From fa2213535aedadebcd71b562d0c29174d534323c Mon Sep 17 00:00:00 2001
From: Patrick Deubel <14445594-patrick.deubel@users.noreply.gitlab.com>
Date: Tue, 10 Feb 2026 20:32:48 +0100
Subject: [PATCH] feat(helm): add bearer token authentication to ServiceMonitor

---
 .../templates/secret-servicemonitor-token.yaml    | 11 +++++++++++
 .../litellm-helm/templates/servicemonitor.yaml    | 12 ++++++++++++
 deploy/charts/litellm-helm/values.yaml            | 15 +++++++++++++++
 3 files changed, 38 insertions(+)
 create mode 100644 deploy/charts/litellm-helm/templates/secret-servicemonitor-token.yaml

diff --git a/deploy/charts/litellm-helm/templates/secret-servicemonitor-token.yaml b/deploy/charts/litellm-helm/templates/secret-servicemonitor-token.yaml
new file mode 100644
index 00000000000..11fe2723f01
--- /dev/null
+++ b/deploy/charts/litellm-helm/templates/secret-servicemonitor-token.yaml
@@ -0,0 +1,11 @@
+{{- if and (eq .Values.serviceMonitor.enabled true) (eq .Values.serviceMonitor.secret.create true) .Values.serviceMonitor.secret.value }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "litellm.fullname" . }}-servicemonitor-token
+  labels:
+    {{- include "litellm.labels" . | nindent 4 }}
+data:
+  token: {{ .Values.serviceMonitor.secret.value | b64enc }}
+type: Opaque
+{{- end }}
diff --git a/deploy/charts/litellm-helm/templates/servicemonitor.yaml b/deploy/charts/litellm-helm/templates/servicemonitor.yaml
index 743098deb3f..f2945bcc634 100644
--- a/deploy/charts/litellm-helm/templates/servicemonitor.yaml
+++ b/deploy/charts/litellm-helm/templates/servicemonitor.yaml
@@ -31,6 +31,18 @@ spec:
     interval: {{ .interval }}
     scrapeTimeout: {{ .scrapeTimeout }}
     scheme: http
+  {{- /*
+    Render bearerTokenSecret block if either chart creates the secret (secret.create=true) or
+    user explicitly sets all three fields (name, key, optional).
+  */ -}}
+  {{- if or (eq .secret.create true) (and .bearerTokenSecret.name .bearerTokenSecret.key }}
+    bearerTokenSecret:
+      name: {{ .bearerTokenSecret.name | default (print (include "litellm.fullname" $) "-servicemonitor-token") }}
+      key: {{ .bearerTokenSecret.key | default "token" }}
+      {{- if hasKey .bearerTokenSecret "optional" }}
+      optional: {{ .bearerTokenSecret.optional }}
+      {{- end }}
+  {{- end }}
   {{- if .relabelings }}
     relabelings:
 {{- toYaml .relabelings | nindent 4 }}
diff --git a/deploy/charts/litellm-helm/values.yaml b/deploy/charts/litellm-helm/values.yaml
index cea25974bb0..04bdb16dec4 100644
--- a/deploy/charts/litellm-helm/values.yaml
+++ b/deploy/charts/litellm-helm/values.yaml
@@ -339,3 +339,18 @@ serviceMonitor:
   namespaceSelector:
     matchNames: []
     # - test-namespace
+  # Bearer token authentication for metrics endpoint
+
+  # Creates a K8s secret with the API key you want to use. With that you do not need to specify
+  # bearerTokenSecret manually.
+  secret:
+    create: false        # Set to true to have the chart create the secret
+    value: ""            # Token value (required if create: true)
+
+  # Use this if you want to configure the bearerTokenSecret manually.
+  bearerTokenSecret: {}
+  #   name: ""           # Secret name. Defaults to: {{ include "litellm.fullname" . }}-servicemonitor-token
+  #   key: "token"       # Secret key. Defaults to: "token"
+  #   optional: false    # Mark secret as optional. Defaults to: false
+
+