feat(helm): add podLabels for the chart's pods

A multi-tenant telemetry collector commonly takes a pod's tenant from a
pod label, the one signal a headerless OTLP export carries. The chart
sets only its own `app` label on every pod and offers no way to add one.

`podLabels` is added to every long-running pod template, next to `app`,
which it cannot replace: `app` is the selector of every workload, so the
render fails when podLabels sets it. The rustfs-bucket-init Job is left
out, because a Job's pod template is immutable and a label change would
fail the upgrade.

The default render is unchanged, so manifests/ate-install/ stays as is.

Signed-off-by: QuentinBisson <quentin@giantswarm.io>

Author: QuentinBisson

charts/substrate/README.md

@@ -49,6 +49,7 @@ See `values.yaml` for the full set; the important keys:
 | `atelet.gcpAuthForImagePulls` | `false` | Enable only when using GCP registry auth |
 | `credentialProvider.namespacePolicies` | `[]` | Default-deny atespace-to-namespace grants; the chart includes get-only Secret RBAC for the provider |
 | `ateApi.extraArgs` | `[]` | Additional command-line arguments appended to the ateapi defaults |
+| `podLabels` | `{}` | Labels added to every long-running pod, next to the chart's own `app` label |
 | `otel.endpoint` | `""` | Set to an OTLP endpoint to export traces, metrics, the actor lifecycle events and the router access log |
 | `otel.traces.enabled` | `true` | Set to `false` to export no traces from the router; the Go components do not honor this yet |
 | `otel.traces.endpoint` | `""` | OTLP endpoint for traces, overriding `otel.endpoint` |

charts/substrate/templates/_helpers.tpl

@@ -219,6 +219,20 @@ imagePullSecrets:
 {{- end -}}
 {{- end -}}
 
+{{/*
+The podLabels entries for a pod template, as YAML map entries. Renders nothing
+when podLabels is empty. The chart's own `app` label is the selector of every
+workload, so a podLabels entry cannot replace it.
+*/}}
+{{- define "substrate.podLabels" -}}
+{{- with .Values.podLabels -}}
+{{- if hasKey . "app" -}}
+{{- fail "podLabels must not set app: it is the selector label of every workload in the chart" -}}
+{{- end -}}
+{{- toYaml . -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 imagePullPolicy: global.imagePullPolicy when set, IfNotPresent otherwise. One
 definition so the fallback cannot drift between pods.

charts/substrate/templates/ate-api-server.yaml

@@ -71,6 +71,7 @@ spec:
     metadata:
       labels:
         app: ate-api-server
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9090"

charts/substrate/templates/ate-controller.yaml

@@ -65,6 +65,7 @@ spec:
     metadata:
       labels:
         app: ate-controller
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "ate-controller" .) }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}

charts/substrate/templates/atelet.yaml

@@ -104,6 +104,7 @@ spec:
     metadata:
       labels:
         app: atelet
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "9090"

charts/substrate/templates/atenet-egress.yaml

@@ -127,6 +127,7 @@ spec:
     metadata:
       labels:
         app: atenet-egress
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "atenet-egress" .) }}
       securityContext:

charts/substrate/templates/atenet-router.yaml

@@ -207,6 +207,7 @@ spec:
     metadata:
       labels:
         app: atenet-router
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "15020"

charts/substrate/templates/k8s-credential-provider.yaml

@@ -65,6 +65,7 @@ spec:
         checksum/namespace-policy: {{ toJson .Values.credentialProvider.namespacePolicies | sha256sum }}
       labels:
         app: {{ include "substrate.fullname" (list "k8s-credential-provider" .) }}
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
     spec:
       serviceAccountName: {{ include "substrate.fullname" (list "k8s-credential-provider" .) }}
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}

charts/substrate/templates/pod-certificate-controller.yaml

@@ -138,6 +138,7 @@ spec:
     metadata:
       labels:
         app: podcertificate-controller
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
     spec:
       {{- with include "substrate.imagePullSecrets" . }}{{- . | nindent 6 }}{{- end }}
       containers:

charts/substrate/templates/postgres.yaml

@@ -104,6 +104,7 @@ spec:
     metadata:
       labels:
         app: {{ $name }}
+        {{- with include "substrate.podLabels" $ }}{{- . | nindent 8 }}{{- end }}
     spec:
       securityContext:
         # Group ownership of the projected certificate below, and of the data