Add recommended chart labels alongside old labels

This enables us to make a breaking change in z2jh 5 where user servers
restarted once or more during z2jh 4 doesn't have to be restarted as
part of the breaking change then. If we did it right away, network
policy enforcement would fail for old servers for example.

Before z2jh 4, we should also get kubespawner to specify
`app.kubernetes.io/component` alongisde `component`.

Also, its nice to be able to provide time for people to adjust to the
new labels with a period of overlapping labels. For example, grafana
dashboards working with prometheus metrics could keep working in this
period and at any time transition to refering to new labels, and then
when we get z2jh 5 released such dashboards could have already adjusted.

Author: consideRatio

ci/common

@@ -50,7 +50,7 @@ await_autohttps_tls_cert_acquisition() {
         kubectl logs deploy/pebble --all-containers # --prefix
         kubectl describe pod -l app.kubernetes.io/name=pebble-coredns
         kubectl logs deploy/pebble-coredns --all-containers # --prefix
-        kubectl describe pod -l component=autohttps
+        kubectl describe pod -l app.kubernetes.io/component=autohttps
         kubectl logs deploy/autohttps --all-containers # --prefix
         exit 1
     fi
@@ -72,7 +72,7 @@ await_autohttps_tls_cert_save() {
         kubectl logs deploy/pebble --all-containers # --prefix
         kubectl describe pod -l app.kubernetes.io/name=pebble-coredns
         kubectl logs deploy/pebble-coredns --all-containers # --prefix
-        kubectl describe pod -l component=autohttps
+        kubectl describe pod -l app.kubernetes.io/component=autohttps
         kubectl logs deploy/autohttps --all-containers # --prefix
         exit 1
     fi

docs/source/administrator/services.md

@@ -82,8 +82,8 @@ proxy:
         - to:
             - podSelector:
                 matchLabels:
-                  app: jupyterhub
-                  component: hub
+                  app.kubernetes.io/name: jupyterhub
+                  app.kubernetes.io/component: hub
           ports:
             - port: 8181
 ```

docs/source/resources/community.md

@@ -94,7 +94,7 @@ user pods. You can search for all user pods with the following label query:
 
 ```bash
 kubectl --namespace=<YOUR-NAMESPACE> get pod \
-    -l "component=singleuser-server"
+    -l "app.kubernetes.io/component=singleuser-server"
 ```
 
 For more information, see the [Kubernetes labels and selectors page](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/).

jupyterhub/files/hub/jupyterhub_config.py

@@ -107,28 +107,36 @@ def camelCaseify(s):
 )
 
 # implement common labels
-# this duplicates the jupyterhub.commonLabels helper
+# This mimics the jupyterhub.commonLabels helper, but declares managed-by to
+# kubespawner instead of helm.
+#
+# The labels app and release are old labels enabled to be deleted in z2jh 5, but
+# for now retained to avoid a breaking change in z2jh 4 that would force user
+# server restarts. Restarts would be required because NetworkPolicy resources
+# must select old/new pods with labels that then needs to be seen on both
+# old/new pods, and we want these resources to keep functioning for old/new user
+# server pods during an upgrade.
+#
 common_labels = c.KubeSpawner.common_labels = {}
-common_labels["app"] = get_config(
+common_labels["app.kubernetes.io/name"] = common_labels["app"] = get_config(
     "nameOverride",
     default=get_config("Chart.Name", "jupyterhub"),
 )
-common_labels["heritage"] = "jupyterhub"
+release = get_config("Release.Name")
+if release:
+    common_labels["app.kubernetes.io/instance"] = common_labels["release"] = release
 chart_name = get_config("Chart.Name")
 chart_version = get_config("Chart.Version")
 if chart_name and chart_version:
-    common_labels["chart"] = "{}-{}".format(
-        chart_name,
-        chart_version.replace("+", "_"),
-    )
-release = get_config("Release.Name")
-if release:
-    common_labels["release"] = release
+    common_labels["helm.sh/chart"] = f"{chart_name}-{chart_version.replace('+', '_')}"
+chart_app_version = get_config("Chart.AppVersion")
+if chart_app_version:
+    common_labels["app.kubernetes.io/version"] = chart_app_version
+common_labels["app.kubernetes.io/managed-by"] = "kubespawner"
 
 c.KubeSpawner.namespace = os.environ.get("POD_NAMESPACE", "default")
 
 # Max number of consecutive failures before the Hub restarts itself
-# requires jupyterhub 0.9.2
 set_config_if_not_none(
     c.Spawner,
     "consecutive_failure_limit",

jupyterhub/templates/_helpers.tpl

@@ -48,7 +48,6 @@
   - commonLabels      | uses appLabel
   - labels            | uses commonLabels
   - matchLabels       | uses labels
-  - podCullerSelector | uses matchLabels
 
 
   ## Example usage
@@ -112,31 +111,65 @@
 {{- /*
   jupyterhub.commonLabels:
     Foundation for "jupyterhub.labels".
-    Provides labels: app, release, (chart and heritage).
+
+    Provides old labels:
+      app
+      release
+      chart (omitted for matchLabels)
+      heritage (omitted for matchLabels)
+    Provides modern labels (omitted for matchLabels):
+      app.kubernetes.io/name ("app")
+      app.kubernetes.io/version
+      app.kubernetes.io/instance release ("release")
+      helm.sh/chart ("chart")
+      app.kubernetes.io/managed-by ("heritage")
 */}}
 {{- define "jupyterhub.commonLabels" -}}
-app: {{ .appLabel | default (include "jupyterhub.appLabel" .) }}
-release: {{ .Release.Name }}
+app: {{ .appLabel | default (include "jupyterhub.appLabel" .) | quote }}
+release: {{ .Release.Name | quote }}
 {{- if not .matchLabels }}
 chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-heritage: {{ .heritageLabel | default .Release.Service }}
+heritage: {{ .Release.Service }}
+app.kubernetes.io/name: {{ .appLabel | default (include "jupyterhub.appLabel" .) | quote }}
+app.kubernetes.io/instance: {{ .Release.Name | quote }}
+app.kubernetes.io/version: {{ .Chart.AppVersion }}
+helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- end }}
 {{- end }}
 
 
 {{- /*
   jupyterhub.labels:
-    Provides labels: component, app, release, (chart and heritage).
+    Provides old labels:
+      component
+      app
+      release
+      chart (omitted for matchLabels)
+      heritage (omitted for matchLabels)
+    Provides modern labels (omitted for matchLabels):
+      app.kubernetes.io/component ("component")
+      app.kubernetes.io/name ("app")
+      app.kubernetes.io/version
+      app.kubernetes.io/instance release ("release")
+      helm.sh/chart ("chart")
+      app.kubernetes.io/managed-by ("heritage")
 */}}
 {{- define "jupyterhub.labels" -}}
 component: {{ include "jupyterhub.componentLabel" . }}
+{{- if not .matchLabels }}
+app.kubernetes.io/component: {{ include "jupyterhub.componentLabel" . }}
+{{- end }}
 {{ include "jupyterhub.commonLabels" . }}
 {{- end }}
 
 
 {{- /*
   jupyterhub.matchLabels:
-    Used to provide pod selection labels: component, app, release.
+    Provides old labels:
+      component
+      app
+      release
 */}}
 {{- define "jupyterhub.matchLabels" -}}
 {{- $_ := merge (dict "matchLabels" true) . -}}

jupyterhub/templates/proxy/autohttps/deployment.yaml

@@ -130,10 +130,10 @@ spec:
           {{- end }}
           args:
             - watch-save
-            - --label=app={{ include "jupyterhub.appLabel" . }}
-            - --label=release={{ .Release.Name }}
-            - --label=chart={{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
-            - --label=heritage=secret-sync
+            - --label=app.kubernetes.io/name={{ include "jupyterhub.appLabel" . }}
+            - --label=app.kubernetes.io/instance={{ .Release.Name }}
+            - --label=helm.sh/chart={{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+            - --label=app.kubernetes.io/managed-by=secret-sync
             - {{ include "jupyterhub.proxy-public-tls.fullname" . }}
             - acme.json
             - /etc/acme/acme.json

jupyterhub/values.schema.yaml

@@ -625,7 +625,7 @@ properties:
                     - to:
                         - podSelector:
                             matchLabels:
-                              app: my-k8s-local-service
+                              app.kubernetes.io/name: my-k8s-local-service
                       ports:
                         - protocol: TCP
                           port: 5978

tools/templates/lint-and-validate-values.yaml

@@ -186,7 +186,7 @@ hub:
       - to:
           - podSelector:
               matchLabels:
-                app: my-k8s-local-service
+                app.kubernetes.io/name: my-k8s-local-service
         ports:
           - protocol: TCP
             port: 5978