Labels

A label is a key=value pair on an endpoint or a project. A policy override of the cloud policy uses a label selector to choose the endpoints and projects that it applies to. See Policy Resolution.

​

Prefixes and sources

The key of a label has the form prefix/name, as in custom/criticality. The prefix names the source of the label. Each source can write only its own prefixes, so an endpoint cannot write a custom/ label and an Admin cannot write a scm/ label. A selector can name each of the six prefixes. A project that is not bound to a repository has only safedep.io/ and custom/ labels.

​

Selectors

A label selector has the form of a Kubernetes label selector:

• matchLabels holds pairs that must match exactly.
• matchExpressions holds terms with the operators In, NotIn, Exists and DoesNotExist.

Every pair and every term must hold. An empty selector matches every subject. A key that a subject does not have fails In and Exists, and passes NotIn and DoesNotExist. To select the subjects that have one of two labels, give them one shared custom/ label, or write two policy overrides. Before you publish a policy override, you can list the projects and endpoints that its selector matches. See Target a Group.

​

When a label change applies

A label change makes no policy revision. It applies when the subject resolves next: at the next policy fetch of an endpoint, or at the next pull request check of a project. Each label change writes an audit event.

​

Which labels you can trust

An endpoint sends its own reported/ labels, and later its managed/ labels. A forge admin sets GitHub custom properties. SafeDep Cloud cannot check these values. Also, until endpoint enrollment ships, an endpoint asserts its own identity, so an endpoint can claim the identity, and the labels, of another endpoint. So no endpoint label is an access boundary yet. For a policy override that loosens the policy, select on safedep.io/, scm/ or custom/ labels. The preview of a policy change warns when a policy override that loosens selects on managed/, reported/ or scm-property/ labels.

​

Limits

A subject has at most 32 custom/ labels. A custom/ value has at most 63 characters, and the name after the prefix has at most 75. See Cloud Policy Limits.

​

Related