Check should warn when expected labels and annotations are confused

[olix0r]

I just lost a lot of time to setting the mirror.linkerd.io/exported=true annotation, when it should have been a label.

It would be awesome if linkerd check could flag this sort of thing. Off the top of my head:

• mirror.linkerd.io/exported should never be an annotation
• config.linkerd.io/* should never be a label
• linkerd.io/inject should never be a label

There may be others?

[Szymongib]

Hey @olix0r,
I was looking into it a little bit and came up with the following checks, that seems to make sense for me:

• Check that Data Plane Pods do not have:
  • config.linkerd.io/* as a label
  • linkerd.io/inject as a label
• Check that Services in DataPlaneNamespace, do not have:
  • mirror.linkerd.io/exported as annotation
  • config.linkerd.io/* as a label

Also, I found a lot of other annotations and labels in https://github.com/linkerd/linkerd2/blob/main/pkg/k8s/labels.go and I wonder for which of them we should also check and which are set by Control Plane, not user.
I assume all the proxy configuration annotations should be checked but not sure about others.

Please, let me know your thoughts, and if this approach makes sense I could help with that.

Thanks!

[Pothulapati]

Hey @Szymongib, Thanks for taking this up.

That makes sense.

• config.linkerd.io should always be a annotation, for pods and services ( I think we only set the opauqe ports annotation and nothing else for services).
• mirror.linkerd.io/exported and linkerd.io/inject are set as a labels (as they are set by the user).

I think we don't have to check for control plane annotations and labels as they will be mostly be configured correctly. We can start with the others and then move to control-plane.

Feel free to start working on it and raise a PR. I'm sure there will be more discussions that will be done in the PR.