makeplane · akshat5302 · Jul 7, 2026
diff --git a/charts/plane-ce/Chart.yaml b/charts/plane-ce/Chart.yaml
@@ -5,7 +5,7 @@ description: Meet Plane. An open-source software development tool to manage issu
 
 type: application
 
-version: 1.6.0
+version: 1.7.0
 appVersion: "1.3.1"
 
 home: https://plane.so

diff --git a/charts/plane-ce/README.md b/charts/plane-ce/README.md
@@ -165,6 +165,48 @@ The default value is `"traefik"`. If you previously relied on the implicit defau
 | ------------ | :-----: | :------: | ----------- |
 | planeVersion | v1.3.1  |   Yes    |             |
 
+### Labels and Annotations
+
+The chart always applies the standard Kubernetes recommended labels (`app.kubernetes.io/name`,
+`app.kubernetes.io/instance`, `app.kubernetes.io/managed-by`, `app.kubernetes.io/version` and
+`helm.sh/chart`) to every resource. On top of those you can attach your own labels/annotations at
+three scopes. All scopes are merged and **more specific scopes win on key conflicts**. The chart's
+`app.name` selector label is never overridden, and nothing is ever injected into a
+`selector`/`matchLabels`, so `helm upgrade` of an existing release is always safe.
+
+| Setting                          | Default | Required | Scope                    | Description                                                                                                                                                                                            |
+| -------------------------------- | :-----: | :------: | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| commonLabels                     |  `{}`   |    No    | **Every resource**       | Labels added to the metadata of **every object** the chart creates (Deployments, StatefulSets, Jobs, Services, ConfigMaps, Secrets, certs, Ingress/IngressRoute, ServiceAccount, Middleware) **and** to every pod template. |
+| commonAnnotations                |  `{}`   |    No    | **Every resource**       | Annotations added to every object's metadata and every pod template. On the nginx `Ingress` these merge with `ingress.ingress_annotations` (the ingress-specific value wins).                          |
+| \<component\>.labels             |  `{}`   |    No    | One workload **object**  | Labels added to a single workload's own resource metadata (e.g. `api.labels`). Wins over `commonLabels`.                                                                                               |
+| \<component\>.annotations        |  `{}`   |    No    | One workload **object**  | Annotations added to a single workload's own resource metadata. Wins over `commonAnnotations`.                                                                                                        |
+| \<component\>.podLabels          |  `{}`   |    No    | One workload **pods**    | Labels added to a single workload's pod template only (e.g. `api.podLabels`). Wins over `commonLabels`. This is what service meshes, NetworkPolicies and Prometheus pod selectors match on.            |
+| \<component\>.podAnnotations     |  `{}`   |    No    | One workload **pods**    | Annotations added to a single workload's pod template only. Wins over `commonAnnotations`.                                                                                                            |
+| api.migrator.\*                  |  `{}`   |    No    | Migration **Job** only   | `labels`/`annotations`/`podLabels`/`podAnnotations` for the one-shot db-migration Job. The Job inherits all of `api`'s maps; keys set here **win** on conflict — e.g. `podAnnotations: {sidecar.istio.io/inject: "false"}` so the Job can complete on a meshed cluster. |
+| minio.bucketJob.\*               |  `{}`   |    No    | Bucket-setup **Job** only | Same override tier for the MinIO bucket-setup Job (inherits `minio`'s maps).                                                                                                                          |
+
+> **Object-level vs pod-level.** `<component>.labels`/`annotations` land on the **workload resource**
+> (the Deployment/StatefulSet object itself). `<component>.podLabels`/`podAnnotations` land on the
+> **pod template** (`spec.template.metadata`), so they propagate to every pod. `commonLabels`/
+> `commonAnnotations` reach **both** levels, on every object in the chart. One-shot Jobs inherit
+> their parent component and can selectively override via `api.migrator` / `minio.bucketJob` —
+> precedence is `job override` > `<component>.*` > `common*` > standard labels.
+
+```yaml
+commonLabels:
+  team: platform
+commonAnnotations:
+  cost-center: engineering
+api:
+  podLabels:
+    tier: backend
+  podAnnotations:
+    prometheus.io/scrape: "true"
+  migrator:
+    podAnnotations:
+      sidecar.istio.io/inject: "false"
+```
+
 ### Postgress DB Setup
 
 | Setting                    |              Default              | Required | Description                                                                                                                                                                                                                                                                                                                                                                             |

diff --git a/charts/plane-ce/templates/_helpers.tpl b/charts/plane-ce/templates/_helpers.tpl
@@ -26,9 +26,9 @@ Standard Kubernetes recommended labels shared by every resource the chart render
 These are additive metadata labels only; they are intentionally kept out of
 spec.selector/matchLabels (which stay on the immutable `app.name` label) so that
 upgrading an existing release never tries to mutate an immutable selector.
-Call with the root context, e.g. {{ include "plane.commonLabels" $ }}
+Call with the root context, e.g. {{ include "plane.standardLabels" $ }}
 */}}
-{{- define "plane.commonLabels" -}}
+{{- define "plane.standardLabels" -}}
 helm.sh/chart: {{ include "plane.chart" . }}
 app.kubernetes.io/name: {{ .Chart.Name }}
 app.kubernetes.io/instance: {{ .Release.Name }}
@@ -39,20 +39,91 @@ app.kubernetes.io/version: {{ . | quote }}
 {{- end -}}
 
 {{/*
-Render a resource's `labels` and `annotations` metadata.
-Always emits the standard recommended labels (see plane.commonLabels) and merges
-any per-component labels supplied under the component's `labels` value. Per-component
-annotations are emitted when present.
+Object-metadata labels as a bare map (no `labels:` key): the standard recommended
+labels merged with the chart-wide user map `.Values.commonLabels`. The user map wins
+on key conflicts. Always non-empty (the standard labels are always present), so callers
+append it under a `labels:` key without a `with` guard. Call with the root context.
+  labels:
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+*/}}
+{{- define "plane.resourceLabels" -}}
+{{- $std := fromYaml (include "plane.standardLabels" .) -}}
+{{- toYaml (merge (dict) (.Values.commonLabels | default dict) $std) -}}
+{{- end -}}
+
+{{/*
+Object-metadata annotations as a bare map (no `annotations:` key): the chart-wide user
+map `.Values.commonAnnotations`. May be empty, so callers guard it with `with` and only
+then emit the `annotations:` key. Call with the root context.
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
+*/}}
+{{- define "plane.resourceAnnotations" -}}
+{{- with .Values.commonAnnotations }}{{ toYaml . }}{{- end }}
+{{- end -}}
+
+{{/*
+Render a resource's `labels` and `annotations` metadata block. Emits the standard
+recommended labels + the chart-wide `.Values.commonLabels` + the per-component `labels`
+map, all merged into a single block (per-component wins over commonLabels wins over the
+standard labels, so no duplicate keys). Annotations merge `.Values.commonAnnotations`
+with the per-component `annotations` map (per-component wins) and are emitted only when
+non-empty. Never touches spec.selector/matchLabels.
 Call with a dict carrying the root context and the component values:
   {{ include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.api) }}
+One-shot Jobs that inherit a parent component's values may pass an optional job-override
+map whose labels/annotations win over the parent's (e.g. an ArgoCD hook annotation that
+belongs on the migration Job but not on the api Deployment):
+  {{ include "plane.labelsAndAnnotations" (dict "context" $ "values" .Values.api "job" .Values.api.migrator) }}
 */}}
-{{- define "plane.labelsAndAnnotations" }}
-  labels:
-    {{- include "plane.commonLabels" .context | nindent 4 }}
-    {{- with .values.labels }}
-    {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with .values.annotations }}
+{{- define "plane.labelsAndAnnotations" -}}
+{{- $std := fromYaml (include "plane.standardLabels" .context) -}}
+{{- $job := .job | default dict -}}
+{{- $labels := merge (dict) ($job.labels | default dict) (.values.labels | default dict) (.context.Values.commonLabels | default dict) $std -}}
+{{- $annotations := merge (dict) ($job.annotations | default dict) (.values.annotations | default dict) (.context.Values.commonAnnotations | default dict) }}
+  labels: {{ toYaml $labels | nindent 4 }}
+  {{- with $annotations }}
   annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
-{{- end }}
+{{- end }}
+
+{{/*
+Pod-template labels as a bare map (no `labels:` key): the standard recommended labels +
+chart-wide `.Values.commonLabels` + the per-workload `podLabels` map, merged into one
+block (podLabels wins over commonLabels wins over the standard labels). Always non-empty,
+so callers append it under the pod template's `labels:` key (which already carries the
+static `app.name` selector label) without a `with` guard. The `app.name` label is emitted
+by the template itself and never included here, so the selector is never duplicated.
+Optional "job" map adds a one-shot Job's podLabels override tier (wins over all).
+Call with a dict carrying the root context and the component values:
+  labels:
+    app.name: ...
+    {{- include "plane.podLabels" (dict "context" $ "values" .Values.api) | nindent 8 }}
+*/}}
+{{- define "plane.podLabels" -}}
+{{- $ctx := .context -}}
+{{- $values := .values | default dict -}}
+{{- $job := .job | default dict -}}
+{{- $std := fromYaml (include "plane.standardLabels" $ctx) -}}
+{{- toYaml (merge (dict) ($job.podLabels | default dict) ($values.podLabels | default dict) ($ctx.Values.commonLabels | default dict) $std) -}}
+{{- end -}}
+
+{{/*
+Pod-template annotations as a bare map (no `annotations:` key): the chart-wide
+`.Values.commonAnnotations` merged with the per-workload `podAnnotations` map
+(podAnnotations wins; an optional "job" map's podAnnotations win over both).
+May be empty, so callers guard it with `with`.
+Call with a dict carrying the root context and the component values:
+  {{- with (include "plane.podAnnotations" (dict "context" $ "values" .Values.api)) }}
+  {{- . | nindent 8 }}
+  {{- end }}
+*/}}
+{{- define "plane.podAnnotations" -}}
+{{- $ctx := .context -}}
+{{- $values := .values | default dict -}}
+{{- $job := .job | default dict -}}
+{{- $merged := merge (dict) ($job.podAnnotations | default dict) ($values.podAnnotations | default dict) ($ctx.Values.commonAnnotations | default dict) -}}
+{{- with $merged }}{{ toYaml . }}{{- end }}
+{{- end -}}
diff --git a/charts/plane-ce/templates/certs/cert-issuers.yaml b/charts/plane-ce/templates/certs/cert-issuers.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-issuer-api-token-secret
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 type: Opaque
 stringData:
   api-token: {{ .Values.ssl.token | default "default-api-token" | quote }}
@@ -18,7 +22,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-cert-issuer
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   acme:
     email: {{ .Values.ssl.email }}

diff --git a/charts/plane-ce/templates/certs/certs.yaml b/charts/plane-ce/templates/certs/certs.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-ssl-cert
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 spec:
   dnsNames:
   - {{ .Values.ingress.appHost | quote }}

diff --git a/charts/plane-ce/templates/config-secrets/app-env.yaml b/charts/plane-ce/templates/config-secrets/app-env.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-app-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   SECRET_KEY: {{ .Values.env.secret_key | default "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" | quote }}
   LIVE_SERVER_SECRET_KEY: {{ .Values.env.live_server_secret_key | default "htbqvBJAgpm9bzvf3r4urJer0ENReatceh" | quote }}
@@ -42,7 +46,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-app-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   SENTRY_DSN: {{ .Values.env.sentry_dsn | default "" | quote}}
   SENTRY_ENVIRONMENT: {{ .Values.env.sentry_environment | default "" | quote}}

diff --git a/charts/plane-ce/templates/config-secrets/doc-store.yaml b/charts/plane-ce/templates/config-secrets/doc-store.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-doc-store-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   FILE_SIZE_LIMIT: {{ .Values.env.doc_upload_size_limit | default 5242880 | quote }}
   AWS_S3_BUCKET_NAME: {{ .Values.env.docstore_bucket | default "" | quote  }}

diff --git a/charts/plane-ce/templates/config-secrets/docker-registry.yaml b/charts/plane-ce/templates/config-secrets/docker-registry.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-docker-registry-credentials
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   .dockerconfigjson: {{ include "imagePullSecret" .}}
 type: kubernetes.io/dockerconfigjson

diff --git a/charts/plane-ce/templates/config-secrets/live-env.yaml b/charts/plane-ce/templates/config-secrets/live-env.yaml
@@ -6,7 +6,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-live-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   LIVE_SERVER_SECRET_KEY: {{ .Values.env.live_server_secret_key | default "htbqvBJAgpm9bzvf3r4urJer0ENReatceh" | quote }}
   {{- if .Values.redis.local_setup }}
@@ -23,7 +27,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-live-vars
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 data:
   API_BASE_URL: "http://{{ .Release.Name }}-api.{{ .Release.Namespace }}.svc.cluster.local:8000/"
   LIVE_BASE_PATH: "/live"

diff --git a/charts/plane-ce/templates/config-secrets/pgdb.yaml b/charts/plane-ce/templates/config-secrets/pgdb.yaml
@@ -7,7 +7,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-pgdb-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   POSTGRES_PASSWORD: {{ .Values.env.pgdb_password | default "plane" | quote }}
   POSTGRES_DB: {{ .Values.env.pgdb_name | default "plane" | quote }}

diff --git a/charts/plane-ce/templates/config-secrets/rabbitmqdb.yaml b/charts/plane-ce/templates/config-secrets/rabbitmqdb.yaml
@@ -7,7 +7,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-rabbitmq-secrets
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 stringData:
   RABBITMQ_DEFAULT_USER: {{ .Values.rabbitmq.default_user | default "plane" | quote }}
   RABBITMQ_DEFAULT_PASS: {{ .Values.rabbitmq.default_password | default "plane" |quote }}

diff --git a/charts/plane-ce/templates/ingress-traefik.yaml b/charts/plane-ce/templates/ingress-traefik.yaml
@@ -5,7 +5,11 @@ kind: IngressRoute
 metadata:
   name: {{ .Release.Name }}-ingress
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   namespace: {{ .Release.Namespace }}
 spec:
   entryPoints:
@@ -86,7 +90,11 @@ kind: IngressRoute
 metadata:
   name: {{ .Release.Name }}-minio-ingress
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   namespace: {{ .Release.Namespace }}
 spec:
   entryPoints:
@@ -110,7 +118,11 @@ kind: IngressRoute
 metadata:
   name: {{ .Release.Name }}-rabbitmq-ingress
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   namespace: {{ .Release.Namespace }}
 spec:
   entryPoints:

diff --git a/charts/plane-ce/templates/ingress.yaml b/charts/plane-ce/templates/ingress.yaml
@@ -6,12 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-ingress
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
-  {{- if gt (len .Values.ingress.ingress_annotations) 0 }}
-  annotations:
-    {{- range $key, $value := .Values.ingress.ingress_annotations }}
-    {{ $key }}: {{ $value | quote }}
-    {{- end }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- $annotations := merge (dict) (.Values.ingress.ingress_annotations | default dict) (.Values.commonAnnotations | default dict) }}
+  {{- with $annotations }}
+  annotations: {{ toYaml . | nindent 4 }}
   {{- end }}
 spec:
   ingressClassName: {{ .Values.ingress.ingressClass | quote }}

diff --git a/charts/plane-ce/templates/service-account.yaml b/charts/plane-ce/templates/service-account.yaml
@@ -5,7 +5,11 @@ metadata:
   namespace: {{ .Release.Namespace }}
   name: {{ .Release.Name }}-srv-account
   labels:
-    {{- include "plane.commonLabels" $ | nindent 4 }}
+    {{- include "plane.resourceLabels" $ | nindent 4 }}
+  {{- with (include "plane.resourceAnnotations" $) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
 {{- if .Values.dockerRegistry.enabled }}
 imagePullSecrets:
   - name: {{ .Release.Name }}-docker-registry-credentials