helm: add missing labels to ConfigMap, SCC, and ServiceAccount resources

Add consistent metadata labels to resources that were missing them:
- configmap.yaml: Add labels to rook-ceph-operator-config ConfigMap
- securityContextConstraints.yaml: Add labels to both rook-ceph and rook-ceph-csi SCCs
- serviceaccount.yaml: Add labels to 6 CSI ServiceAccounts that were missing them

All new labels use the unified library.rook-ceph.labels template for consistency.
Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml
to reflect the updated label definitions.

This addresses reviewer feedback about missing labels in non-RBAC resources
and ensures consistent labeling across all Rook Ceph Helm chart resources.

Signed-off-by: fullstackjam <fullstackjam@outlook.com>
(cherry picked from commit 8656bd493c)

deploy/charts/rook-ceph/templates/configmap.yaml

@@ -6,6 +6,8 @@ apiVersion: v1
 metadata:
   name: rook-ceph-operator-config
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 data:
   ROOK_LOG_LEVEL: {{ .Values.logLevel | quote }}
   ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: {{ .Values.cephCommandsTimeoutSeconds | quote }}

deploy/charts/rook-ceph/templates/securityContextConstraints.yaml

@@ -6,6 +6,8 @@ kind: SecurityContextConstraints
 apiVersion: security.openshift.io/v1
 metadata:
   name: rook-ceph
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 allowPrivilegedContainer: true
 allowHostDirVolumePlugin: true
 allowHostPID: false
@@ -52,6 +54,8 @@ kind: SecurityContextConstraints
 apiVersion: security.openshift.io/v1
 metadata:
   name: rook-ceph-csi
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 # To allow running privilegedContainers
 allowPrivilegedContainer: true
 # CSI daemonset pod needs hostnetworking

deploy/charts/rook-ceph/templates/serviceaccount.yaml

@@ -15,6 +15,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-cephfs-plugin-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 {{- if .Values.csi.nfs.enabled }}
 ---
@@ -24,6 +26,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-nfs-plugin-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 ---
 # Service account for the NFS CSI provisioner
@@ -32,6 +36,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-nfs-provisioner-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 {{- end }}
 ---
@@ -41,6 +47,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-cephfs-provisioner-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 ---
 # Service account for the RBD CSI driver
@@ -49,6 +57,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-rbd-plugin-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 ---
 # Service account for the RBD CSI provisioner
@@ -57,6 +67,8 @@ apiVersion: v1
 metadata:
   name: rook-csi-rbd-provisioner-sa
   namespace: {{ .Release.Namespace }} # namespace:operator
+  labels:
+    {{- include "library.rook-ceph.labels" . | nindent 4 }}
 {{- include "library.imagePullSecrets" . | nindent 0 }}
 ---
 # Service account for Ceph COSI driver

deploy/examples/common.yaml

@@ -1463,6 +1463,11 @@ apiVersion: v1
 metadata:
   name: rook-csi-cephfs-plugin-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret
 ---
@@ -1472,6 +1477,11 @@ apiVersion: v1
 metadata:
   name: rook-csi-cephfs-provisioner-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret
 ---
@@ -1481,6 +1491,11 @@ apiVersion: v1
 metadata:
   name: rook-csi-rbd-plugin-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret
 ---
@@ -1490,5 +1505,10 @@ apiVersion: v1
 metadata:
   name: rook-csi-rbd-provisioner-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret

deploy/examples/csi/nfs/rbac.yaml

@@ -118,6 +118,11 @@ apiVersion: v1
 metadata:
   name: rook-csi-nfs-plugin-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret
 ---
@@ -127,5 +132,10 @@ apiVersion: v1
 metadata:
   name: rook-csi-nfs-provisioner-sa
   namespace: rook-ceph # namespace:operator
+  labels:
+    operator: rook
+    storage-backend: ceph
+    app.kubernetes.io/name: rook-ceph
+    app.kubernetes.io/part-of: rook-ceph-operator
 # imagePullSecrets:
 #   - name: my-registry-secret