From a2bdba98fd0641f49b4d7f75f843072ad4649d3a Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 17:06:56 +0200 Subject: [PATCH 1/8] feat(shield): add global annotations support for all resources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add top-level `annotations` value that propagates to every Kubernetes resource the chart creates (Deployments, DaemonSets, ConfigMaps, Secrets, RBAC resources, Services, etc.). Annotations are merged with any existing resource-specific annotations, with component-level values taking precedence over the global ones. New helpers: - `shield.annotations` – base helper returning .Values.annotations - `cluster.rbac_annotations` – merges shield.annotations + cluster RBAC annotations - `host.rbac_annotations` – merges shield.annotations + host RBAC annotations Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- charts/shield/templates/_helpers.tpl | 9 +++ .../shield/templates/cluster/_annotations.tpl | 11 +++- .../shield/templates/cluster/clusterrole.yaml | 5 +- .../templates/cluster/clusterrolebinding.yaml | 5 +- .../shield/templates/cluster/configmap.yaml | 5 ++ .../openshift-securitycontextconstraint.yaml | 4 ++ charts/shield/templates/cluster/role.yaml | 5 +- .../shield/templates/cluster/rolebinding.yaml | 5 +- charts/shield/templates/cluster/secret.yaml | 5 ++ ...ce-container-vulnerability-management.yaml | 7 +- charts/shield/templates/cluster/service.yaml | 7 +- .../templates/cluster/serviceaccount.yaml | 5 +- .../templates/common/credentials-secret.yaml | 10 +++ .../templates/common/custom-ca-secret.yaml | 5 ++ .../shield/templates/common/proxy-secret.yaml | 5 ++ charts/shield/templates/host/_annotations.tpl | 11 +++- .../templates/host/_windows_annotations.tpl | 4 +- charts/shield/templates/host/clusterrole.yaml | 5 +- .../templates/host/clusterrolebinding.yaml | 5 +- .../templates/host/configmap-windows.yaml | 5 ++ charts/shield/templates/host/configmap.yaml | 5 ++ .../host/gke-allowlist-synchronizer.yaml | 4 ++ .../gke-allowlist-waiter-clusterrole.yaml | 5 +- ...e-allowlist-waiter-clusterrolebinding.yaml | 5 +- .../host/gke-allowlist-waiter-job.yaml | 9 ++- .../gke-allowlist-waiter-serviceaccount.yaml | 5 +- .../openshift-clusterrolebinding-monitor.yaml | 5 +- .../openshift-securitycontextconstraint.yaml | 4 ++ charts/shield/templates/host/role.yaml | 5 +- charts/shield/templates/host/rolebinding.yaml | 5 +- charts/shield/templates/host/secrets.yaml | 10 +++ .../shield/templates/host/serviceaccount.yaml | 5 +- .../shield/tests/cluster/deployment_test.yaml | 64 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 29 +++++++++ .../tests/cluster/serviceaccount_test.yaml | 25 ++++++++ charts/shield/tests/host/daemonset_test.yaml | 51 +++++++++++++++ .../tests/host/serviceaccount_test.yaml | 25 ++++++++ charts/shield/values.schema.json | 7 ++ charts/shield/values.yaml | 2 + 39 files changed, 353 insertions(+), 40 deletions(-) diff --git a/charts/shield/templates/_helpers.tpl b/charts/shield/templates/_helpers.tpl index 4460399f8..79523e31b 100644 --- a/charts/shield/templates/_helpers.tpl +++ b/charts/shield/templates/_helpers.tpl @@ -65,6 +65,15 @@ Component labels {{- end }} {{- end }} +{{/* +Common annotations +*/}} +{{- define "shield.annotations" -}} + {{- with .Values.annotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} + {{- define "shield.component_name_label" -}} sysdig/component {{- end }} diff --git a/charts/shield/templates/cluster/_annotations.tpl b/charts/shield/templates/cluster/_annotations.tpl index ca814ee4e..a38cd3ff4 100644 --- a/charts/shield/templates/cluster/_annotations.tpl +++ b/charts/shield/templates/cluster/_annotations.tpl @@ -1,13 +1,20 @@ {{- define "cluster.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.cluster.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.cluster.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.pod_annotations" -}} - {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.cluster.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.cluster.pod_annotations -}} {{- with $podAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} + +{{- define "cluster.rbac_annotations" -}} + {{- $rbacAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.cluster.rbac.annotations -}} + {{- with $rbacAnnotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} diff --git a/charts/shield/templates/cluster/clusterrole.yaml b/charts/shield/templates/cluster/clusterrole.yaml index f394166bf..16e0720be 100644 --- a/charts/shield/templates/cluster/clusterrole.yaml +++ b/charts/shield/templates/cluster/clusterrole.yaml @@ -5,9 +5,10 @@ metadata: name: {{ include "cluster.fullname" . }} labels: {{- include "cluster.rbac_labels" . | nindent 4 }} - {{- with .Values.cluster.rbac.annotations }} + {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} rules: {{- if (include "cluster.audit_enabled" .) }} diff --git a/charts/shield/templates/cluster/clusterrolebinding.yaml b/charts/shield/templates/cluster/clusterrolebinding.yaml index 60ac13ac4..b6d5c395f 100644 --- a/charts/shield/templates/cluster/clusterrolebinding.yaml +++ b/charts/shield/templates/cluster/clusterrolebinding.yaml @@ -5,9 +5,10 @@ metadata: name: {{ include "cluster.fullname" . }} labels: {{- include "cluster.rbac_labels" . | nindent 4 }} - {{- with .Values.cluster.rbac.annotations }} + {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/charts/shield/templates/cluster/configmap.yaml b/charts/shield/templates/cluster/configmap.yaml index d93cb2d57..437a7585e 100644 --- a/charts/shield/templates/cluster/configmap.yaml +++ b/charts/shield/templates/cluster/configmap.yaml @@ -5,6 +5,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: cluster-shield.yaml: | {{- include "cluster.configmap" . | fromYaml | toYaml | nindent 4 }} diff --git a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml index 239e6ee25..99dc4bb6a 100644 --- a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml +++ b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml @@ -5,6 +5,10 @@ metadata: annotations: kubernetes.io/description: | This provides the minimum requirements to the Sysdig Shield to run in the Openshift. + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- if $shieldAnnotations }} + {{- $shieldAnnotations | nindent 4 }} + {{- end }} name: {{ include "cluster.fullname" . }} labels: {{- include "cluster.labels" . | nindent 4 }} diff --git a/charts/shield/templates/cluster/role.yaml b/charts/shield/templates/cluster/role.yaml index 4f4c08fd1..dac3cb3f9 100644 --- a/charts/shield/templates/cluster/role.yaml +++ b/charts/shield/templates/cluster/role.yaml @@ -6,9 +6,10 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.rbac_labels" . | nindent 4 }} - {{- with .Values.cluster.rbac.annotations }} + {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} rules: {{- if (and (include "cluster.posture_enabled" .) (include "cluster.need_posture_lease" .) .) }} diff --git a/charts/shield/templates/cluster/rolebinding.yaml b/charts/shield/templates/cluster/rolebinding.yaml index f28fea1cc..c672542d0 100644 --- a/charts/shield/templates/cluster/rolebinding.yaml +++ b/charts/shield/templates/cluster/rolebinding.yaml @@ -6,9 +6,10 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.rbac_labels" . | nindent 4 }} - {{- with .Values.cluster.rbac.annotations }} + {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/charts/shield/templates/cluster/secret.yaml b/charts/shield/templates/cluster/secret.yaml index 4d806cb04..b7497d3c0 100644 --- a/charts/shield/templates/cluster/secret.yaml +++ b/charts/shield/templates/cluster/secret.yaml @@ -5,6 +5,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} type: Opaque data: {{- include "cluster.secret" . | nindent 2 }} diff --git a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml index 7a79b3dfa..0cec55faf 100644 --- a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml +++ b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml @@ -9,9 +9,12 @@ metadata: {{- if and .Values.cluster.service .Values.cluster.service.labels }} {{- toYaml .Values.cluster.service.labels | nindent 4 }} {{- end }} - {{- if and .Values.cluster.service .Values.cluster.service.annotations }} + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }} + {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }} + {{- if $allAnnotations }} annotations: - {{- toYaml .Values.cluster.service.annotations | nindent 4 }} + {{- toYaml $allAnnotations | nindent 4 }} {{- end }} spec: {{- if and .Values.cluster.service .Values.cluster.service.type }} diff --git a/charts/shield/templates/cluster/service.yaml b/charts/shield/templates/cluster/service.yaml index 0bc09965b..65d51c996 100644 --- a/charts/shield/templates/cluster/service.yaml +++ b/charts/shield/templates/cluster/service.yaml @@ -8,9 +8,12 @@ metadata: {{- if and .Values.cluster.service .Values.cluster.service.labels }} {{- toYaml .Values.cluster.service.labels | nindent 4 }} {{- end }} - {{- if and .Values.cluster.service .Values.cluster.service.annotations }} + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }} + {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }} + {{- if $allAnnotations }} annotations: - {{- toYaml .Values.cluster.service.annotations | nindent 4 }} + {{- toYaml $allAnnotations | nindent 4 }} {{- end }} spec: {{- if and .Values.cluster.service .Values.cluster.service.type }} diff --git a/charts/shield/templates/cluster/serviceaccount.yaml b/charts/shield/templates/cluster/serviceaccount.yaml index e6a49b1f2..8d8be8eae 100644 --- a/charts/shield/templates/cluster/serviceaccount.yaml +++ b/charts/shield/templates/cluster/serviceaccount.yaml @@ -6,8 +6,9 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.rbac_labels" . | nindent 4 }} - {{- with .Values.cluster.rbac.annotations }} + {{- $rbacAnnotations := (include "cluster.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} {{- end }} diff --git a/charts/shield/templates/common/credentials-secret.yaml b/charts/shield/templates/common/credentials-secret.yaml index d446ba037..b7f1a6691 100644 --- a/charts/shield/templates/common/credentials-secret.yaml +++ b/charts/shield/templates/common/credentials-secret.yaml @@ -7,6 +7,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "common.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} type: Opaque data: access-key: {{ .Values.sysdig_endpoint.access_key | b64enc | quote }} @@ -20,6 +25,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "common.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} type: Opaque data: SECURE_API_TOKEN: {{ .Values.sysdig_endpoint.secure_api_token | b64enc | quote }} diff --git a/charts/shield/templates/common/custom-ca-secret.yaml b/charts/shield/templates/common/custom-ca-secret.yaml index 83d93e0e6..b1a2271e2 100644 --- a/charts/shield/templates/common/custom-ca-secret.yaml +++ b/charts/shield/templates/common/custom-ca-secret.yaml @@ -6,6 +6,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "common.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: {{ include "common.custom_ca.key_name" . }}: {{ include "common.custom_ca.cert" . | b64enc | quote }} {{- end }} diff --git a/charts/shield/templates/common/proxy-secret.yaml b/charts/shield/templates/common/proxy-secret.yaml index 4ac716ad1..1567dcb90 100644 --- a/charts/shield/templates/common/proxy-secret.yaml +++ b/charts/shield/templates/common/proxy-secret.yaml @@ -6,6 +6,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "common.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: {{- if and .Values.proxy.http_proxy (not .Values.proxy.http_proxy_existing_secret) }} http_proxy: {{ .Values.proxy.http_proxy | b64enc | quote }} diff --git a/charts/shield/templates/host/_annotations.tpl b/charts/shield/templates/host/_annotations.tpl index 7814f8d95..25aa39f36 100644 --- a/charts/shield/templates/host/_annotations.tpl +++ b/charts/shield/templates/host/_annotations.tpl @@ -1,12 +1,12 @@ {{- define "host.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.host.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.pod_annotations" -}} - {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.host.pod_annotations -}} {{- if (include "common.cluster_type.is_gke_autopilot" . ) -}} {{- $_ := set $podAnnotations "autopilot.gke.io/no-connect" "true" -}} {{- end -}} @@ -15,3 +15,10 @@ {{- end -}} {{- $podAnnotations | toYaml -}} {{- end -}} + +{{- define "host.rbac_annotations" -}} + {{- $rbacAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host.rbac.annotations -}} + {{- with $rbacAnnotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} diff --git a/charts/shield/templates/host/_windows_annotations.tpl b/charts/shield/templates/host/_windows_annotations.tpl index a0f264a07..5e6e8f75d 100644 --- a/charts/shield/templates/host/_windows_annotations.tpl +++ b/charts/shield/templates/host/_windows_annotations.tpl @@ -1,11 +1,11 @@ {{- define "host.windows.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) .Values.workload_annotations .Values.host_windows.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.pod_annotations" -}} - {{- $podAnnotations := merge (dict) .Values.pod_annotations .Values.host_windows.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} {{- $podAnnotations | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/clusterrole.yaml b/charts/shield/templates/host/clusterrole.yaml index 17635dc35..249b3671e 100644 --- a/charts/shield/templates/host/clusterrole.yaml +++ b/charts/shield/templates/host/clusterrole.yaml @@ -5,9 +5,10 @@ metadata: name: {{ include "host.fullname" . }} labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} rules: - apiGroups: diff --git a/charts/shield/templates/host/clusterrolebinding.yaml b/charts/shield/templates/host/clusterrolebinding.yaml index 3c40882e1..017ddca50 100644 --- a/charts/shield/templates/host/clusterrolebinding.yaml +++ b/charts/shield/templates/host/clusterrolebinding.yaml @@ -5,9 +5,10 @@ metadata: name: {{ include "host.fullname" . }} labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/charts/shield/templates/host/configmap-windows.yaml b/charts/shield/templates/host/configmap-windows.yaml index b2170ba3a..ac14225b0 100644 --- a/charts/shield/templates/host/configmap-windows.yaml +++ b/charts/shield/templates/host/configmap-windows.yaml @@ -6,6 +6,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: host-shield.yaml: | {{- include "host.windows.host_shield_config" . | nindent 4 }} diff --git a/charts/shield/templates/host/configmap.yaml b/charts/shield/templates/host/configmap.yaml index e7906acec..69370f907 100644 --- a/charts/shield/templates/host/configmap.yaml +++ b/charts/shield/templates/host/configmap.yaml @@ -5,6 +5,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: host-shield.yaml: | {{- include "host.host_shield_config" . | nindent 4 }} diff --git a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml index 4d13ed10f..322da79f4 100644 --- a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml +++ b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml @@ -7,6 +7,10 @@ metadata: annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation" + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- if $shieldAnnotations }} + {{- $shieldAnnotations | nindent 4 }} + {{- end }} labels: {{- include "host.labels" . | nindent 4 }} spec: diff --git a/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml b/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml index 348b300ed..478e2d62d 100644 --- a/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml +++ b/charts/shield/templates/host/gke-allowlist-waiter-clusterrole.yaml @@ -10,8 +10,9 @@ metadata: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-weight: "-5" helm.sh/hook-delete-policy: "before-hook-creation" - {{- with .Values.host.rbac.annotations }} - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} rules: - apiGroups: diff --git a/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml b/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml index 63872ef52..90d319fc2 100644 --- a/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml +++ b/charts/shield/templates/host/gke-allowlist-waiter-clusterrolebinding.yaml @@ -10,8 +10,9 @@ metadata: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-weight: "-5" helm.sh/hook-delete-policy: "before-hook-creation" - {{- with .Values.host.rbac.annotations }} - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml index 552621c0a..f5b5f63ca 100644 --- a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml +++ b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml @@ -10,6 +10,10 @@ metadata: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-weight: "5" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded,hook-failed" + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- if $shieldAnnotations }} + {{- $shieldAnnotations | nindent 4 }} + {{- end }} spec: backoffLimit: 3 activeDeadlineSeconds: {{ .Values.gke_autopilot.allowlist_waiter.active_deadline_seconds }} @@ -22,9 +26,10 @@ spec: Autopilot block this Pod on the very allowlist it is waiting to load. */}} {{- include "shield.labels" . | nindent 8 }} - {{- with .Values.pod_annotations }} + {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations }} + {{- if $podAnnotations }} annotations: - {{- toYaml . | nindent 8 }} + {{- toYaml $podAnnotations | nindent 8 }} {{- end }} spec: restartPolicy: OnFailure diff --git a/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml b/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml index 702fb6264..ff7929bf1 100644 --- a/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml +++ b/charts/shield/templates/host/gke-allowlist-waiter-serviceaccount.yaml @@ -11,8 +11,9 @@ metadata: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-weight: "-5" helm.sh/hook-delete-policy: "before-hook-creation" - {{- with .Values.host.rbac.annotations }} - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} {{- end }} {{- end -}} diff --git a/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml b/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml index 073134ea7..b8abb123f 100644 --- a/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml +++ b/charts/shield/templates/host/openshift-clusterrolebinding-monitor.yaml @@ -6,9 +6,10 @@ metadata: name: {{ include "host.fullname" . }}-cluster-monitoring-view labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: kind: ClusterRole diff --git a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml index a7f05293d..76d6b4c77 100644 --- a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml +++ b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml @@ -5,6 +5,10 @@ metadata: annotations: kubernetes.io/description: | This provides the minimum requirements to the Sysdig Shield to run in the Openshift. + {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- if $shieldAnnotations }} + {{- $shieldAnnotations | nindent 4 }} + {{- end }} name: {{ include "host.fullname" . }} labels: {{- include "host.labels" . | nindent 4 }} diff --git a/charts/shield/templates/host/role.yaml b/charts/shield/templates/host/role.yaml index 89aea8a49..cb895c073 100644 --- a/charts/shield/templates/host/role.yaml +++ b/charts/shield/templates/host/role.yaml @@ -6,9 +6,10 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} rules: - apiGroups: diff --git a/charts/shield/templates/host/rolebinding.yaml b/charts/shield/templates/host/rolebinding.yaml index 6ae0710de..4f21f1db8 100644 --- a/charts/shield/templates/host/rolebinding.yaml +++ b/charts/shield/templates/host/rolebinding.yaml @@ -6,9 +6,10 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} roleRef: apiGroup: rbac.authorization.k8s.io diff --git a/charts/shield/templates/host/secrets.yaml b/charts/shield/templates/host/secrets.yaml index b8cd4173c..4010bc4f4 100644 --- a/charts/shield/templates/host/secrets.yaml +++ b/charts/shield/templates/host/secrets.yaml @@ -10,6 +10,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} type: Opaque data: password: {{ (include "host.rapid_response_password" .) | b64enc | quote }} @@ -25,6 +30,11 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} + {{- $annotations := (include "shield.annotations" .) }} + {{- if $annotations }} + annotations: + {{- $annotations | nindent 4 }} + {{- end }} data: local_forwarder_config.yaml: {{ pick .Values.features.investigations.event_forwarder "integrations" | toYaml | b64enc | quote }} {{- end }} diff --git a/charts/shield/templates/host/serviceaccount.yaml b/charts/shield/templates/host/serviceaccount.yaml index 5d060dcc7..aa12f405f 100644 --- a/charts/shield/templates/host/serviceaccount.yaml +++ b/charts/shield/templates/host/serviceaccount.yaml @@ -6,8 +6,9 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.rbac_labels" . | nindent 4 }} - {{- with .Values.host.rbac.annotations }} + {{- $rbacAnnotations := (include "host.rbac_annotations" .) }} + {{- if $rbacAnnotations }} annotations: - {{- toYaml . | nindent 4 }} + {{- $rbacAnnotations | nindent 4 }} {{- end }} {{- end }} diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index 76aaa57f8..5bb09a77a 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1526,3 +1526,67 @@ tests: name: SYSDIG_SHIELD_CHART_VERSION value: 1.2.3-helmtest template: templates/cluster/deployment.yaml + + - it: Global annotations applied to workload metadata + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: metadata.annotations["global-annotation-key"] + value: global-annotation-value + template: templates/cluster/deployment.yaml + + - it: Global annotations applied to pod metadata + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: spec.template.metadata.annotations["global-annotation-key"] + value: global-annotation-value + template: templates/cluster/deployment.yaml + + - it: Global annotations merged with component workload and pod annotations + set: + annotations: + global-key: global-value + workload_annotations: + global-workload-key: global-workload-value + pod_annotations: + global-pod-key: global-pod-value + cluster: + workload_annotations: + component-workload-key: component-workload-value + pod_annotations: + component-pod-key: component-pod-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["global-workload-key"] + value: global-workload-value + - equal: + path: metadata.annotations["component-workload-key"] + value: component-workload-value + - equal: + path: spec.template.metadata.annotations["global-key"] + value: global-value + - equal: + path: spec.template.metadata.annotations["global-pod-key"] + value: global-pod-value + - equal: + path: spec.template.metadata.annotations["component-pod-key"] + value: component-pod-value + template: templates/cluster/deployment.yaml diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index c6d6b3f78..aeed6abe4 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -277,3 +277,32 @@ tests: - equal: path: metadata.annotations["custom-2"] value: annotation-2 + + - it: Global annotations applied to Service + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.annotations["global-annotation-key"] + value: global-annotation-value + + - it: Global annotations merged with service annotations + set: + annotations: + global-key: global-value + cluster: + service: + annotations: + service-key: service-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["service-key"] + value: service-value diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index 84e8bf5fe..ef56424eb 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -76,3 +76,28 @@ tests: path: metadata.annotations content: app.kubernetes.io/description: "This is a test" + + - it: Global annotations applied to ServiceAccount + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - equal: + path: metadata.annotations["global-annotation-key"] + value: global-annotation-value + + - it: Global annotations merged with rbac.annotations on ServiceAccount + set: + annotations: + global-key: global-value + cluster: + rbac: + annotations: + rbac-key: rbac-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["rbac-key"] + value: rbac-value diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 02eef90e5..0b9118c92 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1057,3 +1057,54 @@ tests: mountPath: /opt/draios/etc/local_forwarder_config.yaml subPath: local_forwarder_config.yaml template: host/daemonset.yaml + + - it: Global annotations applied to DaemonSet workload metadata + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - equal: + path: metadata.annotations["global-annotation-key"] + value: global-annotation-value + + - it: Global annotations applied to DaemonSet pod metadata + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - equal: + path: spec.template.metadata.annotations["global-annotation-key"] + value: global-annotation-value + + - it: Global annotations merged with component workload and pod annotations + set: + annotations: + global-key: global-value + workload_annotations: + global-workload-key: global-workload-value + pod_annotations: + global-pod-key: global-pod-value + host: + workload_annotations: + component-workload-key: component-workload-value + pod_annotations: + component-pod-key: component-pod-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["global-workload-key"] + value: global-workload-value + - equal: + path: metadata.annotations["component-workload-key"] + value: component-workload-value + - equal: + path: spec.template.metadata.annotations["global-key"] + value: global-value + - equal: + path: spec.template.metadata.annotations["global-pod-key"] + value: global-pod-value + - equal: + path: spec.template.metadata.annotations["component-pod-key"] + value: component-pod-value diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index 8314a8b0a..7236a7f64 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -76,3 +76,28 @@ tests: path: metadata.annotations content: app.kubernetes.io/description: "This is a test" + + - it: Global annotations applied to ServiceAccount + set: + annotations: + global-annotation-key: global-annotation-value + asserts: + - equal: + path: metadata.annotations["global-annotation-key"] + value: global-annotation-value + + - it: Global annotations merged with rbac.annotations on ServiceAccount + set: + annotations: + global-key: global-value + host: + rbac: + annotations: + rbac-key: rbac-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["rbac-key"] + value: rbac-value diff --git a/charts/shield/values.schema.json b/charts/shield/values.schema.json index a5231cd4e..c9b736355 100644 --- a/charts/shield/values.schema.json +++ b/charts/shield/values.schema.json @@ -36,6 +36,13 @@ "proxy": { "$ref": "#/$defs/Proxy" }, + "annotations": { + "type": "object", + "description": "Additional annotations applied to all resources created by the chart.", + "additionalProperties": { + "type": "string" + } + }, "extra_capabilities_api_versions": { "type": "array", "items": { diff --git a/charts/shield/values.yaml b/charts/shield/values.yaml index 5aef23752..0d6216a54 100644 --- a/charts/shield/values.yaml +++ b/charts/shield/values.yaml @@ -660,6 +660,8 @@ proxy: # Additional .APIVersions in .Capabilities, e.g. "security.openshift.io/v1" extra_capabilities_api_versions: [] +# Additional annotations for all resources (metadata.annotations) +annotations: {} # Additional annotations for the all the workloads (metadata.annotations) workload_annotations: {} # Additional labels for the all the workloads (metadata.labels) From afd33d5ca1839301cbedded658cfb413e54298a3 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 17:08:45 +0200 Subject: [PATCH 2/8] feat(shield): add global labels support for all resources Add top-level `labels` value that propagates to every Kubernetes resource the chart creates. Implemented by merging .Values.labels into the `shield.labels` base helper, which is inherited by all component label helpers (cluster.labels, host.labels, host.windows.labels, common.labels) and cascades to every resource-specific label set. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- charts/shield/templates/_helpers.tpl | 14 ++-- .../shield/tests/cluster/deployment_test.yaml | 66 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 11 ++++ .../tests/cluster/serviceaccount_test.yaml | 9 +++ charts/shield/tests/host/daemonset_test.yaml | 51 ++++++++++++++ .../tests/host/serviceaccount_test.yaml | 9 +++ charts/shield/values.schema.json | 7 ++ charts/shield/values.yaml | 2 + 8 files changed, 163 insertions(+), 6 deletions(-) diff --git a/charts/shield/templates/_helpers.tpl b/charts/shield/templates/_helpers.tpl index 79523e31b..e5e8f50ab 100644 --- a/charts/shield/templates/_helpers.tpl +++ b/charts/shield/templates/_helpers.tpl @@ -34,12 +34,14 @@ Create chart name and version as used by the chart label. Common labels */}} {{- define "shield.labels" -}} -helm.sh/chart: {{ include "shield.chart" . }} -{{ include "shield.selector_labels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- $labels := dict "helm.sh/chart" (include "shield.chart" .) -}} + {{- $_ := merge $labels (include "shield.selector_labels" . | fromYaml) -}} + {{- if .Chart.AppVersion -}} + {{- $_ := set $labels "app.kubernetes.io/version" .Chart.AppVersion -}} + {{- end -}} + {{- $_ := set $labels "app.kubernetes.io/managed-by" .Release.Service -}} + {{- $_ := merge $labels .Values.labels -}} + {{- $labels | toYaml -}} {{- end }} {{/* diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index 5bb09a77a..0fd60bca7 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1527,6 +1527,72 @@ tests: value: 1.2.3-helmtest template: templates/cluster/deployment.yaml + - it: Global labels applied to workload metadata + set: + labels: + global-label-key: global-label-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: metadata.labels["global-label-key"] + value: global-label-value + template: templates/cluster/deployment.yaml + + - it: Global labels applied to pod metadata + set: + labels: + global-label-key: global-label-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: spec.template.metadata.labels["global-label-key"] + value: global-label-value + template: templates/cluster/deployment.yaml + + - it: Global labels merged with component workload and pod labels + set: + labels: + global-key: global-value + workload_labels: + global-workload-key: global-workload-value + pod_labels: + global-pod-key: global-pod-value + cluster: + image: + tag: 1.1.1 + workload_labels: + component-workload-key: component-workload-value + pod_labels: + component-pod-key: component-pod-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["global-workload-key"] + value: global-workload-value + - equal: + path: metadata.labels["component-workload-key"] + value: component-workload-value + - equal: + path: spec.template.metadata.labels["global-key"] + value: global-value + - equal: + path: spec.template.metadata.labels["global-pod-key"] + value: global-pod-value + - equal: + path: spec.template.metadata.labels["component-pod-key"] + value: component-pod-value + template: templates/cluster/deployment.yaml + - it: Global annotations applied to workload metadata set: annotations: diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index aeed6abe4..253b778f0 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -278,6 +278,17 @@ tests: path: metadata.annotations["custom-2"] value: annotation-2 + - it: Global labels applied to Service + set: + labels: + global-label-key: global-label-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.labels["global-label-key"] + value: global-label-value + - it: Global annotations applied to Service set: annotations: diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index ef56424eb..3b3a89c28 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -77,6 +77,15 @@ tests: content: app.kubernetes.io/description: "This is a test" + - it: Global labels applied to ServiceAccount + set: + labels: + global-label-key: global-label-value + asserts: + - equal: + path: metadata.labels["global-label-key"] + value: global-label-value + - it: Global annotations applied to ServiceAccount set: annotations: diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 0b9118c92..1a6f80071 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1058,6 +1058,57 @@ tests: subPath: local_forwarder_config.yaml template: host/daemonset.yaml + - it: Global labels applied to DaemonSet workload metadata + set: + labels: + global-label-key: global-label-value + asserts: + - equal: + path: metadata.labels["global-label-key"] + value: global-label-value + + - it: Global labels applied to DaemonSet pod metadata + set: + labels: + global-label-key: global-label-value + asserts: + - equal: + path: spec.template.metadata.labels["global-label-key"] + value: global-label-value + + - it: Global labels merged with component workload and pod labels + set: + labels: + global-key: global-value + workload_labels: + global-workload-key: global-workload-value + pod_labels: + global-pod-key: global-pod-value + host: + workload_labels: + component-workload-key: component-workload-value + pod_labels: + component-pod-key: component-pod-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["global-workload-key"] + value: global-workload-value + - equal: + path: metadata.labels["component-workload-key"] + value: component-workload-value + - equal: + path: spec.template.metadata.labels["global-key"] + value: global-value + - equal: + path: spec.template.metadata.labels["global-pod-key"] + value: global-pod-value + - equal: + path: spec.template.metadata.labels["component-pod-key"] + value: component-pod-value + - it: Global annotations applied to DaemonSet workload metadata set: annotations: diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index 7236a7f64..8a7549ef5 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -77,6 +77,15 @@ tests: content: app.kubernetes.io/description: "This is a test" + - it: Global labels applied to ServiceAccount + set: + labels: + global-label-key: global-label-value + asserts: + - equal: + path: metadata.labels["global-label-key"] + value: global-label-value + - it: Global annotations applied to ServiceAccount set: annotations: diff --git a/charts/shield/values.schema.json b/charts/shield/values.schema.json index c9b736355..2ab5830be 100644 --- a/charts/shield/values.schema.json +++ b/charts/shield/values.schema.json @@ -43,6 +43,13 @@ "type": "string" } }, + "labels": { + "type": "object", + "description": "Additional labels applied to all resources created by the chart.", + "additionalProperties": { + "type": "string" + } + }, "extra_capabilities_api_versions": { "type": "array", "items": { diff --git a/charts/shield/values.yaml b/charts/shield/values.yaml index 0d6216a54..6d32c5c8e 100644 --- a/charts/shield/values.yaml +++ b/charts/shield/values.yaml @@ -662,6 +662,8 @@ extra_capabilities_api_versions: [] # Additional annotations for all resources (metadata.annotations) annotations: {} +# Additional labels for all resources (metadata.labels) +labels: {} # Additional annotations for the all the workloads (metadata.annotations) workload_annotations: {} # Additional labels for the all the workloads (metadata.labels) From 1335f23443e7d40c8987a48de2c841b174d0169c Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 17:31:47 +0200 Subject: [PATCH 3/8] test(shield): add default labels and annotations coverage Verify that the standard Kubernetes labels (helm.sh/chart, app.kubernetes.io/*) and sysdig/component are always present on every resource type (Deployment, DaemonSet, Service, ServiceAccount, ConfigMap) even when no custom labels/annotations are set. Also verify that resources without any annotations do not gain an unexpected annotations block when annotations: {} (default). Add chart.version: 1.2.3-helmtest to suite headers that lacked it so helm.sh/chart assertions are stable across version bumps. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- .../shield/tests/cluster/configmap_test.yaml | 20 +++++++++++++++++++ .../shield/tests/cluster/deployment_test.yaml | 1 + charts/shield/tests/cluster/service_test.yaml | 14 +++++++++++++ .../tests/cluster/serviceaccount_test.yaml | 20 +++++++++++++++++++ charts/shield/tests/host/daemonset_test.yaml | 13 ++++++++++++ .../tests/host/serviceaccount_test.yaml | 20 +++++++++++++++++++ 6 files changed, 88 insertions(+) diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml index a32e806ab..973fa32f1 100644 --- a/charts/shield/tests/cluster/configmap_test.yaml +++ b/charts/shield/tests/cluster/configmap_test.yaml @@ -1,6 +1,8 @@ suite: Cluster - Configmap templates: - templates/cluster/configmap.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -1050,3 +1052,21 @@ tests: - matchRegex: path: data['cluster-shield.yaml'] pattern: \A\S + + - it: Default labels present on ConfigMap + asserts: + - isSubset: + path: metadata.labels + content: + helm.sh/chart: shield-1.2.3-helmtest + app.kubernetes.io/name: shield + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + sysdig/component: cluster + + - it: No annotations by default on ConfigMap + asserts: + - exists: + path: metadata.annotations + not: true diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index 0fd60bca7..1f133f256 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -290,6 +290,7 @@ tests: - isSubset: path: metadata.labels content: + helm.sh/chart: shield-1.2.3-helmtest app.kubernetes.io/instance: release-name app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: shield diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index 253b778f0..c0cbd9338 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -1,6 +1,8 @@ suite: Cluster - Service templates: - templates/cluster/service.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -227,6 +229,18 @@ tests: path: spec.type value: NodePort + - it: Default labels present on Service + asserts: + - isSubset: + path: metadata.labels + content: + helm.sh/chart: shield-1.2.3-helmtest + app.kubernetes.io/name: shield + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + sysdig/component: cluster + - it: Custom Lables set: cluster: diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index 3b3a89c28..1bdae7b39 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -1,6 +1,8 @@ suite: Cluster - ServiceAccount templates: - templates/cluster/serviceaccount.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -59,6 +61,24 @@ tests: path: metadata.name value: my-existing-sa + - it: Default labels present on ServiceAccount + asserts: + - isSubset: + path: metadata.labels + content: + helm.sh/chart: shield-1.2.3-helmtest + app.kubernetes.io/name: shield + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + sysdig/component: cluster + + - it: No annotations by default on ServiceAccount + asserts: + - exists: + path: metadata.annotations + not: true + - it: Applies rbac.labels and rbac.annotations to the ServiceAccount set: cluster: diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 1a6f80071..12bd718f0 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1,6 +1,8 @@ suite: Host - DaemonSet templates: - templates/host/daemonset.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -341,6 +343,7 @@ tests: - isSubset: path: metadata.labels content: + helm.sh/chart: shield-1.2.3-helmtest app.kubernetes.io/instance: release-name app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: shield @@ -348,6 +351,16 @@ tests: sysdig/component: host sysdig/component-version: 11.11.11 + - it: No global annotations do not add workload annotations + asserts: + - containsDocument: + kind: DaemonSet + apiVersion: apps/v1 + name: release-name-shield-host + namespace: shield-namespace + - isNullOrEmpty: + path: metadata.annotations + - it: Default pod labels set: host: diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index 8a7549ef5..c8dcdf533 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -1,6 +1,8 @@ suite: Host - ServiceAccount templates: - templates/host/serviceaccount.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -59,6 +61,24 @@ tests: path: metadata.name value: my-existing-sa + - it: Default labels present on ServiceAccount + asserts: + - isSubset: + path: metadata.labels + content: + helm.sh/chart: shield-1.2.3-helmtest + app.kubernetes.io/name: shield + app.kubernetes.io/instance: release-name + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + sysdig/component: host + + - it: No annotations by default on ServiceAccount + asserts: + - exists: + path: metadata.annotations + not: true + - it: Applies rbac.labels and rbac.annotations to the ServiceAccount set: host: From aedae1f3a25261bddda7cae92b12ef146c72ea98 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 17:41:40 +0200 Subject: [PATCH 4/8] feat(shield): add component-level annotations for cluster, host, and host_windows Add annotations fields under cluster.annotations, host.annotations, and host_windows.annotations that scope extra annotations to a single component. These are merged on top of the global annotations and below any resource-specific annotations (workload_annotations, rbac.annotations, etc.). New base helpers: cluster.annotations, host.annotations, host.windows.annotations. All existing workload/pod/RBAC annotation helpers are updated to derive from the component base instead of shield.annotations directly. Templates for services, configmaps, secrets, and OpenShift SCCs updated accordingly. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- .../shield/templates/cluster/_annotations.tpl | 13 +++-- .../shield/templates/cluster/configmap.yaml | 2 +- .../openshift-securitycontextconstraint.yaml | 6 +-- charts/shield/templates/cluster/secret.yaml | 2 +- ...ce-container-vulnerability-management.yaml | 2 +- charts/shield/templates/cluster/service.yaml | 2 +- charts/shield/templates/host/_annotations.tpl | 13 +++-- .../templates/host/_windows_annotations.tpl | 11 +++- .../templates/host/configmap-windows.yaml | 2 +- charts/shield/templates/host/configmap.yaml | 2 +- .../host/gke-allowlist-synchronizer.yaml | 2 +- .../host/gke-allowlist-waiter-job.yaml | 4 +- .../openshift-securitycontextconstraint.yaml | 6 +-- charts/shield/templates/host/secrets.yaml | 4 +- .../shield/tests/cluster/configmap_test.yaml | 25 +++++++++ .../shield/tests/cluster/deployment_test.yaml | 53 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 35 ++++++++++++ .../tests/cluster/serviceaccount_test.yaml | 31 +++++++++++ charts/shield/tests/host/daemonset_test.yaml | 40 ++++++++++++++ .../tests/host/serviceaccount_test.yaml | 31 +++++++++++ charts/shield/values.schema.json | 21 ++++++++ charts/shield/values.yaml | 6 +++ 22 files changed, 288 insertions(+), 25 deletions(-) diff --git a/charts/shield/templates/cluster/_annotations.tpl b/charts/shield/templates/cluster/_annotations.tpl index a38cd3ff4..84157db90 100644 --- a/charts/shield/templates/cluster/_annotations.tpl +++ b/charts/shield/templates/cluster/_annotations.tpl @@ -1,19 +1,26 @@ +{{- define "cluster.annotations" -}} + {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.cluster.annotations -}} + {{- with $annotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} + {{- define "cluster.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.cluster.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.workload_annotations .Values.cluster.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.cluster.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.pod_annotations .Values.cluster.pod_annotations -}} {{- with $podAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.rbac_annotations" -}} - {{- $rbacAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.cluster.rbac.annotations -}} + {{- $rbacAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.cluster.rbac.annotations -}} {{- with $rbacAnnotations -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/cluster/configmap.yaml b/charts/shield/templates/cluster/configmap.yaml index 437a7585e..e7067f6ea 100644 --- a/charts/shield/templates/cluster/configmap.yaml +++ b/charts/shield/templates/cluster/configmap.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "cluster.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} diff --git a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml index 99dc4bb6a..e341b3be7 100644 --- a/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml +++ b/charts/shield/templates/cluster/openshift-securitycontextconstraint.yaml @@ -5,9 +5,9 @@ metadata: annotations: kubernetes.io/description: | This provides the minimum requirements to the Sysdig Shield to run in the Openshift. - {{- $shieldAnnotations := (include "shield.annotations" .) }} - {{- if $shieldAnnotations }} - {{- $shieldAnnotations | nindent 4 }} + {{- $clusterAnnotations := (include "cluster.annotations" .) }} + {{- if $clusterAnnotations }} + {{- $clusterAnnotations | nindent 4 }} {{- end }} name: {{ include "cluster.fullname" . }} labels: diff --git a/charts/shield/templates/cluster/secret.yaml b/charts/shield/templates/cluster/secret.yaml index b7497d3c0..b14ccf486 100644 --- a/charts/shield/templates/cluster/secret.yaml +++ b/charts/shield/templates/cluster/secret.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "cluster.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "cluster.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} diff --git a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml index 0cec55faf..dfdf5f9c4 100644 --- a/charts/shield/templates/cluster/service-container-vulnerability-management.yaml +++ b/charts/shield/templates/cluster/service-container-vulnerability-management.yaml @@ -9,7 +9,7 @@ metadata: {{- if and .Values.cluster.service .Values.cluster.service.labels }} {{- toYaml .Values.cluster.service.labels | nindent 4 }} {{- end }} - {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $shieldAnnotations := (include "cluster.annotations" .) }} {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }} {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }} {{- if $allAnnotations }} diff --git a/charts/shield/templates/cluster/service.yaml b/charts/shield/templates/cluster/service.yaml index 65d51c996..3c693e70a 100644 --- a/charts/shield/templates/cluster/service.yaml +++ b/charts/shield/templates/cluster/service.yaml @@ -8,7 +8,7 @@ metadata: {{- if and .Values.cluster.service .Values.cluster.service.labels }} {{- toYaml .Values.cluster.service.labels | nindent 4 }} {{- end }} - {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $shieldAnnotations := (include "cluster.annotations" .) }} {{- $serviceAnnotations := (dig "service" "annotations" dict .Values.cluster) }} {{- $allAnnotations := merge (dict) $serviceAnnotations (fromYaml $shieldAnnotations) }} {{- if $allAnnotations }} diff --git a/charts/shield/templates/host/_annotations.tpl b/charts/shield/templates/host/_annotations.tpl index 25aa39f36..dab2bb565 100644 --- a/charts/shield/templates/host/_annotations.tpl +++ b/charts/shield/templates/host/_annotations.tpl @@ -1,12 +1,19 @@ +{{- define "host.annotations" -}} + {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host.annotations -}} + {{- with $annotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} + {{- define "host.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.host.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.workload_annotations .Values.host.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.host.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.pod_annotations .Values.host.pod_annotations -}} {{- if (include "common.cluster_type.is_gke_autopilot" . ) -}} {{- $_ := set $podAnnotations "autopilot.gke.io/no-connect" "true" -}} {{- end -}} @@ -17,7 +24,7 @@ {{- end -}} {{- define "host.rbac_annotations" -}} - {{- $rbacAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host.rbac.annotations -}} + {{- $rbacAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.host.rbac.annotations -}} {{- with $rbacAnnotations -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_windows_annotations.tpl b/charts/shield/templates/host/_windows_annotations.tpl index 5e6e8f75d..ef4c34458 100644 --- a/charts/shield/templates/host/_windows_annotations.tpl +++ b/charts/shield/templates/host/_windows_annotations.tpl @@ -1,11 +1,18 @@ +{{- define "host.windows.annotations" -}} + {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host_windows.annotations -}} + {{- with $annotations -}} + {{- . | toYaml -}} + {{- end -}} +{{- end -}} + {{- define "host.windows.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "host.windows.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "host.windows.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} {{- $podAnnotations | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/configmap-windows.yaml b/charts/shield/templates/host/configmap-windows.yaml index ac14225b0..90d7260c9 100644 --- a/charts/shield/templates/host/configmap-windows.yaml +++ b/charts/shield/templates/host/configmap-windows.yaml @@ -6,7 +6,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "host.windows.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} diff --git a/charts/shield/templates/host/configmap.yaml b/charts/shield/templates/host/configmap.yaml index 69370f907..de59942ef 100644 --- a/charts/shield/templates/host/configmap.yaml +++ b/charts/shield/templates/host/configmap.yaml @@ -5,7 +5,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "host.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} diff --git a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml index 322da79f4..303e7c12b 100644 --- a/charts/shield/templates/host/gke-allowlist-synchronizer.yaml +++ b/charts/shield/templates/host/gke-allowlist-synchronizer.yaml @@ -7,7 +7,7 @@ metadata: annotations: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-delete-policy: "before-hook-creation" - {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $shieldAnnotations := (include "host.annotations" .) }} {{- if $shieldAnnotations }} {{- $shieldAnnotations | nindent 4 }} {{- end }} diff --git a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml index f5b5f63ca..65e82e3dd 100644 --- a/charts/shield/templates/host/gke-allowlist-waiter-job.yaml +++ b/charts/shield/templates/host/gke-allowlist-waiter-job.yaml @@ -10,7 +10,7 @@ metadata: helm.sh/hook: "pre-install,pre-upgrade" helm.sh/hook-weight: "5" helm.sh/hook-delete-policy: "before-hook-creation,hook-succeeded,hook-failed" - {{- $shieldAnnotations := (include "shield.annotations" .) }} + {{- $shieldAnnotations := (include "host.annotations" .) }} {{- if $shieldAnnotations }} {{- $shieldAnnotations | nindent 4 }} {{- end }} @@ -26,7 +26,7 @@ spec: Autopilot block this Pod on the very allowlist it is waiting to load. */}} {{- include "shield.labels" . | nindent 8 }} - {{- $podAnnotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.pod_annotations }} + {{- $podAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.pod_annotations }} {{- if $podAnnotations }} annotations: {{- toYaml $podAnnotations | nindent 8 }} diff --git a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml index 76d6b4c77..727a1e74c 100644 --- a/charts/shield/templates/host/openshift-securitycontextconstraint.yaml +++ b/charts/shield/templates/host/openshift-securitycontextconstraint.yaml @@ -5,9 +5,9 @@ metadata: annotations: kubernetes.io/description: | This provides the minimum requirements to the Sysdig Shield to run in the Openshift. - {{- $shieldAnnotations := (include "shield.annotations" .) }} - {{- if $shieldAnnotations }} - {{- $shieldAnnotations | nindent 4 }} + {{- $hostAnnotations := (include "host.annotations" .) }} + {{- if $hostAnnotations }} + {{- $hostAnnotations | nindent 4 }} {{- end }} name: {{ include "host.fullname" . }} labels: diff --git a/charts/shield/templates/host/secrets.yaml b/charts/shield/templates/host/secrets.yaml index 4010bc4f4..038e49ecb 100644 --- a/charts/shield/templates/host/secrets.yaml +++ b/charts/shield/templates/host/secrets.yaml @@ -10,7 +10,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "host.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} @@ -30,7 +30,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} - {{- $annotations := (include "shield.annotations" .) }} + {{- $annotations := (include "host.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml index 973fa32f1..25570e77b 100644 --- a/charts/shield/tests/cluster/configmap_test.yaml +++ b/charts/shield/tests/cluster/configmap_test.yaml @@ -1070,3 +1070,28 @@ tests: - exists: path: metadata.annotations not: true + + - it: cluster.annotations applied to ConfigMap + set: + cluster: + annotations: + cluster-annotation-key: cluster-annotation-value + asserts: + - equal: + path: metadata.annotations["cluster-annotation-key"] + value: cluster-annotation-value + + - it: cluster.annotations merged with global annotations on ConfigMap + set: + annotations: + global-key: global-value + cluster: + annotations: + cluster-key: cluster-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["cluster-key"] + value: cluster-value diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index 1f133f256..b846bcd0b 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1657,3 +1657,56 @@ tests: path: spec.template.metadata.annotations["component-pod-key"] value: component-pod-value template: templates/cluster/deployment.yaml + + - it: cluster.annotations applied to Deployment workload metadata + set: + cluster: + annotations: + cluster-annotation-key: cluster-annotation-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: metadata.annotations["cluster-annotation-key"] + value: cluster-annotation-value + template: templates/cluster/deployment.yaml + + - it: cluster.annotations applied to Deployment pod metadata + set: + cluster: + annotations: + cluster-annotation-key: cluster-annotation-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: spec.template.metadata.annotations["cluster-annotation-key"] + value: cluster-annotation-value + template: templates/cluster/deployment.yaml + + - it: cluster.annotations merged with global annotations and workload annotations + set: + annotations: + global-key: global-value + cluster: + annotations: + cluster-key: cluster-value + workload_annotations: + workload-key: workload-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["cluster-key"] + value: cluster-value + - equal: + path: metadata.annotations["workload-key"] + value: workload-value + template: templates/cluster/deployment.yaml diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index c0cbd9338..f00517286 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -331,3 +331,38 @@ tests: - equal: path: metadata.annotations["service-key"] value: service-value + + - it: cluster.annotations applied to Service + set: + cluster: + annotations: + cluster-annotation-key: cluster-annotation-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.annotations["cluster-annotation-key"] + value: cluster-annotation-value + + - it: cluster.annotations merged with global and service annotations on Service + set: + annotations: + global-key: global-value + cluster: + annotations: + cluster-key: cluster-value + service: + annotations: + service-key: service-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["cluster-key"] + value: cluster-value + - equal: + path: metadata.annotations["service-key"] + value: service-value diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index 1bdae7b39..569be1f10 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -130,3 +130,34 @@ tests: - equal: path: metadata.annotations["rbac-key"] value: rbac-value + + - it: cluster.annotations applied to ServiceAccount + set: + cluster: + annotations: + cluster-annotation-key: cluster-annotation-value + asserts: + - equal: + path: metadata.annotations["cluster-annotation-key"] + value: cluster-annotation-value + + - it: cluster.annotations merged with global and rbac annotations on ServiceAccount + set: + annotations: + global-key: global-value + cluster: + annotations: + cluster-key: cluster-value + rbac: + annotations: + rbac-key: rbac-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["cluster-key"] + value: cluster-value + - equal: + path: metadata.annotations["rbac-key"] + value: rbac-value diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 12bd718f0..8444f487b 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1172,3 +1172,43 @@ tests: - equal: path: spec.template.metadata.annotations["component-pod-key"] value: component-pod-value + + - it: host.annotations applied to DaemonSet workload metadata + set: + host: + annotations: + host-annotation-key: host-annotation-value + asserts: + - equal: + path: metadata.annotations["host-annotation-key"] + value: host-annotation-value + + - it: host.annotations applied to DaemonSet pod metadata + set: + host: + annotations: + host-annotation-key: host-annotation-value + asserts: + - equal: + path: spec.template.metadata.annotations["host-annotation-key"] + value: host-annotation-value + + - it: host.annotations merged with global annotations and workload annotations + set: + annotations: + global-key: global-value + host: + annotations: + host-key: host-value + workload_annotations: + workload-key: workload-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["host-key"] + value: host-value + - equal: + path: metadata.annotations["workload-key"] + value: workload-value diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index c8dcdf533..fcb833aaa 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -130,3 +130,34 @@ tests: - equal: path: metadata.annotations["rbac-key"] value: rbac-value + + - it: host.annotations applied to ServiceAccount + set: + host: + annotations: + host-annotation-key: host-annotation-value + asserts: + - equal: + path: metadata.annotations["host-annotation-key"] + value: host-annotation-value + + - it: host.annotations merged with global and rbac annotations on ServiceAccount + set: + annotations: + global-key: global-value + host: + annotations: + host-key: host-value + rbac: + annotations: + rbac-key: rbac-value + asserts: + - equal: + path: metadata.annotations["global-key"] + value: global-value + - equal: + path: metadata.annotations["host-key"] + value: host-value + - equal: + path: metadata.annotations["rbac-key"] + value: rbac-value diff --git a/charts/shield/values.schema.json b/charts/shield/values.schema.json index 2ab5830be..ffbb01b81 100644 --- a/charts/shield/values.schema.json +++ b/charts/shield/values.schema.json @@ -391,6 +391,13 @@ }, "volume_mounts": { "$ref": "#/$defs/VolumeMounts" + }, + "annotations": { + "type": "object", + "description": "Additional annotations applied to all cluster resources created by the chart.", + "additionalProperties": { + "type": "string" + } } }, "required": [ @@ -442,6 +449,13 @@ }, "volume_mounts": { "$ref": "#/$defs/VolumeMounts" + }, + "annotations": { + "type": "object", + "description": "Additional annotations applied to all host resources created by the chart.", + "additionalProperties": { + "type": "string" + } } }, "required": [ @@ -463,6 +477,13 @@ }, "volume_mounts": { "$ref": "#/$defs/VolumeMounts" + }, + "annotations": { + "type": "object", + "description": "Additional annotations applied to all host_windows resources created by the chart.", + "additionalProperties": { + "type": "string" + } } } }, diff --git a/charts/shield/values.yaml b/charts/shield/values.yaml index 6d32c5c8e..9813b5ec7 100644 --- a/charts/shield/values.yaml +++ b/charts/shield/values.yaml @@ -243,6 +243,8 @@ host_windows: memory: 384Mi # The host aliases for the windows host shield workloads host_aliases: [] + # Additional annotations for all host_windows resources (metadata.annotations) + annotations: {} # The annotations for the host shield workloads (metadata.annotations) workload_annotations: {} # The labels for the host shield workloads (metadata.labels) @@ -372,6 +374,8 @@ host: memory: 384Mi # The host aliases for the linux host shield workloads host_aliases: [] + # Additional annotations for all host resources (metadata.annotations) + annotations: {} # The annotations for the host shield workloads (metadata.annotations) workload_annotations: {} # The labels for the host shield workloads (metadata.labels) @@ -551,6 +555,8 @@ cluster: memory: 1536Mi # The host aliases for the cluster shield workloads host_aliases: [] + # Additional annotations for all cluster resources (metadata.annotations) + annotations: {} # The annotations for the cluster shield workloads (metadata.annotations) workload_annotations: {} # The labels for the cluster shield workloads (metadata.labels) From c486bfcc371f976e24b0dda11ea6809be650be37 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 17:43:49 +0200 Subject: [PATCH 5/8] feat(shield): add component-level labels for cluster, host, and host_windows Add labels fields under cluster.labels, host.labels, and host_windows.labels that scope extra labels to a single component. Implemented by merging .Values..labels into the component base label helper (cluster.labels, host.labels, host.windows.labels), which cascades automatically to every workload, pod, RBAC, service, and ConfigMap label set for that component. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- charts/shield/templates/cluster/_labels.tpl | 2 +- charts/shield/templates/host/_labels.tpl | 2 +- .../shield/templates/host/_windows_labels.tpl | 2 +- .../shield/tests/cluster/configmap_test.yaml | 25 +++++++++ .../shield/tests/cluster/deployment_test.yaml | 53 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 29 ++++++++++ .../tests/cluster/serviceaccount_test.yaml | 25 +++++++++ charts/shield/tests/host/daemonset_test.yaml | 40 ++++++++++++++ .../tests/host/serviceaccount_test.yaml | 25 +++++++++ charts/shield/values.schema.json | 21 ++++++++ charts/shield/values.yaml | 6 +++ 11 files changed, 227 insertions(+), 3 deletions(-) diff --git a/charts/shield/templates/cluster/_labels.tpl b/charts/shield/templates/cluster/_labels.tpl index 220f5f16e..91ba4a6fe 100644 --- a/charts/shield/templates/cluster/_labels.tpl +++ b/charts/shield/templates/cluster/_labels.tpl @@ -2,7 +2,7 @@ Common labels */}} {{- define "cluster.labels" -}} - {{- $labels := merge (dict) (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} + {{- $labels := merge (dict) .Values.cluster.labels (include "cluster.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} {{- with $labels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_labels.tpl b/charts/shield/templates/host/_labels.tpl index c5b1765da..e79b21d5a 100644 --- a/charts/shield/templates/host/_labels.tpl +++ b/charts/shield/templates/host/_labels.tpl @@ -13,7 +13,7 @@ GKE Autopilot labels Common labels */}} {{- define "host.labels" -}} - {{- $labels := merge (dict) (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} + {{- $labels := merge (dict) .Values.host.labels (include "host.gke_autopilot_labels" . | fromYaml) (include "host.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} {{- with $labels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_windows_labels.tpl b/charts/shield/templates/host/_windows_labels.tpl index be6a65630..86f2cc2d0 100644 --- a/charts/shield/templates/host/_windows_labels.tpl +++ b/charts/shield/templates/host/_windows_labels.tpl @@ -2,7 +2,7 @@ Common labels */}} {{- define "host.windows.labels" -}} - {{- $labels := merge (dict) (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} + {{- $labels := merge (dict) .Values.host_windows.labels (include "host.windows.self_labels" . | fromYaml) (include "shield.labels" . | fromYaml) }} {{- with $labels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml index 25570e77b..fc76d88bd 100644 --- a/charts/shield/tests/cluster/configmap_test.yaml +++ b/charts/shield/tests/cluster/configmap_test.yaml @@ -1095,3 +1095,28 @@ tests: - equal: path: metadata.annotations["cluster-key"] value: cluster-value + + - it: cluster.labels applied to ConfigMap + set: + cluster: + labels: + cluster-label-key: cluster-label-value + asserts: + - equal: + path: metadata.labels["cluster-label-key"] + value: cluster-label-value + + - it: cluster.labels merged with global labels on ConfigMap + set: + labels: + global-key: global-value + cluster: + labels: + cluster-key: cluster-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["cluster-key"] + value: cluster-value diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index b846bcd0b..c8a58072a 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1710,3 +1710,56 @@ tests: path: metadata.annotations["workload-key"] value: workload-value template: templates/cluster/deployment.yaml + + - it: cluster.labels applied to Deployment workload metadata + set: + cluster: + labels: + cluster-label-key: cluster-label-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: metadata.labels["cluster-label-key"] + value: cluster-label-value + template: templates/cluster/deployment.yaml + + - it: cluster.labels applied to Deployment pod metadata + set: + cluster: + labels: + cluster-label-key: cluster-label-value + asserts: + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: release-name-shield-cluster + namespace: shield-namespace + - equal: + path: spec.template.metadata.labels["cluster-label-key"] + value: cluster-label-value + template: templates/cluster/deployment.yaml + + - it: cluster.labels merged with global and workload labels + set: + labels: + global-key: global-value + cluster: + labels: + cluster-key: cluster-value + workload_labels: + workload-key: workload-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["cluster-key"] + value: cluster-value + - equal: + path: metadata.labels["workload-key"] + value: workload-value + template: templates/cluster/deployment.yaml diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index f00517286..ebe085077 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -366,3 +366,32 @@ tests: - equal: path: metadata.annotations["service-key"] value: service-value + + - it: cluster.labels applied to Service + set: + cluster: + labels: + cluster-label-key: cluster-label-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.labels["cluster-label-key"] + value: cluster-label-value + + - it: cluster.labels merged with global labels on Service + set: + labels: + global-key: global-value + cluster: + labels: + cluster-key: cluster-value + asserts: + - isKind: + of: Service + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["cluster-key"] + value: cluster-value diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index 569be1f10..ecdeea6f3 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -161,3 +161,28 @@ tests: - equal: path: metadata.annotations["rbac-key"] value: rbac-value + + - it: cluster.labels applied to ServiceAccount + set: + cluster: + labels: + cluster-label-key: cluster-label-value + asserts: + - equal: + path: metadata.labels["cluster-label-key"] + value: cluster-label-value + + - it: cluster.labels merged with global labels on ServiceAccount + set: + labels: + global-key: global-value + cluster: + labels: + cluster-key: cluster-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["cluster-key"] + value: cluster-value diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 8444f487b..722e8d68c 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1212,3 +1212,43 @@ tests: - equal: path: metadata.annotations["workload-key"] value: workload-value + + - it: host.labels applied to DaemonSet workload metadata + set: + host: + labels: + host-label-key: host-label-value + asserts: + - equal: + path: metadata.labels["host-label-key"] + value: host-label-value + + - it: host.labels applied to DaemonSet pod metadata + set: + host: + labels: + host-label-key: host-label-value + asserts: + - equal: + path: spec.template.metadata.labels["host-label-key"] + value: host-label-value + + - it: host.labels merged with global and workload labels + set: + labels: + global-key: global-value + host: + labels: + host-key: host-value + workload_labels: + workload-key: workload-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["host-key"] + value: host-value + - equal: + path: metadata.labels["workload-key"] + value: workload-value diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index fcb833aaa..3ca9e56cb 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -161,3 +161,28 @@ tests: - equal: path: metadata.annotations["rbac-key"] value: rbac-value + + - it: host.labels applied to ServiceAccount + set: + host: + labels: + host-label-key: host-label-value + asserts: + - equal: + path: metadata.labels["host-label-key"] + value: host-label-value + + - it: host.labels merged with global labels on ServiceAccount + set: + labels: + global-key: global-value + host: + labels: + host-key: host-value + asserts: + - equal: + path: metadata.labels["global-key"] + value: global-value + - equal: + path: metadata.labels["host-key"] + value: host-value diff --git a/charts/shield/values.schema.json b/charts/shield/values.schema.json index ffbb01b81..9fed15f48 100644 --- a/charts/shield/values.schema.json +++ b/charts/shield/values.schema.json @@ -398,6 +398,13 @@ "additionalProperties": { "type": "string" } + }, + "labels": { + "type": "object", + "description": "Additional labels applied to all cluster resources created by the chart.", + "additionalProperties": { + "type": "string" + } } }, "required": [ @@ -456,6 +463,13 @@ "additionalProperties": { "type": "string" } + }, + "labels": { + "type": "object", + "description": "Additional labels applied to all host resources created by the chart.", + "additionalProperties": { + "type": "string" + } } }, "required": [ @@ -484,6 +498,13 @@ "additionalProperties": { "type": "string" } + }, + "labels": { + "type": "object", + "description": "Additional labels applied to all host_windows resources created by the chart.", + "additionalProperties": { + "type": "string" + } } } }, diff --git a/charts/shield/values.yaml b/charts/shield/values.yaml index 9813b5ec7..786a173e8 100644 --- a/charts/shield/values.yaml +++ b/charts/shield/values.yaml @@ -245,6 +245,8 @@ host_windows: host_aliases: [] # Additional annotations for all host_windows resources (metadata.annotations) annotations: {} + # Additional labels for all host_windows resources (metadata.labels) + labels: {} # The annotations for the host shield workloads (metadata.annotations) workload_annotations: {} # The labels for the host shield workloads (metadata.labels) @@ -376,6 +378,8 @@ host: host_aliases: [] # Additional annotations for all host resources (metadata.annotations) annotations: {} + # Additional labels for all host resources (metadata.labels) + labels: {} # The annotations for the host shield workloads (metadata.annotations) workload_annotations: {} # The labels for the host shield workloads (metadata.labels) @@ -557,6 +561,8 @@ cluster: host_aliases: [] # Additional annotations for all cluster resources (metadata.annotations) annotations: {} + # Additional labels for all cluster resources (metadata.labels) + labels: {} # The annotations for the cluster shield workloads (metadata.annotations) workload_annotations: {} # The labels for the cluster shield workloads (metadata.labels) From 09bc19ae91c9313b34370dfcf94e4e7c400e8c81 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Fri, 19 Jun 2026 18:00:34 +0200 Subject: [PATCH 6/8] refactor(shield): rename host.windows.annotations helper to host_windows.annotations Align the template helper name with the values key naming convention (host_windows.* instead of host.windows.*). Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- charts/shield/templates/host/_windows_annotations.tpl | 6 +++--- charts/shield/templates/host/configmap-windows.yaml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/shield/templates/host/_windows_annotations.tpl b/charts/shield/templates/host/_windows_annotations.tpl index ef4c34458..62831b918 100644 --- a/charts/shield/templates/host/_windows_annotations.tpl +++ b/charts/shield/templates/host/_windows_annotations.tpl @@ -1,4 +1,4 @@ -{{- define "host.windows.annotations" -}} +{{- define "host_windows.annotations" -}} {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host_windows.annotations -}} {{- with $annotations -}} {{- . | toYaml -}} @@ -6,13 +6,13 @@ {{- end -}} {{- define "host.windows.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "host.windows.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) (include "host_windows.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "host.windows.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} + {{- $podAnnotations := merge (dict) (include "host_windows.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} {{- $podAnnotations | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/configmap-windows.yaml b/charts/shield/templates/host/configmap-windows.yaml index 90d7260c9..e991a8ee2 100644 --- a/charts/shield/templates/host/configmap-windows.yaml +++ b/charts/shield/templates/host/configmap-windows.yaml @@ -6,7 +6,7 @@ metadata: namespace: {{ .Release.Namespace }} labels: {{- include "host.labels" . | nindent 4 }} - {{- $annotations := (include "host.windows.annotations" .) }} + {{- $annotations := (include "host_windows.annotations" .) }} {{- if $annotations }} annotations: {{- $annotations | nindent 4 }} From 809d9a120946985d79b1811effe16ca287738d65 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Sat, 20 Jun 2026 12:13:32 +0200 Subject: [PATCH 7/8] fix(shield): correct annotation merge precedence and add override tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverse the merge order in all annotation helpers so more-specific values win over less-specific ones. Previous order had global annotations winning over component annotations, and component-generic winning over workload/rbac-specific — both backwards. Correct precedence (highest → lowest): workload_annotations / pod_annotations / rbac.annotations > cluster.annotations / host.annotations / host_windows.annotations > workload_annotations (global) > annotations (global) Add override tests that set the same key at multiple levels and assert the more-specific value wins, covering cluster, host, and host_windows for workload, pod, and RBAC resources. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- .../shield/templates/cluster/_annotations.tpl | 8 +-- charts/shield/templates/host/_annotations.tpl | 8 +-- .../templates/host/_windows_annotations.tpl | 6 +- .../shield/tests/cluster/configmap_test.yaml | 12 ++++ .../shield/tests/cluster/deployment_test.yaml | 65 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 14 ++++ .../tests/cluster/serviceaccount_test.yaml | 25 +++++++ .../tests/host/daemonset-windows_test.yaml | 50 ++++++++++++++ charts/shield/tests/host/daemonset_test.yaml | 60 +++++++++++++++++ .../tests/host/serviceaccount_test.yaml | 25 +++++++ 10 files changed, 262 insertions(+), 11 deletions(-) diff --git a/charts/shield/templates/cluster/_annotations.tpl b/charts/shield/templates/cluster/_annotations.tpl index 84157db90..951724710 100644 --- a/charts/shield/templates/cluster/_annotations.tpl +++ b/charts/shield/templates/cluster/_annotations.tpl @@ -1,26 +1,26 @@ {{- define "cluster.annotations" -}} - {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.cluster.annotations -}} + {{- $annotations := merge (dict) .Values.cluster.annotations (include "shield.annotations" . | fromYaml) -}} {{- with $annotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.workload_annotations .Values.cluster.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) .Values.cluster.workload_annotations .Values.workload_annotations (include "cluster.annotations" . | fromYaml) -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.pod_annotations .Values.cluster.pod_annotations -}} + {{- $podAnnotations := merge (dict) .Values.cluster.pod_annotations .Values.pod_annotations (include "cluster.annotations" . | fromYaml) -}} {{- with $podAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.rbac_annotations" -}} - {{- $rbacAnnotations := merge (dict) (include "cluster.annotations" . | fromYaml) .Values.cluster.rbac.annotations -}} + {{- $rbacAnnotations := merge (dict) .Values.cluster.rbac.annotations (include "cluster.annotations" . | fromYaml) -}} {{- with $rbacAnnotations -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_annotations.tpl b/charts/shield/templates/host/_annotations.tpl index dab2bb565..9fd978834 100644 --- a/charts/shield/templates/host/_annotations.tpl +++ b/charts/shield/templates/host/_annotations.tpl @@ -1,19 +1,19 @@ {{- define "host.annotations" -}} - {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host.annotations -}} + {{- $annotations := merge (dict) .Values.host.annotations (include "shield.annotations" . | fromYaml) -}} {{- with $annotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.workload_annotations .Values.host.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) .Values.host.workload_annotations .Values.workload_annotations (include "host.annotations" . | fromYaml) -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.pod_annotations .Values.host.pod_annotations -}} + {{- $podAnnotations := merge (dict) .Values.host.pod_annotations .Values.pod_annotations (include "host.annotations" . | fromYaml) -}} {{- if (include "common.cluster_type.is_gke_autopilot" . ) -}} {{- $_ := set $podAnnotations "autopilot.gke.io/no-connect" "true" -}} {{- end -}} @@ -24,7 +24,7 @@ {{- end -}} {{- define "host.rbac_annotations" -}} - {{- $rbacAnnotations := merge (dict) (include "host.annotations" . | fromYaml) .Values.host.rbac.annotations -}} + {{- $rbacAnnotations := merge (dict) .Values.host.rbac.annotations (include "host.annotations" . | fromYaml) -}} {{- with $rbacAnnotations -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_windows_annotations.tpl b/charts/shield/templates/host/_windows_annotations.tpl index 62831b918..484aa4bd9 100644 --- a/charts/shield/templates/host/_windows_annotations.tpl +++ b/charts/shield/templates/host/_windows_annotations.tpl @@ -1,18 +1,18 @@ {{- define "host_windows.annotations" -}} - {{- $annotations := merge (dict) (include "shield.annotations" . | fromYaml) .Values.host_windows.annotations -}} + {{- $annotations := merge (dict) .Values.host_windows.annotations (include "shield.annotations" . | fromYaml) -}} {{- with $annotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.workload_annotations" -}} - {{- $workloadAnnotations := merge (dict) (include "host_windows.annotations" . | fromYaml) .Values.workload_annotations .Values.host_windows.workload_annotations -}} + {{- $workloadAnnotations := merge (dict) .Values.host_windows.workload_annotations .Values.workload_annotations (include "host_windows.annotations" . | fromYaml) -}} {{- with $workloadAnnotations -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.pod_annotations" -}} - {{- $podAnnotations := merge (dict) (include "host_windows.annotations" . | fromYaml) .Values.pod_annotations .Values.host_windows.pod_annotations -}} + {{- $podAnnotations := merge (dict) .Values.host_windows.pod_annotations .Values.pod_annotations (include "host_windows.annotations" . | fromYaml) -}} {{- $podAnnotations | toYaml -}} {{- end -}} diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml index fc76d88bd..e52e4fb7d 100644 --- a/charts/shield/tests/cluster/configmap_test.yaml +++ b/charts/shield/tests/cluster/configmap_test.yaml @@ -1120,3 +1120,15 @@ tests: - equal: path: metadata.labels["cluster-key"] value: cluster-value + + - it: cluster.annotations overrides global annotations on ConfigMap + set: + annotations: + env: global + cluster: + annotations: + env: cluster + asserts: + - equal: + path: metadata.annotations["env"] + value: cluster diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index c8a58072a..1a1e52e43 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1763,3 +1763,68 @@ tests: path: metadata.labels["workload-key"] value: workload-value template: templates/cluster/deployment.yaml + + - it: cluster.annotations overrides global annotations on Deployment workload + set: + annotations: + env: global + cluster: + annotations: + env: cluster + asserts: + - equal: + path: metadata.annotations["env"] + value: cluster + template: templates/cluster/deployment.yaml + + - it: cluster.annotations overrides global annotations on Deployment pod + set: + annotations: + env: global + cluster: + annotations: + env: cluster + asserts: + - equal: + path: spec.template.metadata.annotations["env"] + value: cluster + template: templates/cluster/deployment.yaml + + - it: cluster.workload_annotations overrides cluster.annotations on Deployment workload + set: + cluster: + annotations: + env: component + workload_annotations: + env: workload + asserts: + - equal: + path: metadata.annotations["env"] + value: workload + template: templates/cluster/deployment.yaml + + - it: cluster.pod_annotations overrides cluster.annotations on Deployment pod + set: + cluster: + annotations: + env: component + pod_annotations: + env: pod + asserts: + - equal: + path: spec.template.metadata.annotations["env"] + value: pod + template: templates/cluster/deployment.yaml + + - it: cluster.workload_annotations overrides global workload_annotations on Deployment + set: + workload_annotations: + env: global-workload + cluster: + workload_annotations: + env: component-workload + asserts: + - equal: + path: metadata.annotations["env"] + value: component-workload + template: templates/cluster/deployment.yaml diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index ebe085077..e80a93fea 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -395,3 +395,17 @@ tests: - equal: path: metadata.labels["cluster-key"] value: cluster-value + + - it: cluster.annotations overrides global annotations on Service + set: + annotations: + env: global + cluster: + annotations: + env: cluster + asserts: + - isKind: + of: Service + - equal: + path: metadata.annotations["env"] + value: cluster diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index ecdeea6f3..b2f43bd5f 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -186,3 +186,28 @@ tests: - equal: path: metadata.labels["cluster-key"] value: cluster-value + + - it: cluster.annotations overrides global annotations on ServiceAccount + set: + annotations: + env: global + cluster: + annotations: + env: cluster + asserts: + - equal: + path: metadata.annotations["env"] + value: cluster + + - it: cluster.rbac.annotations overrides cluster.annotations on ServiceAccount + set: + cluster: + annotations: + env: component + rbac: + annotations: + env: rbac + asserts: + - equal: + path: metadata.annotations["env"] + value: rbac diff --git a/charts/shield/tests/host/daemonset-windows_test.yaml b/charts/shield/tests/host/daemonset-windows_test.yaml index 6a5493077..db963dda1 100644 --- a/charts/shield/tests/host/daemonset-windows_test.yaml +++ b/charts/shield/tests/host/daemonset-windows_test.yaml @@ -1,6 +1,8 @@ suite: Host Windows - DaemonSet templates: - templates/host/daemonset-windows.yaml +chart: + version: 1.2.3-helmtest release: name: release-name namespace: shield-namespace @@ -517,3 +519,51 @@ tests: value: - company.public - company.internal + + - it: host_windows.annotations overrides global annotations on DaemonSet workload + set: + annotations: + env: global + host_windows: + annotations: + env: host-windows + asserts: + - equal: + path: metadata.annotations["env"] + value: host-windows + + - it: host_windows.annotations overrides global annotations on DaemonSet pod + set: + annotations: + env: global + host_windows: + annotations: + env: host-windows + asserts: + - equal: + path: spec.template.metadata.annotations["env"] + value: host-windows + + - it: host_windows.workload_annotations overrides host_windows.annotations on DaemonSet workload + set: + host_windows: + annotations: + env: component + workload_annotations: + env: workload + asserts: + - equal: + path: metadata.annotations["env"] + value: workload + + - it: host_windows.workload_annotations overrides global workload_annotations on DaemonSet + set: + workload_annotations: + env: global-workload + host_windows: + workload_annotations: + env: component-workload + asserts: + - equal: + path: metadata.annotations["env"] + value: component-workload diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 722e8d68c..5f88af6ac 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1252,3 +1252,63 @@ tests: - equal: path: metadata.labels["workload-key"] value: workload-value + + - it: host.annotations overrides global annotations on DaemonSet workload + set: + annotations: + env: global + host: + annotations: + env: host + asserts: + - equal: + path: metadata.annotations["env"] + value: host + + - it: host.annotations overrides global annotations on DaemonSet pod + set: + annotations: + env: global + host: + annotations: + env: host + asserts: + - equal: + path: spec.template.metadata.annotations["env"] + value: host + + - it: host.workload_annotations overrides host.annotations on DaemonSet workload + set: + host: + annotations: + env: component + workload_annotations: + env: workload + asserts: + - equal: + path: metadata.annotations["env"] + value: workload + + - it: host.pod_annotations overrides host.annotations on DaemonSet pod + set: + host: + annotations: + env: component + pod_annotations: + env: pod + asserts: + - equal: + path: spec.template.metadata.annotations["env"] + value: pod + + - it: host.workload_annotations overrides global workload_annotations on DaemonSet + set: + workload_annotations: + env: global-workload + host: + workload_annotations: + env: component-workload + asserts: + - equal: + path: metadata.annotations["env"] + value: component-workload diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index 3ca9e56cb..5ee41890d 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -186,3 +186,28 @@ tests: - equal: path: metadata.labels["host-key"] value: host-value + + - it: host.annotations overrides global annotations on ServiceAccount + set: + annotations: + env: global + host: + annotations: + env: host + asserts: + - equal: + path: metadata.annotations["env"] + value: host + + - it: host.rbac.annotations overrides host.annotations on ServiceAccount + set: + host: + annotations: + env: component + rbac: + annotations: + env: rbac + asserts: + - equal: + path: metadata.annotations["env"] + value: rbac From b8d2e428dac63ecaa6da225f311f7b9c1be53d95 Mon Sep 17 00:00:00 2001 From: Marco Vito Moscaritolo Date: Sat, 20 Jun 2026 12:15:33 +0200 Subject: [PATCH 8/8] fix(shield): correct label merge precedence and add override tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reverse the merge order in workload/pod label helpers so component-specific values win over global ones. Previous order had global workload_labels winning over cluster.workload_labels / host.workload_labels. Correct precedence (highest → lowest): cluster.workload_labels / cluster.pod_labels / cluster.rbac.labels > workload_labels / pod_labels (global) > cluster.labels (base, which already has cluster.labels value > shield.labels) > labels (global, inside shield.labels) rbac_labels helpers were already correct and unchanged. Add override tests that set the same key at multiple levels and assert the more-specific value wins, covering cluster, host, and host_windows for workload, pod, RBAC, service, and ConfigMap resources. Generated with support from AI Co-Authored-By: Marco Vito Moscaritolo --- charts/shield/templates/cluster/_labels.tpl | 4 +- charts/shield/templates/host/_labels.tpl | 4 +- .../shield/templates/host/_windows_labels.tpl | 4 +- .../shield/tests/cluster/configmap_test.yaml | 12 ++++ .../shield/tests/cluster/deployment_test.yaml | 65 +++++++++++++++++++ charts/shield/tests/cluster/service_test.yaml | 14 ++++ .../tests/cluster/serviceaccount_test.yaml | 25 +++++++ .../tests/host/daemonset-windows_test.yaml | 48 ++++++++++++++ charts/shield/tests/host/daemonset_test.yaml | 60 +++++++++++++++++ .../tests/host/serviceaccount_test.yaml | 25 +++++++ 10 files changed, 255 insertions(+), 6 deletions(-) diff --git a/charts/shield/templates/cluster/_labels.tpl b/charts/shield/templates/cluster/_labels.tpl index 91ba4a6fe..93bbeadc8 100644 --- a/charts/shield/templates/cluster/_labels.tpl +++ b/charts/shield/templates/cluster/_labels.tpl @@ -24,14 +24,14 @@ Selector labels {{- end }} {{- define "cluster.workload_labels" -}} - {{- $workloadLabels := merge (dict) (dict) .Values.workload_labels .Values.cluster.workload_labels (include "cluster.labels" . | fromYaml) }} + {{- $workloadLabels := merge (dict) .Values.cluster.workload_labels .Values.workload_labels (include "cluster.labels" . | fromYaml) }} {{- with $workloadLabels -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "cluster.pod_labels" -}} - {{- $podLabels := merge (dict) .Values.pod_labels .Values.cluster.pod_labels (include "cluster.labels" . | fromYaml) }} + {{- $podLabels := merge (dict) .Values.cluster.pod_labels .Values.pod_labels (include "cluster.labels" . | fromYaml) }} {{- with $podLabels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_labels.tpl b/charts/shield/templates/host/_labels.tpl index e79b21d5a..0f3e14539 100644 --- a/charts/shield/templates/host/_labels.tpl +++ b/charts/shield/templates/host/_labels.tpl @@ -35,14 +35,14 @@ Selector labels {{- end }} {{- define "host.workload_labels" -}} - {{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host.workload_labels (include "host.labels" . | fromYaml) }} + {{- $workloadLabels := merge (dict) .Values.host.workload_labels .Values.workload_labels (include "host.labels" . | fromYaml) }} {{- with $workloadLabels -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.pod_labels" -}} - {{- $podLabels := merge (dict) .Values.pod_labels .Values.host.pod_labels (include "host.labels" . | fromYaml) }} + {{- $podLabels := merge (dict) .Values.host.pod_labels .Values.pod_labels (include "host.labels" . | fromYaml) }} {{- with $podLabels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/templates/host/_windows_labels.tpl b/charts/shield/templates/host/_windows_labels.tpl index 86f2cc2d0..5a0f32ae6 100644 --- a/charts/shield/templates/host/_windows_labels.tpl +++ b/charts/shield/templates/host/_windows_labels.tpl @@ -24,14 +24,14 @@ Selector labels {{- end }} {{- define "host.windows.workload_labels" -}} - {{- $workloadLabels := merge (dict) .Values.workload_labels .Values.host_windows.workload_labels (include "host.windows.labels" . | fromYaml) }} + {{- $workloadLabels := merge (dict) .Values.host_windows.workload_labels .Values.workload_labels (include "host.windows.labels" . | fromYaml) }} {{- with $workloadLabels -}} {{- . | toYaml -}} {{- end -}} {{- end -}} {{- define "host.windows.pod_labels" -}} - {{- $podLabels := merge (dict) .Values.pod_labels .Values.host_windows.pod_labels (include "host.windows.labels" . | fromYaml) }} + {{- $podLabels := merge (dict) .Values.host_windows.pod_labels .Values.pod_labels (include "host.windows.labels" . | fromYaml) }} {{- with $podLabels -}} {{- . | toYaml -}} {{- end -}} diff --git a/charts/shield/tests/cluster/configmap_test.yaml b/charts/shield/tests/cluster/configmap_test.yaml index e52e4fb7d..c3db73a6c 100644 --- a/charts/shield/tests/cluster/configmap_test.yaml +++ b/charts/shield/tests/cluster/configmap_test.yaml @@ -1132,3 +1132,15 @@ tests: - equal: path: metadata.annotations["env"] value: cluster + + - it: cluster.labels overrides global labels on ConfigMap + set: + labels: + env: global + cluster: + labels: + env: cluster + asserts: + - equal: + path: metadata.labels["env"] + value: cluster diff --git a/charts/shield/tests/cluster/deployment_test.yaml b/charts/shield/tests/cluster/deployment_test.yaml index 1a1e52e43..5dab37f92 100644 --- a/charts/shield/tests/cluster/deployment_test.yaml +++ b/charts/shield/tests/cluster/deployment_test.yaml @@ -1828,3 +1828,68 @@ tests: path: metadata.annotations["env"] value: component-workload template: templates/cluster/deployment.yaml + + - it: cluster.labels overrides global labels on Deployment workload + set: + labels: + env: global + cluster: + labels: + env: cluster + asserts: + - equal: + path: metadata.labels["env"] + value: cluster + template: templates/cluster/deployment.yaml + + - it: cluster.labels overrides global labels on Deployment pod + set: + labels: + env: global + cluster: + labels: + env: cluster + asserts: + - equal: + path: spec.template.metadata.labels["env"] + value: cluster + template: templates/cluster/deployment.yaml + + - it: cluster.workload_labels overrides cluster.labels on Deployment workload + set: + cluster: + labels: + env: component + workload_labels: + env: workload + asserts: + - equal: + path: metadata.labels["env"] + value: workload + template: templates/cluster/deployment.yaml + + - it: cluster.pod_labels overrides cluster.labels on Deployment pod + set: + cluster: + labels: + env: component + pod_labels: + env: pod + asserts: + - equal: + path: spec.template.metadata.labels["env"] + value: pod + template: templates/cluster/deployment.yaml + + - it: cluster.workload_labels overrides global workload_labels on Deployment + set: + workload_labels: + env: global-workload + cluster: + workload_labels: + env: component-workload + asserts: + - equal: + path: metadata.labels["env"] + value: component-workload + template: templates/cluster/deployment.yaml diff --git a/charts/shield/tests/cluster/service_test.yaml b/charts/shield/tests/cluster/service_test.yaml index e80a93fea..ec7c2fb2d 100644 --- a/charts/shield/tests/cluster/service_test.yaml +++ b/charts/shield/tests/cluster/service_test.yaml @@ -409,3 +409,17 @@ tests: - equal: path: metadata.annotations["env"] value: cluster + + - it: cluster.labels overrides global labels on Service + set: + labels: + env: global + cluster: + labels: + env: cluster + asserts: + - isKind: + of: Service + - equal: + path: metadata.labels["env"] + value: cluster diff --git a/charts/shield/tests/cluster/serviceaccount_test.yaml b/charts/shield/tests/cluster/serviceaccount_test.yaml index b2f43bd5f..b09d26dea 100644 --- a/charts/shield/tests/cluster/serviceaccount_test.yaml +++ b/charts/shield/tests/cluster/serviceaccount_test.yaml @@ -211,3 +211,28 @@ tests: - equal: path: metadata.annotations["env"] value: rbac + + - it: cluster.labels overrides global labels on ServiceAccount + set: + labels: + env: global + cluster: + labels: + env: cluster + asserts: + - equal: + path: metadata.labels["env"] + value: cluster + + - it: cluster.rbac.labels overrides cluster.labels on ServiceAccount + set: + cluster: + labels: + env: component + rbac: + labels: + env: rbac + asserts: + - equal: + path: metadata.labels["env"] + value: rbac diff --git a/charts/shield/tests/host/daemonset-windows_test.yaml b/charts/shield/tests/host/daemonset-windows_test.yaml index db963dda1..ea6a8c379 100644 --- a/charts/shield/tests/host/daemonset-windows_test.yaml +++ b/charts/shield/tests/host/daemonset-windows_test.yaml @@ -567,3 +567,51 @@ tests: - equal: path: metadata.annotations["env"] value: component-workload + + - it: host_windows.labels overrides global labels on DaemonSet workload + set: + labels: + env: global + host_windows: + labels: + env: host-windows + asserts: + - equal: + path: metadata.labels["env"] + value: host-windows + + - it: host_windows.labels overrides global labels on DaemonSet pod + set: + labels: + env: global + host_windows: + labels: + env: host-windows + asserts: + - equal: + path: spec.template.metadata.labels["env"] + value: host-windows + + - it: host_windows.workload_labels overrides host_windows.labels on DaemonSet workload + set: + host_windows: + labels: + env: component + workload_labels: + env: workload + asserts: + - equal: + path: metadata.labels["env"] + value: workload + + - it: host_windows.workload_labels overrides global workload_labels on DaemonSet + set: + workload_labels: + env: global-workload + host_windows: + workload_labels: + env: component-workload + asserts: + - equal: + path: metadata.labels["env"] + value: component-workload diff --git a/charts/shield/tests/host/daemonset_test.yaml b/charts/shield/tests/host/daemonset_test.yaml index 5f88af6ac..38d2db1c1 100644 --- a/charts/shield/tests/host/daemonset_test.yaml +++ b/charts/shield/tests/host/daemonset_test.yaml @@ -1312,3 +1312,63 @@ tests: - equal: path: metadata.annotations["env"] value: component-workload + + - it: host.labels overrides global labels on DaemonSet workload + set: + labels: + env: global + host: + labels: + env: host + asserts: + - equal: + path: metadata.labels["env"] + value: host + + - it: host.labels overrides global labels on DaemonSet pod + set: + labels: + env: global + host: + labels: + env: host + asserts: + - equal: + path: spec.template.metadata.labels["env"] + value: host + + - it: host.workload_labels overrides host.labels on DaemonSet workload + set: + host: + labels: + env: component + workload_labels: + env: workload + asserts: + - equal: + path: metadata.labels["env"] + value: workload + + - it: host.pod_labels overrides host.labels on DaemonSet pod + set: + host: + labels: + env: component + pod_labels: + env: pod + asserts: + - equal: + path: spec.template.metadata.labels["env"] + value: pod + + - it: host.workload_labels overrides global workload_labels on DaemonSet + set: + workload_labels: + env: global-workload + host: + workload_labels: + env: component-workload + asserts: + - equal: + path: metadata.labels["env"] + value: component-workload diff --git a/charts/shield/tests/host/serviceaccount_test.yaml b/charts/shield/tests/host/serviceaccount_test.yaml index 5ee41890d..b2a026ffd 100644 --- a/charts/shield/tests/host/serviceaccount_test.yaml +++ b/charts/shield/tests/host/serviceaccount_test.yaml @@ -211,3 +211,28 @@ tests: - equal: path: metadata.annotations["env"] value: rbac + + - it: host.labels overrides global labels on ServiceAccount + set: + labels: + env: global + host: + labels: + env: host + asserts: + - equal: + path: metadata.labels["env"] + value: host + + - it: host.rbac.labels overrides host.labels on ServiceAccount + set: + host: + labels: + env: component + rbac: + labels: + env: rbac + asserts: + - equal: + path: metadata.labels["env"] + value: rbac