Merge pull request #39112 from BerriAI/litellm_helm_migration_argocd_hook_strategy

feat(helm): add Argo CD PreSync hook and rollout strategy knobs to the componentized chart

helm/litellm/templates/backend/deployment.yaml

@@ -7,6 +7,10 @@ metadata:
     {{- include "litellm.commonLabels" . | nindent 4 }}
     app.kubernetes.io/component: backend
 spec:
+  {{- with .Values.backend.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "litellm.backend.selectorLabels" . | nindent 6 }}

helm/litellm/templates/gateway/deployment.yaml

@@ -7,6 +7,10 @@ metadata:
     {{- include "litellm.commonLabels" . | nindent 4 }}
     app.kubernetes.io/component: gateway
 spec:
+  {{- with .Values.gateway.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "litellm.gateway.selectorLabels" . | nindent 6 }}

helm/litellm/templates/migrations-job.yaml

@@ -7,6 +7,8 @@
 #
 # Running this pre-upgrade closes the window where new application pods would
 # otherwise serve traffic against the previous release's unmigrated schema.
+# Argo CD users can swap the Helm hook for a PreSync hook through
+# `migrationJob.hooks`, which re-runs the Job on every sync.
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -14,10 +16,18 @@ metadata:
   labels:
     {{- include "litellm.commonLabels" . | nindent 4 }}
     app.kubernetes.io/component: migrations
+  {{- if or .Values.migrationJob.hooks.helm.enabled .Values.migrationJob.hooks.argocd.enabled }}
   annotations:
+    {{- if .Values.migrationJob.hooks.helm.enabled }}
     helm.sh/hook: pre-install,pre-upgrade
     helm.sh/hook-delete-policy: before-hook-creation
-    helm.sh/hook-weight: "0"
+    helm.sh/hook-weight: {{ .Values.migrationJob.hooks.helm.weight | default "0" | quote }}
+    {{- end }}
+    {{- if .Values.migrationJob.hooks.argocd.enabled }}
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    {{- end }}
+  {{- end }}
 spec:
   backoffLimit: {{ .Values.migrationJob.backoffLimit }}
   ttlSecondsAfterFinished: {{ .Values.migrationJob.ttlSecondsAfterFinished }}

helm/litellm/templates/ui/deployment.yaml

@@ -7,6 +7,10 @@ metadata:
     {{- include "litellm.commonLabels" . | nindent 4 }}
     app.kubernetes.io/component: ui
 spec:
+  {{- with .Values.ui.strategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       {{- include "litellm.ui.selectorLabels" . | nindent 6 }}

helm/litellm/tests/migration_job_hooks_tests.yaml

@@ -0,0 +1,63 @@
+suite: test migrations Job hook annotations
+templates:
+  - migrations-job.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: runs as a Helm pre-install / pre-upgrade hook by default
+    asserts:
+      - equal:
+          path: metadata.annotations["helm.sh/hook"]
+          value: pre-install,pre-upgrade
+      - equal:
+          path: metadata.annotations["helm.sh/hook-delete-policy"]
+          value: before-hook-creation
+      - equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "0"
+      - notExists:
+          path: metadata.annotations["argocd.argoproj.io/hook"]
+
+  - it: adds the Argo CD PreSync hook when asked
+    set:
+      migrationJob.hooks.argocd.enabled: true
+    asserts:
+      - equal:
+          path: metadata.annotations["argocd.argoproj.io/hook"]
+          value: PreSync
+      - equal:
+          path: metadata.annotations["argocd.argoproj.io/hook-delete-policy"]
+          value: BeforeHookCreation
+
+  - it: drops the Helm hook so Argo CD owns the Job
+    set:
+      migrationJob.hooks.argocd.enabled: true
+      migrationJob.hooks.helm.enabled: false
+    asserts:
+      - equal:
+          path: metadata.annotations["argocd.argoproj.io/hook"]
+          value: PreSync
+      - notExists:
+          path: metadata.annotations["helm.sh/hook"]
+      - notExists:
+          path: metadata.annotations["helm.sh/hook-delete-policy"]
+      - notExists:
+          path: metadata.annotations["helm.sh/hook-weight"]
+
+  - it: renders an ordinary Job when both hooks are disabled
+    set:
+      migrationJob.hooks.helm.enabled: false
+    asserts:
+      - notExists:
+          path: metadata.annotations
+      - equal:
+          path: kind
+          value: Job
+
+  - it: honours a custom Helm hook weight
+    set:
+      migrationJob.hooks.helm.weight: "-5"
+    asserts:
+      - equal:
+          path: metadata.annotations["helm.sh/hook-weight"]
+          value: "-5"

helm/litellm/tests/rollout_strategy_tests.yaml

@@ -0,0 +1,66 @@
+suite: test rolling update strategy on the component deployments
+templates:
+  - gateway/deployment.yaml
+  - gateway/configmap.yaml
+  - backend/deployment.yaml
+  - ui/deployment.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: leaves the strategy to Kubernetes defaults when unset
+    asserts:
+      - notExists:
+          path: spec.strategy
+
+  - it: renders the configured strategy on each deployment
+    set:
+      gateway.strategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 0
+          maxSurge: 1
+      backend.strategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: "25%"
+          maxSurge: 2
+      ui.strategy:
+        type: Recreate
+    asserts:
+      - equal:
+          path: spec.strategy
+          value:
+            type: RollingUpdate
+            rollingUpdate:
+              maxUnavailable: 0
+              maxSurge: 1
+        template: gateway/deployment.yaml
+      - equal:
+          path: spec.strategy
+          value:
+            type: RollingUpdate
+            rollingUpdate:
+              maxUnavailable: 25%
+              maxSurge: 2
+        template: backend/deployment.yaml
+      - equal:
+          path: spec.strategy
+          value:
+            type: Recreate
+        template: ui/deployment.yaml
+
+  - it: keeps a component on the cluster default when only another one sets a strategy
+    set:
+      gateway.strategy:
+        type: Recreate
+    asserts:
+      - equal:
+          path: spec.strategy.type
+          value: Recreate
+        template: gateway/deployment.yaml
+      - notExists:
+          path: spec.strategy
+        template: backend/deployment.yaml
+      - notExists:
+          path: spec.strategy
+        template: ui/deployment.yaml

helm/litellm/values.yaml

@@ -75,6 +75,22 @@ serviceAccounts:
 # generate` — the migration engine doesn't need the generated client.
 migrationJob:
   enabled: true
+  # Which controller is responsible for running the Job.
+  #
+  # `helm.enabled` renders the Helm pre-install / pre-upgrade hook, so the Job
+  # runs whenever `helm upgrade` sees a change to apply. `argocd.enabled`
+  # renders an Argo CD PreSync hook instead, which runs the Job on every sync
+  # even when the rendered manifests are unchanged: the way to re-run
+  # migrations on demand from a GitOps pipeline. Turning the Helm hook off
+  # while the Argo CD hook is on leaves the Job out of Helm's own upgrade
+  # path, which is what Argo CD users want since Argo, not Helm, applies the
+  # manifests.
+  hooks:
+    helm:
+      enabled: true
+      weight: "0"
+    argocd:
+      enabled: false
   backoffLimit: 4
   ttlSecondsAfterFinished: 120
   # Wall-clock budget for the whole Job, shared across every `backoffLimit`
@@ -257,6 +273,15 @@ gateway:
     initialDelaySeconds: 5
     periodSeconds: 10
     timeoutSeconds: 10
+  # Rolling update tuning for the gateway Deployment. Empty by default, so
+  # Kubernetes applies its own RollingUpdate defaults (25% maxSurge /
+  # 25% maxUnavailable). Example, for a surge-only rollout behind a load
+  # balancer that must never lose capacity:
+  #   type: RollingUpdate
+  #   rollingUpdate:
+  #     maxUnavailable: 0
+  #     maxSurge: 1
+  strategy: {}
   # Optional startupProbe. Empty by default, so existing installs are unchanged
   # and liveness/readiness apply from container start. Set it to gate
   # liveness/readiness until a slow cold start finishes — a high failureThreshold
@@ -369,6 +394,8 @@ backend:
     initialDelaySeconds: 5
     periodSeconds: 10
     timeoutSeconds: 10
+  # Same shape as gateway.strategy.
+  strategy: {}
   # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
   startupProbe: {}
   hpa:
@@ -433,6 +460,8 @@ ui:
     httpGet: { path: /, port: http }
     initialDelaySeconds: 2
     periodSeconds: 10
+  # Same shape as gateway.strategy.
+  strategy: {}
   # Optional startupProbe; same shape as gateway.startupProbe. Empty by default.
   startupProbe: {}
   hpa: