document some labeling good practice

[goern]

I have stated using a set of commonLabels with all the kustomize files:

commonLabels:
  app.kubernetes.io/name: thoth
  app.kubernetes.io/component: kebechet
  app.kubernetes.io/managed-by: aicoe-thoth-devops-argocd

ArgoCD itself is adding app.kubernetes.io/instance=test-thoth-kebechet depending on the ArgoCD application created.

I would like to standardize on the usage of managed-by: shall we make it the rover group of the team responsible for the management/operation of the app and append -argocd if managed via ArgoCD or -manual if we do it manually using kustomize...

[accorvin]

I like this proposal. Is this something that we could have a bot enforce? I'm notoriously bad at remembering this sort of stuff.

[goern]

Looks like we can use Tekton to run a conftest task, so that we validate PR going it, the validating will be based on some Open Policy Agent policies. We need some policies, like https://github.com/thoth-station/thoth-application/blob/master/policy/deployment.rego and define which labels are recommended/required/... https://github.com/AICoE/aicoe-cd/blob/master/docs/recommended_labels.md

https://github.com/open-policy-agent/conftest/blob/master/examples/tekton/taskrun.yaml

@harshad16 please create an issue with some medium prio

[goern]

https://www.openshift.com/blog/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent

[goern]

tektoncd/pipeline#1078

[tumido]

@goern do you expect the app.kubernetes.io/managed-by label (without the suffix) to match any ldap group/github team or anything like that? Or is this expected to be fully up to people's imagination?

[goern]

hmm, a rover group might be helpful, but not required.

[sesheta]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

/lifecycle stale