pkg/storage: handle more possible release label k/v pairs

pkg/storage/chunked.go

@@ -10,6 +10,7 @@ import (
 	"hash"
 	"hash/fnv"
 	"io"
+	"maps"
 	"strconv"
 	"sync"
 	"time"
@@ -147,12 +148,13 @@ func (c *chunkedSecrets) indexSecretFromChunks(key string, rls *release.Release,
 		panic(err)
 	}
 
-	indexLabels := newIndexLabels(c.owner, key, rls)
+	indexLabels, indexAnnotations := newIndexLabelsAndAnnotations(c.owner, key, rls)
 	indexSecret := &corev1.Secret{
 		Type: SecretTypeChunkedIndex,
 		ObjectMeta: metav1.ObjectMeta{
-			Name:   key,
-			Labels: indexLabels,
+			Name:        key,
+			Labels:      indexLabels,
+			Annotations: indexAnnotations,
 		},
 		Immutable: ptr.To(false),
 		Data: map[string][]byte{
@@ -403,6 +405,7 @@ func (c *chunkedSecrets) decodeRelease(ctx context.Context, indexSecret *corev1.
 		return nil, fmt.Errorf("failed to decode release: %w", err)
 	}
 	r.Labels = filterSystemLabels(indexSecret.Labels)
+	maps.Copy(r.Labels, indexSecret.Annotations)
 	return &r, nil
 }
 

pkg/storage/chunked_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"maps"
+	"strings"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -95,6 +96,28 @@ var _ = Describe("chunkedSecrets", func() {
 			_, err := maxReadDriver.Get(releaseKey(rel))
 			Expect(err).To(MatchError(ContainSubstring("release too large")))
 		})
+		It("should handle release labels that are invalid metadata labels", func() {
+			invalidMetadataLabelKey := "stored-as-annotation"
+			invalidMetadataLabelValue := strings.Repeat("a", 64)
+
+			expected := genRelease("test-release", 1, release.StatusPendingInstall, map[string]string{invalidMetadataLabelKey: invalidMetadataLabelValue}, chunkSize/2)
+			Expect(expected.Labels).To(HaveKey(invalidMetadataLabelKey))
+			Expect(chunkedDriver.Create(releaseKey(expected), expected)).To(Succeed())
+
+			// Make sure the release-only label is in the release metadata
+			actual, err := chunkedDriver.Get(releaseKey(expected))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(actual).To(Equal(expected))
+			Expect(actual.Labels).To(HaveKey(invalidMetadataLabelKey))
+			Expect(actual.Labels[invalidMetadataLabelKey]).To(Equal(invalidMetadataLabelValue))
+
+			// Make sure the invalid label is stored in the secret annotations, not labels
+			items, err := secretInterface.List(context.Background(), metav1.ListOptions{})
+			Expect(err).ToNot(HaveOccurred())
+			Expect(items.Items).To(HaveLen(1))
+			Expect(items.Items[0].Labels).ToNot(HaveKey(invalidMetadataLabelKey))
+			Expect(items.Items[0].Annotations).To(HaveKey(invalidMetadataLabelKey))
+		})
 	})
 
 	var _ = Describe("Update", func() {

pkg/storage/labels.go

@@ -1,24 +1,37 @@
 package storage
 
 import (
-	"maps"
 	"strconv"
 
 	"helm.sh/helm/v3/pkg/release"
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
 )
 
-func newIndexLabels(owner, key string, rls *release.Release) map[string]string {
+func newIndexLabelsAndAnnotations(owner, key string, rls *release.Release) (map[string]string, map[string]string) {
 	labels := map[string]string{}
-	maps.Copy(labels, rls.Labels)
+	annotations := map[string]string{}
+	for k, v := range rls.Labels {
+		if promoteToAnnotation(k, v) {
+			annotations[k] = v
+		} else {
+			labels[k] = v
+		}
+	}
+
 	labels["name"] = rls.Name
 	labels["owner"] = owner
 	labels["status"] = rls.Info.Status.String()
 	labels["version"] = strconv.Itoa(rls.Version)
 	labels["key"] = key
 	labels["type"] = "index"
-	return labels
+	return labels, annotations
+}
+
+func promoteToAnnotation(k, v string) bool {
+	isValidLabel := len(validation.IsQualifiedName(k)) == 0 && len(validation.IsValidLabelValue(v)) == 0
+	return !isValidLabel
 }
 
 func newChunkLabels(owner, key string) map[string]string {