feat: add cluster label to ressources

internal/controller/databasecluster_service.go

@@ -89,8 +89,9 @@
 					TargetPort: intstr.FromInt(5432),
 				},
 			}
+			Service.Labels = ClusterLabels(cluster, "")
 			Service.Spec.Selector = desiredSelector
 			ctrl.SetControllerReference(cluster, &Service, r.Scheme)
 			return r.Create(ctx, &Service)
 		}
 		return err
@@ -133,6 +134,7 @@
 			headlessService.Name = headlessServiceNamespacedName.Name
 			headlessService.Namespace = headlessServiceNamespacedName.Namespace
 			headlessService.Spec.ClusterIP = "None"
+			headlessService.Labels = ClusterLabels(cluster, suffix)
 			headlessService.Spec.PublishNotReadyAddresses = true
 			headlessService.Spec.Selector = map[string]string{
 				"app": cluster.Name + "-" + suffix,
@@ -143,7 +145,7 @@
 					Name: "postgres",
 				},
 			}
 			ctrl.SetControllerReference(cluster, &headlessService, r.Scheme)
 			err = r.Create(ctx, &headlessService)
 			if err != nil {
 				return err

internal/controller/databasecluster_ssh.go

@@ -325,10 +325,12 @@ func (c *certificateSSHTrust) ensureOneCA(
 		return fmt.Errorf("marshal CA to Secret: %w", err)
 	}
 
-	if secret.Labels == nil {
-		secret.Labels = map[string]string{}
+	for k, v := range ClusterLabels(cluster, "ssh") {
+		if secret.Labels == nil {
+			secret.Labels = map[string]string{}
+		}
+		secret.Labels[k] = v
 	}
-	secret.Labels["keldon.io/cluster"] = cluster.Name
 	secret.Labels["keldon.io/ssh-ca"] = strings.TrimPrefix(suffix, "-ssh-")
 
 	if err := controllerutil.SetControllerReference(cluster, secret, c.r.Scheme); err != nil {

internal/controller/databasecluster_statefulset.go

@@ -178,17 +178,22 @@ func (r *DatabaseClusterReconciler) buildStatefulset(
 
 	statefulset.Name = cluster.Name + "-" + suffix
 	statefulset.Namespace = cluster.Namespace
+	// Canonical keldon.io/* labels on the StatefulSet itself so it shows up
+	// in `kubectl get sts -l keldon.io/cluster=<name>` queries.
+	statefulset.Labels = ClusterLabels(cluster, suffix)
 
 	statefulset.Spec.PodManagementPolicy = appsv1.ParallelPodManagement
 
+	// Selector is immutable on existing StatefulSets — keep using the legacy
+	// `app:` label so v0.11.0 → v0.11.1 upgrades don't break.
 	statefulset.Spec.Selector = &metav1.LabelSelector{
 		MatchLabels: map[string]string{
 			"app": cluster.Name + "-" + suffix,
 		},
 	}
-	statefulset.Spec.Template.Labels = map[string]string{
-		"app": cluster.Name + "-" + suffix,
-	}
+	// Pod template labels include both the legacy `app:` (required by the
+	// selector above) and the canonical keldon.io/* labels.
+	statefulset.Spec.Template.Labels = WithLegacyApp(cluster, suffix, suffix)
 
 	// Init container: create the three data-dir parents and chown to UID 1000
 	// (the adminUser's expected UID inside the image — every Greenplum-family
@@ -250,7 +255,10 @@ func (r *DatabaseClusterReconciler) buildStatefulset(
 
 	statefulset.Spec.VolumeClaimTemplates = []corev1.PersistentVolumeClaim{
 		{
-			ObjectMeta: metav1.ObjectMeta{Name: "data"},
+			ObjectMeta: metav1.ObjectMeta{
+				Name:   "data",
+				Labels: ClusterLabels(cluster, suffix),
+			},
 			Spec: corev1.PersistentVolumeClaimSpec{
 				AccessModes:      []corev1.PersistentVolumeAccessMode{corev1.ReadWriteOnce},
 				StorageClassName: storageClassName,

internal/controller/labels.go

@@ -0,0 +1,48 @@
+package controller
+
+import (
+	keldonv1alpha1 "github.com/keldonio/keldon-operator/api/v1alpha1"
+)
+
+// Label keys emitted by the operator on all cluster resources.
+// Use these as the source of truth — do not hard-code label strings.
+const (
+	LabelCluster      = "keldon.io/cluster"
+	LabelRole         = "keldon.io/role"
+	LabelManagedBy    = "keldon.io/managed-by"
+	LabelAppName      = "app.kubernetes.io/name"
+	LabelAppInstance  = "app.kubernetes.io/instance"
+	LabelAppComponent = "app.kubernetes.io/component"
+	LabelAppManagedBy = "app.kubernetes.io/managed-by"
+
+	ValueManagedBy = "keldon-operator"
+	ValueAppName   = "keldon"
+)
+
+// ClusterLabels returns the full metadata.labels set for any resource
+// belonging to a cluster. Use for resource ObjectMeta.Labels and pod
+// template metadata. Do NOT use for Selector.MatchLabels.
+func ClusterLabels(cluster *keldonv1alpha1.DatabaseCluster, role string) map[string]string {
+	labels := map[string]string{
+		LabelCluster:      cluster.Name,
+		LabelManagedBy:    ValueManagedBy,
+		LabelAppName:      ValueAppName,
+		LabelAppInstance:  cluster.Name,
+		LabelAppManagedBy: ValueManagedBy,
+	}
+	if role != "" {
+		labels[LabelRole] = role
+		labels[LabelAppComponent] = role
+	}
+	return labels
+}
+
+// WithLegacyApp returns a label set that includes both ClusterLabels
+// and the legacy `app: <cluster>-<suffix>` label required by existing
+// StatefulSet selectors. Use for pod template metadata where the
+// StatefulSet selector still uses the legacy `app:` label.
+func WithLegacyApp(cluster *keldonv1alpha1.DatabaseCluster, role, appSuffix string) map[string]string {
+	labels := ClusterLabels(cluster, role)
+	labels["app"] = cluster.Name + "-" + appSuffix
+	return labels
+}