Skip to content

chore(shield): Add generic labels and annotations #2661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mavimo wants to merge 8 commits into
base: main
Choose a base branch
from
Draft

chore(shield): Add generic labels and annotations #2661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
55f70f7
feat(shield): add global annotations support for all resources
mavimo Jun 19, 2026
163672a
feat(shield): add global labels support for all resources
mavimo Jun 19, 2026
e02fbe0
test(shield): add default labels and annotations coverage
mavimo Jun 19, 2026
51f2d19
feat(shield): add component-level annotations for cluster, host, and …
mavimo Jun 19, 2026
fdfbed7
feat(shield): add component-level labels for cluster, host, and host_…
mavimo Jun 19, 2026
e0cfa59
refactor(shield): rename host.windows.annotations helper to host_wind…
mavimo Jun 19, 2026
0943203
fix(shield): correct annotation merge precedence and add override tests
mavimo Jun 20, 2026
bab8a1f
fix(shield): correct label merge precedence and add override tests
mavimo Jun 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions charts/shield/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,14 @@ Create chart name and version as used by the chart label.
Common labels
*/}}
{{- define "shield.labels" -}}
helm.sh/chart: {{ include "shield.chart" . }}
{{ include "shield.selector_labels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- $labels := dict "helm.sh/chart" (include "shield.chart" .) -}}
{{- $_ := merge $labels (include "shield.selector_labels" . | fromYaml) -}}
{{- if .Chart.AppVersion -}}
{{- $_ := set $labels "app.kubernetes.io/version" .Chart.AppVersion -}}
{{- end -}}
{{- $_ := set $labels "app.kubernetes.io/managed-by" .Release.Service -}}
{{- $_ := merge $labels .Values.labels -}}
{{- $labels | toYaml -}}
{{- end }}

{{/*
Expand All @@ -65,6 +67,15 @@ Component labels
{{- end }}
{{- end }}

{{/*
Common annotations
*/}}
{{- define "shield.annotations" -}}
{{- with .Values.annotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "shield.component_name_label" -}}
sysdig/component
{{- end }}
Expand Down
18 changes: 16 additions & 2 deletions charts/shield/templates/cluster/_annotations.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,27 @@
{{- define "cluster.annotations" -}}
{{- $annotations := merge (dict) .Values.cluster.annotations (include "shield.annotations" . | fromYaml) -}}
{{- with $annotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "cluster.workload_annotations" -}}
{{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.cluster.workload_annotations -}}
{{- $workloadAnnotations := merge (dict) .Values.cluster.workload_annotations .Values.workload_annotations (include "cluster.annotations" . | fromYaml) -}}
{{- with $workloadAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "cluster.pod_annotations" -}}
{{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.cluster.pod_annotations -}}
{{- $podAnnotations := merge (dict) .Values.cluster.pod_annotations .Values.pod_annotations (include "cluster.annotations" . | fromYaml) -}}
{{- with $podAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "cluster.rbac_annotations" -}}
{{- $rbacAnnotations := merge (dict) .Values.cluster.rbac.annotations (include "cluster.annotations" . | fromYaml) -}}
{{- with $rbacAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}
6 changes: 3 additions & 3 deletions charts/shield/templates/cluster/_labels.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Common labels
*/}}
{{- define "cluster.labels" -}}
{{- $labels := merge (dict) (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- $labels := merge (dict) .Values.cluster.labels (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- with $labels -}}
{{- . | toYaml -}}
{{- end -}}
Expand All @@ -24,14 +24,14 @@ Selector labels
{{- end }}

{{- define "cluster.workload_labels" -}}
{{- $workloadLabels := merge (dict) (dict) .Values.workload_labels .Values.cluster.workload_labels (include "cluster.labels" . | fromYaml) }}
{{- $workloadLabels := merge (dict) .Values.cluster.workload_labels .Values.workload_labels (include "cluster.labels" . | fromYaml) }}
{{- with $workloadLabels -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "cluster.pod_labels" -}}
{{- $podLabels := merge (dict) .Values.pod_labels .Values.cluster.pod_labels (include "cluster.labels" . | fromYaml) }}
{{- $podLabels := merge (dict) .Values.cluster.pod_labels .Values.pod_labels (include "cluster.labels" . | fromYaml) }}
{{- with $podLabels -}}
{{- . | toYaml -}}
{{- end -}}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/cluster/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,10 @@ metadata:
name: {{ include "cluster.fullname" . }}
labels:
{{- include "cluster.rbac_labels" . | nindent 4 }}
{{- with .Values.cluster.rbac.annotations }}
{{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
rules:
{{- if (include "cluster.audit_enabled" .) }}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/cluster/clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,10 @@ metadata:
name: {{ include "cluster.fullname" . }}
labels:
{{- include "cluster.rbac_labels" . | nindent 4 }}
{{- with .Values.cluster.rbac.annotations }}
{{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
roleRef:
apiGroup: rbac.authorization.k8s.io
Expand Down
5 changes: 5 additions & 0 deletions charts/shield/templates/cluster/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "cluster.labels" . | nindent 4 }}
{{- $annotations := (include "cluster.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
data:
cluster-shield.yaml: |
{{- include "cluster.configmap" . | fromYaml | toYaml | nindent 4 }}
4 changes: 4 additions & 0 deletions charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ metadata:
annotations:
kubernetes.io/description: |
This provides the minimum requirements to the Sysdig Shield to run in the Openshift.
{{- $clusterAnnotations := (include "cluster.annotations" .) }}
{{- if $clusterAnnotations }}
{{- $clusterAnnotations | nindent 4 }}
{{- end }}
name: {{ include "cluster.fullname" . }}
labels:
{{- include "cluster.labels" . | nindent 4 }}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/cluster/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "cluster.rbac_labels" . | nindent 4 }}
{{- with .Values.cluster.rbac.annotations }}
{{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
rules:
{{- if (and (include "cluster.posture_enabled" .) (include "cluster.need_posture_lease" .) .) }}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/cluster/rolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,10 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "cluster.rbac_labels" . | nindent 4 }}
{{- with .Values.cluster.rbac.annotations }}
{{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
roleRef:
apiGroup: rbac.authorization.k8s.io
Expand Down
5 changes: 5 additions & 0 deletions charts/shield/templates/cluster/secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "cluster.labels" . | nindent 4 }}
{{- $annotations := (include "cluster.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
type: Opaque
data:
{{- include "cluster.secret" . | nindent 2 }}
7 changes: 5 additions & 2 deletions charts/shield/templates/cluster/service-container-vulnerability-management.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,12 @@ metadata:
{{- if and .Values.cluster.service .Values.cluster.service.labels }}
{{- toYaml .Values.cluster.service.labels | nindent 4 }}
{{- end }}
{{- if and .Values.cluster.service .Values.cluster.service.annotations }}
{{- $shieldAnnotations := (include "cluster.annotations" .) }}
{{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }}
{{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }}
{{- if $allAnnotations }}
annotations:
{{- toYaml .Values.cluster.service.annotations | nindent 4 }}
{{- toYaml $allAnnotations | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.cluster.service .Values.cluster.service.type }}
Expand Down
7 changes: 5 additions & 2 deletions charts/shield/templates/cluster/service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,12 @@ metadata:
{{- if and .Values.cluster.service .Values.cluster.service.labels }}
{{- toYaml .Values.cluster.service.labels | nindent 4 }}
{{- end }}
{{- if and .Values.cluster.service .Values.cluster.service.annotations }}
{{- $shieldAnnotations := (include "cluster.annotations" .) }}
{{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }}
{{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }}
{{- if $allAnnotations }}
annotations:
{{- toYaml .Values.cluster.service.annotations | nindent 4 }}
{{- toYaml $allAnnotations | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.cluster.service .Values.cluster.service.type }}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/cluster/serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,9 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "cluster.rbac_labels" . | nindent 4 }}
{{- with .Values.cluster.rbac.annotations }}
{{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
{{- end }}
10 changes: 10 additions & 0 deletions charts/shield/templates/common/credentials-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "common.labels" . | nindent 4 }}
{{- $annotations := (include "shield.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
type: Opaque
data:
access-key: {{ .Values.sysdig_endpoint.access_key | b64enc | quote }}
Expand All @@ -20,6 +25,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "common.labels" . | nindent 4 }}
{{- $annotations := (include "shield.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
type: Opaque
data:
SECURE_API_TOKEN: {{ .Values.sysdig_endpoint.secure_api_token | b64enc | quote }}
Expand Down
5 changes: 5 additions & 0 deletions charts/shield/templates/common/custom-ca-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "common.labels" . | nindent 4 }}
{{- $annotations := (include "shield.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
data:
{{ include "common.custom_ca.key_name" . }}: {{ include "common.custom_ca.cert" . | b64enc | quote }}
{{- end }}
5 changes: 5 additions & 0 deletions charts/shield/templates/common/proxy-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "common.labels" . | nindent 4 }}
{{- $annotations := (include "shield.annotations" .) }}
{{- if $annotations }}
annotations:
{{- $annotations | nindent 4 }}
{{- end }}
data:
{{- if and .Values.proxy.http_proxy (not .Values.proxy.http_proxy_existing_secret) }}
http_proxy: {{ .Values.proxy.http_proxy | b64enc | quote }}
Expand Down
18 changes: 16 additions & 2 deletions charts/shield/templates/host/_annotations.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,19 @@
{{- define "host.annotations" -}}
{{- $annotations := merge (dict) .Values.host.annotations (include "shield.annotations" . | fromYaml) -}}
{{- with $annotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.workload_annotations" -}}
{{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host.workload_annotations -}}
{{- $workloadAnnotations := merge (dict) .Values.host.workload_annotations .Values.workload_annotations (include "host.annotations" . | fromYaml) -}}
{{- with $workloadAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.pod_annotations" -}}
{{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host.pod_annotations -}}
{{- $podAnnotations := merge (dict) .Values.host.pod_annotations .Values.pod_annotations (include "host.annotations" . | fromYaml) -}}
{{- if (include "common.cluster_type.is_gke_autopilot" . ) -}}
{{- $_ := set $podAnnotations "autopilot.gke.io/no-connect" "true" -}}
{{- end -}}
Expand All @@ -15,3 +22,10 @@
{{- end -}}
{{- $podAnnotations | toYaml -}}
{{- end -}}

{{- define "host.rbac_annotations" -}}
{{- $rbacAnnotations := merge (dict) .Values.host.rbac.annotations (include "host.annotations" . | fromYaml) -}}
{{- with $rbacAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}
6 changes: 3 additions & 3 deletions charts/shield/templates/host/_labels.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ GKE Autopilot labels
Common labels
*/}}
{{- define "host.labels" -}}
{{- $labels := merge (dict) (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- $labels := merge (dict) .Values.host.labels (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- with $labels -}}
{{- . | toYaml -}}
{{- end -}}
Expand All @@ -35,14 +35,14 @@ Selector labels
{{- end }}

{{- define "host.workload_labels" -}}
{{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host.workload_labels (include "host.labels" . | fromYaml) }}
{{- $workloadLabels := merge (dict) .Values.host.workload_labels .Values.workload_labels (include "host.labels" . | fromYaml) }}
{{- with $workloadLabels -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.pod_labels" -}}
{{- $podLabels := merge (dict) .Values.pod_labels .Values.host.pod_labels (include "host.labels" . | fromYaml) }}
{{- $podLabels := merge (dict) .Values.host.pod_labels .Values.pod_labels (include "host.labels" . | fromYaml) }}
{{- with $podLabels -}}
{{- . | toYaml -}}
{{- end -}}
Expand Down
11 changes: 9 additions & 2 deletions charts/shield/templates/host/_windows_annotations.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,18 @@
{{- define "host_windows.annotations" -}}
{{- $annotations := merge (dict) .Values.host_windows.annotations (include "shield.annotations" . | fromYaml) -}}
{{- with $annotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.windows.workload_annotations" -}}
{{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host_windows.workload_annotations -}}
{{- $workloadAnnotations := merge (dict) .Values.host_windows.workload_annotations .Values.workload_annotations (include "host_windows.annotations" . | fromYaml) -}}
{{- with $workloadAnnotations -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.windows.pod_annotations" -}}
{{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host_windows.pod_annotations -}}
{{- $podAnnotations := merge (dict) .Values.host_windows.pod_annotations .Values.pod_annotations (include "host_windows.annotations" . | fromYaml) -}}
{{- $podAnnotations | toYaml -}}
{{- end -}}
6 changes: 3 additions & 3 deletions charts/shield/templates/host/_windows_labels.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Common labels
*/}}
{{- define "host.windows.labels" -}}
{{- $labels := merge (dict) (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- $labels := merge (dict) .Values.host_windows.labels (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }}
{{- with $labels -}}
{{- . | toYaml -}}
{{- end -}}
Expand All @@ -24,14 +24,14 @@ Selector labels
{{- end }}

{{- define "host.windows.workload_labels" -}}
{{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host_windows.workload_labels (include "host.windows.labels" . | fromYaml) }}
{{- $workloadLabels := merge (dict) .Values.host_windows.workload_labels .Values.workload_labels (include "host.windows.labels" . | fromYaml) }}
{{- with $workloadLabels -}}
{{- . | toYaml -}}
{{- end -}}
{{- end -}}

{{- define "host.windows.pod_labels" -}}
{{- $podLabels := merge (dict) .Values.pod_labels .Values.host_windows.pod_labels (include "host.windows.labels" . | fromYaml) }}
{{- $podLabels := merge (dict) .Values.host_windows.pod_labels .Values.pod_labels (include "host.windows.labels" . | fromYaml) }}
{{- with $podLabels -}}
{{- . | toYaml -}}
{{- end -}}
Expand Down
5 changes: 3 additions & 2 deletions charts/shield/templates/host/clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,10 @@ metadata:
name: {{ include "host.fullname" . }}
labels:
{{- include "host.rbac_labels" . | nindent 4 }}
{{- with .Values.host.rbac.annotations }}
{{- $rbacAnnotations := (include "host.rbac_annotations" .) }}
{{- if $rbacAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- $rbacAnnotations | nindent 4 }}
{{- end }}
rules:
- apiGroups:
Expand Down
Loading
Loading