feat: add podLabels to the hook jobs pod template (#9391)

Signed-off-by: Mariam Fahmy <mariam.fahmy@nirmata.com>

charts/kyverno/Chart.yaml

@@ -35,6 +35,10 @@ annotations:
   artifacthub.io/changes: |
     - kind: added
       description: Add global nodeSelector
+    - kind: added
+      description: Add podLabels to the post-upgrade hook
+    - kind: added
+      description: Add podLabels to the pre-delete hook
 dependencies:
   - name: grafana
     version: "0.0.0"

charts/kyverno/README.md

@@ -654,6 +654,7 @@ The chart values are organised per component.
 | webhooksCleanup.tolerations | list | `[]` | List of node taints to tolerate |
 | webhooksCleanup.podAntiAffinity | object | `{}` | Pod anti affinity constraints. |
 | webhooksCleanup.podAffinity | object | `{}` | Pod affinity constraints. |
+| webhooksCleanup.podLabels | object | `{}` | Pod labels. |
 | webhooksCleanup.nodeAffinity | object | `{}` | Node affinity constraints. |
 | webhooksCleanup.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers |
 
@@ -747,6 +748,7 @@ The chart values are organised per component.
 | policyReportsCleanup.tolerations | list | `[]` | List of node taints to tolerate |
 | policyReportsCleanup.podAntiAffinity | object | `{}` | Pod anti affinity constraints. |
 | policyReportsCleanup.podAffinity | object | `{}` | Pod affinity constraints. |
+| policyReportsCleanup.podLabels | object | `{}` | Pod labels. |
 | policyReportsCleanup.nodeAffinity | object | `{}` | Node affinity constraints. |
 | policyReportsCleanup.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the hook containers |
 

charts/kyverno/templates/hooks/post-upgrade.yaml

@@ -13,6 +13,11 @@ metadata:
 spec:
   backoffLimit: 2
   template:
+    metadata:
+      {{- with .Values.policyReportsCleanup.podLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccount: {{ template "kyverno.admission-controller.serviceAccountName" . }}
       {{- with .Values.policyReportsCleanup.podSecurityContext }}

charts/kyverno/templates/hooks/pre-delete.yaml

@@ -13,6 +13,11 @@ metadata:
 spec:
   backoffLimit: 2
   template:
+    metadata:
+      {{- with .Values.webhooksCleanup.podLabels }}
+      labels:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
     spec:
       serviceAccount: {{ template "kyverno.admission-controller.serviceAccountName" . }}
       {{- with .Values.webhooksCleanup.podSecurityContext }}

charts/kyverno/values.yaml

@@ -388,6 +388,9 @@ webhooksCleanup:
   # -- Pod affinity constraints.
   podAffinity: {}
 
+  # -- Pod labels.
+  podLabels: {}
+
   # -- Node affinity constraints.
   nodeAffinity: {}
 
@@ -440,6 +443,9 @@ policyReportsCleanup:
   # -- Pod affinity constraints.
   podAffinity: {}
 
+  # -- Pod labels.
+  podLabels: {}
+
   # -- Node affinity constraints.
   nodeAffinity: {}