maxsmythe
commented
2 years ago The main issue with trying to implement annotation selectors is how to write annotation selectors. I think I wrote about this a while back, but I can't find it.
The thing is that annotations are structured whereas labels must have simple string values. E.g. if I have the annotation:
{"one": "a", "two": "b"}
and there is a selector that is expecting:
{"two": "b", "one": "a" }
should the annotation match? What about matching against a superset of an annotation? Formats that are not JSON?
K8s also mentions that annotations aren't/shouldn't be used as identifying metadata:
Really though the main thing is the arbitrary structure of the value, which means it may not be possible to write a one-size-fits-all selection criteria like label selectors are.
seh
stale[bot]
ritazh
thelabdude
Desire
Per discussion that I started in the "opa-gatekeeper" channel of the "Open Policy Agent" Slack workspace, I would like to be able to select target objects for the AssginMetadata mutator by way of their annotations, and not just their labels.
Repeating what I wrote earlier, I noticed that the AssignMetadata mutator allows one to select target objects by label and set an annotation, but I can’t select target objects by annotation. Is that an efficiency concession, since the Kubernetes API allows filtering admission requests by label, or is it a safety concession to prevent oscillation? The latter doesn’t seem likely, as the criteria and the mutations would be equivalent, just targeting the “metadata.annotations” field rather than the “metadata.labels” field.
We have a situation where we’d like to add an annotation with a fixed value to objects that also bear a related annotation, but in the current system we can’t target objects by whether they have an annotation with a particular value.
We're not allowed to use path tests with AssignMetadata; its implementation synthesizes a single path test that asserts that the target field for the assignment does not exist. If we could use path tests, I could attempt to select the triggering annotation, or reject target objects that lack the intended matching annotation.
Motivation
Our motivating scenario involves automating a gradual transition from annotating objects with one longstanding annotation to a newer replacement. Essentially, we'd like to say, "For all objects annotated with 'original' and a value of 'true,' add a 'newer' annotation with a value of 'yes.'" Of course the names and values are notional, but I hope that shows that we couldn't induce oscillation this way—or at least I haven't been able to concoct a scenario that runs afoul of that threat.
Environment