NO-ISSUE: ensure CMO and its operands pods have the app.kubernetes.io/part-of: openshift-monitoring label

jsonnet/utils/add-labels.libsonnet

@@ -9,7 +9,7 @@
 
   addLabels(labels, o): {
     // ignore *List types. metav1.ListMeta does not include metadata.
-    [k]: o[k] + if !std.endsWith(o[k].kind, 'List') then { metadata+: { labels+: labels { 'app.kubernetes.io/managed-by': managedBy(o[k]) } } } else {}
+    [k]: o[k] + if !std.endsWith(o[k].kind, 'List') then { metadata+: { labels+: labels { 'app.kubernetes.io/managed-by': managedBy(o[k]), 'app.kubernetes.io/part-of': 'openshift-monitoring' } } } else {}
     for k in std.objectFields(o)
   },
 }

manifests/0000_50_cluster-monitoring-operator_05-deployment-ibm-cloud-managed.yaml

@@ -23,6 +23,7 @@ spec:
       labels:
         app: cluster-monitoring-operator
         app.kubernetes.io/name: cluster-monitoring-operator
+        app.kubernetes.io/part-of: openshift-monitoring
     spec:
       containers:
       - args:

manifests/0000_50_cluster-monitoring-operator_05-deployment.yaml

@@ -6,6 +6,7 @@ metadata:
   labels:
     app: cluster-monitoring-operator
     app.kubernetes.io/name: cluster-monitoring-operator
+    app.kubernetes.io/part-of: openshift-monitoring
   annotations:
     include.release.openshift.io/self-managed-high-availability: "true"
     include.release.openshift.io/single-node-developer: "true"
@@ -19,6 +20,7 @@ spec:
       labels:
         app: cluster-monitoring-operator
         app.kubernetes.io/name: cluster-monitoring-operator
+        app.kubernetes.io/part-of: openshift-monitoring
       annotations:
         target.workload.openshift.io/management: '{"effect": "PreferredDuringScheduling"}'
         openshift.io/required-scc: restricted-v2

test/e2e/main_test.go

@@ -26,6 +26,7 @@ import (
 	configv1 "github.com/openshift/api/config/v1"
 	"github.com/openshift/cluster-monitoring-operator/test/e2e/framework"
 
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/tools/clientcmd"
@@ -188,3 +189,28 @@ func TestMemoryUsageRecordingRule(t *testing.T) {
 		"count(namespace:container_memory_usage_bytes:sum)",
 	)
 }
+
+func TestPodsLabels(t *testing.T) {
+	// Verify that all pods in the openshift-monitoring namespace have the
+	// app.kubernetes.io/part-of: openshift-monitoring label.
+	// This label is used among other things to limit the deny-all NP to CMO and its operands only.
+	f.AssertPodConfiguration(
+		f.Ns,
+		"",
+		[]framework.PodAssertion{
+			expectLabel("app.kubernetes.io/part-of", "openshift-monitoring"),
+		},
+	)(t)
+}
+
+func expectLabel(labelKey, expectedValue string) framework.PodAssertion {
+	return func(pod v1.Pod) error {
+		if value, ok := pod.Labels[labelKey]; ok {
+			if value == expectedValue {
+				return nil
+			}
+			return fmt.Errorf("pod %s has label %s with value %q, expected %q", pod.Name, labelKey, value, expectedValue)
+		}
+		return fmt.Errorf("pod %s is missing required label %s", pod.Name, labelKey)
+	}
+}