feat(mutlicluster): Add support for excluding labels and annotations from federated and mirror services

controller/gen/apis/link/v1alpha3/types.go

@@ -91,7 +91,7 @@ type LinkCondition struct {
 	// +optional
 	Message string `json:"message"`
 	// LocalRef is a reference to the local mirror or federated service.
-	LocalRef ObjectRef `json:"localRef,omitempty"`
+	LocalRef *ObjectRef `json:"localRef,omitempty"`
 }
 
 type ObjectRef struct {

multicluster/charts/linkerd-multicluster/templates/local-service-mirror.yaml

@@ -102,6 +102,8 @@ spec:
         - -enable-pprof={{.Values.localServiceMirror.enablePprof | default false}}
         - -local-mirror
         - -federated-service-selector={{.Values.localServiceMirror.federatedServiceSelector}}
+        - -excluded-labels={{.Values.localServiceMirror.excludedLabels}}
+        - -excluded-annotations={{.Values.localServiceMirror.excludedAnnotations}}
         {{- if or .Values.localServiceMirror.additionalEnv .Values.localServiceMirror.experimentalEnv }}
         env:
         {{- with .Values.localServiceMirror.additionalEnv }}

multicluster/charts/linkerd-multicluster/values.yaml

@@ -126,6 +126,14 @@ localServiceMirror:
   # -- Label selector for federated service members in the local cluster.
   federatedServiceSelector: "mirror.linkerd.io/federated=member"
 
+  # -- Labels that should not be copied from the local service to the mirror
+  # service.
+  excludedLabels: ""
+
+  # -- Annotations that should not be copied from the local service to the
+  # mirror service.
+  excludedAnnotations: ""
+
   # -- Number of local service mirror replicas to run
   replicas: 1
 

multicluster/cmd/link.go

@@ -58,6 +58,8 @@ type (
 		federatedServiceSelector string
 		gatewayAddresses         string
 		gatewayPort              uint32
+		excludedAnnotations      []string
+		excludedLabels           []string
 		ha                       bool
 		enableGateway            bool
 		enableServiceMirror      bool
@@ -262,6 +264,8 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 					ClusterCredentialsSecret:      fmt.Sprintf("cluster-credentials-%s", opts.clusterName),
 					RemoteDiscoverySelector:       remoteDiscoverySelector,
 					FederatedServiceSelector:      federatedServiceSelector,
+					ExcludedAnnotations:           opts.excludedAnnotations,
+					ExcludedLabels:                opts.excludedLabels,
 				},
 			}
 
@@ -400,6 +404,8 @@ A full list of configurable values can be found at https://github.com/linkerd/li
 	cmd.Flags().StringVar(&opts.federatedServiceSelector, "federated-service-selector", opts.federatedServiceSelector, "Selector (label query) for federated service members in the target cluster")
 	cmd.Flags().StringVar(&opts.gatewayAddresses, "gateway-addresses", opts.gatewayAddresses, "If specified, overwrites gateway addresses when gateway service is not type LoadBalancer (comma separated list)")
 	cmd.Flags().Uint32Var(&opts.gatewayPort, "gateway-port", opts.gatewayPort, "If specified, overwrites gateway port when gateway service is not type LoadBalancer")
+	cmd.Flags().StringSliceVar(&opts.excludedAnnotations, "excluded-annotations", opts.excludedAnnotations, "Annotations to exclude when mirroring services")
+	cmd.Flags().StringSliceVar(&opts.excludedLabels, "excluded-labels", opts.excludedLabels, "Labels to exclude when mirroring services")
 	cmd.Flags().BoolVar(&opts.ha, "ha", opts.ha, "Enable HA configuration for the service-mirror deployment (default false)")
 	cmd.Flags().BoolVar(&opts.enableGateway, "gateway", opts.enableGateway, "If false, allows a link to be created against a cluster that does not have a gateway service")
 	cmd.Flags().BoolVar(&opts.enableServiceMirror, "service-mirror", opts.enableServiceMirror, "If false, only outputs link manifest and credentials secrets")
@@ -508,6 +514,8 @@ func newLinkOptionsWithDefault() (*linkOptions, error) {
 		federatedServiceSelector: fmt.Sprintf("%s=%s", k8s.DefaultFederatedServiceSelector, "member"),
 		gatewayAddresses:         "",
 		gatewayPort:              0,
+		excludedAnnotations:      []string{},
+		excludedLabels:           []string{},
 		ha:                       false,
 		enableGateway:            true,
 		enableServiceMirror:      true,

multicluster/cmd/service-mirror/main.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -55,6 +56,8 @@ func Main(args []string) {
 	enablePprof := cmd.Bool("enable-pprof", false, "Enable pprof endpoints on the admin server")
 	localMirror := cmd.Bool("local-mirror", false, "watch the local cluster for federated service members")
 	federatedServiceSelector := cmd.String("federated-service-selector", k8s.DefaultFederatedServiceSelector, "Selector (label query) for federated service members in the local cluster")
+	exludedAnnotations := cmd.String("excluded-annotations", "", "Annotations to exclude when mirroring services")
+	excludedLabels := cmd.String("excluded-labels", "", "Labels to exclude when mirroring services")
 	probeSvc := cmd.String("probe-service", "", "Name of the target cluster probe service")
 
 	flags.ConfigureAndParse(cmd, args)
@@ -122,7 +125,35 @@ func Main(args []string) {
 
 	if *localMirror {
 		run = func(ctx context.Context) {
-			err = startLocalClusterWatcher(ctx, *namespace, controllerK8sAPI, linksAPI, *requeueLimit, *repairPeriod, *enableHeadlessSvc, *enableNamespaceCreation, *federatedServiceSelector)
+			federatedLabelSelector, err := metav1.ParseToLabelSelector(*federatedServiceSelector)
+			if err != nil {
+				log.Fatalf("failed to parse federated service selector: %s", err)
+			}
+
+			excludedLabelList := []string{}
+			if *excludedLabels != "" {
+				excludedLabelList = strings.Split(*excludedLabels, ",")
+			}
+			excludedAnnotationList := []string{}
+			if *exludedAnnotations != "" {
+				excludedAnnotationList = strings.Split(*exludedAnnotations, ",")
+			}
+
+			link := v1alpha3.Link{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "local",
+					Namespace: *namespace,
+				},
+				Spec: v1alpha3.LinkSpec{
+					TargetClusterName:        "",
+					Selector:                 nil,
+					RemoteDiscoverySelector:  nil,
+					FederatedServiceSelector: federatedLabelSelector,
+					ExcludedAnnotations:      excludedAnnotationList,
+					ExcludedLabels:           excludedLabelList,
+				},
+			}
+			err = startLocalClusterWatcher(ctx, *namespace, controllerK8sAPI, linksAPI, *requeueLimit, *repairPeriod, *enableHeadlessSvc, *enableNamespaceCreation, link)
 			if err != nil {
 				log.Fatalf("Failed to start local cluster watcher: %s", err)
 			}
@@ -360,25 +391,8 @@ func startLocalClusterWatcher(
 	repairPeriod time.Duration,
 	enableHeadlessSvc bool,
 	enableNamespaceCreation bool,
-	federatedServiceSelector string,
+	link v1alpha3.Link,
 ) error {
-	federatedLabelSelector, err := metav1.ParseToLabelSelector(federatedServiceSelector)
-	if err != nil {
-		return fmt.Errorf("failed to parse federated service selector: %w", err)
-	}
-
-	link := v1alpha3.Link{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      "local",
-			Namespace: namespace,
-		},
-		Spec: v1alpha3.LinkSpec{
-			TargetClusterName:        "",
-			Selector:                 nil,
-			RemoteDiscoverySelector:  nil,
-			FederatedServiceSelector: federatedLabelSelector,
-		},
-	}
 	cw, err := servicemirror.NewRemoteClusterServiceWatcher(
 		ctx,
 		namespace,