From e40624c5454715a52beea0a233e492b0a9ed4ca4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 28 May 2026 18:59:57 +0000
Subject: [PATCH] fix(helm): enforce automountServiceAccountToken on all pod
 specs; fix leading --- in serviceaccount.yaml

- gateway/backend deployments: add explicit automountServiceAccountToken on
  the pod spec so serviceAccounts.*.automount is honoured regardless of
  whether the SA is chart-created or operator-supplied (previously the flag
  only took effect on the SA object when create: true, creating an asymmetry
  with the UI which already enforced it at pod-spec level)
- serviceaccount.yaml: use a $prev sentinel to emit --- only between
  documents, preventing a leading --- when gateway SA is skipped but
  backend or ui SA is created (avoids lint/GitOps warnings from strict
  YAML parsers and tools like ArgoCD)

https://claude.ai/code/session_01QPy362WnjmEpeNuJaPUqmF
---
 helm/litellm/templates/backend/deployment.yaml | 1 +
 helm/litellm/templates/gateway/deployment.yaml | 1 +
 helm/litellm/templates/serviceaccount.yaml     | 7 +++++++
 3 files changed, 9 insertions(+)

diff --git a/helm/litellm/templates/backend/deployment.yaml b/helm/litellm/templates/backend/deployment.yaml
index 4ac56da1be1..3b59c58c8bf 100644
--- a/helm/litellm/templates/backend/deployment.yaml
+++ b/helm/litellm/templates/backend/deployment.yaml
@@ -20,6 +20,7 @@ spec:
         {{- include "litellm.backend.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "litellm.backend.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccounts.backend.automount }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
diff --git a/helm/litellm/templates/gateway/deployment.yaml b/helm/litellm/templates/gateway/deployment.yaml
index 08700f2174b..05ea4052159 100644
--- a/helm/litellm/templates/gateway/deployment.yaml
+++ b/helm/litellm/templates/gateway/deployment.yaml
@@ -23,6 +23,7 @@ spec:
         {{- include "litellm.gateway.selectorLabels" . | nindent 8 }}
     spec:
       serviceAccountName: {{ include "litellm.gateway.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccounts.gateway.automount }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
diff --git a/helm/litellm/templates/serviceaccount.yaml b/helm/litellm/templates/serviceaccount.yaml
index ec8e1bb7bde..a2fc52f47c0 100644
--- a/helm/litellm/templates/serviceaccount.yaml
+++ b/helm/litellm/templates/serviceaccount.yaml
@@ -1,4 +1,6 @@
+{{- $prev := false -}}
 {{- if .Values.serviceAccounts.gateway.create -}}
+{{- $prev = true }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -13,7 +15,10 @@ metadata:
 automountServiceAccountToken: {{ .Values.serviceAccounts.gateway.automount }}
 {{- end }}
 {{- if .Values.serviceAccounts.backend.create }}
+{{- if $prev }}
 ---
+{{- end }}
+{{- $prev = true }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -28,7 +33,9 @@ metadata:
 automountServiceAccountToken: {{ .Values.serviceAccounts.backend.automount }}
 {{- end }}
 {{- if .Values.serviceAccounts.ui.create }}
+{{- if $prev }}
 ---
+{{- end }}
 apiVersion: v1
 kind: ServiceAccount
 metadata: