feat: Add additionalMetadataList Support for Conditional Metadata Assignment #1339

Deofex · 2025-01-31T08:24:51Z

Summary
This PR introduces support for additionalMetadataList, allowing cluster admins to define conditional labels and annotations for namespaces within a tenant. This enhancement builds upon the existing additionalMetadata functionality, providing more granular control through namespaceSelector expressions.

Changes Introduced

Added support for additionalMetadataList in namespaceOptions, enabling selective metadata assignment based on namespace labels.
Maintains existing additionalMetadata behavior, ensuring all namespaces receive global metadata if specified.
Introduced namespaceSelector-based rules, allowing metadata to be applied only to namespaces that match specific conditions.
Updated documentation to clarify the new functionality
If multiple additionalMetadataList entries match a namespace, all applicable labels and annotations are assigned.

Example Configuration
Defining both global and conditional metadata in a tenant:

apiVersion: capsule.clastix.io/v1beta2
kind: Tenant
metadata:
  name: oil
spec:
  owners:
    - name: alice
       kind: User
  namespaceOptions:
    additionalMetadata:
      labels:
        capsule.clastix.io/still-working: "true"
    additionalMetadataList:
      - labels:
          capsule.clastix.io/backup: "true"
      - namespaceSelector:
          matchExpressions:
            - key: capsule.clastix.io/low_security_profile
              operator: NotIn
              values: ["true"]
         labels:
           pod-security.kubernetes.io/enforce: baseline
      - namespaceSelector:
          matchExpressions:
            - key: capsule.clastix.io/low_security_profile
              operator: In
              values: ["true"]
         labels:
           pod-security.kubernetes.io/enforce: privileged

Impact & Compatibility
Fully backward compatible: Existing additionalMetadata configurations will continue to work as before.
New functionality is opt-in, meaning it does not affect existing tenants unless additionalMetadataList is explicitly configured.

netlify · 2025-01-31T08:25:20Z

✅ Deploy Preview for capsule-documentation canceled.

Name	Link
🔨 Latest commit	`e5de5b8`
🔍 Latest deploy log	https://app.netlify.com/sites/capsule-documentation/deploys/679c8ba21f12d500082f7a87

oliverbaehler · 2025-01-31T09:10:49Z

We'll have to do some discussions around this. I am currently refactoring to a generic CEL based approach which would also solve this case. But thanks for the commit for now, I will get back to it

peterbosalliandercom · 2025-02-04T15:06:09Z

@oliverbaehler Any news on the discussion? Our usecase for this is that we want to implement pod security baseline and restricted policies on specific namespaces (https://kubernetes.io/docs/concepts/security/pod-security-standards/). Is there any way we can speedup this feature request?

oliverbaehler · 2025-02-05T01:33:45Z

@peterbosalliandercom yes i get your use-case and it does make sense. However we want to move away from such specific implementations and refactor into more generic solutions, since they are technical dept. Such that we could eg. deprecated the additionalMetadata for pod, services etc. as well. A generic approach to having patches for any kind of manifests on tenant basis with given selector options. That's what i would aim for.

I will have to create a poc on the weekend and see how difficult that is to implement. Based on these findings we will either merge this as is and keep the prospect, that it will be deprecated in the v1 api bump or i will port the same functionality to that generic feature.

Make sense?

prometherion · 2025-02-12T20:58:40Z

Is there any way we can speedup this feature request?

Generally speaking, we're always happy to receive newer contributions: we have limited resources to allocate to the project, especially considering the efforts in reviewing code from non-maintainers.

Remember that Capsule is backed by two vendors (CLASTIX and PeakScale) which offer features prioritisations as well as other professional services, and addons.

I am currently refactoring to a generic CEL based approach which would also solve this case.

We should go toward CEL and drop support of custom handlers where it is possible: @maxgio92 started a PoC with VAP/CEL while working at CLASTIX.

oliverbaehler · 2025-04-02T16:35:36Z

Sorry i haven't had time yet. I am happy to accept this change in the current spec. @Deofex could you merge and resolve the conflicts on the crd?

oliverbaehler · 2025-05-06T09:26:26Z

controllers/tenant/namespaces.go

+
+					for k, v := range additionalMetadata.Labels {
+						labels[k] = v
+					}


Add annotations as well

Suggested change

}

for k, v := range additionalMetadata.Annotations{

annotations[k] = v

}

}

controllers/tenant/namespaces.go

oliverbaehler · 2025-05-06T09:35:22Z

charts/capsule/crds/capsule.clastix.io_globaltenantresources.yaml

this should not be touched with your change

Not sure what happened here, but the changes in this file are removed

oliverbaehler · 2025-05-06T09:40:09Z

pkg/api/additional_metadata.go

+	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
+	Labels            map[string]string     `json:"labels,omitempty"`
+	Annotations       map[string]string     `json:"annotations,omitempty"`
 }


Create a new spec for this, otherwise the other apis also have a nemspaceSelector field out of context.

Suggested change

NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

Labels map[string]string `json:"labels,omitempty"`

Annotations map[string]string `json:"annotations,omitempty"`

}

Labels map[string]string `json:"labels,omitempty"`

Annotations map[string]string `json:"annotations,omitempty"`

}

type AdditionalMetadataSelectorSpec struct

NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

Labels map[string]string `json:"labels,omitempty"`

Annotations map[string]string `json:"annotations,omitempty"`

}

Added the spec

oliverbaehler · 2025-05-06T09:40:40Z

api/v1beta2/namespace_options.go

@@ -13,6 +13,8 @@ type NamespaceOptions struct {
 	Quota *int32 `json:"quota,omitempty"`
 	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.
 	AdditionalMetadata *api.AdditionalMetadataSpec `json:"additionalMetadata,omitempty"`
+	// Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional.
+	AdditionalMetadataList []api.AdditionalMetadataSpec `json:"additionalMetadataList,omitempty"`


Suggested change

AdditionalMetadataList []api.AdditionalMetadataSpec `json:"additionalMetadataList,omitempty"`

AdditionalMetadataList []api.AdditionalMetadataSelectorSpec `json:"additionalMetadataList,omitempty"`

Deofex · 2025-05-06T13:25:29Z

Sorry i haven't had time yet. I am happy to accept this change in the current spec. @Deofex could you merge and resolve the conflicts on the crd?

Sorry for the delayed reply — GitHub has been flooding me with notifications but somehow skipping the important ones. I definitely need to look into that. As you already noticed (and reviewed), the conflicts are resolved.

Svarrogh1337 · 2025-05-06T13:35:52Z

@Deofex workflows approved. Lets see a green e2e :)

Deofex · 2025-05-06T14:13:12Z

There's quite a bit of red there, unfortunately.

Classic “it works on my machine” 🙃:

Ran 115 of 129 Specs in 644.815 seconds  
SUCCESS! -- 115 Passed | 0 Failed | 0 Pending | 14 Skipped

I'll take a look, but if anyone has an idea of what’s causing the failures, I’d appreciate the input — I’m not seeing anything in my code that would explain them.

I also noticed the linter is failing on a Cyclomatic Complexity check. I’ll see if I can split up the syncNamespaceMetadata method.

Is the check commit a required check? If so, I’ll need to adjust my commit messages accordingly.

Deofex · 2025-05-07T07:12:09Z

I refactored the syncNamespaceMetadata method.
I adjusted my commit messages.
The e2e test succeeds multiple times on my laptop. I can't find the cause why it failed in the pipeline.

Can someone review the refactored method and try the 2e2 test again in the pipeline?

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

Signed-off-by: Deofex 28751252+Deofex@users.noreply.github.com

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

oliverbaehler

Thank you very much, i'm going to extend the docs later

Deofex force-pushed the additional_metadata_list_support branch from 821eb00 to a9a7b02 Compare January 31, 2025 08:25

Deofex changed the title ~~Add additionalMetadataList Support for Conditional Metadata Assignment~~ feat: Add additionalMetadataList Support for Conditional Metadata Assignment Jan 31, 2025

Deofex force-pushed the additional_metadata_list_support branch from a9a7b02 to e0d1bae Compare January 31, 2025 08:31

Deofex changed the title ~~feat: Add additionalMetadataList Support for Conditional Metadata Assignment~~ feat: Add additionalMetadataList Support for Conditional Metadata Assignment Jan 31, 2025

oliverbaehler self-requested a review January 31, 2025 09:09

Deofex force-pushed the additional_metadata_list_support branch 2 times, most recently from f988c2d to c80a0d0 Compare May 6, 2025 09:05

oliverbaehler requested changes May 6, 2025

View reviewed changes

Deofex force-pushed the additional_metadata_list_support branch from 7a5484f to ec302db Compare May 7, 2025 07:03

Deofex added 6 commits May 7, 2025 09:17

feat: Add support for additionalMetadataList

8a3b773

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

docs: change description

5bbd865

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

chore: Merge branch 'main' into additional_metadata_list_support

91d76fe

Signed-off-by: Deofex 28751252+Deofex@users.noreply.github.com

fix: missing bracket

34681dd

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

fix: removed duplicated if statement

a4abde0

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

chore: adjustments after review

cfc1158

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

Deofex force-pushed the additional_metadata_list_support branch from ec302db to 16ba9eb Compare May 7, 2025 07:19

chore: Sync syncNamespaceMetadata method

4d5a3bb

Signed-off-by: Deofex <28751252+Deofex@users.noreply.github.com>

Deofex force-pushed the additional_metadata_list_support branch from 16ba9eb to 4d5a3bb Compare May 7, 2025 07:22

Deofex requested a review from oliverbaehler May 7, 2025 08:37

oliverbaehler approved these changes May 8, 2025

View reviewed changes

oliverbaehler merged commit 8e9b8ad into projectcapsule:main May 8, 2025
16 checks passed

oliverbaehler mentioned this pull request May 8, 2025

deprecate additionalMetadata #1445

Closed

-					}
+					for k, v := range additionalMetadata.Annotations{
+						annotations[k] = v
+					}
+			}

	AdditionalMetadataList []api.AdditionalMetadataSpec `json:"additionalMetadataList,omitempty"`
	AdditionalMetadataList []api.AdditionalMetadataSelectorSpec `json:"additionalMetadataList,omitempty"`

feat: Add additionalMetadataList Support for Conditional Metadata Assignment #1339

feat: Add additionalMetadataList Support for Conditional Metadata Assignment #1339

Uh oh!

Conversation

Deofex commented Jan 31, 2025

Uh oh!

netlify bot commented Jan 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for capsule-documentation canceled.

Uh oh!

oliverbaehler commented Jan 31, 2025

Uh oh!

peterbosalliandercom commented Feb 4, 2025

Uh oh!

oliverbaehler commented Feb 5, 2025

Uh oh!

prometherion commented Feb 12, 2025

Uh oh!

oliverbaehler commented Apr 2, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Deofex commented May 6, 2025

Uh oh!

Svarrogh1337 commented May 6, 2025

Uh oh!

Deofex commented May 6, 2025

Uh oh!

Deofex commented May 7, 2025

Uh oh!

oliverbaehler left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

netlify bot commented Jan 31, 2025 •

edited

Loading