Label-Based resource ownership - ALB and Certificates by meneksece · Pull Request #1092 · stackitcloud/cloud-provider-stackit

meneksece · 2026-05-11T08:58:46Z

How to categorize this PR?

What this PR does / why we need it:

This PR introduces structured ownership for Application Load Balancer (ALB) and Certificate resources. By using a consistent labeling system based on the IngressClass UID, the controller can now easily find and clean up the resources it created.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Key Changes:

Ownership Labeling: Introduced LabelIngressClassUID (prefixed with lb.customer.label/) to track resource provenance.
Label Merging Logic: Added logic in getAlbSpecForResources to merge user-defined labels, global config labels, and the internal ownership label (with a safety limit of 64 labels).
Extended Interface: Updated applyCertificates to accept the IngressClass object to ensure certificates are also labeled upon creation.

Breaking changes:

ske-prow · 2026-05-11T08:58:52Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign maboehm for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

…ancer to v1.13.0 (#1104) Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Write gingko test for ingressclass_controller.go update done with "go mod tidy"

Adi146 · 2026-05-21T07:19:50Z

+
+	// Add user labels, mind the limit
+	for k, v := range class.Labels {
+		if len(mergedLabels) < 64 {


Not sure if this makes sense to check the label count here. If you intention is to validate the input before we submit it to the api then we also should check the label name and value for length and invalid characters

added tests for label key validation evict one item from the label list when the label item count exceeds 64 to make room for resource ownership label

kamilprzybyl

labels

kamilprzybyl · 2026-05-21T17:35:59Z

 	// LabelIngressClassUID is the unique key that identifies resources
 	// owned by a specific IngressClass.
 	LabelIngressClassUID = prefixALBIngressController + "ingress-class-uid"
+	maximumLabelCount    = 64


This limit applies to both ALB and NLB so maybe consider moving it to the shared labels package

kamilprzybyl · 2026-05-21T17:37:47Z

+	// prefixStackitInternalLabel is reserved for STACKIT internal labeling of resources that customer are not allowed to use
+	prefixStackitInternalLabel = "stackit-"


Same here, I think it makes sense moving it to the shared labels package.

kamilprzybyl · 2026-05-21T18:15:35Z

+	// evict one item to make room for the ownership label
+	if len(mergedLabels) >= 64 {
+		for k := range mergedLabels {
+			delete(mergedLabels, k)
+			break
 		}
 	}


We shouldn't silently drop customer labels, customers get confused. We should apply the ownership and global config labels first, then merge the customer labels last. If adding a customer label exceeds the 64-label limit, we return an error instead of silently evicting data.

I think we should drop the label but also emit an event so the customer has a chance to spot whats going on

this part could also be a bit more streamlined. Instead of removing a label again when you reach the maximum number you could add this label before you add the customer labels. And also validate the customer labels so that the controller forbids overwriting the LabelIngressClassUID key.

Adi146 · 2026-05-22T07:44:30Z

+	errorList []errorEvents,
+) []errorEvents {
+	for k, v := range inputLabels {
+		if len(mergedLabels) >= 64 {


make use of the maximumLabelCount constant

Adi146 · 2026-05-22T07:47:09Z

+	// evict one item to make room for the ownership label
+	if len(mergedLabels) >= 64 {
+		for k := range mergedLabels {
+			delete(mergedLabels, k)
+			break
 		}
 	}


this part could also be a bit more streamlined. Instead of removing a label again when you reach the maximum number you could add this label before you add the customer labels. And also validate the customer labels so that the controller forbids overwriting the LabelIngressClassUID key.

added tests for label key validation evict one item from the label list when the label item count exceeds 64 to make room for resource ownership label

ske-prow · 2026-05-22T08:58:18Z

@meneksece: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cloud-provider-stackit-verify	`bb55a87`	link	true	`/test pull-cloud-provider-stackit-verify`

Full PR test history. Your PR dashboard. Command help for this repository.
Please help us cut down on flakes by linking this test failure to an open flake report or filing a new flake report if you can't find an existing one. Also see the gardener testing guideline for how to avoid and hunt flakes.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ske-prow Bot added do-not-merge/needs-kind Indicates a PR lacks a `kind/foo` label and requires one. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 11, 2026

meneksece changed the title ~~added labels upon creation of alb and storing certificate~~ Label-Based resource ownership - ALB and Certificates May 11, 2026

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from d1c0fba to 91b83ab Compare May 11, 2026 12:11

ske-prow Bot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 11, 2026

meneksece force-pushed the feat/kp/add-alb-ingress-controller branch from c7749a6 to 7af9e33 Compare May 11, 2026 12:22

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from 91b83ab to a14b123 Compare May 11, 2026 12:26

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from a14b123 to f7de4f0 Compare May 19, 2026 07:12

ske-prow Bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels May 19, 2026

kamilprzybyl reviewed May 19, 2026

View reviewed changes

Comment thread pkg/alb/ingress/ingressclass_controller_unit_test.go

Comment thread pkg/alb/ingress/ingressclass_controller_test.go

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from f7de4f0 to 152e114 Compare May 20, 2026 12:11

ske-prow Bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels May 20, 2026

ske-renovate-ce Bot and others added 12 commits May 20, 2026 14:13

Update kubernetes monorepo to v0.36.1 (#1093)

2410225

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module github.com/stackitcloud/stackit-sdk-go/services/loadbal…

04e32c6

…ancer to v1.13.0 (#1104) Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module google.golang.org/grpc to v1.81.1 (#1109)

e8fd480

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module google.golang.org/grpc to v1.81.1 (#1109)

ac9338b

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module github.com/onsi/ginkgo/v2 to v2.29.0 (#1120)

217b23f

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module github.com/onsi/gomega to v1.41.0 (#1121)

63279fe

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update dependency chainguard-dev/apko to v1.2.13 (#1130)

0d0d229

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module google.golang.org/grpc to v1.81.1 (#1109)

3657038

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

Update module google.golang.org/grpc to v1.81.1 (#1109)

db802c3

Co-authored-by: ske-renovate-ce[bot] <163154779+ske-renovate-ce[bot]@users.noreply.github.com>

added labels upon creation of alb and storing certificate

8100e2a

Add label related alb tests to alb_spec_test.go

e33c9c0

Write gingko test for ingressclass_controller.go update done with "go mod tidy"

changed prefix for cert label

4ef3814

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from 152e114 to 4ef3814 Compare May 20, 2026 21:43

Adi146 reviewed May 21, 2026

View reviewed changes

added unit tests as commented instead of deletion

cbb57dc

meneksece force-pushed the feat/mc/add-alb-ingress-controller-labels branch from e1f8620 to cbb57dc Compare May 21, 2026 08:54

added label key value validation

6af1878

added tests for label key validation evict one item from the label list when the label item count exceeds 64 to make room for resource ownership label

kamilprzybyl reviewed May 21, 2026

View reviewed changes

Adi146 reviewed May 22, 2026

View reviewed changes

added label key value validation

bb55a87

added tests for label key validation evict one item from the label list when the label item count exceeds 64 to make room for resource ownership label

meneksece closed this May 22, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Label-Based resource ownership - ALB and Certificates#1092

Label-Based resource ownership - ALB and Certificates#1092
meneksece wants to merge 15 commits into
feat/kp/add-alb-ingress-controllerfrom
feat/mc/add-alb-ingress-controller-labels

meneksece commented May 11, 2026 •

edited

Loading

Uh oh!

ske-prow Bot commented May 11, 2026

Uh oh!

Uh oh!

Uh oh!

Adi146 May 21, 2026

Uh oh!

kamilprzybyl left a comment

Uh oh!

kamilprzybyl May 21, 2026

Uh oh!

kamilprzybyl May 21, 2026

Uh oh!

kamilprzybyl May 21, 2026

Uh oh!

Adi146 May 22, 2026

Uh oh!

Adi146 May 22, 2026

Uh oh!

Adi146 May 22, 2026

Uh oh!

Adi146 May 22, 2026

Uh oh!

ske-prow Bot commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// prefixStackitInternalLabel is reserved for STACKIT internal labeling of resources that customer are not allowed to use
		prefixStackitInternalLabel = "stackit-"

Conversation

meneksece commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ske-prow Bot commented May 11, 2026

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kamilprzybyl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ske-prow Bot commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

meneksece commented May 11, 2026 •

edited

Loading