chore(shield): Add generic labels and annotations - #2661
Draft
mavimo wants to merge 8 commits into
Draft
Conversation
Add top-level `annotations` value that propagates to every Kubernetes resource the chart creates (Deployments, DaemonSets, ConfigMaps, Secrets, RBAC resources, Services, etc.). Annotations are merged with any existing resource-specific annotations, with component-level values taking precedence over the global ones. New helpers: - `shield.annotations` – base helper returning .Values.annotations - `cluster.rbac_annotations` – merges shield.annotations + cluster RBAC annotations - `host.rbac_annotations` – merges shield.annotations + host RBAC annotations Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
Add top-level `labels` value that propagates to every Kubernetes resource the chart creates. Implemented by merging .Values.labels into the `shield.labels` base helper, which is inherited by all component label helpers (cluster.labels, host.labels, host.windows.labels, common.labels) and cascades to every resource-specific label set. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
Verify that the standard Kubernetes labels (helm.sh/chart,
app.kubernetes.io/*) and sysdig/component are always present on every
resource type (Deployment, DaemonSet, Service, ServiceAccount, ConfigMap)
even when no custom labels/annotations are set.
Also verify that resources without any annotations do not gain an
unexpected annotations block when annotations: {} (default).
Add chart.version: 1.2.3-helmtest to suite headers that lacked it so
helm.sh/chart assertions are stable across version bumps.
Generated with support from AI
Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
…host_windows Add annotations fields under cluster.annotations, host.annotations, and host_windows.annotations that scope extra annotations to a single component. These are merged on top of the global annotations and below any resource-specific annotations (workload_annotations, rbac.annotations, etc.). New base helpers: cluster.annotations, host.annotations, host.windows.annotations. All existing workload/pod/RBAC annotation helpers are updated to derive from the component base instead of shield.annotations directly. Templates for services, configmaps, secrets, and OpenShift SCCs updated accordingly. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
…windows Add labels fields under cluster.labels, host.labels, and host_windows.labels that scope extra labels to a single component. Implemented by merging .Values.<component>.labels into the component base label helper (cluster.labels, host.labels, host.windows.labels), which cascades automatically to every workload, pod, RBAC, service, and ConfigMap label set for that component. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
…ows.annotations Align the template helper name with the values key naming convention (host_windows.* instead of host.windows.*). Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
Reverse the merge order in all annotation helpers so more-specific values win over less-specific ones. Previous order had global annotations winning over component annotations, and component-generic winning over workload/rbac-specific — both backwards. Correct precedence (highest → lowest): workload_annotations / pod_annotations / rbac.annotations > cluster.annotations / host.annotations / host_windows.annotations > workload_annotations (global) > annotations (global) Add override tests that set the same key at multiple levels and assert the more-specific value wins, covering cluster, host, and host_windows for workload, pod, and RBAC resources. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
Reverse the merge order in workload/pod label helpers so component-specific values win over global ones. Previous order had global workload_labels winning over cluster.workload_labels / host.workload_labels. Correct precedence (highest → lowest): cluster.workload_labels / cluster.pod_labels / cluster.rbac.labels > workload_labels / pod_labels (global) > cluster.labels (base, which already has cluster.labels value > shield.labels) > labels (global, inside shield.labels) rbac_labels helpers were already correct and unchanged. Add override tests that set the same key at multiple levels and assert the more-specific value wins, covering cluster, host, and host_windows for workload, pod, RBAC, service, and ConfigMap resources. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo <marcovito.moscaritolo@sysdig.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Checklist
feat(agent,node-analyzer,sysdig-deploy):)