Common labels

api/operator/v1/vlsingle_types.go

@@ -254,11 +254,17 @@ func (cr *VLSingle) PodLabels() map[string]string {
 
 // FinalLabels returns combination of selector and managed labels
 func (cr *VLSingle) FinalLabels() map[string]string {
-	v := cr.SelectorLabels()
+	return cr.ResourceLabels(nil)
+}
+
+// ResourceLabels returns combination of selector, resource and managed labels
+func (cr *VLSingle) ResourceLabels(input map[string]string) map[string]string {
+	var v map[string]string
 	if cr.Spec.ManagedMetadata != nil {
-		v = labels.Merge(cr.Spec.ManagedMetadata.Labels, v)
+		v = cr.Spec.ManagedMetadata.Labels
 	}
-	return v
+	v = labels.Merge(v, input)
+	return labels.Merge(v, cr.SelectorLabels())
 }
 
 func (cr *VLSingle) PrefixedName() string {

api/operator/v1/vtsingle_types.go

@@ -248,11 +248,17 @@ func (cr *VTSingle) PodLabels() map[string]string {
 
 // FinalLabels returns combination of selector and managed labels
 func (cr *VTSingle) FinalLabels() map[string]string {
-	v := cr.SelectorLabels()
+	return cr.ResourceLabels(nil)
+}
+
+// ResourceLabels returns combination of selector, resource and managed labels
+func (cr *VTSingle) ResourceLabels(input map[string]string) map[string]string {
+	var v map[string]string
 	if cr.Spec.ManagedMetadata != nil {
-		v = labels.Merge(cr.Spec.ManagedMetadata.Labels, v)
+		v = cr.Spec.ManagedMetadata.Labels
 	}
-	return v
+	v = labels.Merge(v, input)
+	return labels.Merge(v, cr.SelectorLabels())
 }
 
 // PrefixedName format name of the component with hard-coded prefix

api/operator/v1beta1/vmauth_types.go

@@ -661,11 +661,17 @@ func (cr *VMAuth) PodLabels() map[string]string {
 
 // FinalLabels returns combination of selector and managed labels
 func (cr *VMAuth) FinalLabels() map[string]string {
-	v := cr.SelectorLabels()
+	return cr.ResourceLabels(nil)
+}
+
+// ResourceLabels returns combination of selector, resource and managed labels
+func (cr *VMAuth) ResourceLabels(input map[string]string) map[string]string {
+	var v map[string]string
 	if cr.Spec.ManagedMetadata != nil {
-		v = labels.Merge(cr.Spec.ManagedMetadata.Labels, v)
+		v = cr.Spec.ManagedMetadata.Labels
 	}
-	return v
+	v = labels.Merge(v, input)
+	return labels.Merge(v, cr.SelectorLabels())
 }
 
 // FinalAnnotations returns annotations to be applied for created objects

api/operator/v1beta1/vmauth_types_test.go

@@ -26,13 +26,13 @@ func TestVMAuthValidate(t *testing.T) {
 	// invalid ingress
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
 spec:
   ingress:
-    tlsHosts: 
+    tlsHosts:
       - host-1
       - host-2`,
 		wantErr: `spec.ingress.tlsSecretName cannot be empty with non-empty spec.ingress.tlsHosts`,
@@ -41,7 +41,7 @@ spec:
 	// both configSecret and external config is defined at the same time
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
@@ -57,21 +57,21 @@ spec:
 	// incorrect unauthorized access config, missing backends"
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
 spec:
   unauthorizedUserAccessSpec:
-    default_url: 
+    default_url:
       - http://url-1`,
 		wantErr: "incorrect cr.spec.UnauthorizedUserAccess syntax: at least one of `url_map`, `url_prefix` or `targetRefs` must be defined",
 	})
 
 	// incorrect unauthorized access config, bad metric_labels syntax
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
@@ -80,15 +80,15 @@ spec:
     metric_labels:
       124124asff: 12fsaf
     url_prefix: http://some-dst
-    default_url: 
+    default_url:
       - http://url-1`,
 		wantErr: `incorrect cr.spec.UnauthorizedUserAccess syntax: incorrect metricLabelName="124124asff", must match pattern="^[a-zA-Z_:.][a-zA-Z0-9_:.]*$"`,
 	})
 
 	// incorrect unauthorized access config url_map"
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
@@ -100,20 +100,20 @@ spec:
       - url_prefix: http://some-url
         src_paths: ["/path-1"]
       - url_prefix: http://some-url-2
-    default_url: 
+    default_url:
       - http://url-1`,
 		wantErr: `incorrect cr.spec.UnauthorizedUserAccess syntax: incorrect url_map at idx=1: incorrect url_map config at least of one src_paths,src_hosts,src_query_args or src_headers must be defined`,
 	})
 
 	// both unauthorizedUserAccessSpec and UnauthorizedUserAccess defined
 	f(opts{
 		src: `
-apiVersion: v1 
+apiVersion: v1
 kind: VMAuth
 metadata:
   name: must-fail
 spec:
-  unauthorizedAccessConfig: 
+  unauthorizedAccessConfig:
     - url_prefix: http://some-url
       src_paths: ["/path-1"]
     - url_prefix: http://some-url-2
@@ -124,7 +124,7 @@ spec:
     url_map:
       - url_prefix: http://some-url
         src_paths: ["/path-1"]
-    default_url: 
+    default_url:
       - http://url-1`,
 		wantErr: "at most one option can be used `spec.unauthorizedAccessConfig` or `spec.unauthorizedUserAccessSpec`, got both",
 	})

api/operator/v1beta1/vmsingle_types.go

@@ -290,11 +290,17 @@ func (cr *VMSingle) PodLabels() map[string]string {
 
 // FinalLabels returns combination of selector and managed labels
 func (cr *VMSingle) FinalLabels() map[string]string {
-	v := cr.SelectorLabels()
+	return cr.ResourceLabels(nil)
+}
+
+// ResourceLabels returns combination of selector, resource and managed labels
+func (cr *VMSingle) ResourceLabels(input map[string]string) map[string]string {
+	var v map[string]string
 	if cr.Spec.ManagedMetadata != nil {
-		v = labels.Merge(cr.Spec.ManagedMetadata.Labels, v)
+		v = cr.Spec.ManagedMetadata.Labels
 	}
-	return v
+	v = labels.Merge(v, input)
+	return labels.Merge(v, cr.SelectorLabels())
 }
 
 // FinalAnnotations returns annotations to be applied for created objects

docs/CHANGELOG.md

@@ -32,6 +32,8 @@ aliases:
 * FEATURE: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed): introduce `spec.zones[*].trafficMode` property, which allows disable read, write or whole traffic to a zone. See [#1995](https://github.com/VictoriaMetrics/operator/issues/1995).
 * FEATURE: [vmagent](https://docs.victoriametrics.com/operator/resources/vmagent/): support per remote write queues configuration. See [#2138](https://github.com/VictoriaMetrics/operator/issues/2138).
 
+* FEATURE: [vmoperator](https://docs.victoriametrics.com/operator/): added `VM_COMMON_LABELS` and `VM_COMMON_ANNOTATIONS` environment variables to apply common labels/annotations to all Kubernetes resources managed by the operator. These cannot override labels/annotations already set by the operator or via `spec.managedMetadata`. This also ensures HTTPRoutes and PVCs include ManagedMetadata labels and annotations
+
 * BUGFIX: [converter](https://docs.victoriametrics.com/operator/integrations/prometheus/#objects-conversion): disable all prometheus controllers if CRD group was not found. See [#2838](https://github.com/VictoriaMetrics/helm-charts/issues/2838).
 * BUGFIX: [vmdistributed](https://docs.victoriametrics.com/operator/resources/vmdistributed/): change default load balancing policy for write requests from `first_available` to `least_loaded`. This should allow to evenly distribute write load across all VMAgents.
 * BUGFIX: [vmalertmanagerconfig](https://docs.victoriametrics.com/operator/resources/vmalertmanagerconfig/): fix previously ignored negative values in VMAlertmanagerConfig. See [#2132](https://github.com/VictoriaMetrics/operator/issues/2132).

internal/config/config.go

@@ -39,7 +39,7 @@ var (
 		"VM_LOGS_VERSION":     "v1.50.0",
 		"VM_ANOMALY_VERSION":  "v1.29.3",
 		"VM_TRACES_VERSION":   "v0.7.0",
-		"VM_OPERATOR_VERSION": getVersion("v0.69.0"),
+		"VM_OPERATOR_VERSION": getVersion("v0.70.1"),
 	}
 )
 
@@ -623,6 +623,15 @@ type BaseOperatorConf struct {
 	//        - all
 	// turn off `EnableStrictSecurity` by default, see https://github.com/VictoriaMetrics/operator/issues/749 for details
 	EnableStrictSecurity bool `default:"false" env:"VM_ENABLESTRICTSECURITY"`
+
+	// CommonLabels are added to every Kubernetes resource created by the operator.
+	// They cannot override labels already set by the operator or via spec.managedMetadata.
+	// Format: key=value,key2=value2
+	CommonLabels map[string]string `default:"" env:"VM_COMMON_LABELS" envSeparator:"," envKeyValSeparator:"="`
+	// CommonAnnotations are added to every Kubernetes resource created by the operator.
+	// They cannot override annotations already set by the operator or via spec.managedMetadata.
+	// Format: key=value,key2=value2
+	CommonAnnotations map[string]string `default:"" env:"VM_COMMON_ANNOTATIONS" envSeparator:"," envKeyValSeparator:"="`
 }
 
 // ResyncAfterDuration returns requeue duration for object period reconcile

internal/controller/operator/factory/build/daemonset.go

@@ -2,34 +2,14 @@ package build
 
 import (
 	appsv1 "k8s.io/api/apps/v1"
-	"k8s.io/utils/ptr"
 
 	vmv1beta1 "github.com/VictoriaMetrics/operator/api/operator/v1beta1"
 )
 
-// DeploymentAddCommonParams adds common params for all deployments
+// DaemonSetAddCommonParams adds common params for all deployments
 func DaemonSetAddCommonParams(dst *appsv1.DaemonSet, params *vmv1beta1.CommonAppsParams) {
-	dst.Spec.Template.Spec.Affinity = params.Affinity
-	dst.Spec.Template.Spec.Tolerations = params.Tolerations
-	dst.Spec.Template.Spec.SchedulerName = params.SchedulerName
-	dst.Spec.Template.Spec.RuntimeClassName = params.RuntimeClassName
-	dst.Spec.Template.Spec.HostAliases = params.HostAliases
-	if len(params.HostAliasesUnderScore) > 0 {
-		dst.Spec.Template.Spec.HostAliases = params.HostAliasesUnderScore
-	}
-	dst.Spec.Template.Spec.PriorityClassName = params.PriorityClassName
-	dst.Spec.Template.Spec.HostNetwork = params.HostNetwork
-	dst.Spec.Template.Spec.DNSPolicy = params.DNSPolicy
-	dst.Spec.Template.Spec.DNSConfig = params.DNSConfig
-	dst.Spec.Template.Spec.NodeSelector = params.NodeSelector
+	PodTemplateAddCommonParams(&dst.Spec.Template, params)
 	dst.Spec.Template.Spec.SecurityContext = addStrictSecuritySettingsWithRootToPod(params)
-	dst.Spec.Template.Spec.TerminationGracePeriodSeconds = params.TerminationGracePeriodSeconds
-	dst.Spec.Template.Spec.TopologySpreadConstraints = params.TopologySpreadConstraints
-	dst.Spec.Template.Spec.ImagePullSecrets = params.ImagePullSecrets
-	dst.Spec.Template.Spec.ReadinessGates = params.ReadinessGates
 	dst.Spec.MinReadySeconds = params.MinReadySeconds
 	dst.Spec.RevisionHistoryLimit = params.RevisionHistoryLimitCount
-	if params.DisableAutomountServiceAccountToken {
-		dst.Spec.Template.Spec.AutomountServiceAccountToken = ptr.To(false)
-	}
 }