[bug] Patch not applied to sandbox

[xolott]

Describe the bug
Patching pod labels or annotations doesn't work. These labels are used as selectors to apply network policies, and because the sandbox doesn't inherit labels, we need to patch the deployment.

To Reproduce
Using the guide example, add a customization block:

name: test-sandbox-routing
spec:
  description: Test Sandbox Routing
  cluster: "@{cluster}"
  forks:
    - forkOf:
        kind: Deployment
        namespace: "@{namespace}"
        name: "@{name}"
      customizations:
        patch:
          type: strategic
          value: |
            spec:
              metadata:
                annotations:
                  test-annotation: "true"

Expected behavior
It should add test-annotation as an annotation (or label, depending on if annotations or labels is used in the patch value)

Observed behavior
Nothing changes. My patch is not applied. Could the signadot labels assignment run after the patch?

[foxish]

Hi @xolott, thanks for filing an issue. If you are looking to change the annotations on the pod, the patch format may be an issue here. The right format would be:

name: test-sandbox-routing
spec:
  description: Test Sandbox Routing
  cluster: "@{cluster}"
  forks:
    - forkOf:
        kind: Deployment
        namespace: "@{namespace}"
        name: "@{name}"
      customizations:
        patch:
          type: strategic
          value: |
            spec:
              template:
                metadata:
                  annotations:
                    test-annotation: "true"

Labels present a more tricky case because accidentally adding labels that also match baseline services would break sandbox routing, so, there's a specific setting on app.signadot.com under "Settings > Preserved Labels" that you have to allow specific labels to exist on the sandboxes, and if you were specify something like test-label there, you should then be able to do the following:

name: test-sandbox-routing
spec:
  description: Test Sandbox Routing
  cluster: "@{cluster}"
  forks:
    - forkOf:
        kind: Deployment
        namespace: "@{namespace}"
        name: "@{name}"
      customizations:
        patch:
          type: strategic
          value: |
            spec:
              template:
                metadata:
                  labels: 
                    test-label: "true"

Please let me know if this works. It's unfortunately not as well documented as it should be, so, I'll track that as part of this issue as well.

[foxish]

This has been added to the docs under https://www.signadot.com/docs/reference/sandboxes/advanced/custom-patches#customizing-kubernetes-labels-on-sandbox-pods