restricting tekton.dev labels in metadata

[pritidesai]

Tekton resources are automatically assigned certain labels including the ones with tekton.dev. The labels are created and propagated from one resource to another using this group name to signify the association and relationship between pipeline task, taskRun, pipeline, and pipelineRun . We should restrict possibility of overwriting those labels otherwise it could result in conflicting resources.

Result of the discussion in PR #2826.

Opening this issue to track the work done in PR #2891 and possibly implementing the restriction.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[lbernick]

/priority backlog

[vdemeester]

/remove-lifecycle stale

[austinzhao-go]

thanks @afrittoli hints out.
TEP-0106 should also be applied with the similar constraints to avoid overwriting the Tekton metadata. marked a follow up action on my side to sync the work from this thread.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[lbernick]

@vdemeester is this closed now as a result of #6441?

[vdemeester]

@lbernick not really, #6441 was just about the "other projects" labels issues (chains.tekton.dev, …). This issue is more about restricting tekton.dev/* labels / annotations to only be set by us (tektoncd/pipeline controllers) and filtered from outside (aka not allowed).