Concierge controllers add labels to all created resources

test/integration/concierge_api_serving_certs_test.go

@@ -90,6 +90,10 @@ func TestAPIServingCertificateAutoCreationAndRotation(t *testing.T) {
 			require.NotEmpty(t, initialCACert)
 			require.NotEmpty(t, initialPrivateKey)
 			require.NotEmpty(t, initialCertChain)
+			for k, v := range env.ConciergeCustomLabels {
+				require.Equalf(t, v, secret.Labels[k], "expected secret to have label %s: %s", k, v)
+			}
+			require.Equal(t, env.ConciergeAppName, secret.Labels["app"])
 
 			// Check that the APIService has the same CA.
 			apiService, err := aggregatedClient.ApiregistrationV1().APIServices().Get(ctx, apiServiceName, metav1.GetOptions{})
@@ -115,6 +119,10 @@ func TestAPIServingCertificateAutoCreationAndRotation(t *testing.T) {
 			require.NotEqual(t, initialCACert, regeneratedCACert)
 			require.NotEqual(t, initialPrivateKey, regeneratedPrivateKey)
 			require.NotEqual(t, initialCertChain, regeneratedCertChain)
+			for k, v := range env.ConciergeCustomLabels {
+				require.Equalf(t, v, secret.Labels[k], "expected secret to have label `%s: %s`", k, v)
+			}
+			require.Equal(t, env.ConciergeAppName, secret.Labels["app"])
 
 			// Expect that the APIService was also updated with the new CA.
 			aggregatedAPIUpdated := func() bool {

test/integration/concierge_credentialissuerconfig_test.go

@@ -33,8 +33,14 @@ func TestCredentialIssuerConfig(t *testing.T) {
 
 		require.Len(t, actualConfigList.Items, 1)
 
+		actualConfig := actualConfigList.Items[0]
 		actualStatusKubeConfigInfo := actualConfigList.Items[0].Status.KubeConfigInfo
 
+		for k, v := range env.ConciergeCustomLabels {
+			require.Equalf(t, v, actualConfig.Labels[k], "expected cic to have label `%s: %s`", k, v)
+		}
+		require.Equal(t, env.ConciergeAppName, actualConfig.Labels["app"])
+
 		// Verify the cluster strategy status based on what's expected of the test cluster's ability to share signing keys.
 		actualStatusStrategies := actualConfigList.Items[0].Status.Strategies
 		require.Len(t, actualStatusStrategies, 1)

test/integration/concierge_kubecertagent_test.go

@@ -44,6 +44,14 @@ func TestKubeCertAgent(t *testing.T) {
 	require.NotEmpty(t, originalAgentPods.Items)
 	sortPods(originalAgentPods)
 
+	for _, agentPod := range originalAgentPods.Items {
+		// All agent pods should contain all custom labels
+		for k, v := range env.ConciergeCustomLabels {
+			require.Equalf(t, v, agentPod.Labels[k], "expected agent pod to have label `%s: %s`", k, v)
+		}
+		require.Equal(t, env.ConciergeAppName, agentPod.Labels["app"])
+	}
+
 	agentPodsReconciled := func() bool {
 		var currentAgentPods *corev1.PodList
 		currentAgentPods, err = kubeClient.CoreV1().Pods(env.ConciergeNamespace).List(ctx, metav1.ListOptions{