feat(helm): support tpl rendering in podAnnotations

[devauxbr]

Closes #28332

Note: This re-opens the work from #28333, which was auto-closed when its base branch (shin_agent_oss_staging_05_20_2026) was deleted. Re-targeting today's active OSS staging branch. The change itself is unchanged — all CI checks passed green on the previous PR.

Summary

Render Values.podAnnotations through tpl ... $ in deploy/charts/litellm-helm/templates/deployment.yaml, so users can include template expressions (e.g. a sha256 of their custom ConfigMap) inside pod annotations.

 {{- with .Values.podAnnotations }}
-{{- toYaml . | nindent 8 }}
+{{- tpl (toYaml .) $ | nindent 8 }}
 {{- end }}

Motivation

When users disable proxyConfigMap.create to provide their own ConfigMap, the chart's built-in checksum/config annotation is also disabled, so changes to a user-managed ConfigMap no longer roll the deployment. Allowing tpl in podAnnotations lets users re-implement that annotation themselves, e.g.:

podAnnotations:
  checksum/config: '{{ include "my-umbrella.litellm-config" . | sha256sum }}'

Consistency with existing chart code

This matches the tpl (toYaml .) $ pattern already used elsewhere in the same chart:

• deploy/charts/litellm-helm/templates/deployment.yaml:50 — extraInitContainers
• deploy/charts/litellm-helm/templates/deployment.yaml:215 — extraContainers
• deploy/charts/litellm-helm/templates/migrations-job.yaml:40,99 — migrations job

Direct precedent: commit 87d7e86479 ("feat(helm): add tpl support to extraContainers and extraInitContainers", April 2026).

Tests

Added one new helm unittest case to deploy/charts/litellm-helm/tests/deployment_tests.yaml:

• should support tpl in podAnnotations — sets proxyConfigMap.create: false to mirror the real-world scenario, then asserts that a templated annotation referencing .Values.image.tag resolves correctly (proves $ is wired), a second key referencing .Values.image.repository resolves correctly, and a plain-string annotation passes through unchanged (backward-compat canary).

Run locally with make test-unit-helm — all 54 tests pass.

Also manually verified with helm template that .Release.Name and | sha256sum pipelines resolve correctly inside annotations.

Backward compatibility

tpl passes plain strings (no {{ }}) through unchanged, so existing chart users see no behavior change. Users with a literal {{ inside an annotation value would now see it rendered as a template — that caveat already applies to every other tpl usage in this chart, and to the precedent PR above.

Checklist

• Sign the Contributor License Agreement (CLA)
• Keep scope isolated — one helm-only one-liner + one test
• Helm unit test added — make test-unit-helm passes
• helm lint deploy/charts/litellm-helm passes

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

Adds tpl rendering support to podAnnotations in deployment.yaml so users can embed Go template expressions (e.g. sha256sum of a user-managed ConfigMap) directly in annotation values. The change is a single-line replacement matching the identical pattern already used for extraInitContainers and extraContainers in the same file.

• deployment.yaml: replaces toYaml . | nindent 8 with tpl (toYaml .) $ | nindent 8 inside the {{- with .Values.podAnnotations }} block, passing root context $ so annotations can reference .Values, .Release, etc.
• deployment_tests.yaml: adds one new helm unittest case that validates template-expression resolution, multi-value resolution, and backward-compatible pass-through of plain-string annotations.

Confidence Score: 5/5

Safe to merge — the change is a one-liner that follows an established pattern already used twice in the same file, and the new test covers the relevant scenarios.

The change is minimal and consistent with the existing tpl (toYaml .) $ usage for extraInitContainers and extraContainers. Plain-string annotations are unaffected, the root context is correctly threaded via $, and the unit test validates both template-expression rendering and backward-compat pass-through. No custom rules are touched by this Helm-only change.

No files require special attention.

Important Files Changed

Filename	Overview
deploy/charts/litellm-helm/templates/deployment.yaml	One-line change: wraps podAnnotations rendering with tpl (toYaml .) $ to enable template expressions; follows the identical pattern used for extraInitContainers (line 50) and extraContainers (line 231).
deploy/charts/litellm-helm/tests/deployment_tests.yaml	Adds a single new helm unittest case covering template-expression resolution, multi-value resolution, and plain-string backward-compat pass-through in podAnnotations.

_{Reviews (1): Last reviewed commit: "feat(helm): support tpl rendering in pod..." | Re-trigger Greptile}

[veria-ai]

PR overview

Medium: Helm template execution in pod annotations

This PR changes pod annotations from static values into Helm templates. A user who can influence podAnnotations can now execute Helm template functions during rendering and write the results into Pod metadata.

Security review

• 1 new security issue(s) were flagged in the latest review.
• 1 issue(s) remain open on this pull request.

Risk: 5/10

[veria-ai]

Medium: Helm template injection in pod annotations

A user who can supply podAnnotations can now execute Helm template functions during render and place the output into Pod annotations, for example using lookup to read Kubernetes objects when Helm renders with cluster credentials. Keep annotations as data, or add a dedicated constrained value for the checksum use case instead of evaluating the entire annotations map as a template.

[oss-pr-review-agent-shin]

🤖 litellm-agent: Squash-merged into staging branch shin_agent_oss_staging_05_22_2026. Staging PR: #28601

---

Triage Summary
Wraps the podAnnotations rendering block in deployment.yaml with tpl (toYaml .) $ so users can embed Go template expressions (e.g. sha256sum of a user-managed ConfigMap) in annotation values. Follows the identical pattern already used for extraInitContainers and extraContainers in the same file. Adds one helm unittest case covering template-expression resolution, multi-value resolution, and plain-string backward-compat pass-through.

Merge Confidence: 5/5 ✅ READY
Ready to ship.

All checks green. Greptile 5/5, no blocking pattern findings, no CircleCI runs (OSS-typical).