fix: Remove labels that aren't referenced by explicit fields.

Author: vercel-eddie

pkg/admin/local.go

@@ -112,6 +112,7 @@ func (l *adminService) CreateBridge(ctx context.Context, req *bridgev1.CreateBri
 		resources.SetNamespace(targetNS),
 		resources.PruneAllMetadata(),
 		resources.StripOrphanedVolumes(),
+		resources.StripUnreferencedLabels(),
 		resources.InjectProxyImage(proxyImage),
 		resources.ClearClusterIPs(),
 		resources.SuffixNames(suffix),

pkg/k8s/resources/manifests_test.go

@@ -58,6 +58,7 @@ func testCreateFromManifests(t *testing.T, client *k8stesting.Clientset, sourceM
 
 	transforms := []Transformer{
 		PruneAllMetadata(),
+		StripUnreferencedLabels(),
 		InjectProxyImage(testProxyImage),
 		SuffixNames(testSuffix),
 		InjectLabels(),
@@ -487,6 +488,7 @@ data:
 
 	transforms := []Transformer{
 		PruneAllMetadata(),
+		StripUnreferencedLabels(),
 		InjectProxyImage(testProxyImage),
 		SuffixNames(testSuffix),
 		InjectLabels(),
@@ -580,6 +582,197 @@ data:
 	assert.Equal(t, "bridge-value", bridgeCM.Data["DB_HOST"])
 }
 
+func TestStripUnreferencedLabels_RemovesSourceLabels(t *testing.T) {
+	manifests := packTestManifests(t, map[string]string{
+		"deploy.yaml": `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  labels:
+    app: my-app
+    version: v1
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+        version: v1
+    spec:
+      containers:
+      - name: app
+        image: my-app:latest
+        ports:
+        - containerPort: 3000
+`,
+	})
+
+	client := k8stesting.NewSimpleClientset()
+	deployName, _, err := testCreateFromManifests(t, client, manifests, "default")
+	require.NoError(t, err)
+
+	deploy, err := client.AppsV1().Deployments("default").Get(context.Background(), deployName, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// Source labels (app, version) should be stripped.
+	assert.Empty(t, deploy.Labels["app"], "source label 'app' should be stripped from deployment metadata")
+	assert.Empty(t, deploy.Labels["version"], "source label 'version' should be stripped from deployment metadata")
+
+	// Bridge labels should still be present (injected after strip).
+	assert.Equal(t, meta.BridgeTypeProxy, deploy.Labels[meta.LabelBridgeType])
+}
+
+func TestStripUnreferencedLabels_PreservesFieldRefLabels(t *testing.T) {
+	manifests := packTestManifests(t, map[string]string{
+		"deploy.yaml": `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  labels:
+    app: my-app
+    version: v1
+    region: us-east-1
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+        version: v1
+        region: us-east-1
+    spec:
+      containers:
+      - name: app
+        image: my-app:latest
+        ports:
+        - containerPort: 3000
+        env:
+        - name: APP_VERSION
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.labels['version']
+        - name: REGION
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.labels['region']
+`,
+	})
+
+	client := k8stesting.NewSimpleClientset()
+	deployName, _, err := testCreateFromManifests(t, client, manifests, "default")
+	require.NoError(t, err)
+
+	deploy, err := client.AppsV1().Deployments("default").Get(context.Background(), deployName, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// Labels referenced by fieldRef should be preserved.
+	assert.Equal(t, "v1", deploy.Labels["version"], "fieldRef-referenced label 'version' should be preserved")
+	assert.Equal(t, "us-east-1", deploy.Labels["region"], "fieldRef-referenced label 'region' should be preserved")
+
+	// Non-referenced source labels should be stripped.
+	assert.Empty(t, deploy.Labels["app"], "non-referenced label 'app' should be stripped")
+
+	// Pod template labels should also preserve fieldRef-referenced labels.
+	podLabels := deploy.Spec.Template.Labels
+	assert.Equal(t, "v1", podLabels["version"])
+	assert.Equal(t, "us-east-1", podLabels["region"])
+}
+
+func TestStripUnreferencedLabels_InitContainerFieldRef(t *testing.T) {
+	manifests := packTestManifests(t, map[string]string{
+		"deploy.yaml": `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  labels:
+    app: my-app
+    tier: backend
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+        tier: backend
+    spec:
+      initContainers:
+      - name: init
+        image: init:latest
+        env:
+        - name: TIER
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.labels['tier']
+      containers:
+      - name: app
+        image: my-app:latest
+        ports:
+        - containerPort: 3000
+`,
+	})
+
+	client := k8stesting.NewSimpleClientset()
+	deployName, _, err := testCreateFromManifests(t, client, manifests, "default")
+	require.NoError(t, err)
+
+	deploy, err := client.AppsV1().Deployments("default").Get(context.Background(), deployName, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// Label referenced by initContainer fieldRef should be preserved.
+	assert.Equal(t, "backend", deploy.Labels["tier"], "fieldRef label from initContainer should be preserved")
+
+	// Non-referenced label should be stripped.
+	assert.Empty(t, deploy.Labels["app"])
+}
+
+func TestStripUnreferencedLabels_NoFieldRefs(t *testing.T) {
+	manifests := packTestManifests(t, map[string]string{
+		"deploy.yaml": `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+  labels:
+    app: my-app
+    team: platform
+spec:
+  selector:
+    matchLabels:
+      app: my-app
+  template:
+    metadata:
+      labels:
+        app: my-app
+        team: platform
+    spec:
+      containers:
+      - name: app
+        image: my-app:latest
+        ports:
+        - containerPort: 3000
+`,
+	})
+
+	client := k8stesting.NewSimpleClientset()
+	deployName, _, err := testCreateFromManifests(t, client, manifests, "default")
+	require.NoError(t, err)
+
+	deploy, err := client.AppsV1().Deployments("default").Get(context.Background(), deployName, metav1.GetOptions{})
+	require.NoError(t, err)
+
+	// All source labels should be stripped when there are no fieldRefs.
+	assert.Empty(t, deploy.Labels["app"])
+	assert.Empty(t, deploy.Labels["team"])
+
+	// Bridge labels should still be present.
+	assert.Equal(t, meta.BridgeTypeProxy, deploy.Labels[meta.LabelBridgeType])
+}
+
 // packTestManifests creates a tar.gz archive from a map of filename to YAML content.
 func packTestManifests(t *testing.T, files map[string]string) []byte {
 	t.Helper()

pkg/k8s/resources/transforms.go

@@ -1,6 +1,8 @@
 package resources
 
 import (
+	"strings"
+
 	"github.com/vercel/bridge/pkg/k8s/meta"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -81,6 +83,82 @@ func filterMounts(mounts []corev1.VolumeMount, validVolumes map[string]bool) []c
 	return kept
 }
 
+// StripUnreferencedLabels returns a Transformer that removes all labels from
+// Deployments (both object metadata and pod template metadata) except those
+// referenced by fieldRef expressions in the pod spec (e.g. downward API env
+// vars like metadata.labels['key']). This prevents existing Services from
+// selecting bridge pods via inherited source labels while preserving labels
+// required by the pod's runtime configuration.
+// Runs before InjectLabels — operates on original source labels.
+func StripUnreferencedLabels() Transformer {
+	return TransformFunc(func(_ *TransformContext, b *Bundle) error {
+		for _, r := range b.Resources {
+			deploy, ok := r.Object.(*appsv1.Deployment)
+			if !ok {
+				continue
+			}
+			referenced := collectFieldRefLabels(&deploy.Spec.Template.Spec)
+			deploy.Labels = keepOnly(deploy.Labels, referenced)
+			deploy.Spec.Template.Labels = keepOnly(deploy.Spec.Template.Labels, referenced)
+		}
+		return nil
+	})
+}
+
+// collectFieldRefLabels scans all containers in a pod spec for env vars that
+// use fieldRef with metadata.labels['...'] and returns the set of label keys.
+func collectFieldRefLabels(podSpec *corev1.PodSpec) map[string]bool {
+	keys := make(map[string]bool)
+	for _, c := range podSpec.Containers {
+		addFieldRefLabels(&c, keys)
+	}
+	for _, c := range podSpec.InitContainers {
+		addFieldRefLabels(&c, keys)
+	}
+	return keys
+}
+
+func addFieldRefLabels(c *corev1.Container, keys map[string]bool) {
+	for _, env := range c.Env {
+		if env.ValueFrom == nil || env.ValueFrom.FieldRef == nil {
+			continue
+		}
+		if key, ok := parseLabelFieldPath(env.ValueFrom.FieldRef.FieldPath); ok {
+			keys[key] = true
+		}
+	}
+}
+
+// parseLabelFieldPath extracts the label key from a fieldPath like
+// metadata.labels['app'] or metadata.labels['app.kubernetes.io/name'].
+func parseLabelFieldPath(fieldPath string) (string, bool) {
+	const prefix = "metadata.labels['"
+	const suffix = "']"
+	if strings.HasPrefix(fieldPath, prefix) && strings.HasSuffix(fieldPath, suffix) {
+		key := fieldPath[len(prefix) : len(fieldPath)-len(suffix)]
+		return key, true
+	}
+	return "", false
+}
+
+// keepOnly returns a new map containing only the keys present in the keep set.
+// Returns nil if no labels remain or labels is nil.
+func keepOnly(labels map[string]string, keep map[string]bool) map[string]string {
+	if len(labels) == 0 {
+		return nil
+	}
+	filtered := make(map[string]string)
+	for k, v := range labels {
+		if keep[k] {
+			filtered[k] = v
+		}
+	}
+	if len(filtered) == 0 {
+		return nil
+	}
+	return filtered
+}
+
 // InjectProxyImage returns a Transformer that finds the target Deployment and
 // swaps its first container for the bridge proxy. It also sets replicas to 1.
 // Runs before SuffixNames — finds the deployment by tc.SourceName.