Labels added to namespace not being deployed

[ohheyrj]

Hello,

I previously used Flux to deploy a namespace into my cluster. I now wanted to add a new label of goldilocks.fairwinds.com/enabled: true to the namespace, however, once I updated the code and pushed to git, the namespace doesn't seem to deploy the changed labels.

My code (stored under cluster/production/namespaces) looks like this:

---
apiVersion: v1
kind: Namespace
metadata:
  name: traefik
  labels:
    goldilocks.fairwinds.com/enabled: true

Doing a kubectl describe namespace traefik gives me this:

Name:         traefik
Labels:       kubernetes.io/metadata.name=traefik
              kustomize.toolkit.fluxcd.io/name=flux-system
              kustomize.toolkit.fluxcd.io/namespace=flux-system
Annotations:  <none>
Status:       Active

No resource quota.

No LimitRange resource.

I have also tried doing:

flux suspend kustomization -n flux-system flux-system
flux resume kustomization -n flux-system flux-system

But this doesn't seem to change the outcome. Any help would be greatly appreciated.

[stefanprodan]

If you do flux trace namespace/traefik does it show the Git SHA for the commit you pushed with the labels addition? Also can you please post here kubectl get namespace traefik --show-managed-fields -oyaml.

[ohheyrj]

I created a new namespace called test-namespace. I tried without the label to start, then commited the change with the additional label (similar to above). The addition of the label was done in commit SHA 2c52a163. The output from the commands are as follows:

$ flux trace namespace/test-namespace
Object:          Namespace/test-namespace
Status:          Managed by Flux
---
Kustomization:   flux-system
Namespace:       flux-system
Path:            ./cluster/production
Revision:        main/2c52a1639867618483fd8ce5567ba036fef3e78f
Status:          Last reconciled at 2023-03-04 21:39:00 +0000 GMT
Message:         Applied revision: main/2c52a1639867618483fd8ce5567ba036fef3e78f
---
GitRepository:   flux-system
Namespace:       flux-system
URL:             ssh://git@github.com/systemsmystery/flux-sm-main-eks-cluster
Branch:          main
Revision:        main/2c52a1639867618483fd8ce5567ba036fef3e78f
Status:          Last reconciled at 2023-03-04 21:38:57 +0000 GMT
Message:         stored artifact for revision 'main/2c52a1639867618483fd8ce5567ba036fef3e78f'

And the output of the second command:

$ kubectl get namespace test-namespace --show-managed-fields -oyaml
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: "2023-03-04T21:37:55Z"
  labels:
    kubernetes.io/metadata.name: test-namespace
    kustomize.toolkit.fluxcd.io/name: flux-system
    kustomize.toolkit.fluxcd.io/namespace: flux-system
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          f:kustomize.toolkit.fluxcd.io/name: {}
          f:kustomize.toolkit.fluxcd.io/namespace: {}
    manager: kustomize-controller
    operation: Apply
    time: "2023-03-04T21:37:55Z"
  name: test-namespace
  resourceVersion: "8375030"
  uid: 956a187a-c83d-423c-9a63-8de7d87fdd49
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

As a work around for now I have manually applied the label and followed this FAQ article (https://fluxcd.io/flux/faq/#why-are-kubectl-edits-rolled-back-by-flux) using the --field-manager=flux-client-side-apply flag, the labels have since stuck. I didn't do this on the test-namespace however so I still have a namespace with the issue.

[apuri1-arqit]

We've got the same issue here, labels are not being applied to namespaces, whether via patches using vars passed in from postBuild, or hardcoded in the kustomization.

[a-nych]

I have the same issue, with the same label! The namespace is managed by Flux, and it doesn't set the labels to the namespace. Whats worse, if I set them manually, Flux removes them after a reconcile.

Kustomize controller version: v1.2.2

[DevSecNinja]

Same issue and same scenario with my goldilocks labels.

[DevSecNinja]

This fixed it for me: #4603 (comment)

[stefanprodan]

You need to add make the value a string e.g. "true", otherwise the value of the label is of type boolean and the Kubernetes API drops it as being invalid.

apiVersion: v1
kind: Namespace
metadata:
  name: traefik
  labels:
    goldilocks.fairwinds.com/enabled: "true"