fix: give every K8s workspace pod the standard Coder label set

deployments/ai.coder.com/coder/memorycard/workspace.tf

@@ -3,6 +3,21 @@ locals {
   labels = {
     "com.coder.workspace.uuid" = data.coder_workspace.me.id
   }
+
+  # spec.selector.match_labels is immutable: changing local.labels would force a
+  # Deployment replacement and recreate running workspaces. New labels therefore go
+  # here and are applied to the pod template only. merge() guarantees pod_labels is a
+  # superset of labels, which Kubernetes requires of the selector.
+  pod_labels = merge(local.labels, {
+    "app.kubernetes.io/name"     = "coder-workspace"
+    "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+    "app.kubernetes.io/part-of"  = "coder"
+    "com.coder.resource"         = "true"
+    "com.coder.workspace.id"     = data.coder_workspace.me.id
+    "com.coder.workspace.name"   = data.coder_workspace.me.name
+    "com.coder.user.id"          = data.coder_workspace_owner.me.id
+    "com.coder.user.username"    = data.coder_workspace_owner.me.name
+  })
   annotations = {
     "com.coder.user.email"     = data.coder_workspace_owner.me.email
     "com.coder.workspace.id"   = data.coder_workspace.me.id
@@ -159,7 +174,7 @@ resource "kubernetes_deployment_v1" "this" {
     }
     template {
       metadata {
-        labels      = local.labels
+        labels      = local.pod_labels
         annotations = local.annotations
       }
       spec {

deployments/ai.coder.com/coder/realworld/workspace.tf

@@ -2,6 +2,21 @@ locals {
   labels = {
     "com.coder.workspace.uuid" = data.coder_workspace.me.id
   }
+
+  # spec.selector.match_labels is immutable: changing local.labels would force a
+  # Deployment replacement and recreate running workspaces. New labels therefore go
+  # here and are applied to the pod template only. merge() guarantees pod_labels is a
+  # superset of labels, which Kubernetes requires of the selector.
+  pod_labels = merge(local.labels, {
+    "app.kubernetes.io/name"     = "coder-workspace"
+    "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+    "app.kubernetes.io/part-of"  = "coder"
+    "com.coder.resource"         = "true"
+    "com.coder.workspace.id"     = data.coder_workspace.me.id
+    "com.coder.workspace.name"   = data.coder_workspace.me.name
+    "com.coder.user.id"          = data.coder_workspace_owner.me.id
+    "com.coder.user.username"    = data.coder_workspace_owner.me.name
+  })
   annotations = {
     "com.coder.user.email"     = data.coder_workspace_owner.me.email
     "com.coder.workspace.id"   = data.coder_workspace.me.id
@@ -106,7 +121,7 @@ resource "kubernetes_deployment_v1" "this" {
     }
     template {
       metadata {
-        labels      = local.labels
+        labels      = local.pod_labels
         annotations = local.annotations
       }
       spec {

deployments/ai.coder.com/demo/datasci/workspace.tf

@@ -2,6 +2,21 @@ locals {
   labels = {
     "com.coder.workspace.uuid" = random_uuid.this.result
   }
+
+  # spec.selector.match_labels is immutable: changing local.labels would force a
+  # Deployment replacement and recreate running workspaces. New labels therefore go
+  # here and are applied to the pod template only. merge() guarantees pod_labels is a
+  # superset of labels, which Kubernetes requires of the selector.
+  pod_labels = merge(local.labels, {
+    "app.kubernetes.io/name"     = "coder-workspace"
+    "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+    "app.kubernetes.io/part-of"  = "coder"
+    "com.coder.resource"         = "true"
+    "com.coder.workspace.id"     = data.coder_workspace.me.id
+    "com.coder.workspace.name"   = data.coder_workspace.me.name
+    "com.coder.user.id"          = data.coder_workspace_owner.me.id
+    "com.coder.user.username"    = data.coder_workspace_owner.me.name
+  })
   annotations = {
     "com.coder.user.email"     = data.coder_workspace_owner.me.email
     "com.coder.workspace.id"   = data.coder_workspace.me.id
@@ -112,7 +127,7 @@ resource "kubernetes_deployment_v1" "this" {
     }
     template {
       metadata {
-        labels      = local.labels
+        labels      = local.pod_labels
         annotations = local.annotations
       }
       spec {

deployments/ai.coder.com/demo/devbox/workspace.tf

@@ -2,6 +2,21 @@ locals {
   labels = {
     "com.coder.workspace.uuid" = random_uuid.this.result
   }
+
+  # spec.selector.match_labels is immutable: changing local.labels would force a
+  # Deployment replacement and recreate running workspaces. New labels therefore go
+  # here and are applied to the pod template only. merge() guarantees pod_labels is a
+  # superset of labels, which Kubernetes requires of the selector.
+  pod_labels = merge(local.labels, {
+    "app.kubernetes.io/name"     = "coder-workspace"
+    "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+    "app.kubernetes.io/part-of"  = "coder"
+    "com.coder.resource"         = "true"
+    "com.coder.workspace.id"     = data.coder_workspace.me.id
+    "com.coder.workspace.name"   = data.coder_workspace.me.name
+    "com.coder.user.id"          = data.coder_workspace_owner.me.id
+    "com.coder.user.username"    = data.coder_workspace_owner.me.name
+  })
   annotations = {
     "com.coder.user.email"     = data.coder_workspace_owner.me.email
     "com.coder.workspace.id"   = data.coder_workspace.me.id
@@ -215,7 +230,7 @@ resource "kubernetes_deployment_v1" "this" {
     }
     template {
       metadata {
-        labels      = local.labels
+        labels      = local.pod_labels
         annotations = local.annotations
       }
       spec {

deployments/ai.coder.com/demo/envbox/main.tf

@@ -140,6 +140,21 @@ resource "kubernetes_pod_v1" "main" {
   metadata {
     name      = "coder-${lower(data.coder_workspace_owner.me.name)}-${lower(data.coder_workspace.me.name)}"
     namespace = var.namespace
+
+    # Matches the label set used by every other Kubernetes template here, so network
+    # policy and fleet-wide queries can select this pod. It previously had none, which
+    # made it invisible to any label selector. Safe to add: this is a bare Pod, so there
+    # is no immutable Deployment selector to worry about.
+    labels = {
+      "app.kubernetes.io/name"     = "coder-workspace"
+      "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+      "app.kubernetes.io/part-of"  = "coder"
+      "com.coder.resource"         = "true"
+      "com.coder.workspace.id"     = data.coder_workspace.me.id
+      "com.coder.workspace.name"   = data.coder_workspace.me.name
+      "com.coder.user.id"          = data.coder_workspace_owner.me.id
+      "com.coder.user.username"    = data.coder_workspace_owner.me.name
+    }
   }
 
   spec {

deployments/ai.coder.com/demo/universal-sandbox/workspace.tf

@@ -2,6 +2,21 @@ locals {
   labels = {
     "com.coder.workspace.uuid" = data.coder_workspace.me.id
   }
+
+  # spec.selector.match_labels is immutable: changing local.labels would force a
+  # Deployment replacement and recreate running workspaces. New labels therefore go
+  # here and are applied to the pod template only. merge() guarantees pod_labels is a
+  # superset of labels, which Kubernetes requires of the selector.
+  pod_labels = merge(local.labels, {
+    "app.kubernetes.io/name"     = "coder-workspace"
+    "app.kubernetes.io/instance" = "coder-workspace-${data.coder_workspace.me.id}"
+    "app.kubernetes.io/part-of"  = "coder"
+    "com.coder.resource"         = "true"
+    "com.coder.workspace.id"     = data.coder_workspace.me.id
+    "com.coder.workspace.name"   = data.coder_workspace.me.name
+    "com.coder.user.id"          = data.coder_workspace_owner.me.id
+    "com.coder.user.username"    = data.coder_workspace_owner.me.name
+  })
   annotations = {
     "com.coder.user.email"     = data.coder_workspace_owner.me.email
     "com.coder.workspace.id"   = data.coder_workspace.me.id
@@ -118,7 +133,7 @@ resource "kubernetes_deployment_v1" "this" {
     }
     template {
       metadata {
-        labels      = local.labels
+        labels      = local.pod_labels
         annotations = local.annotations
       }
       spec {