fix: give every K8s workspace pod the standard Coder label set - #179
Conversation
Six templates were invisible to label selectors, which blocks any network policy
or fleet-wide query from selecting workspaces:
datasci, devbox, universal-sandbox, memorycard, realworld
one label only (com.coder.workspace.uuid); Coder identity lived in
ANNOTATIONS, which label selectors cannot match
envbox
no labels at all
They now carry the same set selenium and awshp-k8s-with-kiro-cli already use:
app.kubernetes.io/{name,instance,part-of}, com.coder.resource, and the
workspace/user id and name.
The five Deployment-based templates use local.labels for BOTH the pod template
and spec.selector.match_labels, and the selector is immutable: changing it forces
a Deployment replacement and recreates running workspaces. So local.labels is
left untouched and a new local.pod_labels = merge(local.labels, {...}) is applied
to the pod template only. merge() guarantees pod_labels is a superset of labels,
which is what Kubernetes requires of the selector.
envbox is a bare Pod, so it has no selector constraint and gets the set directly.
com.coder.user.email stays an annotation: '@' is not a valid label value.
terraform validate passes on all six.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/90a15723-3d73-4af5-b308-846d21c76bc2 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/f5e0f0bd-a176-4b28-83c8-4c61969048f3 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/6cc7db19-278b-468a-b70b-fa4ecea28ef9 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/ddc24fb6-7ee9-4748-b677-c351c8257c47 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/ff2b8d2e-671d-4b4d-b512-6e64d621f913 |
|
✅ Agent Validation PASSED for template
|
|
Coder Agents Chat: agent finished or is awaiting input Chat: https://ai.coder.com/agents/4f64108e-dd50-40f1-ac66-0b4c384ff4b9 |
|
✅ Agent Validation PASSED for template
|
1 participant
Why
Prerequisite for network policy. Six templates were invisible to label selectors, so nothing could select "a Coder workspace pod" fleet-wide:
datasci,devbox,universal-sandbox,memorycard,realworldcom.coder.workspace.uuidonly — Coder identity was in annotations, which label selectors cannot matchenvboxOnly
coder-selenium-demoandawshp-k8s-with-kiro-clicarried the full set. Namespace was the only universal handle.What
All six now carry the same set those two already use:
app.kubernetes.io/{name,instance,part-of},com.coder.resource, and the workspace/user id and name.The immutable-selector trap, and how this avoids it
In the five Deployment-based templates,
local.labelsfeeds both the pod template andspec.selector.match_labels. The selector is immutable in Kubernetes — changing it forces a Deployment replacement and recreates every running workspace.So
local.labelsis left untouched and a new local is added:applied to the pod template only.
merge()guaranteespod_labels ⊇ labels, which is what Kubernetes requires of the selector. Verified in the diff:match_labelsis unchanged in all five.envboxis a bare Pod with no selector constraint, so it gets the set directly.com.coder.user.emaildeliberately stays an annotation:@is not a valid label value.Testing
terraform validateandterraform fmt -checkpass on all six. Agent validation will build a real workspace per template. The thing to confirm in review is that no Deployment is replaced — the pod is recreated (strategy = "Recreate"), PVCs survive, the agent reconnects.🤖 Generated with Claude Code