From 9cb5367a4dc2bf0492a598f0bd08195f880b09bb Mon Sep 17 00:00:00 2001 From: bhuvan-somisetty Date: Tue, 21 Jul 2026 21:08:31 +0530 Subject: [PATCH] fix: filter system labels from release labels in List/Query Secrets.List/Query and ConfigMaps.List/Query returned the raw object labels, including system labels (name, owner, status, version, createdAt, modifiedAt), unlike Get which already filters them. This let system labels ride along in lastRelease.Labels on upgrade and get merged into the new release, permanently baking stale createdAt values and system-label keys into the stored release body. Fixes #32404 Signed-off-by: bhuvan-somisetty --- pkg/storage/driver/cfgmaps.go | 4 ++-- pkg/storage/driver/cfgmaps_test.go | 13 ++++++++++--- pkg/storage/driver/secrets.go | 4 ++-- pkg/storage/driver/secrets_test.go | 13 ++++++++++--- 4 files changed, 24 insertions(+), 10 deletions(-) diff --git a/pkg/storage/driver/cfgmaps.go b/pkg/storage/driver/cfgmaps.go index f71ce44f1..bae5fb2b9 100644 --- a/pkg/storage/driver/cfgmaps.go +++ b/pkg/storage/driver/cfgmaps.go @@ -113,7 +113,7 @@ func (cfgmaps *ConfigMaps) List(filter func(release.Releaser) bool) ([]release.R continue } - rls.Labels = item.Labels + rls.Labels = filterSystemLabels(item.Labels) if filter(rls) { results = append(results, rls) @@ -152,7 +152,7 @@ func (cfgmaps *ConfigMaps) Query(labels map[string]string) ([]release.Releaser, cfgmaps.Logger().Debug("failed to decode release", slog.Any("error", err)) continue } - rls.Labels = item.Labels + rls.Labels = filterSystemLabels(item.Labels) results = append(results, rls) } return results, nil diff --git a/pkg/storage/driver/cfgmaps_test.go b/pkg/storage/driver/cfgmaps_test.go index 947ebff71..397f229d8 100644 --- a/pkg/storage/driver/cfgmaps_test.go +++ b/pkg/storage/driver/cfgmaps_test.go @@ -149,11 +149,12 @@ func TestConfigMapList(t *testing.T) { if len(ssd) != 2 { t.Errorf("Expected 2 superseded, got %d", len(ssd)) } - // Check if release having both system and custom labels, this is needed to ensure that selector filtering would work. + // List should return custom labels only, system labels (name, owner, status, etc.) + // must not leak into rls.Labels or they'll be carried into the next revision on upgrade. rls := convertReleaserToV1(t, ssd[0]) _, ok := rls.Labels["name"] - if !ok { - t.Fatalf("Expected 'name' label in results, actual %v", rls.Labels) + if ok { + t.Fatalf("Expected 'name' system label to be filtered out, actual %v", rls.Labels) } _, ok = rls.Labels["key1"] if !ok { @@ -179,6 +180,12 @@ func TestConfigMapQuery(t *testing.T) { t.Errorf("Expected 2 results, got %d", len(rls)) } + // Query should return custom labels only, same as Get and List. + queried := convertReleaserToV1(t, rls[0]) + if _, ok := queried.Labels["name"]; ok { + t.Fatalf("Expected 'name' system label to be filtered out, actual %v", queried.Labels) + } + _, err = cfgmaps.Query(map[string]string{"name": "notExist"}) if !errors.Is(err, ErrReleaseNotFound) { t.Errorf("Expected {%v}, got {%v}", ErrReleaseNotFound, err) diff --git a/pkg/storage/driver/secrets.go b/pkg/storage/driver/secrets.go index a1f3e94fc..0fffcf183 100644 --- a/pkg/storage/driver/secrets.go +++ b/pkg/storage/driver/secrets.go @@ -110,7 +110,7 @@ func (secrets *Secrets) List(filter func(release.Releaser) bool) ([]release.Rele continue } - rls.Labels = item.Labels + rls.Labels = filterSystemLabels(item.Labels) if filter(rls) { results = append(results, rls) @@ -152,7 +152,7 @@ func (secrets *Secrets) Query(labels map[string]string) ([]release.Releaser, err ) continue } - rls.Labels = item.Labels + rls.Labels = filterSystemLabels(item.Labels) results = append(results, rls) } return results, nil diff --git a/pkg/storage/driver/secrets_test.go b/pkg/storage/driver/secrets_test.go index a11ec4380..fe8db4b50 100644 --- a/pkg/storage/driver/secrets_test.go +++ b/pkg/storage/driver/secrets_test.go @@ -134,11 +134,12 @@ func TestSecretList(t *testing.T) { if len(ssd) != 2 { t.Errorf("Expected 2 superseded, got %d", len(ssd)) } - // Check if release having both system and custom labels, this is needed to ensure that selector filtering would work. + // List should return custom labels only, system labels (name, owner, status, etc.) + // must not leak into rls.Labels or they'll be carried into the next revision on upgrade. rls := convertReleaserToV1(t, ssd[0]) _, ok := rls.Labels["name"] - if !ok { - t.Fatalf("Expected 'name' label in results, actual %v", rls.Labels) + if ok { + t.Fatalf("Expected 'name' system label to be filtered out, actual %v", rls.Labels) } _, ok = rls.Labels["key1"] if !ok { @@ -164,6 +165,12 @@ func TestSecretQuery(t *testing.T) { t.Fatalf("Expected 2 results, actual %d", len(rls)) } + // Query should return custom labels only, same as Get and List. + queried := convertReleaserToV1(t, rls[0]) + if _, ok := queried.Labels["name"]; ok { + t.Fatalf("Expected 'name' system label to be filtered out, actual %v", queried.Labels) + } + _, err = secrets.Query(map[string]string{"name": "notExist"}) if !errors.Is(err, ErrReleaseNotFound) { t.Errorf("Expected {%v}, got {%v}", ErrReleaseNotFound, err)