CM-1112: Fix cluster-monitoring set as annotation instead of label

[sebrandon1]

Summary

• Moves openshift.io/cluster-monitoring: "true" from annotations to labels on the cert-manager namespace manifest
• Regenerates bindata.go to match

Per the OCP docs, cluster monitoring requires the openshift.io/cluster-monitoring: "true" key to be set as a label on the namespace. The operator was incorrectly setting it as an annotation, which prevented Prometheus from discovering the namespace for metrics scraping.

Note on existing clusters: The operator's static resource controller (library-go EnsureObjectMeta) merges labels additively. On upgrade, the label will be added but the old annotation will remain. This is harmless — monitoring only checks for the label.

Cluster verification (OCP 4.19)

Before — label missing, only annotation set:

$ oc get ns cert-manager -o jsonpath='{.metadata.annotations.openshift\.io/cluster-monitoring}'
true

$ oc get ns cert-manager -o jsonpath='{.metadata.labels.openshift\.io/cluster-monitoring}'
(empty)

After — label correctly set:

$ oc get ns cert-manager -o jsonpath='{.metadata.labels.openshift\.io/cluster-monitoring}'
true

$ oc get ns cert-manager -o jsonpath='{.metadata.labels}'
{
    "kubernetes.io/metadata.name": "cert-manager",
    "openshift.io/cluster-monitoring": "true",
    "pod-security.kubernetes.io/audit": "restricted",
    "pod-security.kubernetes.io/audit-version": "latest",
    "pod-security.kubernetes.io/warn": "restricted",
    "pod-security.kubernetes.io/warn-version": "latest"
}

The old annotation remains on existing clusters (additive merge), which is harmless:

$ oc get ns cert-manager -o jsonpath='{.metadata.annotations.openshift\.io/cluster-monitoring}'
true

Fixes #336

Test plan

• Unit tests pass (make test)
• Verified on live OCP 4.19 cluster: label present after applying fix
• CI e2e tests pass

Summary by CodeRabbit

• Chores
  • Updated the cert-manager namespace manifest so the cluster monitoring setting is now applied via metadata.labels instead of metadata.annotations.

[openshift-ci-robot]

@sebrandon1: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Moves openshift.io/cluster-monitoring: "true" from annotations to labels on the cert-manager namespace manifest
• Regenerates bindata.go to match

Per the OCP docs, cluster monitoring requires the openshift.io/cluster-monitoring: "true" key to be set as a label on the namespace. The operator was incorrectly setting it as an annotation, which prevented Prometheus from scraping cert-manager metrics.

Note on existing clusters: The operator static resource controller (library-go EnsureObjectMeta) merges labels additively. On upgrade, the label will be added but the old annotation will remain. This is harmless -- monitoring only checks for the label.

Fixes #336

Test plan

• Unit tests pass (make test)
• Verify oc get ns cert-manager -o jsonpath='{.metadata.labels}' includes openshift.io/cluster-monitoring: "true" after operator reconciles
• Verify cert-manager metrics appear in cluster monitoring after the fix

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 8fda6e41-6914-496f-a70e-203988846c11

📥 Commits

Reviewing files that changed from the base of the PR and between e6de6a6 and 5d34e5e.

📒 Files selected for processing (2)

• bindata/cert-manager-deployment/cert-manager-namespace.yaml
• pkg/operator/assets/bindata.go

✅ Files skipped from review due to trivial changes (1)

• bindata/cert-manager-deployment/cert-manager-namespace.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/operator/assets/bindata.go

---

Walkthrough

The cert-manager Namespace manifest and its embedded bindata asset now place openshift.io/cluster-monitoring: "true" under metadata.labels instead of metadata.annotations.

Changes

Namespace monitoring label placement

Layer / File(s)	Summary
Manifest and asset update bindata/cert-manager-deployment/cert-manager-namespace.yaml, pkg/operator/assets/bindata.go	openshift.io/cluster-monitoring: "true" is moved from metadata.annotations to metadata.labels in both the source manifest and the embedded asset bytes.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: moving cluster-monitoring from an annotation to a label.
Linked Issues check	✅ Passed	The PR updates the namespace manifest and regenerated bindata to place openshift.io/cluster-monitoring under metadata.labels as requested in #336.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested label fix and matching generated asset update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Stable And Deterministic Test Names	✅ Passed	The PR only changes a YAML namespace manifest and regenerated bindata; no Ginkgo test titles were added or modified.
Test Structure And Quality	✅ Passed	PR only changes a YAML asset and regenerated bindata; no Ginkgo tests were added or modified, so the checklist is not applicable.
Microshift Test Compatibility	✅ Passed	Only two manifest/bindata files changed; no Ginkgo e2e tests or new MicroShift-sensitive APIs were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; the diff only changes a namespace YAML and regenerated bindata, so SNO compatibility is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a Namespace label/annotation correction changed; no replicas, affinities, nodeSelectors, PDBs, or topology-aware scheduling constraints were introduced.
Ote Binary Stdout Contract	✅ Passed	PASS: Diff only updates a YAML asset and regenerated bindata bytes; no main/init/TestMain/suite setup or stdout-writing calls were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only the namespace YAML and generated bindata changed; no Ginkgo e2e tests or network code were added.
No-Weak-Crypto	✅ Passed	Diff only moves a namespace YAML key and regenerates bindata; no MD5/SHA1/DES/RC4/custom crypto/secret comparisons appear in touched files.
Container-Privileges	✅ Passed	Only a Namespace label/asset changed; no privileged, host*, SYS_ADMIN, root, or allowPrivilegeEscalation settings were added.
No-Sensitive-Data-In-Logs	✅ Passed	The only changed content is the cert-manager namespace YAML and regenerated bindata; no logging calls or sensitive data exposure appear in the modified files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sebrandon1
Once this PR has been reviewed and has the lgtm label, please assign bharath-b-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sebrandon1: This pull request references CM-1112 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Moves openshift.io/cluster-monitoring: "true" from annotations to labels on the cert-manager namespace manifest
• Regenerates bindata.go to match

Per the OCP docs, cluster monitoring requires the openshift.io/cluster-monitoring: "true" key to be set as a label on the namespace. The operator was incorrectly setting it as an annotation, which prevented Prometheus from discovering the namespace for metrics scraping.

Note on existing clusters: The operator's static resource controller (library-go EnsureObjectMeta) merges labels additively. On upgrade, the label will be added but the old annotation will remain. This is harmless — monitoring only checks for the label.

Cluster verification (OCP 4.19)

Before — label missing, only annotation set:

$ oc get ns cert-manager -o jsonpath='{.metadata.annotations.openshift\.io/cluster-monitoring}'
true

$ oc get ns cert-manager -o jsonpath='{.metadata.labels.openshift\.io/cluster-monitoring}'
(empty)

After — label correctly set:

$ oc get ns cert-manager -o jsonpath='{.metadata.labels.openshift\.io/cluster-monitoring}'
true

$ oc get ns cert-manager -o jsonpath='{.metadata.labels}'
{
   "kubernetes.io/metadata.name": "cert-manager",
   "openshift.io/cluster-monitoring": "true",
   "pod-security.kubernetes.io/audit": "restricted",
   "pod-security.kubernetes.io/audit-version": "latest",
   "pod-security.kubernetes.io/warn": "restricted",
   "pod-security.kubernetes.io/warn-version": "latest"
}

The old annotation remains on existing clusters (additive merge), which is harmless:

$ oc get ns cert-manager -o jsonpath='{.metadata.annotations.openshift\.io/cluster-monitoring}'
true

Fixes #336

Test plan

• Unit tests pass (make test)
• Verified on live OCP 4.19 cluster: label present after applying fix
• CI e2e tests pass

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[sebrandon1]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[sebrandon1]

/retest

[openshift-ci]

@sebrandon1: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-operator-tech-preview	5d34e5e	link	false	/test e2e-operator-tech-preview
ci/prow/e2e-operator	5d34e5e	link	true	/test e2e-operator

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.