[INFRA-438] - feat(plane-ce): configurable labels & annotations for all resources, pods, and one-shot jobs#263
Conversation
…ds, and one-shot jobs Community-chart counterpart of the plane-enterprise change (#262). Adds a three-tier (plus job-override) configurable metadata scheme on top of the standard recommended labels from #257, following the Grafana/GitLab chart conventions: - commonLabels / commonAnnotations: chart-wide, applied to every object the chart renders (Deployments, StatefulSets, Jobs, Services, ConfigMaps, Secrets, certs, Ingress/IngressRoute, ServiceAccount, Middleware) and to every pod template. - <component>.labels / annotations: one workload's object metadata (pre-existing keys, now merged with the common tier). - <component>.podLabels / podAnnotations: one workload's pod template only - what NetworkPolicies, service meshes and Prometheus match on. Added for all 11 components (plane-ce values are flat: api.podLabels). - api.migrator / minio.bucketJob: override tier for the one-shot Jobs. Jobs inherit their parent component's maps; keys set here win on conflict (e.g. sidecar.istio.io/inject "false" so migration Jobs complete on meshed clusters, or ArgoCD hook annotations on the Job object only). Precedence: job override > per-component > common > standard labels. Nothing is ever injected into spec.selector/matchLabels, so helm upgrade of an existing release never trips the immutable-selector error. Helpers: plane.commonLabels (from #257) renamed to plane.standardLabels to free the "common" name for the user-facing values key (GitLab's naming); new plane.resourceLabels / plane.resourceAnnotations / plane.podLabels / plane.podAnnotations compose the tiers; plane.labelsAndAnnotations extended with the common + job tiers. Also fixes, found while testing: - MinIO bucket Job pod template had no labels at all (missed in #257 too). - Traefik Middleware maxRequestBodyBytes rendered as scientific notation (2.097152e+07), which the CRD's integer field can reject - now | int64. Validated with helm lint and a 5-scenario render-assertion suite (~1,500 assertions) plus a selector-immutability check between unlabeled and fully-labeled renders. Chart version: 1.6.0 -> 1.7.0.
|
Warning Review limit reached
Next review available in: 10 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (28)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Linked to Plane Work Item(s) References
This comment was auto-generated by Plane |
1 participant
What
Community-chart counterpart of #262. Makes labels/annotations user-configurable across the entire
plane-cechart, layered on top of the standard recommended labels from #257. Adds tovalues.yaml(plane-ce uses flat component keys):Precedence on key conflict: job override > per-component > common > standard labels. All chart objects (Deployments, StatefulSets, Jobs, Services, ConfigMaps, Secrets, certs, Ingress/IngressRoute, ServiceAccount, Middleware) and all 12 pod templates are wired through shared helpers in
templates/_helpers.tpl, for all 11 components.Why
podSelector, service-mesh injection, Prometheus scrape annotations, Vault agent injection. The chart previously exposed only object-level<component>.labels, so none of these integrations could target Plane pods.commonLabels/commonAnnotations(Grafana/GitLab convention) enable cost-allocation, ownership, and GitOps grouping without repeating maps per component.sidecar.istio.io/inject: "true"on api pods would be inherited by the migration Job, whose sidecar never exits, so the Job never completes. Jobs inherit the parent component's maps and selectively override (inject: "false"), and can take Job-only object annotations likeargocd.argoproj.io/hook: PreSync.Scope / behavior
{}; with defaults the rendered output is identical to master except the two bug-fixes below.helm upgradesafe: nothing is ever injected intospec.selector/matchLabels— selectors stay on the immutableapp.namelabel. Verified all 20 selectors byte-identical between unlabeled and fully-labeled renders.IngressmergescommonAnnotationswith the existingingress.ingress_annotations(ingress-specific wins). TraefikIngressRoutes/Middlewareget the common maps too.plane.commonLabels([INFRA-423] - feat(plane-ce): add standard Kubernetes recommended labels #257) →plane.standardLabels, freeing the "common" name for the user-facing values key; newplane.resourceLabels/plane.resourceAnnotations/plane.podLabels/plane.podAnnotationscompose the tiers.Bug fixes (found while testing)
MiddlewarerenderedmaxRequestBodyBytes: 2.097152e+07(Helm float64 scientific notation), which the CRD's integer field can reject — now| int64, renders20971520.Testing
helm lintclean; chart version bumped 1.6.0 → 1.7.0.helm template+ YAML parsing): defaults (standard labels everywhere, zero leak), full combo (common + per-component + precedence conflicts:postgres.podLabels.teambeatscommonLabels.team; migrator overrides istio inject while inheriting prometheus annotations; ArgoCD hook on Job object only; bucket Job pod labels), nginx ingress annotation merge conflict, standard-label override escape hatch, special-character values (JSON/unicode/URLs/numeric strings stay strings).Upgrade notes
None required. Existing releases upgrade in place; new labels/annotations only appear if the operator sets the new values.
Related
🤖 Generated with Claude Code