From b2b6ecc5d701f48864f10e789e9bf30c6d3a969c Mon Sep 17 00:00:00 2001
From: Praveenrajmani <praveen@minio.io>
Date: Wed, 11 Sep 2024 16:16:19 +0530
Subject: [PATCH] fix: do not allow removing/changing the reserved labels

also, show only custom labels in `kubectl directpv list drives --show-labels`
and `kubectl directpv list volumes --show-labels`
---
 cmd/kubectl-directpv/list.go            | 10 +++++++--
 pkg/admin/label_drives.go               | 11 ++++++++++
 pkg/admin/label_volumes.go              | 11 ++++++++++
 pkg/apis/directpv.min.io/types/label.go | 29 +++++++++++++++++++++++++
 4 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/cmd/kubectl-directpv/list.go b/cmd/kubectl-directpv/list.go
index fe0756e2..cf9e0d57 100644
--- a/cmd/kubectl-directpv/list.go
+++ b/cmd/kubectl-directpv/list.go
@@ -21,6 +21,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/minio/directpv/pkg/apis/directpv.min.io/types"
 	"github.com/minio/directpv/pkg/consts"
 	"github.com/spf13/cobra"
 )
@@ -64,8 +65,13 @@ func validateListCmd() error {
 func labelsToString(labels map[string]string) string {
 	var labelsArray []string
 	for k, v := range labels {
-		k = strings.TrimPrefix(k, consts.GroupName+"/")
-		labelsArray = append(labelsArray, fmt.Sprintf("%s=%v", k, v))
+		if !types.LabelKey(k).IsReserved() {
+			k = strings.TrimPrefix(k, consts.GroupName+"/")
+			labelsArray = append(labelsArray, fmt.Sprintf("%s=%v", k, v))
+		}
+	}
+	if len(labelsArray) == 0 {
+		return "-"
 	}
 	sort.Strings(labelsArray)
 	return strings.Join(labelsArray, ",")
diff --git a/pkg/admin/label_drives.go b/pkg/admin/label_drives.go
index eed8988e..ab09e943 100644
--- a/pkg/admin/label_drives.go
+++ b/pkg/admin/label_drives.go
@@ -63,6 +63,17 @@ func (client *Client) LabelDrives(ctx context.Context, args LabelDriveArgs, labe
 		log = nullLogger
 	}
 
+	for _, label := range labels {
+		if label.Key.IsReserved() {
+			action := "use"
+			if label.Remove {
+				action = "remove"
+			}
+			err = fmt.Errorf("cannot %v reserved key %v", action, label.Key)
+			return
+		}
+	}
+
 	var processed bool
 	ctx, cancelFunc := context.WithCancel(ctx)
 	defer cancelFunc()
diff --git a/pkg/admin/label_volumes.go b/pkg/admin/label_volumes.go
index 6817a219..67e3c154 100644
--- a/pkg/admin/label_volumes.go
+++ b/pkg/admin/label_volumes.go
@@ -51,6 +51,17 @@ func (client *Client) LabelVolumes(ctx context.Context, args LabelVolumeArgs, la
 		log = nullLogger
 	}
 
+	for _, label := range labels {
+		if label.Key.IsReserved() {
+			action := "use"
+			if label.Remove {
+				action = "remove"
+			}
+			err = fmt.Errorf("cannot %v reserved key %v", action, label.Key)
+			return
+		}
+	}
+
 	ctx, cancelFunc := context.WithCancel(ctx)
 	defer cancelFunc()
 
diff --git a/pkg/apis/directpv.min.io/types/label.go b/pkg/apis/directpv.min.io/types/label.go
index 43d7e24d..72425b63 100644
--- a/pkg/apis/directpv.min.io/types/label.go
+++ b/pkg/apis/directpv.min.io/types/label.go
@@ -96,6 +96,35 @@ const (
 	PluginVersionLabelKey LabelKey = consts.GroupName + "/plugin-version"
 )
 
+var reservedLabelKeys = map[LabelKey]struct{}{
+	NodeLabelKey:           {},
+	DriveNameLabelKey:      {},
+	AccessTierLabelKey:     {},
+	DriveLabelKey:          {},
+	VersionLabelKey:        {},
+	CreatedByLabelKey:      {},
+	PodNameLabelKey:        {},
+	PodNSLabelKey:          {},
+	LatestVersionLabelKey:  {},
+	TopologyDriverIdentity: {},
+	TopologyDriverRack:     {},
+	TopologyDriverZone:     {},
+	TopologyDriverRegion:   {},
+	MigratedLabelKey:       {},
+	RequestIDLabelKey:      {},
+	SuspendLabelKey:        {},
+	VolumeClaimIDLabelKey:  {},
+	ClaimIDLabelKey:        {},
+	ImageTagLabelKey:       {},
+	PluginVersionLabelKey:  {},
+}
+
+// IsReserved returns if the key is a reserved key
+func (k LabelKey) IsReserved() bool {
+	_, found := reservedLabelKeys[k]
+	return found || strings.HasPrefix(string(k), VolumeClaimIDLabelKeyPrefix)
+}
+
 // LabelValue is a type definition for label value
 type LabelValue string