Propagate labels from the DVs to the importer pods

[liranr23]

Is your feature request related to a problem? Please describe:
We wish to clean up the importer pods after the migration succeeds. For cold migrations it uses only single importer pod and we can get it by annotation in the PVC (cdi.kubevirt.io/storage.import.importPodName). But in case we do warm migration it uses more than one importer pod and PVC, the scratch ones.
We set labels on the DVs such as:

    migration: 61bb4fd7-ccb5-4584-8f23-ab519fa8b95a
    plan: caf900ea-ca79-4948-b76c-16567207f80a
    vmID: vm-710

That will make it easy to get the related importer pods based on that using label selector.

Describe the solution you'd like:
Labels that set in the DV will propagate to the importer pods.

Additional context:
More details in: kubev2v/forklift#588 (comment)

[akalenyu]

We had a similar issue recently with passing the priority class:
#2864

[aglitke]

@liranr23 let us know if you think the approach in #2864 would work for your use case.

[liranr23]

Yes, just for labeling so I don't think it needs to be allowed, just passed from the PVC (as the labels passed from the DV to the PVC)

containerized-data-importer/pkg/controller/import-controller.go

Lines 1046 to 1050 in 18e6607

	Labels: map[string]string{
	common.CDILabelKey: common.CDILabelValue,
	common.CDIComponentLabel: common.ImporterPodName,
	common.PrometheusLabelKey: common.PrometheusLabelValue,
	},

[akalenyu]

Not sure I understand - do you suggest we pass labels from DV/PVC to importer pods?
If so, we discussed this in the sig-storage meeting this week, and IIUC that opens up a security concern
(Users that can't create pods with specific label can now exploit CDI to do it for them)

[liranr23]

Not sure I understand - do you suggest we pass labels from DV/PVC to importer pods? If so, we discussed this in the sig-storage meeting this week, and IIUC that opens up a security concern (Users that can't create pods with specific label can now exploit CDI to do it for them)

Yes, that's what I suggest. If it raise security context maybe it can be limited to allowed ones? I think kubevirt already passing labels from resource to pod - e.g virt-launcher https://github.com/kubevirt/kubevirt/blob/main/pkg/virt-controller/services/template.go#L1403C11-L1403C11

[akalenyu]

If it raise security context maybe it can be limited to allowed ones?

Yeah, that's what we do with annotations

[kubevirt-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[kubevirt-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

/lifecycle rotten

[alromeros]

/remove-lifecycle rotten
Hey @liranr23, I think it's safe to close this since the main issue was addressed in kubev2v/forklift#588. wdyt?

[alromeros]

Closing this since the main issue seems to have been addressed. Feel free to reopen if necessary, thanks!