Control propagation of labels and annotations from SubnamespaceAnchor to Namespace

[adamjohnson01]

We have a use case where we would like to add labels and annotations to namespaces but do not want them propagated down the tree. This is useful for Namespace overrides for specific values that are used by our policy engine.

We configure --managed-namespace-annotation=tenant.config/.* and want all of these to be propagated but we also have namespace.config/* annotations that we would like to be able to set on each Namespace. Ideally something like the following.

apiVersion: hnc.x-k8s.io/v1alpha2
kind: SubnamespaceAnchor
metadata:
  namespace: parent-namespace
  name: child-namespace
spec:
  annotations:
  # This will be propagated
  - key: tenant.config/env
    value: prd
  # This will be applied to the Namespace but not propagated down the tree
  - key: namespace.config/default-instance-size
    value: large

Currently if I try to do this I get the following error

The SubnamespaceAnchor "child-namespace" is invalid: spec.annotations: Invalid value: "namespace.config/default-instance-size": not a managed annotation and cannot be configured

I think that this could potentially be implemented with a flag to allow non-managed annotations and or labels in the annotation validation function and the label validation function. I am happy to implement this if it is approved.

[adrianludwin]

Hi, sorry for the delay in getting back to you.

The way we currently limit propagation from parents to children is Exceptions. Currently, these only apply to objects, but there's a proposal to add the same feature to HRQs. I believe we should use the same mechanism to limit the propagation of labels and annotations.

As a technical note, "non-managed" labels and annotations are exactly that - they are not managed or enforced by HNC, so asking HNC to manage them wouldn't really make sense. But adding a propagate field to the managed labels/annotations would be relatively straightforward:

apiVersion: hnc.x-k8s.io/v1alpha2
kind: SubnamespaceAnchor
metadata:
  namespace: parent-namespace
  name: child-namespace
spec:
  annotations:
  # This will be propagated
  - key: tenant.config/env
    value: prd
  # This will apply to the subnamespace but no others:
  - key: namespace.config/default-instance-size
    value: large
    propagate: none # like propagate.hnc.x-k8s.io/none

It's important to make propagate a string field, since we might one day want to allow arbitrary selectors, as we do with objects. But we don't need to do that today, and it's fine to say that the only allowed values for propagate are "none" and "all".

wdty?

[adamjohnson01]

@adrianludwin thanks for getting back to me!

That makes sense, I will have a look at adding the propagate field for labels and annotations.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.