Configurable label propagation for EventListener Pods

[muxmuse]

Feature request

EventListeners propagate their labels to Deployments and additionally to the (Pod) Template of the Deployment. This should be configurable, e.g. with the PodTemplate field of the EventListener. It should be possible to provide an empty value for a label such that a specific label is not propagated.

Use case

Label based garbage collection in a git-ops setup.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[muxmuse]

/remove-lifecycle stale

[savitaashture]

Hi @muxmuse

I have spent sometime to understand the feature request and based on my understanding tried below steps to see the current behavior

Steps:

1. Below is the sample EL yaml by providing some labels at el metadata

added
hello: hi

---
apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-listener
  labels:
    "hello": "hi"
spec:
  triggers:
    - name: github-listener
      interceptors:
        - ref:
            name: "github"
          params:
            - name: "secretRef"
              value:
                secretName: github-secret
                secretKey: secretToken
            - name: "eventTypes"
              value: ["pull_request"]
        - name: "only when PRs are opened"
          ref:
            name: "cel"
          params:
            - name: "filter"
              value: "body.action in ['opened', 'synchronize', 'reopened']"
      bindings:
        - ref: github-pr-binding
      template:
        ref: github-template
  resources:
    kubernetesResource:
      spec:
        template:
          spec:
            serviceAccountName: tekton-triggers-example-sa
            ...

The created pod looks like below

pod metadata contains label
"hello": "hi"

kubectl get pod el-github-listener-74f457bcd-57kpb -o yaml
apiVersion: v1
kind: Pod
metadata:
   generateName: el-github-listener-74f457bcd-
  labels:
    app.kubernetes.io/managed-by: EventListener
    app.kubernetes.io/part-of: Triggers
    eventlistener: github-listener
    hello: hi
    pod-template-hash: 74f457bcd
  name: el-github-listener-74f457bcd-57kpb
  namespace: default

3. Below is the sample yaml by providing empty values to label using PodTemplate field of the EventListener

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-listener
  labels:
    "hello": "hi"
spec:
  triggers:
    - name: github-listener
      interceptors:
        - ref:
            name: "github"
          params:
            - name: "secretRef"
              value:
                secretName: github-secret
                secretKey: secretToken
            - name: "eventTypes"
              value: ["pull_request"]
        - name: "only when PRs are opened"
          ref:
            name: "cel"
          params:
            - name: "filter"
              value: "body.action in ['opened', 'synchronize', 'reopened']"
      bindings:
        - ref: github-pr-binding
      template:
        ref: github-template
  resources:
    kubernetesResource:
      spec:
        template:
          metadata:
            labels:
              "hello": ""
          spec:
              ....

The created pod looks like below

kubectl get pod el-github-listener-74f457bcd-57kpb -o yaml
apiVersion: v1
kind: Pod
metadata:
   generateName: el-github-listener-74f457bcd-
  labels:
    app.kubernetes.io/managed-by: EventListener
    app.kubernetes.io/part-of: Triggers
    eventlistener: github-listener
    hello: ""
    pod-template-hash: 74f457bcd
  name: el-github-listener-74f457bcd-57kpb
  namespace: default

[savitaashture]

So basically what i want to say is that is that something you are looking

If not

Could you specify the UX of the expectation

[muxmuse]

Thank you very much for taking the time. The described approach changes the contents of the pod's label as I need it, but the deployment's label remains unchanged.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: el-github-eventlistener
  labels:
    app.kubernetes.io/managed-by: EventListener
    app.kubernetes.io/part-of: Triggers
    eventlistener: github-eventlistener
    hello: hi

Based on the current design of the resources field, the expected UX behavior would be that the deployment's labels are configurable, too. Based on the current design, I am not sure where I would expect it, as kubernetesResource.spec is reserved for the pod template.

apiVersion: triggers.tekton.dev/v1beta1
kind: EventListener
metadata:
  name: github-eventlistener
  labels:
    hello: hi
spec:
  ...
  resources:
    kubernetesResource:
      deploymentSpec: // ? doesn't seem right here
         metadata:
           labels: 
             hello: ""

Not taking the current design into account, I would expect that labels are only propagated if specified explicitly, i.e. without a resources field, there are no labels propagated at all.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[muxmuse]

/remove-lifecycle stale

[savitaashture]

Hi @muxmuse

I rechecked
and yes right now whatever we change at el.metadata.labels will be added to deployment.labels
But if we add labels at el.spec.resources.kubernetesResource are directly added to pods but not deployment

So your request is even if there is a update to labels for el.spec.resources.kubernetesResource it should reflect in Deployment metadata labels ?

Let me know on this

[dibyom]

So your request is even if there is a update to labels for el.spec.resources.kubernetesResource it should reflect in Deployment metadata labels ?

This sounds reasonable to me. Updating just the pod's labels and not the deployment feels a bit weird?

[muxmuse]

So your request is even if there is a update to labels for el.spec.resources.kubernetesResource it should reflect in Deployment metadata labels ?

I'd like to avoid propagation of certain labels of the EventListener to its Deployment and Pods.

In my use case, all resources in a subset of my cluster configuration are labelled with the same label. On each deployment, the cluster is searched for resources with matching labels and they are deleted if they exist on the cluster but not in the applied configuration. The EventListener occurs in my configuration, while its Deployment and Pods are defined implicitly by the EventListener. Currently, Deployment and Pods inherit all labels of the EventListener and would be deleted every time the config is applied.