Fix PDB label selectors - #764
Open
pbenas wants to merge 1 commit into
Open
Conversation
pbenas
force-pushed
the
fix-pdb-label-selector
branch
from
June 23, 2026 11:20
dce4110 to
362313c
Compare
pbenas
marked this pull request as draft
June 23, 2026 11:22
pbenas
marked this pull request as ready for review
June 23, 2026 11:22
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes the poddisruptionbudget validation policy so that matching between a PodDisruptionBudget and a workload is based on the workload’s pod template labels (spec.template.metadata.labels) rather than the workload selector’s matchLabels, which aligns with how PDB selectors actually target pods.
Changes:
- Updated the Rego policy logic to compare PDB selector
matchLabelsagainst workload pod template labels. - Updated the website documentation snippet to reflect the corrected matching logic.
- Updated generated ConstraintTemplate artifacts (library + ArtifactHub) and adjusted unit test inputs.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| website/docs/validation/poddisruptionbudget.md | Updates the documented Rego snippet to use pod template labels for matching. |
| src/general/poddisruptionbudget/src.rego | Fixes the core matching logic to use spec.template.metadata.labels. |
| src/general/poddisruptionbudget/src_test.rego | Updates test inputs for the new label source (and is the right place to add a regression test for the specific bug scenario). |
| library/general/poddisruptionbudget/template.yaml | Regenerates the published template with the corrected Rego logic. |
| artifacthub/library/general/poddisruptionbudget/1.0.4/template.yaml | Updates the ArtifactHub-published template with the corrected Rego logic. |
| artifacthub/library/general/poddisruptionbudget/1.0.4/artifacthub-pkg.yml | Updates the ArtifactHub digest to reflect the template content change. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
pbenas
force-pushed
the
fix-pdb-label-selector
branch
from
June 23, 2026 11:59
ca561fc to
c16fbc7
Compare
The actual matching between PDB and deployment is based on the pod template labels (`spec.template.metadata.labels`) rather than on the configured label selector (`.spec.slector.matchLabels`). The template can have more labels than the matchLabel selects on and PDB would still apply in such a case. fixes open-policy-agent#755 Signed-off-by: Petr Benas <petrbenas@gmail.com>
pbenas
force-pushed
the
fix-pdb-label-selector
branch
from
June 29, 2026 08:02
c16fbc7 to
eac8625
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
The actual matching between PDB and deployment is based on the pod template labels (
spec.template.metadata.labels) rather than on the configured label selector (.spec.slector.matchLabels). The template can have more labels than the matchLabel selects on and PDB would still apply in such a case.Which issue(s) does this PR fix:
fixes #755
Special notes for your reviewer:
Disclaimer: This is my first contribution to upstream gatekeeper library.