SEANK.H.LIAO

k8s labelling reflections

reflections on a k8s resource labelling initiative at work

kubernetes labels

Kubernetes resources all have a metadata.labels field, allowing you to add key-value pairs to help with tracking / selecting things.

So we discovered Open Policy Agent Gatekeeper, A way for you to force all resources to conform to policies, otherwise prevent their creation. One of these policies is enforcing a required set of labels. To use this, we had to ensure this didn't cause any unintended disruptions, so off we go adding a bunch of labels to everything.

only add labels you will actually use

There are a lot of things that sound nice, like owner, environment, version labels on everything. But after you've wasted 2 weeks adding labels to everything, are you actually going to use it? Or are they there just so you can fulfill a policy (that you also wrote)?

bad tooling

If you use Helm, you'll know the inconsistency of upstream charts, not everything uses the recommended set much less provide you with options to insert labels on everything.

Even then, it very likely has different ideas on what the common labels mean versus what's actually useful for you. eg:

namespace per app

Adding labels to everything is almost certainly a giant waste of time, better to isolate each app in their own namespace and just label that.