Skip to content

Add CredentialIssuer service labels to impersonator Services - #3235

Open
0hlov3 wants to merge 2 commits into
vmware:mainfrom
0hlov3:credentialissuer-service-labels
Open

Add CredentialIssuer service labels to impersonator Services#3235
0hlov3 wants to merge 2 commits into
vmware:mainfrom
0hlov3:credentialissuer-service-labels

Conversation

@0hlov3

@0hlov3 0hlov3 commented Aug 11, 2026

Copy link
Copy Markdown

Add support for configuring custom labels on Concierge impersonation proxy Services through CredentialIssuer.spec.impersonationProxy.service.labels.

The configured labels are merged with Pinniped's existing controller-managed labels and applied to both generated Service types:

  • LoadBalancer
  • ClusterIP

The existing Service reconciliation logic tracks the configured labels as managed labels. This allows CredentialIssuer-provided values to take precedence for managed keys while preserving unrelated labels added by other controllers or users.

This change also:

  • adds validation for Service label keys and values using Kubernetes label validation
  • updates the CredentialIssuer API, CRDs, generated API documentation, and generated deepcopy code
  • extends controller tests to cover custom labels on both LoadBalancer and ClusterIP Services
  • verifies that configured labels participate in the existing Service metadata reconciliation behavior

Fixes #3233

Release note:

The Concierge CredentialIssuer API now supports configuring custom labels on managed impersonation proxy Services using `spec.impersonationProxy.service.labels`.

@0hlov3
Add CredentialIssuer service labels to impersonator Services
10a19f9 
Wire spec.impersonationProxy.service.labels into generated
LoadBalancer and ClusterIP Service metadata, update generated API
artifacts, and cover label reconciliation in controller tests.

Signed-off-by: 0hlov3 <dev@schoenwald.aero>
@netlify

netlify Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for pinniped-dev canceled.

Name Link
🔨 Latest commit 359ff05
🔍 Latest deploy log https://app.netlify.com/projects/pinniped-dev/deploys/6aa44f96ff6f6f00083fda61

@legal-compliance-bot

legal-compliance-bot Bot commented Sep 11, 2026

Copy link
Copy Markdown

🛑 Legal Compliance Check Failed

Hi @0hlov3, thank you for your contribution!

To merge this Pull Request, you must sign our DCO.

Note: Even if you signed off your commits locally (using git commit -s), you must post the comment below to register your signature with our automated system.
Note: This is a one-time process. Once signed, future contributions to this repository will be verified automatically.

1. Read the Document: Click here to read the DCO
2. Sign via Comment: Copy and paste the exact line below into a new comment on this Pull Request:

I have read the DCO Document and I hereby sign the DCO for this and all future contributions.

⏳ Processing Schedule:
Our 'Compliance Sweeper' runs automatically approximately every 15-20 minutes.
After you post the comment, your status will update automatically during the next scheduled run.
You do not need to take any further action.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add support for setting custom labels on Concierge impersonation proxy Services through the CredentialIssuer API.

1 participant

@0hlov3