From 89c316cd6809cbfcf40eb4cb5f4a07110973f6ed Mon Sep 17 00:00:00 2001 From: fullstackjam Date: Sun, 28 Sep 2025 01:02:08 +0800 Subject: [PATCH] helm: add missing labels to ConfigMap, SCC, and ServiceAccount resources Add consistent metadata labels to resources that were missing them: - configmap.yaml: Add labels to rook-ceph-operator-config ConfigMap - securityContextConstraints.yaml: Add labels to both rook-ceph and rook-ceph-csi SCCs - serviceaccount.yaml: Add labels to 6 CSI ServiceAccounts that were missing them All new labels use the unified library.rook-ceph.labels template for consistency. Regenerated deploy/examples/common.yaml and deploy/examples/csi/nfs/rbac.yaml to reflect the updated label definitions. This addresses reviewer feedback about missing labels in non-RBAC resources and ensures consistent labeling across all Rook Ceph Helm chart resources. Signed-off-by: fullstackjam (cherry picked from commit 8656bd493c82b0f4d7b1a6b0ddaca99eefd8cf2b) --- .../charts/rook-ceph/templates/configmap.yaml | 2 ++ .../templates/securityContextConstraints.yaml | 4 ++++ .../rook-ceph/templates/serviceaccount.yaml | 12 +++++++++++ deploy/examples/common.yaml | 20 +++++++++++++++++++ deploy/examples/csi/nfs/rbac.yaml | 10 ++++++++++ 5 files changed, 48 insertions(+) diff --git a/deploy/charts/rook-ceph/templates/configmap.yaml b/deploy/charts/rook-ceph/templates/configmap.yaml index 4e5ac35fd..4b7a1f64a 100644 --- a/deploy/charts/rook-ceph/templates/configmap.yaml +++ b/deploy/charts/rook-ceph/templates/configmap.yaml @@ -6,6 +6,8 @@ apiVersion: v1 metadata: name: rook-ceph-operator-config namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} data: ROOK_LOG_LEVEL: {{ .Values.logLevel | quote }} ROOK_CEPH_COMMANDS_TIMEOUT_SECONDS: {{ .Values.cephCommandsTimeoutSeconds | quote }} diff --git a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml index c0b8d9774..2dc53b70d 100644 --- a/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml +++ b/deploy/charts/rook-ceph/templates/securityContextConstraints.yaml @@ -6,6 +6,8 @@ kind: SecurityContextConstraints apiVersion: security.openshift.io/v1 metadata: name: rook-ceph + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} allowPrivilegedContainer: true allowHostDirVolumePlugin: true allowHostPID: false @@ -52,6 +54,8 @@ kind: SecurityContextConstraints apiVersion: security.openshift.io/v1 metadata: name: rook-ceph-csi + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} # To allow running privilegedContainers allowPrivilegedContainer: true # CSI daemonset pod needs hostnetworking diff --git a/deploy/charts/rook-ceph/templates/serviceaccount.yaml b/deploy/charts/rook-ceph/templates/serviceaccount.yaml index 2b5f7f265..3e9bd3b34 100644 --- a/deploy/charts/rook-ceph/templates/serviceaccount.yaml +++ b/deploy/charts/rook-ceph/templates/serviceaccount.yaml @@ -15,6 +15,8 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} {{- if .Values.csi.nfs.enabled }} --- @@ -24,6 +26,8 @@ apiVersion: v1 metadata: name: rook-csi-nfs-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the NFS CSI provisioner @@ -32,6 +36,8 @@ apiVersion: v1 metadata: name: rook-csi-nfs-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} {{- end }} --- @@ -41,6 +47,8 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the RBD CSI driver @@ -49,6 +57,8 @@ apiVersion: v1 metadata: name: rook-csi-rbd-plugin-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for the RBD CSI provisioner @@ -57,6 +67,8 @@ apiVersion: v1 metadata: name: rook-csi-rbd-provisioner-sa namespace: {{ .Release.Namespace }} # namespace:operator + labels: + {{- include "library.rook-ceph.labels" . | nindent 4 }} {{- include "library.imagePullSecrets" . | nindent 0 }} --- # Service account for Ceph COSI driver diff --git a/deploy/examples/common.yaml b/deploy/examples/common.yaml index 49cd638b1..defa9688e 100644 --- a/deploy/examples/common.yaml +++ b/deploy/examples/common.yaml @@ -1463,6 +1463,11 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1472,6 +1477,11 @@ apiVersion: v1 metadata: name: rook-csi-cephfs-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1481,6 +1491,11 @@ apiVersion: v1 metadata: name: rook-csi-rbd-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -1490,5 +1505,10 @@ apiVersion: v1 metadata: name: rook-csi-rbd-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret diff --git a/deploy/examples/csi/nfs/rbac.yaml b/deploy/examples/csi/nfs/rbac.yaml index a4b1f9b8b..efb45e90f 100644 --- a/deploy/examples/csi/nfs/rbac.yaml +++ b/deploy/examples/csi/nfs/rbac.yaml @@ -118,6 +118,11 @@ apiVersion: v1 metadata: name: rook-csi-nfs-plugin-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret --- @@ -127,5 +132,10 @@ apiVersion: v1 metadata: name: rook-csi-nfs-provisioner-sa namespace: rook-ceph # namespace:operator + labels: + operator: rook + storage-backend: ceph + app.kubernetes.io/name: rook-ceph + app.kubernetes.io/part-of: rook-ceph-operator # imagePullSecrets: # - name: my-registry-secret