Duc NguyenandClaude Opus 5 1505471bc7 fix(label-studio): set the partof pod label from the release name ...

Each tenant namespace carries two NetworkPolicies created by KubePlus:

  restrict-cross-ns-traffic   podSelector {}                  same-namespace only
  allow-external-traffic      podSelector partof=<release>    allow all

Without the partof label only the first applies, so the ingress controller - which
lives in another namespace - is blocked and every request to the tenant returns 502
from nginx while Label Studio itself is perfectly healthy.

That label was only ever applied by the KubePlus mutating webhook at pod creation
time, and that webhook runs with failurePolicy: Ignore. When the webhook is broken,
pods are still admitted, just without the label, and the tenant goes dark silently.
Every pod recreated during such a window loses external access.

Set it in the pod template instead so it no longer depends on the webhook. The Helm
release name is exactly the value the policy expects (labelstudioservice-<namespace>).
The selector is left untouched, so this stays a valid in-place upgrade.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-14 13:59:31 +07:00

228 KiB

Raw History

View Raw