Skip to content

check label key/val format #9414

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
jukie wants to merge 1 commit into
base: main
Choose a base branch
from
+438 −32
Draft

check label key/val format #9414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions api/v1alpha1/shared_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,9 +173,12 @@ type KubernetesPodSpec struct {

// Labels are the additional labels that should be tagged to the pods.
// By default, no additional pod labels are tagged.
// Keys must be valid label keys (optionally prefixed qualified names) and
// values must satisfy the Kubernetes label value format, otherwise the
// resource is rejected.
//
// +optional
Labels map[string]string `json:"labels,omitempty"`
Labels map[gwapiv1.LabelKey]gwapiv1.LabelValue `json:"labels,omitempty"`

// SecurityContext holds pod-level security attributes and common container settings.
// Optional: Defaults to empty. See type description for default values of each field.
Expand Down Expand Up @@ -329,9 +332,12 @@ type KubernetesServiceSpec struct {

// Labels that should be appended to the service.
// By default, no labels are appended.
// Keys must be valid label keys (optionally prefixed qualified names) and
// values must satisfy the Kubernetes label value format, otherwise the
// resource is rejected.
//
// +optional
Labels map[string]string `json:"labels,omitempty"`
Labels map[gwapiv1.LabelKey]gwapiv1.LabelValue `json:"labels,omitempty"`

// Type determines how the Service is exposed. Defaults to LoadBalancer.
// Valid options are ClusterIP, LoadBalancer and NodePort.
Expand Down
4 changes: 2 additions & 2 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

57 changes: 57 additions & 0 deletions charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_envoyproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2340,10 +2340,29 @@ spec:
type: array
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are the additional labels that should be tagged to the pods.
By default, no additional pod labels are tagged.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
nodeSelector:
additionalProperties:
Expand Down Expand Up @@ -7897,10 +7916,29 @@ spec:
type: array
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are the additional labels that should be tagged to the pods.
By default, no additional pod labels are tagged.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
nodeSelector:
additionalProperties:
Expand Down Expand Up @@ -11157,10 +11195,29 @@ spec:
type: string
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels that should be appended to the service.
By default, no labels are appended.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
loadBalancerClass:
description: |-
Expand Down
57 changes: 57 additions & 0 deletions charts/gateway-helm/charts/crds/crds/generated/gateway.envoyproxy.io_envoyproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2339,10 +2339,29 @@ spec:
type: array
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are the additional labels that should be tagged to the pods.
By default, no additional pod labels are tagged.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
nodeSelector:
additionalProperties:
Expand Down Expand Up @@ -7896,10 +7915,29 @@ spec:
type: array
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels are the additional labels that should be tagged to the pods.
By default, no additional pod labels are tagged.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
nodeSelector:
additionalProperties:
Expand Down Expand Up @@ -11156,10 +11194,29 @@ spec:
type: string
labels:
additionalProperties:
description: |-
LabelValue is the value of a label in the Gateway API. This is used for validation
of maps such as Gateway infrastructure labels. This matches the Kubernetes
label validation rules:
* must be 63 characters or less (can be empty),
* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.

Valid values include:

* MyValue
* my.name
* 123-my-value
maxLength: 63
minLength: 0
pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
type: string
description: |-
Labels that should be appended to the service.
By default, no labels are appended.
Keys must be valid label keys (optionally prefixed qualified names) and
values must satisfy the Kubernetes label value format, otherwise the
resource is rejected.
type: object
loadBalancerClass:
description: |-
Expand Down
6 changes: 2 additions & 4 deletions internal/infrastructure/kubernetes/proxy/resource_provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,9 +244,7 @@ func (r *ResourceRender) Service() (*corev1.Service, error) {
// Get service-specific labels
svcLabels := map[string]string{}
maps.Copy(svcLabels, infraLabels)
if envoyServiceConfig.Labels != nil {
maps.Copy(svcLabels, envoyServiceConfig.Labels)
}
utils.CopyStringMap(svcLabels, envoyServiceConfig.Labels)
if len(svcLabels) == 0 {
svcLabels = nil
}
Expand Down Expand Up @@ -677,7 +675,7 @@ func (r *ResourceRender) getLabels() (map[string]string, error) {

func (r *ResourceRender) getPodLabels(pod *egv1a1.KubernetesPodSpec) map[string]string {
podLabels := r.infra.GetProxyMetadata().Labels
maps.Copy(podLabels, pod.Labels)
utils.CopyStringMap(podLabels, pod.Labels)

return r.envoyLabels(podLabels)
}
Expand Down
16 changes: 8 additions & 8 deletions internal/infrastructure/kubernetes/proxy/resource_provider_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,7 +224,7 @@ func TestDeployment(t *testing.T) {
Annotations: map[string]string{
"prometheus.io/scrape": "true",
},
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"foo.bar": "custom-label",
},
SecurityContext: &corev1.PodSecurityContext{
Expand Down Expand Up @@ -502,7 +502,7 @@ func TestDeployment(t *testing.T) {
Annotations: map[string]string{
"prometheus.io/scrape": "true",
},
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"foo.bar": "custom-label",
},
SecurityContext: &corev1.PodSecurityContext{
Expand Down Expand Up @@ -577,7 +577,7 @@ func TestDeployment(t *testing.T) {
Annotations: map[string]string{
"anno1": "value1-override",
},
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"label1": "value1-override",
},
},
Expand Down Expand Up @@ -801,7 +801,7 @@ func TestDaemonSet(t *testing.T) {
Annotations: map[string]string{
"prometheus.io/scrape": "true",
},
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"foo.bar": "custom-label",
},
SecurityContext: &corev1.PodSecurityContext{
Expand Down Expand Up @@ -1068,7 +1068,7 @@ func TestDaemonSet(t *testing.T) {
Annotations: map[string]string{
"anno1": "value1-override",
},
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"label1": "value1-override",
},
},
Expand Down Expand Up @@ -1270,7 +1270,7 @@ func TestService(t *testing.T) {
caseName: "custom",
infra: newTestInfra(),
service: &egv1a1.KubernetesServiceSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"key1": "value1",
},
Annotations: map[string]string{
Expand Down Expand Up @@ -1305,7 +1305,7 @@ func TestService(t *testing.T) {
caseName: "with-svc-labels",
infra: newTestInfra(),
service: &egv1a1.KubernetesServiceSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"label1": "value1",
"label2": "value2",
},
Expand All @@ -1321,7 +1321,7 @@ func TestService(t *testing.T) {
"label2": "value2",
}),
service: &egv1a1.KubernetesServiceSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"label1": "value1-override",
},
},
Expand Down
7 changes: 4 additions & 3 deletions internal/infrastructure/kubernetes/proxy_daemonset_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"

egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
"github.com/envoyproxy/gateway/internal/envoygateway"
Expand Down Expand Up @@ -195,7 +196,7 @@ func TestCreateOrUpdateProxyDaemonSet(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
// Add a new label to the custom label config.
// It wouldn't break the daemonset because the selector would still match after this label update.
"custom-label": "version1",
Expand Down Expand Up @@ -236,7 +237,7 @@ func TestCreateOrUpdateProxyDaemonSet(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"custom-label": "version1",
"another-custom-label": "version1", // added.
},
Expand Down Expand Up @@ -276,7 +277,7 @@ func TestCreateOrUpdateProxyDaemonSet(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDaemonSet: &egv1a1.KubernetesDaemonSetSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
// Update the label value which will break the daemonset
// because the selector cannot be updated while the user wants to update the label value.
// We cannot help this case, just emit an error and let the user recreate the envoy proxy by themselves.
Expand Down
7 changes: 4 additions & 3 deletions internal/infrastructure/kubernetes/proxy_deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"sigs.k8s.io/controller-runtime/pkg/client"
fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"

egv1a1 "github.com/envoyproxy/gateway/api/v1alpha1"
"github.com/envoyproxy/gateway/internal/envoygateway"
Expand Down Expand Up @@ -188,7 +189,7 @@ func TestCreateOrUpdateProxyDeployment(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"custom-label": "version1", // added.
},
},
Expand Down Expand Up @@ -227,7 +228,7 @@ func TestCreateOrUpdateProxyDeployment(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
"custom-label": "version1",
// Add a new label to the custom label config.
// It wouldn't break the deployment because the selector would still match after this label update.
Expand Down Expand Up @@ -269,7 +270,7 @@ func TestCreateOrUpdateProxyDeployment(t *testing.T) {
Kubernetes: &egv1a1.EnvoyProxyKubernetesProvider{
EnvoyDeployment: &egv1a1.KubernetesDeploymentSpec{
Pod: &egv1a1.KubernetesPodSpec{
Labels: map[string]string{
Labels: map[gwapiv1.LabelKey]gwapiv1.LabelValue{
// Update the label value which will break the deployment
// because the selector cannot be updated while the user wants to update the label value.
// We cannot help this case, just emit an error and let the user recreate the envoy proxy by themselves.
Expand Down
Loading
Loading