Admission controller reject "app.kubernetes.io/managed-by" labels on Provisioner

[loganmzz]

Description

Observed Behavior:

When wanting to add "standard" labels app.kubernetes.io/* resource creation is rejected by adminission controller

Expected Behavior:

Being able to use any app.kubernetes.io/* labels.

Reproduction Steps (Please include YAML):

apiVersion: karpenter.sh/v1alpha5
kind: Provisioner
metadata:
  name: demo
  labels:
    "app.kubernetes.io/name": "demo" # OK
    "app.kubernetes.io/managed-from": "Git" # OK
    "app.kubernetes.io/managed-by: "Self" # FAILED

Versions:

• Chart Version: 0.31.5
• Kubernetes Version (kubectl version):

Client Version: v1.28.6
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.9-eks-036c24b

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[jonathan-innis]

resource creation is rejected by adminission controller

Which admission controller is rejecting this? Is this the Kubernetes admission controller or the Karpenter one?