README
¶
pkg/labels
labels defines all label, annotation, and finalizer constants used by the Orkestra control plane. It is intentionally dependency-free and safe to import from any layer of the system — runtime, CLI, generators, komposers, motifs.
Nothing in this package performs logic. It only provides stable string identifiers and a few helpers for constructing label sets and selectors.
Key constants
| Constant | Value | Purpose |
|---|---|---|
DeletionProtectionLabel |
orkestra.io/deletion-protection |
Marks resources the deletion-protection webhook protects |
Managed |
orkestra.orkspace.io/managed |
Resources actively managed by Orkestra |
OrkestraOwner |
orkestra-owner |
Label value identifying the owning CR name |
AnnotationManagedBy |
orkestra.orkspace.io/managed-by |
Which operator instance manages the CR |
AnnotationManagedSince |
orkestra.orkspace.io/managed-since |
When Orkestra first took ownership |
FinalizerOrkestra |
orkestra.orkspace.io/finalizer |
Finalizer applied to CRs for cleanup hooks |
Label set helpers
// Standard labels applied to every Orkestra control-plane resource.
// Includes deletion-protection so the webhook protects Orkestra's own resources.
labels.OrkestraBaseLabels() map[string]string
// Add deletion-protection to an existing label map (non-destructive copy).
labels.WithDeletionProtection(m) map[string]string
Selector helpers
// LabelSelector matching orkestra.io/deletion-protection=true
// Used when building webhook NamespaceSelector or ObjectSelector.
labels.DeletionProtectionSelector() *metav1.LabelSelector
// LabelSelector matching all Orkestra control-plane resources.
labels.OrkestraResourceSelector() *metav1.LabelSelector
Documentation
¶
Overview ¶
Package labels defines all label, annotation, and finalizer constants used by the Orkestra control plane. These identifiers form the contract between the runtime, admission webhooks, generators, CLI tooling, and developer-created workloads.
Nothing in this package performs logic — it only provides:
- stable label keys
- stable annotation keys
- stable finalizer keys
- helpers for constructing label sets
- selectors used by the admission webhooks
This package is intentionally dependency‑free and safe to import from any layer of the system (runtime, CLI, generators, komposers, motifs, etc.).
Package labels provides a manager for adding standard Orkestra labels and annotations to any Kubernetes object that implements the domain.Object interface.
The manager is stateless and does not import any Orkestra internal packages (katalog, etc.). All configuration is passed explicitly at creation time.
Responsibilities:
- EnsureManagedLabels: adds "orkestra.orkspace.io/managed: true" label, and "managed-by", "managed-since" annotations. For runtime, also adds finalizers.
- EnsureDeletionProtectionLabel: adds "orkestra.io/deletion-protection: true" label when deletion protection is enabled globally.
The manager does NOT perform any API calls; it only mutates the object in memory. The caller is responsible for persisting changes (e.g., via kube.PatchLabels).
Index ¶
- Constants
- func DeletionProtectionSelector() *metav1.LabelSelector
- func OrkestraBaseLabels() map[string]string
- func OrkestraResourceLabels() map[string]string
- func OrkestraResourceSelector() *metav1.LabelSelector
- func WithDeletionProtection(m map[string]string) map[string]string
- type Config
- type Manager
- func (m *Manager) EnsureDeletionProtectionLabel(obj domain.Object) bool
- func (m *Manager) EnsureManagedAnnotations(obj domain.Object, operatorName string) bool
- func (m *Manager) EnsureManagedLabel(obj domain.Object) bool
- func (m *Manager) GetDeletionProtectionLabel() string
- func (m *Manager) GetManagedByAnnotation() string
- func (m *Manager) GetManagedLabel() string
- func (m *Manager) GetManagedSinceAnnotation() string
- func (m *Manager) IsDeletionProtectionEnabled() bool
- func (m *Manager) IsStandalone() bool
Constants ¶
const ( DeletionProtectionLabel = "orkestra.io/deletion-protection" // DeletionProtectionValue is the label value that enables protection. DeletionProtectionValue = "true" )
DeletionProtectionLabel marks resources that must not be deleted. Any object carrying:
orkestra.io/deletion-protection=true
will be matched by the deletion‑protection admission webhook. This protects both Orkestra control‑plane resources and developer‑opt‑in resources.
const ( AnnotationManagedBy = "orkestra.orkspace.io/managed-by" // AnnotationManagedSince records when Orkestra first took ownership of a CR. AnnotationManagedSince = "orkestra.orkspace.io/managed-since" )
AnnotationManagedBy identifies which Orkestra operator instance manages a CR.
const CreatedByOrkDoctor = "orkdoctor"
CreatedByOrkDoctor marks resources created by orkdoctor. These are excluded from cleanup logic even if ownership matches.
const FinalizerOrkestra = "orkestra.orkspace.io/finalizer"
FinalizerOrkestra ensures cleanup runs before a CR is removed.
const LabelCreatedBy = "app.kubernetes.io/createdBy"
LabelCreatedBy identifies the creator of a resource.
const ManagedKey = "orkestra.orkspace.io/managed"
Managed marks resources that Orkestra actively manages.
const ManagedValue = "true"
ManagedValue is always "true".
const OrkestraOwner = "orkestra-owner"
OrkestraOwner identifies which CR owns a generated resource. Used by reconcile loops to determine whether a resource should be updated or deleted.
Variables ¶
This section is empty.
Functions ¶
func DeletionProtectionSelector ¶ added in v0.4.1
func DeletionProtectionSelector() *metav1.LabelSelector
DeletionProtectionSelector returns a LabelSelector matching only the deletion‑protection label. Used when constructing webhook configurations.
func OrkestraBaseLabels ¶ added in v0.4.1
OrkestraBaseLabels returns a copy of the standard Orkestra control‑plane labels. Useful for generators and CLI commands that do not load Konfig.
func OrkestraResourceLabels ¶ added in v0.4.1
OrkestraResourceLabels returns the internal label map used for control‑plane resources. Callers must treat the returned map as read‑only.
func OrkestraResourceSelector ¶ added in v0.4.1
func OrkestraResourceSelector() *metav1.LabelSelector
OrkestraResourceSelector returns the selector for Orkestra control‑plane resources.
Types ¶
type Config ¶ added in v0.5.2
type Config struct {
// Standalone mode: no runtime reconciler exists. Finalizers will be skipped.
Standalone bool
// DeletionProtectionEnabled: if true, the deletion‑protection label is added.
DeletionProtectionEnabled bool
}
Config holds the configuration for the LabelManager.
type Manager ¶ added in v0.5.2
type Manager struct {
// contains filtered or unexported fields
}
Manager handles label and annotation mutations on domain objects. It is configuration-driven and does not depend on external packages.
func NewManager ¶ added in v0.5.2
NewManager creates a LabelManager with the given configuration.
func (*Manager) EnsureDeletionProtectionLabel ¶ added in v0.5.2
EnsureDeletionProtectionLabel adds the deletion‑protection label to the object if the manager is configured with deletionProtectionEnabled = true.
The label added is: orkestra.io/deletion-protection: "true"
It returns true if the label was added or already present, false if the feature is disabled (no action taken).
func (*Manager) EnsureManagedAnnotations ¶ added in v0.5.2
EnsureManagedAnnotations adds the standard Orkestra management annotations to the object if they are missing.
Managed‑by annotation: orkestra.workspace.io/managed-by: <operatorName> Managed‑since annotation: orkestra.workspace.io/managed-since: <UTC timestamp>
The method modifies the object in place. It returns true if any annotation was added or updated, false if both already had non‑empty values.
func (*Manager) EnsureManagedLabel ¶ added in v0.5.2
EnsureManagedLabel adds the standard Orkestra managed label to the object if it is missing.
Managed label: orkestra.workspace.io/managed: "true"
The method modifies the object in place. It returns true if the label was added or already present with the correct value, false if no change was needed.
Source Files