feat(helm): add podLabels support to the agent and gateway charts

• Exposes optional pod labels across agent, gateway, PostgreSQL, and Presidio workloads.
• Preserves fixed app selector labels by filtering conflicting user-provided app values.
• Defaults label maps to empty for backward-compatible Helm rendering.

graph TD
  AV["Agent values"] --> AT["Agent template"] --> AP["Agent pod"]
  GV["Gateway values"] --> GT["Gateway templates"] --> GW["Gateway pod"]
  GT --> PG["Postgres pod"]
  GT --> PR["Presidio pods"]

The current approach is appropriate: it mirrors the established podAnnotations configuration pattern, scopes labels to their owning components, and uses omit to prevent callers from overriding the immutable app selector relationship. A single global label map was considered but would undesirably leak labels into optional subcomponent pods.

Enhancement (4) +15 / -0

deployment.yamlRender configurable labels on agent pods +3/-0

Render configurable labels on agent pods

• Merges values from podLabels into the agent pod template metadata. The reserved app key is omitted so the pod label continues matching the Deployment selector.

deploy/helm-chart/chart/agent/templates/deployment.yaml

deployment-postgres.yamlRender component-scoped labels on PostgreSQL pods +3/-0

Render component-scoped labels on PostgreSQL pods

• Applies postgres.podLabels to the bundled PostgreSQL pod template while filtering the protected app label.

deploy/helm-chart/chart/gateway/templates/deployment-postgres.yaml

deployment.yamlRender configurable labels on gateway pods +3/-0

Render configurable labels on gateway pods

• Merges top-level podLabels into gateway pod metadata without allowing the fixed app selector label to be overridden.

deploy/helm-chart/chart/gateway/templates/deployment.yaml

presidio-deployment.yamlRender separate labels on Presidio pods +6/-0

Render separate labels on Presidio pods

• Adds independently configurable labels to the Presidio analyzer and anonymizer pod templates. Both paths omit app to preserve their Deployment selector labels.

deploy/helm-chart/chart/gateway/templates/presidio-deployment.yaml

Other (2) +15 / -0

values.yamlDefine the agent podLabels value +4/-0

Define the agent podLabels value

• Adds an empty podLabels map beside the existing pod annotation settings, preserving existing rendered output by default.

deploy/helm-chart/chart/agent/values.yaml

values.yamlDefine gateway and subcomponent pod label values +11/-0

Define gateway and subcomponent pod label values

• Adds empty podLabels maps for the gateway, bundled PostgreSQL, Presidio analyzer, and Presidio anonymizer workloads. Component-specific namespaces prevent labels from leaking across workloads.

deploy/helm-chart/chart/gateway/values.yaml

Description

The new component-specific values cover the Presidio analyzer and anonymizer but omit
dataMasking.envoyProxy.podLabels, so labels cannot be applied to the presidio-envoy-proxy pods.
Data-masking installations therefore cannot consistently use custom pod labels for selectors,
ownership, or observability across all gateway-chart pods.

Code

deploy/helm-chart/chart/gateway/values.yaml[R75-76]

+    # -- Additional labels to add to the presidio-analyzer pod
+    podLabels: {}

Relevance

●●● Strong

PR explicitly promises labels on every pod; Envoy is omitted, making this a direct completeness bug.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The chart defines Envoy proxy settings under dataMasking.envoyProxy, but unlike the newly updated
analyzer and anonymizer sections, that component has no podLabels value. Its Deployment pod
template still contains only the fixed app: presidio-envoy-proxy label and does not merge any
configurable labels.

deploy/helm-chart/chart/gateway/values.yaml[75-76] deploy/helm-chart/chart/gateway/values.yaml[95-96] deploy/helm-chart/chart/gateway/values.yaml[106-118] deploy/helm-chart/chart/gateway/templates/presidio-envoy-proxy.yaml[13-18]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The gateway chart adds component-specific pod labels for the Presidio analyzer and anonymizer but leaves the Presidio Envoy proxy Deployment without configurable pod labels.

## Issue Context
The Envoy proxy is another pod-producing component under `dataMasking.envoyProxy`. Add a `podLabels: {}` default there and merge it into the proxy pod template while omitting the reserved `app` selector label.

## Fix Focus Areas
- deploy/helm-chart/chart/gateway/values.yaml[106-118]
- deploy/helm-chart/chart/gateway/templates/presidio-envoy-proxy.yaml[13-18]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗