aws-for-fluent-bit: add podLabels support

[mcastellini]

Add optional podLabels to the DaemonSet pod template, using merge to ensure selector labels cannot be overridden by user-provided values.

Issue

#1008

Description of changes

Allow users to specify custom pod labels for the aws-for-fluent-bit chart.

Checklist

• Added/modified documentation as required (such as the README.md for modified charts)
• Incremented the chart version in Chart.yaml for the modified chart(s)
• Manually tested. Describe what testing was done in the testing section below
• Make sure the title of the PR is a good description that can go into the release notes

Testing

helm lint passes

$ helm lint ./stable/aws-for-fluent-bit
==> Linting ./stable/aws-for-fluent-bit

1 chart(s) linted, 0 chart(s) failed

helm template setting custom labels works correctly

$ helm template test ./stable/aws-for-fluent-bit --set 'podLabels.foo=bar,podLabels.env=staging' | yq 'select(.kind == "DaemonSet") | .spec.template.metadata.labels'
app.kubernetes.io/instance: test-aws-for-fluent-bit
app.kubernetes.io/name: aws-for-fluent-bit
env: staging
foo: bar

helm template without setting custom labels works correctly

$ helm template test ./stable/aws-for-fluent-bit | yq 'select(.kind == "DaemonSet") | .spec.template.metadata.labels'
app.kubernetes.io/instance: test-aws-for-fluent-bit
app.kubernetes.io/name: aws-for-fluent-bit

helm template setting custom labels conflicting with default labels do not override the value

$ helm template test ./stable/aws-for-fluent-bit --set 'podLabels.app\.kubernetes\.io/name=override' | yq 'select(.kind == "DaemonSet") | .spec.template.metadata.labels'
app.kubernetes.io/instance: test-aws-for-fluent-bit
app.kubernetes.io/name: aws-for-fluent-bit

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[mcastellini]

Tagging @dims as code owner to understand if it is possible to have this PR reviewed

[dims]

@mcastellini i am no longer at AWS. sorry.

[mcastellini]

Tagging @PettitWesley based on previous closed PRs to understand if it is possible to have this PR reviewed

[ranyhb]

Another user for this. We hit the same gap needing sidecar.istio.io/inject on the pods — without podLabels the only way in is to overwrite spec.template.metadata.labels wholesale, which then forces overwriting spec.selector.matchLabels to keep the selector a subset. That selector is immutable, so the workaround also means the DaemonSet can't be updated in place afterwards.

The merge approach here is the right one. FWIW I opened #1361 for the Service/DaemonSet object annotations, which is a separate gap in the same chart and deliberately doesn't touch podLabels — the two compose cleanly.

[ranyhb]

@cdirubbio @shraddhabang @jaydeokar — apologies for the cold ping, and this isn't my PR. CODEOWNERS for this chart resolves to * @dims, who replied above that he's no longer at AWS, and @PettitWesley didn't pick it up either — so stable/aws-for-fluent-bit/ has no active owner. You three are the most active maintainers in the repo right now; could one of you review this, or point us at whoever owns the chart?

TL;DR: aws-for-fluent-bit hardcodes the DaemonSet's pod labels to selectorLabels, so there's no way to add e.g. sidecar.istio.io/inject. The workaround is overwriting spec.template.metadata.labels wholesale, which then forces overwriting the immutable spec.selector too. #1305 is 4 lines, mergeable, and the same request goes back to #757 (2022).

[mcastellini]

@cheeseandcereal, I noticed you're one of the most recent people to approve a FluentBit PR in this repo. Could you take a look at this or help me reach the right person?