Fix selector.matchLabels to not include version label

selector.matchLabels should use cfg.matchLabels without the version label,
since Kubernetes selectors can't be updated and should remain stable.
Previously selector.matchLabels was using labels which included the version
through cfg.labels, causing the selector to change when version changes.

Fixed by:
- Using cfg.matchLabels directly for selectors
- Adding component-specific labels explicitly in selector.matchLabels
- Not including cfg.labels (which contains version) in selectors

Author: Lillecarl

kubenix/builder.nix

@@ -87,7 +87,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "builder";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "builder";
+      };
     in
     lib.mkIf (cfg.enable && cfg.builders.enable) {
       nix-csi.builders.nixConfig.settings.sandbox = cfg.builders.privilegedSandboxedBuilds;
@@ -205,7 +207,11 @@ in
                 metadata.labels = v2.labels;
                 spec = {
                   replicas = v.replicas;
-                  selector.matchLabels = cfg.matchLabels // v2.labels;
+                  selector.matchLabels = cfg.matchLabels // {
+                    "app.kubernetes.io/component" = "builder";
+                    "kubernetes.io/arch" = v.arch;
+                    "nix.csi/deployment" = n;
+                  };
                   template = podTemplate v2;
                 };
               }
@@ -298,7 +304,11 @@ in
             {
               metadata.labels = v2.labels;
               spec = {
-                selector.matchLabels = cfg.matchLabels // v2.labels;
+                selector.matchLabels = cfg.matchLabels // {
+                  "app.kubernetes.io/component" = "builder";
+                  "kubernetes.io/arch" = v.arch;
+                  "nix.csi/daemonset" = n;
+                };
                 template = lib.recursiveUpdate (podTemplate v2) {
                   spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms = [
                     {

kubenix/cache.nix

@@ -38,7 +38,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "cache";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "cache";
+      };
     in
     lib.mkIf (cfg.enable && cfg.cache.enable) {
       kubernetes.resources.${cfg.namespace} = {

kubenix/ci/default.nix

@@ -4,7 +4,6 @@
   config,
   curPkgs,
   lib,
-  mkNCSI,
   subPath,
   inputs,
   ...
@@ -60,8 +59,14 @@ in
       };
     };
     kubernetes.resources.${cfg.namespace} = {
-      ConfigMap.inputs.data = inputs;
-      Job.flake-hello = mkNCSI {
+      ConfigMap.inputs = {
+        metadata.labels = cfg.labels;
+        data = inputs;
+      };
+      Job.flake-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -77,7 +82,10 @@ in
           };
         };
       };
-      Job.expr-hello = mkNCSI {
+      Job.expr-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -117,7 +125,10 @@ in
           };
         };
       };
-      Job.path-hello = mkNCSI {
+      Job.path-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -134,7 +145,10 @@ in
           };
         };
       };
-      Job.commandpath-hello = mkNCSI {
+      Job.commandpath-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -152,7 +166,10 @@ in
           };
         };
       };
-      Job.env-ssl = mkNCSI {
+      Job.env-ssl = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -229,7 +246,10 @@ in
         };
       };
       # Test failure scenarios for event reporting
-      Job.invalid-storepath-hello = mkNCSI {
+      Job.invalid-storepath-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -246,7 +266,10 @@ in
           };
         };
       };
-      Job.invalid-flake-hello = mkNCSI {
+      Job.invalid-flake-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {
@@ -262,7 +285,10 @@ in
           };
         };
       };
-      Job.invalid-expr-hello = mkNCSI {
+      Job.invalid-expr-hello = {
+        metadata.labels = cfg.labels // {
+          "app.kubernetes.io/component" = "ci-test";
+        };
         spec = {
           template = {
             spec = {

kubenix/config.nix

@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  mkNCSI,
   x86Pkgs,
   armPkgs,
   ...

kubenix/csidriver.nix

@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  mkNCSI,
   ...
 }:
 let

kubenix/daemonset.nix

@@ -27,7 +27,9 @@ in
       labels = cfg.labels // {
         "app.kubernetes.io/component" = "node";
       };
-      matchLabels = cfg.matchLabels // labels;
+      matchLabels = cfg.matchLabels // {
+        "app.kubernetes.io/component" = "node";
+      };
     in
     lib.mkIf cfg.enable {
       kubernetes.resources.${cfg.namespace} = {
@@ -38,7 +40,7 @@ in
               type = "RollingUpdate";
               rollingUpdate.maxUnavailable = 1;
             };
-            selector.matchLabels = labels;
+            selector.matchLabels = matchLabels;
             template = {
               metadata.labels = labels;
               metadata.annotations = {

kubenix/namespace.nix

@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  mkNCSI,
   ...
 }:
 let

kubenix/rbac.nix

@@ -3,7 +3,6 @@
 {
   config,
   lib,
-  mkNCSI,
   ...
 }:
 let

kubenix/undeploy.nix

@@ -26,10 +26,13 @@ in
         labels = cfg.labels // {
           "app.kubernetes.io/component" = "cleanup";
         };
+        matchLabels = cfg.matchLabels // {
+          "app.kubernetes.io/component" = "cleanup";
+        };
       in
       {
         metadata.labels = labels;
-        spec.selector.matchLabels = cfg.matchLabels // labels;
+        spec.selector.matchLabels = matchLabels;
         spec.template = {
           metadata.labels = labels;
           spec = {