress` when your cluster runs Istio. Uses `networkin
| `istio.gateway.enabled` | Create an Istio Gateway resource. Set `false` to use an existing shared gateway (recommended in production) | `false` |
| `istio.gateway.selector` | Label selector to bind the Gateway to an ingress gateway pod | `{istio: ingressgateway}` |
| `istio.gateway.httpPort` | HTTP port number on the Gateway server | `80` |
| `istio.gateway.tls.enabled` | Add a HTTPS server block with TLS to the Gateway (also sets HTTP→HTTPS redirect) | `false` |
| `istio.gateway.tls.enabled` | Add a TLS server block to the Gateway. For SIMPLE/MUTUAL, also enables HTTP→HTTPS redirect (configurable via `httpsRedirect`) | `false` |
| `istio.gateway.tls.httpsPort` | HTTPS port number on the Gateway server | `443` |
| `istio.gateway.tls.httpsRedirect` | Redirect HTTP to HTTPS on the Gateway. Automatically disabled for PASSTHROUGH mode | `true` |
| `istio.gateway.tls.mode` | Istio TLS mode: `SIMPLE`, `MUTUAL`, or `PASSTHROUGH` | `SIMPLE` |
| `istio.gateway.tls.credentialName` | Name of the Kubernetes Secret (in `istio-system`) holding the TLS certificate | `""` |
| `istio.gateway.tls.minProtocolVersion` | Minimum TLS protocol version (e.g. `TLSV1_2`) | `""` |
| `istio.gateway.tls.maxProtocolVersion` | Maximum TLS protocol version (e.g. `TLSV1_3`) | `""` |
| `istio.gateway.labels` | Additional labels for the Gateway resource | `{}` |
| `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` |
| `istio.virtualService.enabled` | Create a VirtualService resource | `true` |

14
deploy/charts/litellm-helm/templates/istio-gateway.yaml
View file

@ -20,9 +20,11 @@ spec:
number: {{ .Values.istio.gateway.httpPort | default 80 }}
name: http
protocol: HTTP
{{- if .Values.istio.gateway.tls.enabled }}
{{- $tlsMode := .Values.istio.gateway.tls.mode | default "SIMPLE" }}
{{- $isPassthrough := or (eq $tlsMode "PASSTHROUGH") (eq $tlsMode "AUTO_PASSTHROUGH") }}
{{- if and .Values.istio.gateway.tls.enabled (not $isPassthrough) }}
tls:
httpsRedirect: true
httpsRedirect: {{ if hasKey .Values.istio.gateway.tls "httpsRedirect" }}{{ .Values.istio.gateway.tls.httpsRedirect }}{{ else }}true{{ end }}
{{- end }}
hosts:
{{- range .Values.istio.hosts }}
@ -31,11 +33,11 @@ spec:
{{- if .Values.istio.gateway.tls.enabled }}
- port:
number: {{ .Values.istio.gateway.tls.httpsPort | default 443 }}
name: https
protocol: HTTPS
name: {{ if $isPassthrough }}tls{{ else }}https{{ end }}
protocol: {{ if $isPassthrough }}TLS{{ else }}HTTPS{{ end }}
tls:
mode: {{ .Values.istio.gateway.tls.mode | default "SIMPLE" }}
{{- if ne (.Values.istio.gateway.tls.mode | default "SIMPLE") "PASSTHROUGH" }}
mode: {{ $tlsMode }}
{{- if not $isPassthrough }}
{{- if not .Values.istio.gateway.tls.credentialName }}
{{- fail "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode" }}
{{- end }}

79
deploy/charts/litellm-helm/tests/istio_tests.yaml
View file

@ -762,7 +762,7 @@ tests:
errorMessage: "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode"
template: istio-gateway.yaml
- it: should not emit credentialName for PASSTHROUGH mode
- it: should not emit credentialName for PASSTHROUGH mode and should use TLS protocol
set:
istio:
enabled: true
@ -781,3 +781,80 @@ tests:
path: spec.servers[1].tls.mode
value: PASSTHROUGH
template: istio-gateway.yaml
- equal:
path: spec.servers[1].port.name
value: tls
template: istio-gateway.yaml
- equal:
path: spec.servers[1].port.protocol
value: TLS
template: istio-gateway.yaml
# PASSTHROUGH should NOT have httpsRedirect on the HTTP server
- isNull:
path: spec.servers[0].tls
template: istio-gateway.yaml
- it: should use HTTPS protocol and https name for SIMPLE TLS mode
set:
istio:
enabled: true
hosts:
- api.example.com
gateway:
enabled: true
tls:
enabled: true
mode: SIMPLE
credentialName: litellm-tls-cert
asserts:
- equal:
path: spec.servers[1].port.name
value: https
template: istio-gateway.yaml
- equal:
path: spec.servers[1].port.protocol
value: HTTPS
template: istio-gateway.yaml
- it: should allow disabling httpsRedirect
set:
istio:
enabled: true
hosts:
- api.example.com
gateway:
enabled: true
tls:
enabled: true
mode: SIMPLE
credentialName: litellm-tls-cert
httpsRedirect: false
asserts:
- equal:
path: spec.servers[0].tls.httpsRedirect
value: false
template: istio-gateway.yaml
- it: should use TLS protocol for AUTO_PASSTHROUGH mode
set:
istio:
enabled: true
hosts:
- api.example.com
gateway:
enabled: true
tls:
enabled: true
mode: AUTO_PASSTHROUGH
asserts:
- equal:
path: spec.servers[1].port.name
value: tls
template: istio-gateway.yaml
- equal:
path: spec.servers[1].port.protocol
value: TLS
template: istio-gateway.yaml
- isNull:
path: spec.servers[0].tls
template: istio-gateway.yaml

2
deploy/charts/litellm-helm/values.yaml
View file

@ -155,6 +155,8 @@ istio:
httpPort: 80
tls:
enabled: false
# Redirect HTTP to HTTPS (disabled automatically for PASSTHROUGH mode)
httpsRedirect: true
# HTTPS port for the Gateway server
httpsPort: 443
# TLS mode: SIMPLE, MUTUAL, PASSTHROUGH, etc.