feat(recommended labels) #4327

rene-dekker · 2025-12-30T01:00:06Z

feat(recommended labels): Set recommended labels as per
https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/

For example:

apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2025-12-29T18:44:40Z"
  labels:
    app.kubernetes.io/component: Installation.operator.tigera.io
    app.kubernetes.io/instance: default
    app.kubernetes.io/managed-by: tigera-operator
    app.kubernetes.io/name: calico-system
    app.kubernetes.io/part-of: TigeraSecureEnterprise
    k8s-app: calico-system
    kubernetes.io/metadata.name: calico-system
    name: calico-system
    pod-security.kubernetes.io/enforce: privileged
    pod-security.kubernetes.io/enforce-version: latest
  name: calico-system
  ownerReferences:
  - apiVersion: operator.tigera.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Installation
    name: default
    uid: 9df390bc-84bd-4990-a839-5cfbb1a68287
  resourceVersion: "78244"
  uid: 4fa83b63-932d-4b0c-8eb7-8280bc58023e
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Set recommended labels as per 
https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/

The version label was deliberately skipped as discussed in our operator grooming meetings.

rene-dekker · 2025-12-30T01:01:18Z

pkg/controller/logstorage/managedcluster/managed_cluster_controller.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2022-2025 Tigera, Inc. All rights reserved.


lol on Dec 29th...

caseydavenport · 2025-12-31T17:15:57Z

pkg/controller/monitor/monitor_controller_test.go

+					"app.kubernetes.io/instance":   "tigera-secure",
+					"app.kubernetes.io/managed-by": "tigera-operator",
+					"app.kubernetes.io/name":       "tigera-external-prometheus",
+					"app.kubernetes.io/part-of":    "TigeraSecureEnterprise",


Shoud this just be Calico always? I think that makes more sense.

Should we do CalicoEnterprise with the enterprise variant?

We could, although I think from a users perspective "Calico" is probably the most useful. Not sure it adds value for a user to have this change between product variants?

Either of your suggestions are nicer than TigeraSecureEnterprise. My take would be that:

Either we hardcode "calico"

Or - since we don't really like TigeraSecureEnterprise - we deprecate Variant enum value TigeraSecureEnterprise in favour of CalicoEnterprise as well.

Let's hard code Calico for now IMO - the use-case of allow-listing a set of components means a singular value here is probably better.

We should look at getting rid of TSE separately IMO.

caseydavenport · 2025-12-31T17:17:11Z

pkg/controller/monitor/monitor_controller_test.go

 				Expect(serviceMonitor.Spec.Endpoints).To(HaveLen(1))
 				// Verify that the default settings are propagated.
-				Expect(serviceMonitor.Labels).To(Equal(map[string]string{render.AppLabelName: monitor.TigeraExternalPrometheus}))
+				Expect(serviceMonitor.Labels).To(Equal(map[string]string{


What about app.kubernetes.io/version?

I think if we're including version we need to differentiate in one of the other labels enterprise vs open source.

Yeah, unless it was app.kubernetes.io/version: v3.30-enterprise or something.

We spoke about this during the dev grooming meetings (IIRC twice even) and we concluded that today we don't have a very good way of ensuring they are all correct, that doing it correct would take a lot of work and so we decided to defer this label for the time being.

Hm, I don't recall those (or maybe I just missed them). How would they be incorrect? Don't we have the version compiled into operator?

I believe we chatted only briefly on the approach before debating if there would be value in having it. In the end we basically concluded that it was low ROI and worth skipping until a user asks for it with a valid use case.

What are the use-cases for all of the other labels?

Feel free to go ahead without it, I'm just a bit confused as to the motivations for some of these labels but not others.

We have a user that wants to block resources being deployed using a webhook if they do not belong to allow-listed components. Previously they would filter resources on the expected name prefix such as "tigera-" or "calico-". Labels would be a better way of implementing this.

Surely that's only an argument for adding the app.kubernetes.io/component label then, and not all of the others? Or maybe "app.kubernetes.io/part-of"?

Set recommended labels as per https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/

rene-dekker requested a review from a team as a code owner December 30, 2025 01:00

marvin-tigera added this to the v1.42.0 milestone Dec 30, 2025

marvin-tigera added docs-pr-required release-note-required labels Dec 30, 2025

rene-dekker commented Dec 30, 2025

View reviewed changes

rene-dekker force-pushed the ci-1800-recommended-labels branch 5 times, most recently from 628c1c9 to 1cbb0a6 Compare December 30, 2025 16:39

caseydavenport reviewed Dec 31, 2025

View reviewed changes

rene-dekker closed this Jan 16, 2026

rene-dekker force-pushed the ci-1800-recommended-labels branch from 54bfbbc to 0c939f5 Compare January 16, 2026 19:52

marvin-tigera removed docs-pr-required release-note-required labels Jan 16, 2026

rene-dekker deleted the ci-1800-recommended-labels branch January 16, 2026 19:52

rene-dekker restored the ci-1800-recommended-labels branch January 16, 2026 19:55

rene-dekker deleted the ci-1800-recommended-labels branch January 16, 2026 19:57

rene-dekker restored the ci-1800-recommended-labels branch January 16, 2026 19:58

rene-dekker deleted the ci-1800-recommended-labels branch January 16, 2026 19:58

feat(recommended labels): Set recommended labels

53c7388

Set recommended labels as per https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/

rene-dekker reopened this Jan 16, 2026

marvin-tigera added docs-pr-required release-note-required labels Jan 16, 2026

		@@ -1,4 +1,4 @@
		// Copyright (c) 2022-2024 Tigera, Inc. All rights reserved.
		// Copyright (c) 2022-2025 Tigera, Inc. All rights reserved.

feat(recommended labels) #4327

Are you sure you want to change the base?

feat(recommended labels) #4327

Conversation

rene-dekker commented Dec 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rene-dekker commented Dec 30, 2025 •

edited

Loading