From 0c1d2de3e866d0ecdb7afcc03e431fc7dfed5b81 Mon Sep 17 00:00:00 2001 From: Denis Lisovsky Date: Thu, 1 Oct 2026 16:15:31 +0500 Subject: [PATCH 1/3] feat(helm): allow labels and annotations on the proxy ConfigMap Add proxyConfigMap.labels and proxyConfigMap.annotations, rendered on the generated -config ConfigMap when proxyConfigMap.create is true. Secret-injection webhooks (e.g. bank-vaults) resolve placeholders such as ${vault:...} inside the ConfigMap and read their auth settings (role, path, TLS) from the object's own annotations. The pod already has podAnnotations and the migration Job has migrationJob.annotations, but the ConfigMap had no metadata knob, so a proxy_config with placeholders could not be resolved without forking the chart. --- .../templates/configmap-litellm.yaml | 8 ++++ helm/litellm-helm/tests/configmap_tests.yaml | 43 +++++++++++++++++++ helm/litellm-helm/values.yaml | 6 +++ 3 files changed, 57 insertions(+) create mode 100644 helm/litellm-helm/tests/configmap_tests.yaml diff --git a/helm/litellm-helm/templates/configmap-litellm.yaml b/helm/litellm-helm/templates/configmap-litellm.yaml index 03e4f620206..d84ccfd0631 100644 --- a/helm/litellm-helm/templates/configmap-litellm.yaml +++ b/helm/litellm-helm/templates/configmap-litellm.yaml @@ -16,6 +16,14 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "litellm.fullname" . }}-config + {{- with .Values.proxyConfigMap.labels }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.proxyConfigMap.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: config.yaml: | {{ $config | toYaml | indent 6 }} diff --git a/helm/litellm-helm/tests/configmap_tests.yaml b/helm/litellm-helm/tests/configmap_tests.yaml new file mode 100644 index 00000000000..5f9b9711428 --- /dev/null +++ b/helm/litellm-helm/tests/configmap_tests.yaml @@ -0,0 +1,43 @@ +suite: test proxy configmap +templates: + - configmap-litellm.yaml +tests: + - it: should render no labels or annotations by default + asserts: + - isKind: + of: ConfigMap + - notExists: + path: metadata.labels + - notExists: + path: metadata.annotations + - it: should add the configured labels and annotations + set: + proxyConfigMap: + create: true + labels: + vault-injection: enabled + annotations: + vault.security.banzaicloud.io/vault-role: vault-injector + vault.security.banzaicloud.io/vault-skip-verify: "true" + asserts: + - equal: + path: metadata.labels + value: + vault-injection: enabled + - equal: + path: metadata.annotations + value: + vault.security.banzaicloud.io/vault-role: vault-injector + vault.security.banzaicloud.io/vault-skip-verify: "true" + - exists: + path: data["config.yaml"] + - it: should render no ConfigMap when create is false, even with labels set + set: + proxyConfigMap: + create: false + name: my-existing-config + labels: + vault-injection: enabled + asserts: + - hasDocuments: + count: 0 diff --git a/helm/litellm-helm/values.yaml b/helm/litellm-helm/values.yaml index 199c4595149..5ab6425cd38 100644 --- a/helm/litellm-helm/values.yaml +++ b/helm/litellm-helm/values.yaml @@ -171,6 +171,12 @@ billingMetrics: proxyConfigMap: # when true, creates a new configmap create: true + # Extra labels and annotations for the generated ConfigMap (only used when + # create is true). Useful for tooling that selects or configures objects by + # their metadata, e.g. secret-injection webhooks that resolve placeholders + # such as ${vault:...} inside proxy_config. + labels: {} + annotations: {} # if create is false and name is set, use existing ConfigMap # create: false # name: "" From 199003cfae90b8e60753e7d2856a04c3f8b67215 Mon Sep 17 00:00:00 2001 From: Denis Lisovsky Date: Fri, 2 Oct 2026 12:09:58 +0500 Subject: [PATCH 2/3] chore(helm): bump litellm-helm chart version to 1.2.0 New optional proxyConfigMap.labels / proxyConfigMap.annotations values, so a minor bump: operators can tell which packages carry the feature. --- helm/litellm-helm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm/litellm-helm/Chart.yaml b/helm/litellm-helm/Chart.yaml index a3a94241057..5eec89d4631 100644 --- a/helm/litellm-helm/Chart.yaml +++ b/helm/litellm-helm/Chart.yaml @@ -18,7 +18,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 1.1.3 +version: 1.2.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to From 6294e07cd33803e134948d0280d0cddec8ff4722 Mon Sep 17 00:00:00 2001 From: Denis Lisovsky Date: Fri, 16 Oct 2026 23:00:59 +0500 Subject: [PATCH 3/3] feat(helm): allow labels and annotations on the litellm chart gateway ConfigMap Add gateway.config.labels and gateway.config.annotations to the componentized helm/litellm chart, rendered on the generated -config ConfigMap when gateway.config.create is true. Same knob as proxyConfigMap.labels/annotations in litellm-helm, so secret-injection webhooks (e.g. bank-vaults) can resolve ${vault:...} placeholders in proxy_config on either chart. --- helm/litellm/templates/gateway/configmap.yaml | 8 ++++ .../tests/gateway_configmap_tests.yaml | 46 +++++++++++++++++++ helm/litellm/values.yaml | 6 +++ 3 files changed, 60 insertions(+) create mode 100644 helm/litellm/tests/gateway_configmap_tests.yaml diff --git a/helm/litellm/templates/gateway/configmap.yaml b/helm/litellm/templates/gateway/configmap.yaml index d262bf25b87..67bd8e060f2 100644 --- a/helm/litellm/templates/gateway/configmap.yaml +++ b/helm/litellm/templates/gateway/configmap.yaml @@ -3,6 +3,14 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "litellm.gateway.fullname" . }}-config + {{- with .Values.gateway.config.labels }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.gateway.config.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} data: config.yaml: | {{ .Values.gateway.config.proxy_config | toYaml | indent 6 }} diff --git a/helm/litellm/tests/gateway_configmap_tests.yaml b/helm/litellm/tests/gateway_configmap_tests.yaml new file mode 100644 index 00000000000..0f478dd5892 --- /dev/null +++ b/helm/litellm/tests/gateway_configmap_tests.yaml @@ -0,0 +1,46 @@ +suite: test gateway configmap +templates: + - gateway/configmap.yaml +values: + - ./values/required.yaml +tests: + - it: should render no labels or annotations by default + asserts: + - isKind: + of: ConfigMap + - notExists: + path: metadata.labels + - notExists: + path: metadata.annotations + - it: should add the configured labels and annotations + set: + gateway: + config: + create: true + labels: + vault-injection: enabled + annotations: + vault.security.banzaicloud.io/vault-role: vault-injector + vault.security.banzaicloud.io/vault-skip-verify: "true" + asserts: + - equal: + path: metadata.labels + value: + vault-injection: enabled + - equal: + path: metadata.annotations + value: + vault.security.banzaicloud.io/vault-role: vault-injector + vault.security.banzaicloud.io/vault-skip-verify: "true" + - exists: + path: data["config.yaml"] + - it: should render no ConfigMap when create is false, even with labels set + set: + gateway: + config: + create: false + labels: + vault-injection: enabled + asserts: + - hasDocuments: + count: 0 diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml index aa6ee7a6056..d403d1ba468 100644 --- a/helm/litellm/values.yaml +++ b/helm/litellm/values.yaml @@ -314,6 +314,12 @@ gateway: config: create: true proxy_config: {} + # Extra labels and annotations for the generated ConfigMap (only used when + # create is true). Useful for tooling that selects or configures objects by + # their metadata, e.g. secret-injection webhooks that resolve placeholders + # such as ${vault:...} inside proxy_config. + labels: {} + annotations: {} # Serve Prometheus /metrics from a `metrics` sidecar container (same image, # `python -m litellm.proxy.prometheus_metrics_server`) that aggregates the # workers' PROMETHEUS_MULTIPROC_DIR samples over a shared emptyDir, so a