From d06dd204a3f9911e935b03ae60cc77355908d0ee Mon Sep 17 00:00:00 2001
From: StyleTang <styletang@apache.org>
Date: Fri, 13 Mar 2026 15:52:03 +0800
Subject: [PATCH] fix: add validation guards for Istio templates

- Gateway: credentialName only emitted for non-PASSTHROUGH TLS modes;
  fail when credentialName empty for SIMPLE/MUTUAL
- VirtualService: fail when neither gateway.enabled nor
  virtualService.gateways is configured (prevents null gateways field)
- Tests: add gateway.enabled to DestinationRule tests to satisfy
  VirtualService validation guard; add 4 validation guard test cases
  (total 40 Istio tests, all passing)
---
 .../litellm-helm/templates/istio-gateway.yaml |  5 ++
 .../templates/istio-virtualservice.yaml       |  3 +
 .../litellm-helm/tests/istio_tests.yaml       | 87 +++++++++++++++++++
 3 files changed, 95 insertions(+)

diff --git a/deploy/charts/litellm-helm/templates/istio-gateway.yaml b/deploy/charts/litellm-helm/templates/istio-gateway.yaml
index 8b3c56e1425..54589da25e5 100644
--- a/deploy/charts/litellm-helm/templates/istio-gateway.yaml
+++ b/deploy/charts/litellm-helm/templates/istio-gateway.yaml
@@ -35,7 +35,12 @@ spec:
         protocol: HTTPS
       tls:
         mode: {{ .Values.istio.gateway.tls.mode | default "SIMPLE" }}
+        {{- if ne (.Values.istio.gateway.tls.mode | default "SIMPLE") "PASSTHROUGH" }}
+        {{- if not .Values.istio.gateway.tls.credentialName }}
+        {{- fail "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode" }}
+        {{- end }}
         credentialName: {{ .Values.istio.gateway.tls.credentialName | quote }}
+        {{- end }}
         {{- if .Values.istio.gateway.tls.minProtocolVersion }}
         minProtocolVersion: {{ .Values.istio.gateway.tls.minProtocolVersion }}
         {{- end }}
diff --git a/deploy/charts/litellm-helm/templates/istio-virtualservice.yaml b/deploy/charts/litellm-helm/templates/istio-virtualservice.yaml
index 96353c51bcb..bfe369c83de 100644
--- a/deploy/charts/litellm-helm/templates/istio-virtualservice.yaml
+++ b/deploy/charts/litellm-helm/templates/istio-virtualservice.yaml
@@ -20,6 +20,9 @@ spec:
     - {{ . | quote }}
     {{- end }}
   gateways:
+    {{- if and (not .Values.istio.gateway.enabled) (not .Values.istio.virtualService.gateways) }}
+    {{- fail "istio.virtualService: at least one gateway must be configured — either set istio.gateway.enabled=true or provide istio.virtualService.gateways" }}
+    {{- end }}
     {{- if .Values.istio.gateway.enabled }}
     - {{ $fullName }}
     {{- end }}
diff --git a/deploy/charts/litellm-helm/tests/istio_tests.yaml b/deploy/charts/litellm-helm/tests/istio_tests.yaml
index cf4945332fa..d62d0a97a0c 100644
--- a/deploy/charts/litellm-helm/tests/istio_tests.yaml
+++ b/deploy/charts/litellm-helm/tests/istio_tests.yaml
@@ -585,6 +585,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
     asserts:
@@ -602,6 +604,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
     asserts:
@@ -614,6 +618,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
     asserts:
@@ -626,6 +632,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
           trafficPolicy:
@@ -648,6 +656,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
           trafficPolicy:
@@ -665,6 +675,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
           labels:
@@ -685,6 +697,8 @@ tests:
     set:
       istio:
         enabled: true
+        gateway:
+          enabled: true
         destinationRule:
           enabled: true
     asserts:
@@ -694,3 +708,76 @@ tests:
       - isNotNull:
           path: metadata.labels["helm.sh/chart"]
         template: istio-destinationrule.yaml
+
+  #
+  # === Validation Guards ===
+  #
+  - it: should fail when VirtualService has no gateway source
+    set:
+      istio:
+        enabled: true
+        hosts:
+          - api.example.com
+        gateway:
+          enabled: false
+        virtualService:
+          enabled: true
+          gateways: []
+    asserts:
+      - failedTemplate:
+          errorMessage: "istio.virtualService: at least one gateway must be configured \u2014 either set istio.gateway.enabled=true or provide istio.virtualService.gateways"
+        template: istio-virtualservice.yaml
+
+  - it: should fail when TLS enabled without credentialName for SIMPLE mode
+    set:
+      istio:
+        enabled: true
+        hosts:
+          - api.example.com
+        gateway:
+          enabled: true
+          tls:
+            enabled: true
+            mode: SIMPLE
+            credentialName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode"
+        template: istio-gateway.yaml
+
+  - it: should fail when TLS enabled without credentialName for MUTUAL mode
+    set:
+      istio:
+        enabled: true
+        hosts:
+          - api.example.com
+        gateway:
+          enabled: true
+          tls:
+            enabled: true
+            mode: MUTUAL
+            credentialName: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "istio.gateway.tls.credentialName must be set for SIMPLE or MUTUAL TLS mode"
+        template: istio-gateway.yaml
+
+  - it: should not emit credentialName for PASSTHROUGH mode
+    set:
+      istio:
+        enabled: true
+        hosts:
+          - api.example.com
+        gateway:
+          enabled: true
+          tls:
+            enabled: true
+            mode: PASSTHROUGH
+    asserts:
+      - isNull:
+          path: spec.servers[1].tls.credentialName
+        template: istio-gateway.yaml
+      - equal:
+          path: spec.servers[1].tls.mode
+          value: PASSTHROUGH
+        template: istio-gateway.yaml