diff --git a/deploy/charts/litellm-helm/README.md b/deploy/charts/litellm-helm/README.md index 86e09a9de17..fd198cdf536 100644 --- a/deploy/charts/litellm-helm/README.md +++ b/deploy/charts/litellm-helm/README.md @@ -168,10 +168,13 @@ Use these **instead of** `ingress` when your cluster runs Istio. Uses `networkin | `istio.gateway.enabled` | Create an Istio Gateway resource. Set `false` to use an existing shared gateway (recommended in production) | `false` | | `istio.gateway.selector` | Label selector to bind the Gateway to an ingress gateway pod | `{istio: ingressgateway}` | | `istio.gateway.httpPort` | HTTP port number on the Gateway server | `80` | -| `istio.gateway.tls.enabled` | Add a HTTPS server block with TLS to the Gateway (also sets HTTP→HTTPS redirect) | `false` | +| `istio.gateway.tls.enabled` | Add a TLS server block to the Gateway. For SIMPLE/MUTUAL, also enables HTTP→HTTPS redirect (configurable via `httpsRedirect`) | `false` | | `istio.gateway.tls.httpsPort` | HTTPS port number on the Gateway server | `443` | +| `istio.gateway.tls.httpsRedirect` | Redirect HTTP to HTTPS on the Gateway. Automatically disabled for PASSTHROUGH mode | `true` | | `istio.gateway.tls.mode` | Istio TLS mode: `SIMPLE`, `MUTUAL`, or `PASSTHROUGH` | `SIMPLE` | | `istio.gateway.tls.credentialName` | Name of the Kubernetes Secret (in `istio-system`) holding the TLS certificate | `""` | +| `istio.gateway.tls.minProtocolVersion` | Minimum TLS protocol version (e.g. `TLSV1_2`) | `""` | +| `istio.gateway.tls.maxProtocolVersion` | Maximum TLS protocol version (e.g. `TLSV1_3`) | `""` | | `istio.gateway.labels` | Additional labels for the Gateway resource | `{}` | | `istio.gateway.annotations` | Additional annotations for the Gateway resource | `{}` | | `istio.virtualService.enabled` | Create a VirtualService resource | `true` | diff --git a/deploy/charts/litellm-helm/templates/istio-gateway.yaml b/deploy/charts/litellm-helm/templates/istio-gateway.yaml index 54589da25e5..39ca16a4662 100644 --- a/deploy/charts/litellm-helm/templates/istio-gateway.yaml +++ b/deploy/charts/litellm-helm/templates/istio-gateway.yaml @@ -20,9 +20,11 @@ spec: number: {{ .Values.istio.gateway.httpPort | default 80 }} name: http protocol: HTTP - {{- if .Values.istio.gateway.tls.enabled }} + {{- $tlsMode := .Values.istio.gateway.tls.mode | default "SIMPLE" }} + {{- $isPassthrough := or (eq $tlsMode "PASSTHROUGH") (eq $tlsMode "AUTO_PASSTHROUGH") }} + {{- if and .Values.istio.gateway.tls.enabled (not $isPassthrough) }} tls: - httpsRedirect: true + httpsRedirect: {{ if hasKey .Values.istio.gateway.tls "httpsRedirect" }}{{ .Values.istio.gateway.tls.httpsRedirect }}{{ else }}true{{ end }} {{- end }} hosts: {{- range .Values.istio.hosts }} @@ -31,11 +33,11 @@ spec: {{- if .Values.istio.gateway.tls.enabled }} - port: number: {{ .Values.istio.gateway.tls.httpsPort | default 443 }} - name: https - protocol: HTTPS + name: {{ if $isPassthrough }}tls{{ else }}https{{ end }} + protocol: {{ if $isPassthrough }}TLS{{ else }}HTTPS{{ end }} tls: - mode: {{ .Values.istio.gateway.tls.mode | default "SIMPLE" }} - {{- if ne (.Values.istio.gateway.tls.mode | default "SIMPLE") "PASSTHROUGH" }} + mode: {{ $tlsMode }} + {{- if not $isPassthrough }} {{- if not .Values.istio.gateway.tls.credentialName }} {{- fail "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode" }} {{- end }} diff --git a/deploy/charts/litellm-helm/tests/istio_tests.yaml b/deploy/charts/litellm-helm/tests/istio_tests.yaml index d62d0a97a0c..09ab65a532e 100644 --- a/deploy/charts/litellm-helm/tests/istio_tests.yaml +++ b/deploy/charts/litellm-helm/tests/istio_tests.yaml @@ -762,7 +762,7 @@ tests: errorMessage: "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode" template: istio-gateway.yaml - - it: should not emit credentialName for PASSTHROUGH mode + - it: should not emit credentialName for PASSTHROUGH mode and should use TLS protocol set: istio: enabled: true @@ -781,3 +781,80 @@ tests: path: spec.servers[1].tls.mode value: PASSTHROUGH template: istio-gateway.yaml + - equal: + path: spec.servers[1].port.name + value: tls + template: istio-gateway.yaml + - equal: + path: spec.servers[1].port.protocol + value: TLS + template: istio-gateway.yaml + # PASSTHROUGH should NOT have httpsRedirect on the HTTP server + - isNull: + path: spec.servers[0].tls + template: istio-gateway.yaml + + - it: should use HTTPS protocol and https name for SIMPLE TLS mode + set: + istio: + enabled: true + hosts: + - api.example.com + gateway: + enabled: true + tls: + enabled: true + mode: SIMPLE + credentialName: litellm-tls-cert + asserts: + - equal: + path: spec.servers[1].port.name + value: https + template: istio-gateway.yaml + - equal: + path: spec.servers[1].port.protocol + value: HTTPS + template: istio-gateway.yaml + + - it: should allow disabling httpsRedirect + set: + istio: + enabled: true + hosts: + - api.example.com + gateway: + enabled: true + tls: + enabled: true + mode: SIMPLE + credentialName: litellm-tls-cert + httpsRedirect: false + asserts: + - equal: + path: spec.servers[0].tls.httpsRedirect + value: false + template: istio-gateway.yaml + + - it: should use TLS protocol for AUTO_PASSTHROUGH mode + set: + istio: + enabled: true + hosts: + - api.example.com + gateway: + enabled: true + tls: + enabled: true + mode: AUTO_PASSTHROUGH + asserts: + - equal: + path: spec.servers[1].port.name + value: tls + template: istio-gateway.yaml + - equal: + path: spec.servers[1].port.protocol + value: TLS + template: istio-gateway.yaml + - isNull: + path: spec.servers[0].tls + template: istio-gateway.yaml diff --git a/deploy/charts/litellm-helm/values.yaml b/deploy/charts/litellm-helm/values.yaml index aed8f60405d..63b8dc7ecda 100644 --- a/deploy/charts/litellm-helm/values.yaml +++ b/deploy/charts/litellm-helm/values.yaml @@ -155,6 +155,8 @@ istio: httpPort: 80 tls: enabled: false + # Redirect HTTP to HTTPS (disabled automatically for PASSTHROUGH mode) + httpsRedirect: true # HTTPS port for the Gateway server httpsPort: 443 # TLS mode: SIMPLE, MUTUAL, PASSTHROUGH, etc.