Reject reserved deletion job pod labels

Co-authored-by: Codex <noreply@openai.com>
Signed-off-by: tornquist <tornquist@squareup.com>

deploy/charts/buzz/templates/_operator-jobs.tpl

@@ -4,6 +4,11 @@
 {{- $root := .root -}}
 {{- if eq .type "deletionDrain" -}}
 {{- $job := $root.Values.operatorJobs.deletionDrain -}}
+{{- range $label := list "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" -}}
+{{- if hasKey $job.podLabels $label -}}
+{{- fail (printf "operatorJobs.deletionDrain.podLabels may not set chart-owned label %q" $label) -}}
+{{- end -}}
+{{- end -}}
 apiVersion: batch/v1
 kind: CronJob
 metadata:

deploy/charts/buzz/tests/deletion_drain_test.yaml

@@ -200,6 +200,24 @@ tests:
           content:
             name: RELAY_URL
 
+  - it: rejects chart-owned pod identity labels
+    set:
+      relayUrl: wss://buzz.example.com
+      ownerPubkey: "0000000000000000000000000000000000000000000000000000000000000000"
+      externalPostgresql.url: postgres://u:p@h:5432/d
+      externalRedis.url: redis://h:6379
+      s3.endpoint: https://s3.example.com
+      s3.bucket: buzz-media-example
+      s3.accessKey: test
+      s3.secretKey: test
+      operatorJobs.deletionDrain:
+        enabled: true
+        podLabels:
+          app.kubernetes.io/component: relay
+    asserts:
+      - failedTemplate:
+          errorPattern: 'operatorJobs.deletionDrain.podLabels may not set chart-owned label "app.kubernetes.io/component"'
+
   - it: rejects enablement without a Redis source
     set:
       relayUrl: wss://buzz.example.com