fix: preserving externally managed labels

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

Author: prometherion

controllers/tenant/limitranges.go

@@ -55,7 +55,7 @@ func (r *Manager) syncLimitRange(ctx context.Context, tenant *capsulev1beta2.Ten
 		return err
 	}
 
-	for i, spec := range tenant.Spec.LimitRanges.Items {
+	for i, spec := range tenant.Spec.LimitRanges.Items { //nolint:dupl
 		target := &corev1.LimitRange{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      fmt.Sprintf("capsule-%s-%d", tenant.Name, i),
@@ -65,10 +65,14 @@ func (r *Manager) syncLimitRange(ctx context.Context, tenant *capsulev1beta2.Ten
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-			target.ObjectMeta.Labels = map[string]string{
-				tenantLabel:     tenant.Name,
-				limitRangeLabel: strconv.Itoa(i),
+			labels := target.GetLabels()
+			if labels == nil {
+				labels = map[string]string{}
 			}
+			labels[tenantLabel] = tenant.Name
+			labels[limitRangeLabel] = strconv.Itoa(i)
+
+			target.SetLabels(labels)
 			target.Spec = spec
 
 			return controllerutil.SetControllerReference(tenant, target, r.Client.Scheme())

controllers/tenant/networkpolicies.go

@@ -54,7 +54,7 @@ func (r *Manager) syncNetworkPolicy(ctx context.Context, tenant *capsulev1beta2.
 		return err
 	}
 
-	for i, spec := range tenant.Spec.NetworkPolicies.Items {
+	for i, spec := range tenant.Spec.NetworkPolicies.Items { //nolint:dupl
 		target := &networkingv1.NetworkPolicy{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      fmt.Sprintf("capsule-%s-%d", tenant.Name, i),
@@ -64,10 +64,15 @@ func (r *Manager) syncNetworkPolicy(ctx context.Context, tenant *capsulev1beta2.
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-			target.SetLabels(map[string]string{
-				tenantLabel:        tenant.Name,
-				networkPolicyLabel: strconv.Itoa(i),
-			})
+			labels := target.GetLabels()
+			if labels == nil {
+				labels = map[string]string{}
+			}
+
+			labels[tenantLabel] = tenant.Name
+			labels[networkPolicyLabel] = strconv.Itoa(i)
+
+			target.SetLabels(labels)
 			target.Spec = spec
 
 			return controllerutil.SetControllerReference(tenant, target, r.Client.Scheme())

controllers/tenant/resourcequotas.go

@@ -196,10 +196,15 @@ func (r *Manager) syncResourceQuota(ctx context.Context, tenant *capsulev1beta2.
 
 		err = retry.RetryOnConflict(retry.DefaultBackoff, func() (retryErr error) {
 			res, retryErr = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() (err error) {
-				target.SetLabels(map[string]string{
-					tenantLabel: tenant.Name,
-					typeLabel:   strconv.Itoa(index),
-				})
+				targetLabels := target.GetLabels()
+				if targetLabels == nil {
+					targetLabels = map[string]string{}
+				}
+
+				targetLabels[tenantLabel] = tenant.Name
+				targetLabels[typeLabel] = strconv.Itoa(index)
+
+				target.SetLabels(targetLabels)
 				target.Spec.Scopes = resQuota.Scopes
 				target.Spec.ScopeSelector = resQuota.ScopeSelector
 				// In case of Namespace scope for the ResourceQuota we can easily apply the bare specification

controllers/tenant/rolebindings.go

@@ -128,10 +128,12 @@ func (r *Manager) syncAdditionalRoleBinding(ctx context.Context, tenant *capsule
 
 		var res controllerutil.OperationResult
 		res, err = controllerutil.CreateOrUpdate(ctx, r.Client, target, func() error {
-			target.ObjectMeta.Labels = map[string]string{
-				tenantLabel:      tenant.Name,
-				roleBindingLabel: roleBindingHashLabel,
+			if target.ObjectMeta.Labels == nil {
+				target.ObjectMeta.Labels = map[string]string{}
 			}
+
+			target.ObjectMeta.Labels[tenantLabel] = tenant.Name
+			target.ObjectMeta.Labels[roleBindingLabel] = roleBindingHashLabel
 			target.RoleRef = rbacv1.RoleRef{
 				APIGroup: rbacv1.GroupName,
 				Kind:     "ClusterRole",