fix: filter system labels from release labels in List/Query

Secrets.List/Query and ConfigMaps.List/Query returned the raw object
labels, including system labels (name, owner, status, version,
createdAt, modifiedAt), unlike Get which already filters them. This
let system labels ride along in lastRelease.Labels on upgrade and get
merged into the new release, permanently baking stale createdAt values
and system-label keys into the stored release body.

Fixes #32404

Signed-off-by: bhuvan-somisetty <somisettybhuvan5@gmail.com>

pkg/storage/driver/cfgmaps.go

@@ -113,7 +113,7 @@ func (cfgmaps *ConfigMaps) List(filter func(release.Releaser) bool) ([]release.R
 			continue
 		}
 
-		rls.Labels = item.Labels
+		rls.Labels = filterSystemLabels(item.Labels)
 
 		if filter(rls) {
 			results = append(results, rls)
@@ -152,7 +152,7 @@ func (cfgmaps *ConfigMaps) Query(labels map[string]string) ([]release.Releaser,
 			cfgmaps.Logger().Debug("failed to decode release", slog.Any("error", err))
 			continue
 		}
-		rls.Labels = item.Labels
+		rls.Labels = filterSystemLabels(item.Labels)
 		results = append(results, rls)
 	}
 	return results, nil

pkg/storage/driver/cfgmaps_test.go

@@ -149,11 +149,12 @@ func TestConfigMapList(t *testing.T) {
 	if len(ssd) != 2 {
 		t.Errorf("Expected 2 superseded, got %d", len(ssd))
 	}
-	// Check if release having both system and custom labels, this is needed to ensure that selector filtering would work.
+	// List should return custom labels only, system labels (name, owner, status, etc.)
+	// must not leak into rls.Labels or they'll be carried into the next revision on upgrade.
 	rls := convertReleaserToV1(t, ssd[0])
 	_, ok := rls.Labels["name"]
-	if !ok {
+	if ok {
-		t.Fatalf("Expected 'name' label in results, actual %v", rls.Labels)
+		t.Fatalf("Expected 'name' system label to be filtered out, actual %v", rls.Labels)
 	}
 	_, ok = rls.Labels["key1"]
 	if !ok {
@@ -179,6 +180,12 @@ func TestConfigMapQuery(t *testing.T) {
 		t.Errorf("Expected 2 results, got %d", len(rls))
 	}
 
+	// Query should return custom labels only, same as Get and List.
+	queried := convertReleaserToV1(t, rls[0])
+	if _, ok := queried.Labels["name"]; ok {
+		t.Fatalf("Expected 'name' system label to be filtered out, actual %v", queried.Labels)
+	}
+
 	_, err = cfgmaps.Query(map[string]string{"name": "notExist"})
 	if !errors.Is(err, ErrReleaseNotFound) {
 		t.Errorf("Expected {%v}, got {%v}", ErrReleaseNotFound, err)

pkg/storage/driver/secrets.go

@@ -110,7 +110,7 @@ func (secrets *Secrets) List(filter func(release.Releaser) bool) ([]release.Rele
 			continue
 		}
 
-		rls.Labels = item.Labels
+		rls.Labels = filterSystemLabels(item.Labels)
 
 		if filter(rls) {
 			results = append(results, rls)
@@ -152,7 +152,7 @@ func (secrets *Secrets) Query(labels map[string]string) ([]release.Releaser, err
 			)
 			continue
 		}
-		rls.Labels = item.Labels
+		rls.Labels = filterSystemLabels(item.Labels)
 		results = append(results, rls)
 	}
 	return results, nil

pkg/storage/driver/secrets_test.go

@@ -134,11 +134,12 @@ func TestSecretList(t *testing.T) {
 	if len(ssd) != 2 {
 		t.Errorf("Expected 2 superseded, got %d", len(ssd))
 	}
-	// Check if release having both system and custom labels, this is needed to ensure that selector filtering would work.
+	// List should return custom labels only, system labels (name, owner, status, etc.)
+	// must not leak into rls.Labels or they'll be carried into the next revision on upgrade.
 	rls := convertReleaserToV1(t, ssd[0])
 	_, ok := rls.Labels["name"]
-	if !ok {
+	if ok {
-		t.Fatalf("Expected 'name' label in results, actual %v", rls.Labels)
+		t.Fatalf("Expected 'name' system label to be filtered out, actual %v", rls.Labels)
 	}
 	_, ok = rls.Labels["key1"]
 	if !ok {
@@ -164,6 +165,12 @@ func TestSecretQuery(t *testing.T) {
 		t.Fatalf("Expected 2 results, actual %d", len(rls))
 	}
 
+	// Query should return custom labels only, same as Get and List.
+	queried := convertReleaserToV1(t, rls[0])
+	if _, ok := queried.Labels["name"]; ok {
+		t.Fatalf("Expected 'name' system label to be filtered out, actual %v", queried.Labels)
+	}
+
 	_, err = secrets.Query(map[string]string{"name": "notExist"})
 	if !errors.Is(err, ErrReleaseNotFound) {
 		t.Errorf("Expected {%v}, got {%v}", ErrReleaseNotFound, err)