From b8680120ce4f0a05c0529eb5b884a765365aba2d Mon Sep 17 00:00:00 2001 From: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:45:18 -0700 Subject: [PATCH 1/2] fix(helm): render ingress-nginx compatible path types via ingress.controller ingress-nginx's admission webhook (strict-validate-path-type, on by default from v1.12.0 until v1.12.6 / v1.13.2 allowed dots again) rejects the chart's /favicon.ico Exact and /eu.assemblyai Prefix rules, so helm install fails on any cluster it fronts. A new ingress.controller value (alb, the default, or nginx) renders dotted built-in paths as ImplementationSpecific under nginx, which serves them as plain prefix locations, and drops the ALB-only /*.txt wildcard rule there. The default render is unchanged --- helm/litellm/templates/_helpers.tpl | 13 ++ helm/litellm/templates/ingress.yaml | 38 +++--- .../tests/ingress_controller_tests.yaml | 129 ++++++++++++++++++ helm/litellm/values.yaml | 11 ++ 4 files changed, 175 insertions(+), 16 deletions(-) create mode 100644 helm/litellm/tests/ingress_controller_tests.yaml diff --git a/helm/litellm/templates/_helpers.tpl b/helm/litellm/templates/_helpers.tpl index 72f7f74bcf6..be6b9093f53 100644 --- a/helm/litellm/templates/_helpers.tpl +++ b/helm/litellm/templates/_helpers.tpl @@ -428,3 +428,16 @@ envFrom: {{- end }} {{- end }} {{- end -}} + +{{/* +ingress-nginx's admission webhook rejects a dot in an Exact or Prefix path +(strict-validate-path-type) and serves ImplementationSpecific as a plain +prefix location, so a dotted path takes that type there. +*/}} +{{- define "litellm.ingress.pathType" -}} +{{- if and (eq .controller "nginx") (contains "." .path) -}} +ImplementationSpecific +{{- else -}} +{{- .pathType -}} +{{- end -}} +{{- end -}} diff --git a/helm/litellm/templates/ingress.yaml b/helm/litellm/templates/ingress.yaml index f77ef537b02..0a215de5a56 100644 --- a/helm/litellm/templates/ingress.yaml +++ b/helm/litellm/templates/ingress.yaml @@ -5,6 +5,10 @@ {{- $gatewayPort := .Values.gateway.service.port -}} {{- $backendPort := .Values.backend.service.port -}} {{- $uiPort := .Values.ui.service.port -}} +{{- $controller := .Values.ingress.controller | default "alb" -}} +{{- if not (has $controller (list "alb" "nginx")) }} +{{- fail (printf "ingress.controller: unknown controller %q, expected one of alb, nginx" $controller) }} +{{- end }} {{/* Backends addressable from ingress.extraPaths, keyed by the `service` field. */}} @@ -27,10 +31,11 @@ /litellm-asset-prefix, so without /*.txt they fall to the backend catch-all → 404 → client-side navigation never settles and the login flow spins in an infinite redirect loop (/ ⇄ /ui/login). ui/nginx.conf already serves *.txt - from the export; the rule only routes the request to it. Needs an ingress - controller whose ImplementationSpecific path is a wildcard pattern - (AWS ALB: `*` = 0+ chars); this chart targets the AWS Load Balancer - Controller. + from the export; the rule only routes the request to it. It needs an + ingress controller whose ImplementationSpecific path is a wildcard pattern + (AWS ALB: `*` = 0+ chars), so it is rendered for ingress.controller=alb + only: ingress-nginx serves ImplementationSpecific as a literal prefix + location, where /*.txt can never match. */}} {{- $uiPaths := list (dict "path" "/" "pathType" "Exact") @@ -38,8 +43,10 @@ (dict "path" "/litellm-asset-prefix" "pathType" "Prefix") (dict "path" "/_next" "pathType" "Prefix") (dict "path" "/ui" "pathType" "Prefix") - (dict "path" "/*.txt" "pathType" "ImplementationSpecific") -}} +{{- if eq $controller "alb" }} +{{- $uiPaths = append $uiPaths (dict "path" "/*.txt" "pathType" "ImplementationSpecific") }} +{{- end }} {{/* Gateway data-plane prefixes — must mirror gateway/routes/allowlist.py. Versioned paths are listed explicitly to avoid routing management routes @@ -83,12 +90,6 @@ adding to it. */}} {{- $builtinPathKeys := list "/test|Exact" "/|Prefix" -}} -{{- range $uiPaths }} -{{- $builtinPathKeys = append $builtinPathKeys (printf "%s|%s" .path .pathType) }} -{{- end }} -{{- range $gatewayPrefixes }} -{{- $builtinPathKeys = append $builtinPathKeys (printf "%s|Prefix" .) }} -{{- end }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -115,8 +116,10 @@ spec: paths: # --- UI (Next.js static export) --- {{- range $uiPaths }} + {{- $pathType := include "litellm.ingress.pathType" (dict "controller" $controller "path" .path "pathType" .pathType) }} + {{- $builtinPathKeys = append $builtinPathKeys (printf "%s|%s" .path $pathType) }} - path: {{ .path }} - pathType: {{ .pathType }} + pathType: {{ $pathType }} backend: service: name: {{ $uiName }} @@ -134,8 +137,10 @@ spec: port: number: {{ $gatewayPort }} {{- range $gatewayPrefixes }} + {{- $pathType := include "litellm.ingress.pathType" (dict "controller" $controller "path" . "pathType" "Prefix") }} + {{- $builtinPathKeys = append $builtinPathKeys (printf "%s|%s" . $pathType) }} - path: {{ . }} - pathType: Prefix + pathType: {{ $pathType }} backend: service: name: {{ $gatewayName }} @@ -147,10 +152,11 @@ spec: Rendered after every built-in path so an entry can never take precedence over a default, and before the backend catch-all. Position only decides the match on controllers that honour manifest - order: the AWS Load Balancer Controller this chart targets sorts - Exact paths first and Prefix paths longest-first, but keeps + order: the AWS Load Balancer Controller (ingress.controller=alb) + sorts Exact paths first and Prefix paths longest-first, but keeps ImplementationSpecific paths in manifest order, which is what the - /*.txt rule above already depends on. + /*.txt rule above already depends on. ingress-nginx ignores order + and serves the longest matching location. */}} {{- range $idx, $extra := .Values.ingress.extraPaths }} {{- if not (kindIs "map" $extra) }} diff --git a/helm/litellm/tests/ingress_controller_tests.yaml b/helm/litellm/tests/ingress_controller_tests.yaml new file mode 100644 index 00000000000..a86271a02be --- /dev/null +++ b/helm/litellm/tests/ingress_controller_tests.yaml @@ -0,0 +1,129 @@ +suite: test ingress.controller +templates: + - ingress.yaml +values: + - ./values/required.yaml +tests: + - it: keeps the AWS Load Balancer Controller path types by default + set: + ingress.enabled: true + asserts: + - contains: + path: spec.rules[0].http.paths + content: + path: /favicon.ico + pathType: Exact + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 + - contains: + path: spec.rules[0].http.paths + content: + path: /eu.assemblyai + pathType: Prefix + backend: + service: + name: RELEASE-NAME-litellm-gateway + port: + number: 4000 + - contains: + path: spec.rules[0].http.paths + content: + path: /*.txt + pathType: ImplementationSpecific + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 + + - it: renders no dotted Exact or Prefix path for ingress-nginx, whose admission webhook rejects them + set: + ingress.enabled: true + ingress.controller: nginx + asserts: + - notMatchRegexRaw: + pattern: 'path: /\S*\.\S*\n\s+pathType: (Exact|Prefix)\n' + - contains: + path: spec.rules[0].http.paths + content: + path: /favicon.ico + pathType: ImplementationSpecific + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 + - contains: + path: spec.rules[0].http.paths + content: + path: /eu.assemblyai + pathType: ImplementationSpecific + backend: + service: + name: RELEASE-NAME-litellm-gateway + port: + number: 4000 + + - it: drops the /*.txt wildcard for ingress-nginx and keeps every other route as is + set: + ingress.enabled: true + ingress.controller: nginx + asserts: + - notContains: + path: spec.rules[0].http.paths + content: + path: /*.txt + any: true + - contains: + path: spec.rules[0].http.paths + content: + path: /ui + pathType: Prefix + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 + - contains: + path: spec.rules[0].http.paths + content: + path: /test + pathType: Exact + backend: + service: + name: RELEASE-NAME-litellm-gateway + port: + number: 4000 + - equal: + path: spec.rules[0].http.paths[-1] + value: + path: / + pathType: Prefix + backend: + service: + name: RELEASE-NAME-litellm-backend + port: + number: 4001 + + - it: rejects an extraPaths entry that repeats a built-in path at the pathType ingress-nginx renders it with + set: + ingress.enabled: true + ingress.controller: nginx + ingress.extraPaths: + - path: /favicon.ico + service: ui + pathType: ImplementationSpecific + asserts: + - failedTemplate: + errorMessage: "ingress.extraPaths[0]: path /favicon.ico with pathType ImplementationSpecific is already routed by this chart, and a duplicate would take it over rather than add to it" + + - it: rejects a controller it has no path types for + set: + ingress.enabled: true + ingress.controller: traefik + asserts: + - failedTemplate: + errorMessage: 'ingress.controller: unknown controller "traefik", expected one of alb, nginx' diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml index 378c3b7a618..592bb6d6131 100644 --- a/helm/litellm/values.yaml +++ b/helm/litellm/values.yaml @@ -10,6 +10,17 @@ imagePullSecrets: [] ingress: enabled: false className: "" + # Which ingress controller serves this Ingress. Controllers disagree on the + # pathTypes they accept, so this picks the pathType of a few built-in paths: + # alb AWS Load Balancer Controller (default): Exact and Prefix paths plus + # the /*.txt wildcard that routes the UI's RSC payloads. + # nginx ingress-nginx: its admission webhook rejects a dot in an Exact or + # Prefix path (strict-validate-path-type, on by default from v1.12.0 + # until v1.12.6 / v1.13.2 allowed dots again), so /favicon.ico and + # /eu.assemblyai render as ImplementationSpecific, which nginx serves + # as a plain prefix location. /*.txt is dropped: nginx has no + # wildcard pathType, so that rule could never match there. + controller: alb annotations: {} host: "" # optional; if set, becomes the rule's host tls: [] From ad0f0af1922e226a34baf5e59bccef58761ada2c Mon Sep 17 00:00:00 2001 From: mateo-berri <277851410+mateo-berri@users.noreply.github.com> Date: Wed, 2 Sep 2026 19:15:41 -0700 Subject: [PATCH 2/2] fix(helm): normalize ingress.extraPaths path types for ingress-nginx too A dotted extraPaths entry kept its requested Exact or Prefix type under ingress.controller=nginx, so the admission webhook rejected the render the option exists to avoid, and the duplicate check compared the raw type against the built-in paths' normalized one, letting a repeated /favicon.ico through. Extra paths now go through the same controller normalization before both the duplicate check and the render. --- helm/litellm/templates/ingress.yaml | 7 +- .../tests/ingress_controller_tests.yaml | 76 +++++++++++++++++++ helm/litellm/values.yaml | 6 +- 3 files changed, 84 insertions(+), 5 deletions(-) diff --git a/helm/litellm/templates/ingress.yaml b/helm/litellm/templates/ingress.yaml index 0a215de5a56..732564b280f 100644 --- a/helm/litellm/templates/ingress.yaml +++ b/helm/litellm/templates/ingress.yaml @@ -170,10 +170,11 @@ spec: {{- if not $target }} {{- fail (printf "ingress.extraPaths[%d] (path %s): unknown service %q, expected one of backend, gateway, ui" $idx $extra.path $service) }} {{- end }} - {{- $pathType := $extra.pathType | default "Prefix" }} - {{- if not (has $pathType (list "Prefix" "Exact" "ImplementationSpecific")) }} - {{- fail (printf "ingress.extraPaths[%d] (path %s): unknown pathType %q, expected one of Exact, ImplementationSpecific, Prefix" $idx $extra.path $pathType) }} + {{- $requestedPathType := $extra.pathType | default "Prefix" }} + {{- if not (has $requestedPathType (list "Prefix" "Exact" "ImplementationSpecific")) }} + {{- fail (printf "ingress.extraPaths[%d] (path %s): unknown pathType %q, expected one of Exact, ImplementationSpecific, Prefix" $idx $extra.path $requestedPathType) }} {{- end }} + {{- $pathType := include "litellm.ingress.pathType" (dict "controller" $controller "path" $extra.path "pathType" $requestedPathType) }} {{- if eq $extra.path "/" }} {{- fail (printf "ingress.extraPaths[%d]: path / is already routed in both directions, Exact to ui and Prefix to backend, so no pathType leaves a request for an entry here to capture" $idx) }} {{- end }} diff --git a/helm/litellm/tests/ingress_controller_tests.yaml b/helm/litellm/tests/ingress_controller_tests.yaml index a86271a02be..40790ba674a 100644 --- a/helm/litellm/tests/ingress_controller_tests.yaml +++ b/helm/litellm/tests/ingress_controller_tests.yaml @@ -127,3 +127,79 @@ tests: asserts: - failedTemplate: errorMessage: 'ingress.controller: unknown controller "traefik", expected one of alb, nginx' + + - it: rejects an extraPaths entry that repeats a built-in path once ingress-nginx normalizes its pathType + set: + ingress.enabled: true + ingress.controller: nginx + ingress.extraPaths: + - path: /favicon.ico + service: ui + asserts: + - failedTemplate: + errorMessage: "ingress.extraPaths[0]: path /favicon.ico with pathType ImplementationSpecific is already routed by this chart, and a duplicate would take it over rather than add to it" + + - it: renders a dotted extraPaths entry as ImplementationSpecific for ingress-nginx + set: + ingress.enabled: true + ingress.controller: nginx + ingress.extraPaths: + - path: /eu.assemblyai.custom + service: gateway + - path: /robots.txt + service: ui + pathType: Exact + asserts: + - notMatchRegexRaw: + pattern: 'path: "?/\S*\.\S*"?\n\s+pathType: (Exact|Prefix)\n' + - contains: + path: spec.rules[0].http.paths + content: + path: /eu.assemblyai.custom + pathType: ImplementationSpecific + backend: + service: + name: RELEASE-NAME-litellm-gateway + port: + number: 4000 + - contains: + path: spec.rules[0].http.paths + content: + path: /robots.txt + pathType: ImplementationSpecific + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 + + - it: keeps the requested pathType of a dotted extraPaths entry for the AWS Load Balancer Controller + set: + ingress.enabled: true + ingress.extraPaths: + - path: /eu.assemblyai.custom + service: gateway + - path: /robots.txt + service: ui + pathType: Exact + asserts: + - contains: + path: spec.rules[0].http.paths + content: + path: /eu.assemblyai.custom + pathType: Prefix + backend: + service: + name: RELEASE-NAME-litellm-gateway + port: + number: 4000 + - contains: + path: spec.rules[0].http.paths + content: + path: /robots.txt + pathType: Exact + backend: + service: + name: RELEASE-NAME-litellm-ui + port: + number: 3000 diff --git a/helm/litellm/values.yaml b/helm/litellm/values.yaml index 592bb6d6131..461330ba491 100644 --- a/helm/litellm/values.yaml +++ b/helm/litellm/values.yaml @@ -11,7 +11,8 @@ ingress: enabled: false className: "" # Which ingress controller serves this Ingress. Controllers disagree on the - # pathTypes they accept, so this picks the pathType of a few built-in paths: + # pathTypes they accept, so this picks the pathType of the dotted paths, the + # built-in ones and any dotted extraPaths entry alike: # alb AWS Load Balancer Controller (default): Exact and Prefix paths plus # the /*.txt wildcard that routes the UI's RSC payloads. # nginx ingress-nginx: its admission webhook rejects a dot in an Exact or @@ -37,7 +38,8 @@ ingress: # # path required; the HTTP path to route # service which component serves it: gateway (default), backend, or ui - # pathType Prefix (default), Exact, or ImplementationSpecific + # pathType Prefix (default), Exact, or ImplementationSpecific; a dotted + # path renders as ImplementationSpecific when controller is nginx # # The target component only answers paths its own route allowlist keeps, so # a path here still has to be one that component serves.