open-policy-agent / gatekeeper

🐊 Gatekeeper - Policy Controller for Kubernetes
https://open-policy-agent.github.io/gatekeeper/
Apache License 2.0
3.62k stars 742 forks source link

AssignMetadata for multiple labels #1635

Open jwineinger opened 2 years ago

jwineinger commented 2 years ago

We have a use case where pods are created with a single label that is a reference to an ID in another system. We want to take data from that system (based on that ID) and add several (1-20 labels) to the pods. Currently, it seems that the AssignMetadata mutating CRD allows only a single label to be set at a time. It seems suboptimal to manage that many resources for a single pod/deployment. We'd like to describe a set of labels in a single resource.

Currently the AssignMetadata mutation ignores labels that already exist on the pod. One options might be allowing location: metadata.labels, and setting properties.assign.value to a mapping of label: value pairs (similar to the last example in the mutation docs, for Assign). The controller could still silently ignore changes to existing labels as it currently does for single changes.

maxsmythe commented 2 years ago

Thanks for the use case!

This sounds a bit to me like it could be addressed by the features mentioned in #1348 though an interesting feature of this request is that it also seeks to avoid boilerplate.

if multi-mutators and stamped mutators went together such that you could essentially write a base mutator and then add customizations (the below just describes the logic flow, not what the actual resource would look like):

This should be a similar level of boilerplate, but has the advantage of not needing to hardcode in special logic for merging labels, which may make it more flexible in terms of handling other, similar use-cases (like containers + initContainers) and accommodating as K8s adds more features in the future.

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

maxsmythe commented 2 years ago

still salient

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.