Refactoring Kubernetes recommanded labels for Falco Sidekick

charts/falcosidekick/templates/_helpers.tpl

@@ -44,6 +44,27 @@ Return the appropriate apiVersion for ingress.
   {{- end -}}
 {{- end -}}
 
+{{/*
+Common labels
+*/}}
+{{- define "falcosidekick.labels" -}}
+helm.sh/chart: {{ include "falcosidekick.chart" . }}
+{{ include "falcosidekick.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/part-of: {{ include "falcosidekick.name" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "falcosidekick.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
 {{/*
 Return if ingress is stable.
 */}}

charts/falcosidekick/templates/aadpodidentity.yaml

@@ -3,6 +3,9 @@
 apiVersion: "aadpodidentity.k8s.io/v1"
 kind: AzureIdentity
 metadata:
+  labels:
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
 spec:
@@ -13,6 +16,8 @@ spec:
 apiVersion: "aadpodidentity.k8s.io/v1"
 kind: AzureIdentityBinding
 metadata:
+  labels:
+    {{- include "falcosidekick.labels" . | nindent 4 }}
   name: {{ include "falcosidekick.fullname" . }}
 spec:
   azureIdentity: {{ include "falcosidekick.fullname" . }}

charts/falcosidekick/templates/certs-secret.yaml

@@ -5,10 +5,8 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-certs
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 type: Opaque
 data:
   {{ $key := .Values.config.tlsserver.serverkey }}

charts/falcosidekick/templates/clusterrole.yaml

@@ -5,10 +5,8 @@ apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ template "falcosidekick.fullname" .}}
   labels:
-    app: {{ template "falcosidekick.fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 rules:
   - apiGroups:
       - policy

charts/falcosidekick/templates/deployment-ui.yaml

@@ -11,24 +11,22 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}-ui
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 spec:
   replicas: {{ .Values.webui.replicaCount }}
   {{- if .Values.webui.revisionHistoryLimit }}
   revisionHistoryLimit: {{ .Values.webui.revisionHistoryLimit }}
   {{- end }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-      app.kubernetes.io/instance: {{ .Release.Name }}-ui
+      {{- include "falcosidekick.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: ui
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-        app.kubernetes.io/instance: {{ .Release.Name }}-ui
+        {{- include "falcosidekick.labels" . | nindent 8 }}
+        app.kubernetes.io/component: ui
       {{- if .Values.webui.podLabels }}
 {{ toYaml .Values.webui.podLabels | indent 8 }}
       {{- end }}
@@ -125,22 +123,20 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui-redis
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui-redis
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}-ui
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui-redis
 spec:
   replicas: 1
   serviceName: {{ include "falcosidekick.fullname" . }}-ui-redis
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui-redis
-      app.kubernetes.io/instance: {{ .Release.Name }}-ui-redis
+      {{- include "falcosidekick.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: ui-redis
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui-redis
-        app.kubernetes.io/instance: {{ .Release.Name }}-ui-redis
+        {{- include "falcosidekick.labels" . | nindent 8 }}
+        app.kubernetes.io/component: ui-redis
       {{- if .Values.webui.redis.podLabels }}
 {{ toYaml .Values.webui.redis.podLabels | indent 8 }}
       {{- end }}

charts/falcosidekick/templates/deployment.yaml

@@ -5,24 +5,22 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 spec:
   replicas: {{ .Values.replicaCount }}
   {{- if .Values.revisionHistoryLimit }}
   revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
   {{- end }}
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-      app.kubernetes.io/instance: {{ .Release.Name }}
+      {{- include "falcosidekick.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: core
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-        app.kubernetes.io/instance: {{ .Release.Name }}
+        {{- include "falcosidekick.labels" . | nindent 8 }}
+        app.kubernetes.io/component: core
         {{- if and .Values.config.azure.podIdentityClientID .Values.config.azure.podIdentityName }}
         aadpodidbinding: {{ include "falcosidekick.fullname" . }}
         {{- end }}

charts/falcosidekick/templates/ingress-ui.yaml

@@ -9,10 +9,8 @@ metadata:
   name: {{ $fullName }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}-ui
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
   {{- with .Values.webui.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/falcosidekick/templates/ingress.yaml

@@ -9,10 +9,8 @@ metadata:
   name: {{ $fullName }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/falcosidekick/templates/podsecuritypolicy.yaml

@@ -4,10 +4,8 @@ kind: PodSecurityPolicy
 metadata:
   name: {{ template "falcosidekick.fullname" . }}
   labels:
-    app: {{ template "falcosidekick.fullname" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    release: "{{ .Release.Name }}"
-    heritage: "{{ .Release.Service }}"
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 spec:
   privileged: false
   allowPrivilegeEscalation: false

charts/falcosidekick/templates/prometheusrule.yaml

@@ -8,6 +8,7 @@ metadata:
   {{- end }}
   labels:
     {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
     {{- if .Values.prometheusRules.additionalLabels }}
     {{- toYaml .Values.prometheusRules.additionalLabels | nindent 4 }}
     {{- end }}

charts/falcosidekick/templates/rbac-ui.yaml

@@ -1,25 +1,22 @@
+{{- if .Values.webui.enabled -}}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 rules: []
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -28,14 +25,13 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: {{ include "falcosidekick.fullname" . }}-ui
 subjects:
 - kind: ServiceAccount
   name: {{ include "falcosidekick.fullname" . }}-ui
+{{- end }}

charts/falcosidekick/templates/rbac.yaml

@@ -9,21 +9,17 @@ metadata:
     eks.amazonaws.com/role-arn: {{ .Values.config.aws.rolearn }}
   {{- end }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 rules:
 - apiGroups:
     - ""
@@ -48,10 +44,8 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -66,10 +60,8 @@ kind: ClusterRole
 metadata:
   name: {{ include "falcosidekick.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 rules:
 - apiGroups:
     - "wgpolicyk8s.io"
@@ -87,10 +79,8 @@ kind: ClusterRoleBinding
 metadata:
   name: {{ include "falcosidekick.fullname" . }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

charts/falcosidekick/templates/secrets-ui.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.webui.enabled -}}
 {{- if eq .Values.webui.existingSecret "" }}
 ---
 apiVersion: v1
@@ -6,10 +7,8 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 type: Opaque
 data:
   {{- if .Values.webui.user }}
@@ -27,13 +26,12 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}-ui-redis
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}-ui
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: ui
 type: Opaque
 data:
   {{- if .Values.webui.redis.password }}
   REDIS_ARGS: "{{ printf "--requirepass %s" .Values.webui.redis.password | b64enc}}"
   {{-  end }}
+{{- end }}
 {{- end }}

charts/falcosidekick/templates/secrets.yaml

@@ -7,10 +7,8 @@ metadata:
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "falcosidekick.name" . }}
-    helm.sh/chart: {{ include "falcosidekick.chart" . }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    {{- include "falcosidekick.labels" . | nindent 4 }}
+    app.kubernetes.io/component: core
 type: Opaque
 data:
   # Slack Output