fix(konnect): Use correct label value of secret to store license (#7648)

* fix label value of secret to store license

* Update internal/labels/labels.go

Co-authored-by: Patryk Małek <[email protected]>

* check secret for stored license

---------

Co-authored-by: Patryk Małek <[email protected]>

Author: randmonkey

CHANGELOG.md

@@ -111,6 +111,14 @@ Adding a new version? You'll need three changes:
 - [0.0.5](#005)
 - [0.0.4 and prior](#004-and-prior)
 
+## Unreleased
+
+### Fixed
+
+- Fix the issue that invalid label value causing KIC failed to store the license
+from Konnect into `Secret`.
+[#7648](https://github.com/Kong/kubernetes-ingress-controller/pull/7648)
+
 ## [3.5.0]
 
 > Release date: 2025-07-02

internal/konnect/license/client.go

@@ -94,7 +94,9 @@ func (c *Client) Get(ctx context.Context) (mo.Option[license.KonnectLicense], er
 
 	if c.enableLicenseStorage && l.IsPresent() {
 		err = c.licenseStore.Store(ctx, l.MustGet())
-		c.logger.Error(err, "failed to store retrieved license to local storage")
+		if err != nil {
+			c.logger.Error(err, "failed to store retrieved license to local storage")
+		}
 	}
 
 	return l, nil

internal/labels/labels.go

@@ -24,8 +24,8 @@ const (
 
 	// ManagedByLabel is the label key to mark that the object is managed by a specific controller.
 	ManagedByLabel = LabelPrefix + ManagedByKey
-	// ManagedByLabelValueIngressController is the label value that marks the object is managed byu KIC.
-	ManagedByLabelValueIngressController = LabelPrefix + "/ingress-controller"
+	// ManagedByLabelValueIngressController is the label value that marks the object is managed by KIC.
+	ManagedByLabelValueIngressController = "kong-ingress-controller"
 )
 
 // ValidateType indicates the type of validation applied to a Secret.

test/e2e/konnect_test.go

@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/blang/semver/v4"
 	environment "github.com/kong/kubernetes-testing-framework/pkg/environments"
 	"github.com/samber/lo"
 	"github.com/stretchr/testify/assert"
@@ -122,6 +123,15 @@ func TestKonnectLicenseActivation(t *testing.T) {
 		}
 		return license.License.Expiration != ""
 	}, adminAPIWait, time.Second)
+
+	skipTestIfControllerVersionBelow(t, semver.MustParse("3.5.1"))
+	t.Log("checking if the license is stored in the local secret")
+	secret, err := env.Cluster().Client().CoreV1().Secrets(namespace).Get(
+		ctx, "konnect-license-"+rgID, metav1.GetOptions{})
+	require.NoError(t, err)
+	require.NotNil(t, secret.Data, "secret to store Konnect license should not be empty")
+	require.NotEmpty(t, secret.Data["id"], "stored license should have a non-empty ID")
+
 	t.Log("done")
 }
 

test/e2e/utils_test.go

@@ -189,8 +189,6 @@ func extractVersionFromImage(imageName string) (semver.Version, error) {
 // below the minVersion.
 // if the override KIC image is not set, it assumes that the latest image is used, so it never skips
 // the test if override image is not given.
-//
-//lint:ignore U1000 retained for future use
 func skipTestIfControllerVersionBelow(t *testing.T, minVersion semver.Version) {
 	if testenv.ControllerImageTag() == "" {
 		return