feat: adds labels for better discovery

[bartoszmajsak]

Summary by CodeRabbit

• New Features
  • Standardized labels for token-related namespaces and service accounts for improved consistency and discoverability.
• Refactor
  • Replaced legacy label construction with dedicated helper functions and removed the obsolete label utility.
• Tests
  • Updated tests to use the test framework’s context and switched to the current fake Kubernetes client for test interactions.

[coderabbitai]

Walkthrough

Adds dedicated label helper functions for token-related Kubernetes resources, updates the token manager to use them (removing the former commonLabels), and updates tests to use t.Context() and fake.NewClientset(). No exported APIs or core control flow logic were changed.

Changes

Cohort / File(s)	Summary
Token label helpers and integration maas-api/internal/token/labels.go, maas-api/internal/token/manager.go	Adds namespaceLabels and serviceAccountLabels; updates ensureTierNamespace and ensureServiceAccount to use the new helpers; removes the now-unused commonLabels.
Test client updates and context usage maas-api/internal/tier/mapper_test.go, maas-api/internal/token/reviewer_test.go	Replaces fake.NewSimpleClientset() with fake.NewClientset() in tests; reviewer_test.go uses t.Context() instead of context.Background() and drops the unused import.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

A rabbit stamps a tidy label,
On namespaces, accounts—quite stable.
Tests hop to a fresher set,
NewClientset—a perfect fit.
With paws that file and names that sing,
The warren’s tokens neatly spring.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title clearly summarizes the primary feature introduced—additional Kubernetes labels to improve resource discovery—reflecting the main code and test changes without extraneous detail.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3b85bed and bef32fa.

📒 Files selected for processing (4)

• maas-api/internal/tier/mapper_test.go (2 hunks)
• maas-api/internal/token/labels.go (1 hunks)
• maas-api/internal/token/manager.go (2 hunks)
• maas-api/internal/token/reviewer_test.go (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• maas-api/internal/token/reviewer_test.go

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

🔇 Additional comments (5)

maas-api/internal/token/manager.go (2)

137-137: LGTM! Cleaner label construction.

The use of namespaceLabels centralizes label logic and improves modularity.

---

174-174: LGTM! Cleaner label construction.

The use of serviceAccountLabels centralizes label logic and improves modularity.

maas-api/internal/token/labels.go (2)

3-11: LGTM! Well-structured namespace labels.

The label set follows Kubernetes conventions and provides clear identification for tier-based namespaces.

---

13-20: LGTM! Clean service account labels.

The label set is well-structured and avoids the username label concerns raised in previous reviews. The current implementation uses only instance and tier parameters, which are safe for Kubernetes label constraints.

maas-api/internal/tier/mapper_test.go (1)

158-158: LGTM! Updated to current fake clientset constructor.

The migration from fake.NewSimpleClientset() to fake.NewClientset() aligns with current Kubernetes client-go best practices and preserves test functionality.

Also applies to: 197-197

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e315444 and 3b85bed.

📒 Files selected for processing (4)

• maas-api/internal/tier/mapper_test.go (2 hunks)
• maas-api/internal/token/labels.go (1 hunks)
• maas-api/internal/token/manager.go (2 hunks)
• maas-api/internal/token/reviewer_test.go (2 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

🔇 Additional comments (6)

maas-api/internal/token/reviewer_test.go (2)

92-92: LGTM: Modern fake clientset constructor.

The switch from fake.NewSimpleClientset() to fake.NewClientset() aligns with current client-go best practices.

---

104-104: LGTM: Test context best practice.

Using t.Context() ensures the context is automatically canceled when the test completes, improving resource management and aligning with Go 1.21+ testing patterns.

maas-api/internal/tier/mapper_test.go (1)

158-158: LGTM: Consistent fake clientset migration.

Both test functions correctly migrate to fake.NewClientset(), maintaining consistency with the modern client-go constructor pattern used across the test suite.

Also applies to: 197-197

maas-api/internal/token/manager.go (2)

137-137: LGTM: Specialized namespace labeling.

The migration from commonLabels() to namespaceLabels(m.tenantName, tier) provides clearer intent and ensures namespace-specific labels are applied consistently.

---

174-174: LGTM: Specialized service account labeling.

The migration to serviceAccountLabels(m.tenantName, userTier, username) adds username-specific labeling, enabling better resource discovery and filtering by user.

maas-api/internal/token/labels.go (1)

3-11: LGTM: Namespace labels follow Kubernetes best practices.

The label structure correctly uses standard app.kubernetes.io/* labels and custom maas.opendatahub.io/* labels. The tier-namespace: "true" marker enables easy discovery of tier namespaces.

[dmytro-zaharnytskyi]

Nothing to add other than Coderabbit comment on username, as option - replace username label with {user-id: } and move raw username to an annotation.

But from other side, we can assume that there is no invalid username exists in maas.opendatahub.io/ :)

[bartoszmajsak]

Nothing to add other than Coderabbit comment on username, as option - replace username label with {user-id: } and move raw username to an annotation.

But from other side, we can assume that there is no invalid username exists in maas.opendatahub.io/ :)

Maybe we don't need it yet. I will remove. Speculative

[israel-hdez]

LGTM

[israel-hdez]

/label tide/merge-method-squash

[openshift-ci]

@israel-hdez: The label(s) tide/merge-method-squash cannot be applied, because the repository doesn't have them.

Details

In response to this:

/label tide/merge-method-squash

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[israel-hdez]

/label tide/merge-method-squash

[israel-hdez]

/lgtm

[israel-hdez]

/close

[openshift-ci]

@israel-hdez: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[israel-hdez]

/reopen

[openshift-ci]

@israel-hdez: Reopened this PR.

Details

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD ee76fea and 2 for PR HEAD bef32fa in total

[openshift-ci]

@bartoszmajsak: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/pr-image-mirror-maas-api	bef32fa	link	true	/test pr-image-mirror-maas-api

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jland-redhat]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bartoszmajsak, dmytro-zaharnytskyi, israel-hdez, jland-redhat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bartoszmajsak,dmytro-zaharnytskyi,israel-hdez,jland-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment