[INFRA-437] - feat(plane-enterprise): configurable labels & annotations for all resources, pods, and one-shot jobs

charts/plane-enterprise/Chart.yaml

@@ -5,7 +5,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue
 
 type: application
 
-version: 2.7.0
+version: 2.8.0
 appVersion: "2.6.3"
 
 home: https://plane.so/

charts/plane-enterprise/README.md

@@ -258,6 +258,50 @@ securityContext:
     runAsUser: 10001
 ```
 
+### Labels and Annotations
+
+The chart always applies the standard Kubernetes recommended labels (`app.kubernetes.io/name`,
+`app.kubernetes.io/instance`, `app.kubernetes.io/managed-by`, `app.kubernetes.io/version` and
+`helm.sh/chart`) to every resource. On top of those you can attach your own labels/annotations at
+three scopes. All scopes are merged and **more specific scopes win on key conflicts**. The chart's
+`app.name` selector label is never overridden, and nothing is ever injected into a
+`selector`/`matchLabels`, so `helm upgrade` of an existing release is always safe.
+
+| Setting                          | Default | Required | Scope                    | Description                                                                                                                                                                                                                             |
+| -------------------------------- | :-----: | :------: | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| commonLabels                     |  `{}`   |    No    | **Every resource**       | Labels added to the metadata of **every object** the chart creates (Deployments, StatefulSets, Jobs, Services, ConfigMaps, Secrets, certs, Ingress/IngressRoute, ServiceAccount, Middleware) **and** to every pod template.            |
+| commonAnnotations                |  `{}`   |    No    | **Every resource**       | Annotations added to every object's metadata and every pod template. On the nginx `Ingress` these merge with `ingress.ingress_annotations` (the ingress-specific value wins).                                                          |
+| services.\<svc\>.labels          |  `{}`   |    No    | One workload **object**  | Labels added to a single workload's own resource metadata (the Deployment/StatefulSet/Job object). Wins over `commonLabels`.                                                                                                           |
+| services.\<svc\>.annotations     |  `{}`   |    No    | One workload **object**  | Annotations added to a single workload's own resource metadata. Wins over `commonAnnotations`.                                                                                                                                        |
+| services.\<svc\>.podLabels       |  `{}`   |    No    | One workload **pods**    | Labels added to a single workload's pod template only (e.g. `services.api.podLabels`). Wins over `commonLabels`. This is what service meshes, NetworkPolicies and Prometheus pod selectors match on.                                   |
+| services.\<svc\>.podAnnotations  |  `{}`   |    No    | One workload **pods**    | Annotations added to a single workload's pod template only (e.g. `services.api.podAnnotations`). Wins over `commonAnnotations`.                                                                                                        |
+| services.api.migrator.\*         |  `{}`   |    No    | Migration **Job** only   | `labels`/`annotations`/`podLabels`/`podAnnotations` for the one-shot db-migration Job. The Job inherits all of `services.api`'s maps; keys set here **win** on conflict — e.g. `podAnnotations: {sidecar.istio.io/inject: "false"}` so the Job can complete on a meshed cluster, or `annotations: {argocd.argoproj.io/hook: PreSync}`. |
+| services.pi.migrator.\*          |  `{}`   |    No    | pi migration **Job** only  | Same override tier for the pi db-migration Job (inherits `services.pi`'s maps).                                                                                                                                                     |
+| services.minio.bucketJob.\*      |  `{}`   |    No    | Bucket-setup **Job** only  | Same override tier for the MinIO bucket-setup Job (inherits `services.minio`'s maps).                                                                                                                                               |
+
+> **Object-level vs pod-level.** `services.<svc>.labels`/`annotations` land on the **workload
+> resource** (the Deployment/StatefulSet object itself). `services.<svc>.podLabels`/`podAnnotations`
+> land on the **pod template** (`spec.template.metadata`), so they propagate to every pod.
+> `commonLabels`/`commonAnnotations` reach **both** levels, on every object in the chart.
+> One-shot Jobs (api/pi migrators, MinIO bucket setup) inherit their parent service's maps and can
+> selectively override them via the `migrator`/`bucketJob` blocks — precedence is
+> `job override` > `services.<svc>.*` > `common*` > standard labels.
+
+```yaml
+commonLabels:
+  team: platform
+commonAnnotations:
+  cost-center: engineering
+services:
+  api:
+    labels: {}          # only the api Deployment/Service object
+    annotations: {}
+    podLabels:          # only the api pods; wins over commonLabels
+      tier: backend
+    podAnnotations:
+      prometheus.io/scrape: "true"
+```
+
 ### Docker Registry
 
 | Setting                      | Default              | Required | Description                                                                                                                                                                                                                                                                                                                        |

charts/plane-enterprise/templates/_helpers.tpl

@@ -54,9 +54,9 @@ Standard Kubernetes recommended labels shared by every resource the chart render
 These are additive metadata labels only; they are intentionally kept out of
 spec.selector/matchLabels (which stay on the immutable `app.name` label) so that
 upgrading an existing release never tries to mutate an immutable selector.
-Call with the root context, e.g. {{ include "plane.commonLabels" $ }}
+Call with the root context, e.g. {{ include "plane.standardLabels" $ }}
 */}}
-{{- define "plane.commonLabels" -}}
+{{- define "plane.standardLabels" -}}
 helm.sh/chart: {{ include "plane.chart" . }}
 app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
@@ -67,24 +67,93 @@ app.kubernetes.io/version: {{ . | quote }}
 {{- end -}}
 
 {{/*
-Render a resource's `labels` and `annotations` metadata.
-Always emits the standard recommended labels (see plane.commonLabels) and merges
-any per-component labels supplied under the component's `labels` value. Per-component
-annotations are emitted when present.
+Object-metadata labels as a bare map (no `labels:` key): the standard recommended
+labels merged with the chart-wide user map `.Values.commonLabels`. The user map wins
+on key conflicts. Always non-empty (the standard labels are always present), so callers
+append it under a `labels:` key without a `with` guard. Call with the root context.
+  labels:
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+*/}}
+{{- define "plane.resourceLabels" -}}
+{{- $std := fromYaml (include "plane.standardLabels" .) -}}
+{{- toYaml (merge (dict) (.Values.commonLabels | default dict) $std) -}}
+{{- end -}}
+
+{{/*
+Object-metadata annotations as a bare map (no `annotations:` key): the chart-wide user
+map `.Values.commonAnnotations`. May be empty, so callers guard it with `with` and only
+then emit the `annotations:` key. Call with the root context.
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+*/}}
+{{- define "plane.resourceAnnotations" -}}
+{{- with .Values.commonAnnotations }}{{ toYaml . }}{{- end }}
+{{- end -}}
+
+{{/*
+Render a resource's `labels` and `annotations` metadata block. Emits the standard
+recommended labels + the chart-wide `.Values.commonLabels` + the per-component `labels`
+map, all merged into a single block (per-component wins over commonLabels wins over the
+standard labels, so no duplicate keys). Annotations merge `.Values.commonAnnotations`
+with the per-component `annotations` map (per-component wins) and are emitted only when
+non-empty. Never touches spec.selector/matchLabels.
 Call with a dict carrying the root context and the component values:
   {{ include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.services.api) }}
+One-shot Jobs that inherit a parent service's values may pass an optional job-override
+map whose labels/annotations win over the parent's (e.g. an ArgoCD hook annotation that
+belongs on the migration Job but not on the api Deployment):
+  {{ include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.services.api "job" .Values.services.api.migrator) }}
 */}}
-{{- define "plane.labelsAndAnnotations" }}
-  labels:
-    {{- include "plane.commonLabels" .context | nindent 4 }}
-    {{- with .values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with .values.annotations }}
+{{- define "plane.labelsAndAnnotations" -}}
+{{- $std := fromYaml (include "plane.standardLabels" .context) -}}
+{{- $job := .job | default dict -}}
+{{- $labels := merge (dict) ($job.labels | default dict) (.values.labels | default dict) (.context.Values.commonLabels | default dict) $std -}}
+{{- $annotations := merge (dict) ($job.annotations | default dict) (.values.annotations | default dict) (.context.Values.commonAnnotations | default dict) }}
+  labels: {{ toYaml $labels | nindent 4 }}
+  {{- with $annotations }}
   annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
 {{- end }}
 
+{{/*
+Pod-template labels as a bare map (no `labels:` key): the standard recommended labels +
+chart-wide `.Values.commonLabels` + the per-workload `podLabels` map, merged into one
+block (podLabels wins over commonLabels wins over the standard labels). Always non-empty,
+so callers append it under the pod template's `labels:` key (which already carries the
+static `app.name` selector label) without a `with` guard. The `app.name` label is emitted
+by the template itself and never included here, so the selector is never duplicated.
+Call with a dict carrying the root context and the component values:
+  labels:
+    app.name: ...
+    {{- include "plane.podLabels" (dict "context" $ "values" .Values.services.api) | nindent 8 }}
+*/}}
+{{- define "plane.podLabels" -}}
+{{- $ctx := .context -}}
+{{- $values := .values | default dict -}}
+{{- $job := .job | default dict -}}
+{{- $std := fromYaml (include "plane.standardLabels" $ctx) -}}
+{{- toYaml (merge (dict) ($job.podLabels | default dict) ($values.podLabels | default dict) ($ctx.Values.commonLabels | default dict) $std) -}}
+{{- end -}}
+
+{{/*
+Pod-template annotations as a bare map (no `annotations:` key): the chart-wide
+`.Values.commonAnnotations` merged with the per-workload `podAnnotations` map
+(podAnnotations wins). May be empty, so callers guard it with `with`.
+Call with a dict carrying the root context and the component values:
+  {{- with (include "plane.podAnnotations" (dict "context" $ "values" .Values.services.api)) }}
+  {{- . | nindent 8 }}
+  {{- end }}
+*/}}
+{{- define "plane.podAnnotations" -}}
+{{- $ctx := .context -}}
+{{- $values := .values | default dict -}}
+{{- $job := .job | default dict -}}
+{{- $merged := merge (dict) ($job.podAnnotations | default dict) ($values.podAnnotations | default dict) ($ctx.Values.commonAnnotations | default dict) -}}
+{{- with $merged }}{{ toYaml . }}{{- end }}
+{{- end -}}
+
 {{/*
 Returns "true" when the bundled MinIO should be deployed.
 MinIO is deployed only when services.minio.local_setup is enabled AND the storage

charts/plane-enterprise/templates/certs/cert-issuers.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-issuer-api-token-secret
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 type: Opaque
 stringData:
   api-token: {{ .Values.ssl.token | default "default-api-token" | quote }}
@@ -18,7 +22,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-cert-issuer
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   acme:
     email: {{ .Values.ssl.email }}

charts/plane-enterprise/templates/certs/certs.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-ssl-cert
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   dnsNames:
   - {{ .Values.license.licenseDomain | quote }}

charts/plane-enterprise/templates/certs/email-certs.yaml

@@ -4,7 +4,11 @@ kind: Certificate
 metadata:
   name: {{ .Release.Name }}-mail-tls-cert
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   namespace: {{ .Release.Namespace }}
 spec:
   dnsNames:

charts/plane-enterprise/templates/config-secrets/app-env.yaml

@@ -9,7 +9,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-app-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   SECRET_KEY: {{ .Values.env.secret_key | default "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" | quote }}
   AES_SECRET_KEY: {{ .Values.env.silo_envs.aes_secret_key | default "dsOdt7YrvxsTIFJ37pOaEVvLxN8KGBCr" | quote }}
@@ -54,7 +58,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-app-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   PRIME_HOST: {{ .Values.license.licenseServer | quote }}
   MACHINE_SIGNATURE: {{ include "hashString" . | quote }}

charts/plane-enterprise/templates/config-secrets/automations-consumer.yaml

@@ -5,7 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-automation-consumer-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   AUTOMATION_EVENT_STREAM_QUEUE_NAME: {{ .Values.env.automation_consumer_envs.event_stream_queue_name | default "plane.event_stream.automations" | quote }}
   AUTOMATION_EVENT_STREAM_PREFETCH: {{ .Values.env.automation_consumer_envs.event_stream_prefetch | default 10 | quote }}

charts/plane-enterprise/templates/config-secrets/doc-store.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-doc-store-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   FILE_SIZE_LIMIT: {{ .Values.env.doc_upload_size_limit | default "20971520" | quote }}
   AWS_S3_BUCKET_NAME: {{ .Values.env.docstore_bucket | default "" | quote  }}

charts/plane-enterprise/templates/config-secrets/docker-registry.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-docker-registry-credentials
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   .dockerconfigjson: {{ include "imagePullSecret" .}}
 type: kubernetes.io/dockerconfigjson

charts/plane-enterprise/templates/config-secrets/email-env.yaml

@@ -5,7 +5,11 @@ kind: ConfigMap
 metadata:
   name: {{ .Release.Name }}-email-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   namespace: {{ .Release.Namespace }}
 data:
   SMTP_DOMAIN: {{ .Values.env.email_service_envs.smtp_domain | default "" | quote }}

charts/plane-enterprise/templates/config-secrets/live-env.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-live-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   LIVE_SERVER_SECRET_KEY: {{ .Values.env.live_server_secret_key | default "htbqvBJAgpm9bzvf3r4urJer0ENReatceh" | quote }}
   {{- if .Values.services.redis.local_setup }}
@@ -22,7 +26,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-live-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   API_BASE_URL: "http://{{ .Release.Name }}-api.{{ .Release.Namespace }}.svc.{{ .Values.env.default_cluster_domain | default "cluster.local" }}:8000/"
   LIVE_SENTRY_DSN: {{ .Values.env.live_sentry_dsn | default "" | quote }}

charts/plane-enterprise/templates/config-secrets/monitor.yaml

@@ -4,7 +4,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-monitor-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   PRIME_HOST: {{ .Values.license.licenseServer | quote }}
   MACHINE_SIGNATURE: {{ include "hashString" . | quote }}

charts/plane-enterprise/templates/config-secrets/opensearchdb.yaml

@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-opensearch-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   {{- if .Values.services.opensearch.local_setup }}
   OPENSEARCH_ENABLED: "1"
@@ -40,7 +44,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-opensearch-init
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   create-user.sh: |
     #!/bin/bash

charts/plane-enterprise/templates/config-secrets/outbox-poller.yaml

@@ -5,7 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-outbox-poller-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   OUTBOX_POLLER_MEMORY_LIMIT_MB: {{ .Values.env.outbox_poller_envs.memory_limit_mb | default 400 | quote }}
   OUTBOX_POLLER_INTERVAL_MIN: {{ .Values.env.outbox_poller_envs.interval_min | default 0.25 | quote }}