[Defilan]

What

Adds spec.proxy.podLabels and spec.proxy.podAnnotations to ModelRouter. Both merge into the router-proxy pod template.

spec:
  proxy:
    podLabels:
      netpol.example.com/apiserver: allow
    podAnnotations:
      example.com/team: llm

Why

Fixes #2282

Requested on Discord. Clusters that grant egress through label-based NetworkPolicies could select router-proxy pods only by the operator's own labels. A proxy that does ModelPool activation or resolution: endpoint tracking also needs to reach the API server.

How

• Merge. Labels go through mergePodLabels, the same helper InferenceService uses. The operator's keys win on collision: app and inference.llmkube.dev/model-router, the config-hash annotation, and the prometheus.io annotations when --emit-scrape-annotations is on.
• Selectors. The Deployment selector and the Service selector stay on routerProxySelectorLabels(mr). Before this change the selector and the template labels were the same map. They're now separate, so a user label can't reach the immutable selector.
• Removal. The update path merges with mergePreservingExternal ([BUG] ModelRouter controller overwrites pod template annotations on reconcile #456), which keeps template keys the desired template no longer sets. Without extra work, a label removed from podLabels would stay on the pods.
  • The Deployment now records which user keys it applied, in inference.llmkube.dev/applied-pod-labels and inference.llmkube.dev/applied-pod-annotations.
  • On the next reconcile, a recorded key the spec no longer sets is deleted before the merge.
  • Keys other tools add (kubectl rollout restart's restartedAt, GitOps sync labels) aren't recorded, so they pass through as before.
  • The record lives on the Deployment's own metadata, not the template, so writing it doesn't roll the pods.
  • A user key the operator overrode isn't recorded, so the operator never prunes one of its own keys.
• Scrape cleanup. With scrape annotations off, the existing cleanup deleted any prometheus.io/* key whose value matched the operator's. It now skips keys podAnnotations sets, so a user's own scrape annotations survive.

InferenceService's podLabels still has the removal leak: a removed label stays on its pods. That's out of scope here, and I can file it separately.

Consumers

• Deployment and Service selectors: unchanged. The tests assert this across add, change and remove.
• Pod template: gains the user keys, so changing these fields rolls the proxy pods, as any template change does.
• Deployment metadata: gains the two record annotations, only while user keys are set. They're removed when the fields are emptied.
• CRD: two new optional map fields. Regenerated with make generate manifests chart-crds.

Testing

make gate passes: regen, drift, fmt, vet, lint-all and the full suite. Chart lint passes. helm unittest isn't installed on this machine. The chart diff is only the regenerated CRD, so I'm relying on CI's make test-chart for the chart unit tests.

New tests are in internal/controller/router_proxy_podmeta_test.go:

• TestRouterDeploymentPodLabelsAndAnnotations covers the builder: the user keys land, the operator's app and config hash win, the selector holds only the operator labels, and the record lists only applied keys.

• TestReconcileRouterDeploymentPodMetadataLifecycle uses the fake client:

  • add keys;
  • have another tool add a label and restartedAt;
  • change one label and remove another, plus the annotation;
  • remove everything.

  It asserts that removed keys leave the template, the other tool's keys survive, the record tracks the spec, and the selector never changes.

• TestReconcileRouterDeploymentKeepsUserScrapeAnnotations: a user's prometheus.io/scrape and path survive the update path with scrape emission off.

Bite checks, with each production edit reverted on its own:

• Pruning removed:

  router_proxy_podmeta_test.go:120: label b removed from the spec is still on the template: map[a:changed app:coding-router-router-proxy b:2 gitops.example.com/sync:yes inference.llmkube.dev/model-router:coding-router]
  router_proxy_podmeta_test.go:123: annotation x removed from the spec is still on the template: map[inference.llmkube.dev/router-config-hash:hash kubectl.kubernetes.io/restartedAt:now x:1]
  

• Selector built from the merged labels:

  router_proxy_podmeta_test.go:50: selector = map[app:coding-router-router-proxy inference.llmkube.dev/model-router:coding-router netpol.example.com/apiserver:allow], want only the operator labels map[app:coding-router-router-proxy inference.llmkube.dev/model-router:coding-router]
  

• Scrape cleanup ignoring user keys:

  router_proxy_podmeta_test.go:178: prometheus.io/scrape = "", want the user's true
  

• Record not synced on update:

  router_proxy_podmeta_test.go:130: applied labels record = "a,b", want a
  

• User annotation overriding the operator's:

  router_proxy_podmeta_test.go:64: config hash = "spoofed", want the operator's value
  

Checklist

• Tests added/updated
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change)

AI assistance: this change was AI-assisted. I reviewed the diffs and supervised the build.

[codecov]

Codecov Report

❌ Patch coverage is 83.63636% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
api/v1alpha1/zz_generated.deepcopy.go	20.00%	8 Missing ⚠️
internal/controller/router_deployment_builder.go	97.77%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!