Merge 6294e07cd3 into 527d882508

helm/litellm-helm/Chart.yaml

@@ -18,7 +18,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.3
+version: 1.2.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

helm/litellm-helm/templates/configmap-litellm.yaml

@@ -16,6 +16,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.fullname" . }}-config
+  {{- with .Values.proxyConfigMap.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.proxyConfigMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ $config | toYaml | indent 6 }}

helm/litellm-helm/tests/configmap_tests.yaml

@@ -0,0 +1,43 @@
+suite: test proxy configmap
+templates:
+  - configmap-litellm.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      proxyConfigMap:
+        create: true
+        labels:
+          vault-injection: enabled
+        annotations:
+          vault.security.banzaicloud.io/vault-role: vault-injector
+          vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      proxyConfigMap:
+        create: false
+        name: my-existing-config
+        labels:
+          vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0

helm/litellm-helm/values.yaml

@@ -171,6 +171,12 @@ billingMetrics:
 proxyConfigMap:
   # when true, creates a new configmap
   create: true
+  # Extra labels and annotations for the generated ConfigMap (only used when
+  # create is true). Useful for tooling that selects or configures objects by
+  # their metadata, e.g. secret-injection webhooks that resolve placeholders
+  # such as ${vault:...} inside proxy_config.
+  labels: {}
+  annotations: {}
   # if create is false and name is set, use existing ConfigMap
   # create: false
   # name: ""

helm/litellm/templates/gateway/configmap.yaml

@@ -3,6 +3,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "litellm.gateway.fullname" . }}-config
+  {{- with .Values.gateway.config.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.gateway.config.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yaml: |
 {{ .Values.gateway.config.proxy_config | toYaml | indent 6 }}

helm/litellm/tests/gateway_configmap_tests.yaml

@@ -0,0 +1,46 @@
+suite: test gateway configmap
+templates:
+  - gateway/configmap.yaml
+values:
+  - ./values/required.yaml
+tests:
+  - it: should render no labels or annotations by default
+    asserts:
+      - isKind:
+          of: ConfigMap
+      - notExists:
+          path: metadata.labels
+      - notExists:
+          path: metadata.annotations
+  - it: should add the configured labels and annotations
+    set:
+      gateway:
+        config:
+          create: true
+          labels:
+            vault-injection: enabled
+          annotations:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+    asserts:
+      - equal:
+          path: metadata.labels
+          value:
+            vault-injection: enabled
+      - equal:
+          path: metadata.annotations
+          value:
+            vault.security.banzaicloud.io/vault-role: vault-injector
+            vault.security.banzaicloud.io/vault-skip-verify: "true"
+      - exists:
+          path: data["config.yaml"]
+  - it: should render no ConfigMap when create is false, even with labels set
+    set:
+      gateway:
+        config:
+          create: false
+          labels:
+            vault-injection: enabled
+    asserts:
+      - hasDocuments:
+          count: 0

helm/litellm/values.yaml

@@ -314,6 +314,12 @@ gateway:
   config:
     create: true
     proxy_config: {}
+    # Extra labels and annotations for the generated ConfigMap (only used when
+    # create is true). Useful for tooling that selects or configures objects by
+    # their metadata, e.g. secret-injection webhooks that resolve placeholders
+    # such as ${vault:...} inside proxy_config.
+    labels: {}
+    annotations: {}
   # Serve Prometheus /metrics from a `metrics` sidecar container (same image,
   # `python -m litellm.proxy.prometheus_metrics_server`) that aggregates the
   # workers' PROMETHEUS_MULTIPROC_DIR samples over a shared emptyDir, so a