WIP: Labels

.source/certificates/cert-manager/config/overlays/crds.yaml

@@ -1,5 +1,15 @@
 ---
-commonOverlays: []
+commonOverlays:
+  - name: "add kubernetes and nukleros labels"
+    query: "metadata"
+    value:
+      labels:
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
+
 yamlFiles:
   - name: "cert-manager custom resource definitions"
     path: "../../vendor/cert-manager.yaml"
@@ -11,3 +21,4 @@ yamlFiles:
         documentQuery:
           - conditions:
               - query: $[?($.kind != "CustomResourceDefinition")]
+

.source/certificates/cert-manager/config/overlays/deployment.yaml

@@ -1,13 +1,24 @@
 ---
 commonOverlays:
-  - name: "inject the platform purpose label"
+  - name: "add kubernetes and nukleros labels on deployments"
     query: "metadata"
     value:
       labels:
-        platform.nukleros.io/purpose: certificates
-    documentQuery:
-      - conditions:
-          - query: $[?($.kind != "Deployment")]
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
+
+  - name: "add kubernetes and nukleros labels on pods"
+    query: "spec.template.metadata"
+    value:
+      labels:
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
 
 yamlFiles:
   - name: "cert-manager deployments"
@@ -74,7 +85,40 @@ yamlFiles:
           - conditions:
               - query: $[?($.metadata.name == "cert-manager")]
 
-      - name: "ensure controller affinity is set"
+      - name: "set controller deployment labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager
+            app.kubernetes.io/instance: cert-manager
+            app.kubernetes.io/component: controller
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager")]
+
+      - name: "set controller label selectors"
+        query: "spec.selector"
+        value:
+          matchLabels:
+            app.kubernetes.io/name: cert-manager
+            app.kubernetes.io/instance: cert-manager
+            app.kubernetes.io/component: controller
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager")]
+
+      - name: "set controller pod labels"
+        query: "spec.template.metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager
+            app.kubernetes.io/instance: cert-manager
+            app.kubernetes.io/component: controller
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager")]
+
+      - name: "ensure controller anti affinity is set"
         query: spec.template.spec
         action: merge
         value:
@@ -110,7 +154,40 @@ yamlFiles:
           - conditions:
               - query: $[?($.metadata.name == "cert-manager-cainjector")]
 
-      - name: "ensure injector affinity is set"
+      - name: "set injector deployment labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-cainjector
+            app.kubernetes.io/instance: cert-manager-cainjector
+            app.kubernetes.io/component: cainjector
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-cainjector")]
+
+      - name: "set injector label selectors"
+        query: "spec.selector"
+        value:
+          matchLabels:
+            app.kubernetes.io/name: cert-manager-cainjector
+            app.kubernetes.io/instance: cert-manager-cainjector
+            app.kubernetes.io/component: cainjector
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-cainjector")]
+
+      - name: "set injector pod labels"
+        query: "spec.template.metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-cainjector
+            app.kubernetes.io/instance: cert-manager-cainjector
+            app.kubernetes.io/component: cainjector
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-cainjector")]
+
+      - name: "ensure injector anti affinity is set"
         query: spec.template.spec
         action: merge
         value:
@@ -146,7 +223,40 @@ yamlFiles:
           - conditions:
               - query: $[?($.metadata.name == "cert-manager-webhook")]
 
-      - name: "ensure webhook affinity is set"
+      - name: "set webhook deployment labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+
+      - name: "set webhook label selectors"
+        query: "spec.selector"
+        value:
+          matchLabels:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+
+      - name: "set webhook pod labels"
+        query: "spec.template.metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+
+      - name: "ensure webhook anti affinity is set"
         query: spec.template.spec
         action: merge
         value:
@@ -161,9 +271,10 @@ yamlFiles:
                         - key: app.kubernetes.io/name
                           operator: In
                           values:
-                            - cert-manager-cainjector
+                            - cert-manager-webhook
           nodeSelector:
             kubernetes.io/os: linux
         documentQuery:
           - conditions:
               - query: $[?($.metadata.name == "cert-manager-webhook")]
+

.source/certificates/cert-manager/config/overlays/rbac.yaml

@@ -1,5 +1,15 @@
 ---
-commonOverlays: []
+commonOverlays:
+  - name: "add kubernetes and nukleros labels"
+    query: "metadata"
+    value:
+      labels:
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
+
 yamlFiles:
   - name: "cert-manager rbac"
     path: "../../vendor/cert-manager.yaml"
@@ -20,4 +30,60 @@ yamlFiles:
         query:
           - metadata.namespace
           - subjects[*].namespace
-        value: "{{ .namespace }}"
+        value: "{{ .namespace }}"
+
+      - name: "set controller service account labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager
+            app.kubernetes.io/instance: cert-manager
+            app.kubernetes.io/component: controller
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-issuers")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-clusterissuers")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-certificates")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-orders")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-challenges")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-ingress-shim")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-approve:cert-manager-io")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-controller-certificatesigningrequests")]
+
+      - name: "set injector service account labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-cainjector
+            app.kubernetes.io/instance: cert-manager-cainjector
+            app.kubernetes.io/component: cainjector
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-cainjector")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-cainjector:leaderelection")]
+
+      - name: "set webhook service account labels"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook:subjectaccessreviews")]
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook:dynamic-serving")]
+

.source/certificates/cert-manager/config/overlays/service.yaml

@@ -1,5 +1,15 @@
 ---
-commonOverlays: []
+commonOverlays:
+  - name: "add kubernetes and nukleros labels"
+    query: "metadata"
+    value:
+      labels:
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
+
 yamlFiles:
   - name: "cert-manager services"
     path: "../../vendor/cert-manager.yaml"
@@ -15,3 +25,26 @@ yamlFiles:
       - name: "ensure namespace is updated"
         query: metadata.namespace
         value: "{{ .namespace }}"
+
+      - name: "set webhook service labes"
+        query: "metadata"
+        value:
+          labels:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+
+      - name: "set webhook service label selectors"
+        query: "spec"
+        value:
+          selector:
+            app.kubernetes.io/name: cert-manager-webhook
+            app.kubernetes.io/instance: cert-manager-webhook
+            app.kubernetes.io/component: webhook
+        documentQuery:
+          - conditions:
+              - query: $[?($.metadata.name == "cert-manager-webhook")]
+

.source/certificates/cert-manager/config/overlays/webhook.yaml

@@ -1,5 +1,18 @@
 ---
-commonOverlays: []
+commonOverlays:
+  - name: "add kubernetes and nukleros labels"
+    query: "metadata"
+    value:
+      labels:
+        app.kubernetes.io/name: cert-manager-webhook
+        app.kubernetes.io/instance: cert-manager-webhook
+        app.kubernetes.io/component: webhook
+        app.kubernetes.io/version: {{ .version }}
+        app.kubernetes.io/part-of: cert-manager
+        app.kubernetes.io/managed-by: platform-component-library
+        platform.nukleros.io/group: certificates
+        platform.nukleros.io/project: cert-manager
+
 yamlFiles:
   - name: "cert-manager webhooks"
     path: "../../vendor/cert-manager.yaml"
@@ -22,3 +35,4 @@ yamlFiles:
       - name: "ensure webhook annotation with appropriate namespace is updated"
         query: metadata.annotations['cert-manager.io/inject-ca-from-secret']
         value: "{{ .namespace }}/cert-manager-webhook-ca"
+

.source/certificates/cert-manager/config/values.yaml

@@ -1,4 +1,5 @@
 ---
+version: "v1.9.1"
 namespace: certificates-system
 replicas: 2
 injector:

.source/ingress/external-dns/config/overlays/config-active-directory.yaml

@@ -10,3 +10,19 @@ yamlFiles:
         value: "{{ .namespace }}"
         onMissing:
           action: inject
+
+      - name: "add kubernetes and nukleros labels"
+        query: metadata
+        onMissing:
+          action: inject
+        value:
+          labels:
+            app.kubernetes.io/name: external-dns-active-directory
+            app.kubernetes.io/instance: external-dns-active-directory
+            app.kubernetes.io/component: external-dns
+            app.kubernetes.io/version: {{ .version }}
+            app.kubernetes.io/part-of: external-dns
+            app.kubernetes.io/managed-by: platform-component-library
+            platform.nukleros.io/group: ingress
+            platform.nukleros.io/project: external-dns
+

.source/ingress/external-dns/config/overlays/config-google.yaml

@@ -9,4 +9,20 @@ yamlFiles:
         query: metadata.namespace
         value: "{{ .namespace }}"
         onMissing:
-          action: inject
+          action: inject
+
+      - name: "add kubernetes and nukleros labels"
+        query: metadata
+        onMissing:
+          action: inject
+        value:
+          labels:
+            app.kubernetes.io/name: external-dns-google
+            app.kubernetes.io/instance: external-dns-google
+            app.kubernetes.io/component: external-dns
+            app.kubernetes.io/version: {{ .version }}
+            app.kubernetes.io/part-of: external-dns
+            app.kubernetes.io/managed-by: platform-component-library
+            platform.nukleros.io/group: ingress
+            platform.nukleros.io/project: external-dns
+