feat(hyades): separate Job and Pod metadata for initializer

Split annotations and labels into Job-level and Pod-template-level
to allow independent customization. Add support for custom labels
on both Job and Pod. Wrap labels blocks in conditional to prevent
rendering empty labels fields.

Signed-off-by: rseleven <73898556+rseleven@users.noreply.github.com>

Author: rseleven

charts/hyades/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: hyades
-version: 0.22.0
+version: 0.22.1
 type: application
 appVersion: 5.0.2
 description: |-

charts/hyades/README.md

@@ -1,6 +1,6 @@
 # hyades
 
-![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.2](https://img.shields.io/badge/AppVersion-5.0.2-informational?style=flat-square)
+![Version: 0.22.1](https://img.shields.io/badge/Version-0.22.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.2](https://img.shields.io/badge/AppVersion-5.0.2-informational?style=flat-square)
 
 Hyades is the preview chart for Dependency-Track v5.
 
@@ -148,8 +148,11 @@ v2, or be ready to migrate when v2 is released.
 | initializer.image.registry | string | `""` | Override common.image.registry for the API server. |
 | initializer.image.repository | string | `"dependencytrack/apiserver"` |  |
 | initializer.image.tag | string | `""` | Can be a tag name such as "latest", or an image digest prefixed with "sha256:". |
+| initializer.labels | object | `{}` |  |
 | initializer.noHelmHook | bool | `false` | Whether to NOT deploy the initializer Job as `post-install` and `post-upgrade` Helm hook. Deploying as Helm hook can create deadlock situations when `helm install` and `helm upgrade` are executed with `--wait` flag. See <https://github.com/helm/helm/issues/10555>. Note that without hooks, `helm upgrade` may fail due to Job fields being immutable. |
 | initializer.nodeSelector | object | `{}` |  |
+| initializer.podAnnotations | object | `{}` |  |
+| initializer.podLabels | object | `{}` |  |
 | initializer.resources.limits.memory | string | `"256Mi"` |  |
 | initializer.resources.requests.cpu | string | `"150m"` |  |
 | initializer.resources.requests.memory | string | `"256Mi"` |  |
@@ -161,3 +164,5 @@ v2, or be ready to migrate when v2 is released.
 | initializer.waiter.image.repository | string | `"bitnami/kubectl"` |  |
 | initializer.waiter.image.tag | string | `"latest"` |  |
 
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

charts/hyades/templates/initializer/job.yaml

@@ -5,19 +5,36 @@ kind: Job
 metadata:
   name: {{ include "hyades.initializerFullname" . }}
   namespace: {{ .Release.Namespace }}
-  labels: {{- include "hyades.initializerLabels" . | nindent 4 }}
-  {{- if not .Values.initializer.noHelmHook }}
+  {{- if or (not .Values.initializer.noHelmHook) .Values.initializer.annotations }}
   annotations:
+    {{- if not .Values.initializer.noHelmHook }}
     "helm.sh/hook": "post-install, post-upgrade"
     "helm.sh/hook-delete-policy": "before-hook-creation"
+    {{- end }}
+    {{- with .Values.initializer.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- end }}
+  {{- if or (include "hyades.initializerLabels" . | trim) .Values.initializer.labels }}
+  labels:
+    {{- include "hyades.initializerLabels" . | nindent 4 }}
+    {{- with .Values.initializer.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
   {{- end }}
 spec:
   template:
     metadata:
-      labels: {{- include "hyades.initializerSelectorLabels" . | nindent 8 }}
-      {{- with .Values.initializer.annotations }}
+      {{- with .Values.initializer.podAnnotations }}
       annotations: {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if or (include "hyades.initializerSelectorLabels" . | trim) .Values.initializer.podLabels }}
+      labels:
+        {{- include "hyades.initializerSelectorLabels" . | nindent 8 }}
+        {{- with .Values.initializer.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- end }}
     spec:
       restartPolicy: Never
       serviceAccountName: {{ include "hyades.serviceAccountName" . }}
@@ -79,4 +96,4 @@ spec:
       volumes:
       - name: tmp
         emptyDir: {}
-{{- end }}
+{{- end }}

charts/hyades/values.schema.json

@@ -144,9 +144,21 @@
         "enabled": {
           "type": "boolean"
         },
+        "noHelmHook": {
+          "type": "boolean"
+        },
+        "labels": {
+          "type": "object"
+        },
         "annotations": {
           "type": "object"
         },
+        "podLabels": {
+          "type": "object"
+        },
+        "podAnnotations": {
+          "type": "object"
+        },
         "image": {
           "$ref": "#/$defs/image"
         },

charts/hyades/values.yaml

@@ -56,7 +56,7 @@ apiServer:
     allowPrivilegeEscalation: false
     capabilities:
       drop:
-      - ALL
+        - ALL
     runAsNonRoot: true
     readOnlyRootFilesystem: true
     seccompProfile:
@@ -138,7 +138,10 @@ initializer:
   # and `helm upgrade` are executed with `--wait` flag. See <https://github.com/helm/helm/issues/10555>.
   # Note that without hooks, `helm upgrade` may fail due to Job fields being immutable.
   noHelmHook: false
+  labels: {}
   annotations: {}
+  podLabels: {}
+  podAnnotations: {}
   image: *apiServerImage
   command: []
   args: []
@@ -203,7 +206,7 @@ frontend:
     allowPrivilegeEscalation: false
     capabilities:
       drop:
-      - ALL
+        - ALL
     runAsNonRoot: true
     # RO filesystems are not supported by the frontend
     readOnlyRootFilesystem: false