7d:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T8a3,## What Add a `podLabels` value (default `{}`) to every pod template in the **agent** and **gateway** charts, merged in alongside the hardcoded `app:` selector label. This mirrors the existing `podAnnotations` pattern. ## Why Both charts hardcode only `app: hoop*` in their pod templates and expose no way to add pod labels, so labels applied out-of-band with `kubectl label pod …` are silently reverted on the next `helm upgrade` when pods cycle. Today the only workaround is forking the chart. Common use-cases for pod labels: - Team/ownership labels for observability and cost attribution - Prometheus `podMonitor` / `serviceMonitor` selectors - Kubernetes `NetworkPolicy` pod selectors ## Implementation The selector label is deliberately protected. `spec.selector.matchLabels` is immutable and fixed to `app: hoop*`, so allowing a caller to set `podLabels.app` would emit a duplicate `app` key that shadows it and make Kubernetes reject the Deployment. `omit` drops that one reserved key: ```yaml labels: app: hoopagent {{- with omit .Values.podLabels "app" }} {{- toYaml . | nindent 8 }} {{- end }} ``` ## Changes | File | Value | Pod | |---|---|---| | `chart/agent/values.yaml` + `templates/deployment.yaml` | `podLabels` | `hoopagent` | | `chart/gateway/values.yaml` + `templates/deployment.yaml` | `podLabels` | `hoopgateway` | | `chart/gateway/templates/deployment-postgres.yaml` | `postgres.podLabels` | `hoopgateway-pg` | | `chart/gateway/templates/presidio-deployment.yaml` | `dataMasking.analyzer.podLabels` | `presidio-analyzer` | | `chart/gateway/templates/presidio-deployment.yaml` | `dataMasking.anonymizer.podLabels` | `presidio-anonymizer` | The per-component values are namespaced to match where each pod's other settings already live (`postgres.*`, `dataMasking.analyzer.*`), rather than having one global key leak into subcomponent pods. ## Example ```yaml # gateway values.yaml podLabels: team: platform dataMasking: analyzer: podLabels: team: platform ``` ## Compatibility Non-breaking: every `podLabels` key defaults to `{}`, so rendered output is byte-identical for existing installs. Diff is +30/-0 across 6 files, with no existing lines modified. 79:T1495,

PR Summary by Qodo

Add configurable pod labels to agent and gateway Helm charts ✨ Enhancement ⚙️ Configuration changes 🕐 10\-20 Minutes Grey Divider

AI Description

> • Exposes optional pod labels across agent, gateway, PostgreSQL, and Presidio workloads.
> • Preserves fixed app selector labels by filtering conflicting user-provided app values.
> • Defaults label maps to empty for backward-compatible Helm rendering.
>

Diagram

```mermaid graph TD AV["Agent values"] --> AT["Agent template"] --> AP["Agent pod"] GV["Gateway values"] --> GT["Gateway templates"] --> GW["Gateway pod"] GT --> PG["Postgres pod"] GT --> PR["Presidio pods"] ```

High-Level Assessment

> The current approach is appropriate: it mirrors the established podAnnotations configuration pattern, scopes labels to their owning components, and uses omit to prevent callers from overriding the immutable app selector relationship. A single global label map was considered but would undesirably leak labels into optional subcomponent pods.

Files changed (6) +30 / -0

Enhancement (4) +15 / -0

deployment.yamlRender configurable labels on agent pods +3/-0

> Render configurable labels on agent pods > >

> • Merges values from podLabels into the agent pod template metadata. The reserved app key is omitted so the pod label continues matching the Deployment selector.
>

> > deploy/helm\-chart/chart/agent/templates/deployment.yaml

deployment-postgres.yamlRender component-scoped labels on PostgreSQL pods +3/-0

> Render component\-scoped labels on PostgreSQL pods > >

> • Applies postgres.podLabels to the bundled PostgreSQL pod template while filtering the protected app label.
>

> > deploy/helm\-chart/chart/gateway/templates/deployment\-postgres.yaml

deployment.yamlRender configurable labels on gateway pods +3/-0

> Render configurable labels on gateway pods > >

> • Merges top-level podLabels into gateway pod metadata without allowing the fixed app selector label to be overridden.
>

> > deploy/helm\-chart/chart/gateway/templates/deployment.yaml

presidio-deployment.yamlRender separate labels on Presidio pods +6/-0

> Render separate labels on Presidio pods > >

> • Adds independently configurable labels to the Presidio analyzer and anonymizer pod templates. Both paths omit app to preserve their Deployment selector labels.
>

> > deploy/helm\-chart/chart/gateway/templates/presidio\-deployment.yaml

Other (2) +15 / -0

values.yamlDefine the agent podLabels value +4/-0

> Define the agent podLabels value > >

> • Adds an empty podLabels map beside the existing pod annotation settings, preserving existing rendered output by default.
>

> > deploy/helm\-chart/chart/agent/values.yaml

values.yamlDefine gateway and subcomponent pod label values +11/-0

> Define gateway and subcomponent pod label values > >

> • Adds empty podLabels maps for the gateway, bundled PostgreSQL, Presidio analyzer, and Presidio anonymizer workloads. Component-specific namespaces prevent labels from leaking across workloads.
>

> > deploy/helm\-chart/chart/gateway/values.yaml

7a:T1bc9,

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross\-repo conflicts (0) 📜 Skill insights (0) Grey Divider

1. ~~Envoy pods lack label support~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

>
> >

> The new component-specific values cover the Presidio analyzer and anonymizer but omit
> dataMasking.envoyProxy.podLabels, so labels cannot be applied to the presidio-envoy-proxy pods.
> Data-masking installations therefore cannot consistently use custom pod labels for selectors,
> ownership, or observability across all gateway-chart pods.
>

> >

Code

>
> >

[deploy/helm\-chart/chart/gateway/values.yaml[R75\-76]](https://github.com/hoophq/hoop/pull/1721/files#diff-84b745b095885a66edcb3e610abb07a093a4514bfc0094eecb4475d1bf0f857bR75-R76)

> > ```diff > + # -- Additional labels to add to the presidio-analyzer pod > + podLabels: {} > ``` >

Relevance

>
> > `●●● Strong` > >

> PR explicitly promises labels on every pod; Envoy is omitted, making this a direct completeness bug.
>

> > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> The chart defines Envoy proxy settings under dataMasking.envoyProxy, but unlike the newly updated
> analyzer and anonymizer sections, that component has no podLabels value. Its Deployment pod
> template still contains only the fixed app: presidio-envoy-proxy label and does not merge any
> configurable labels.
>

> >

[deploy/helm\-chart/chart/gateway/values.yaml[75\-76]](https://github.com/hoophq/hoop/blob/626eddf8a019134e49b8ee5d434f6b83fa2d4108/deploy/helm-chart/chart/gateway/values.yaml/#L75-L76)

[deploy/helm\-chart/chart/gateway/values.yaml[95\-96]](https://github.com/hoophq/hoop/blob/626eddf8a019134e49b8ee5d434f6b83fa2d4108/deploy/helm-chart/chart/gateway/values.yaml/#L95-L96)

[deploy/helm\-chart/chart/gateway/values.yaml[106\-118]](https://github.com/hoophq/hoop/blob/626eddf8a019134e49b8ee5d434f6b83fa2d4108/deploy/helm-chart/chart/gateway/values.yaml/#L106-L118)

[deploy/helm\-chart/chart/gateway/templates/presidio\-envoy\-proxy.yaml[13\-18]](https://github.com/hoophq/hoop/blob/626eddf8a019134e49b8ee5d434f6b83fa2d4108/deploy/helm-chart/chart/gateway/templates/presidio-envoy-proxy.yaml/#L13-L18)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ## Issue description > The gateway chart adds component-specific pod labels for the Presidio analyzer and anonymizer but leaves the Presidio Envoy proxy Deployment without configurable pod labels. > > ## Issue Context > The Envoy proxy is another pod-producing component under `dataMasking.envoyProxy`. Add a `podLabels: {}` default there and merge it into the proxy pod template while omitting the reserved `app` selector label. > > ## Fix Focus Areas > - deploy/helm-chart/chart/gateway/values.yaml[106-118] > - deploy/helm-chart/chart/gateway/templates/presidio-envoy-proxy.yaml[13-18] > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

Context

✅ Compliance rules (platform): 39 rules

✅ Cross-repo context — repo relationships

Explored: repo: hoophq/infra (sha: 673728f8)

Explored: repo: hoophq/documentation (sha: 5ce11675)

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ \| Customize Qodo ↗ \| Qodo docs ↗

7b:T47c,feat(helm): add podLabels support to the agent and gateway charts Both charts hardcode only `app: hoop*` in their pod templates and expose no way to add pod labels, so labels applied out-of-band with `kubectl label pod` are reverted on the next `helm upgrade` when pods cycle. The only workaround today is forking the chart. Add a podLabels value (default `{}`) for every pod template, mirroring the existing podAnnotations pattern: podLabels hoopagent, hoopgateway postgres.podLabels hoopgateway-pg dataMasking.analyzer.podLabels presidio-analyzer dataMasking.anonymizer.podLabels presidio-anonymizer Per-component values are namespaced to match where each pod's other settings already live, so one global key does not leak into subcomponent pods. `spec.selector.matchLabels` is immutable and fixed to `app: hoop*`, so a caller setting podLabels.app would emit a duplicate `app` key that shadows it and make Kubernetes reject the Deployment. `omit` drops that reserved key. Non-breaking: every podLabels key defaults to `{}`, so rendered output is byte-identical for existing installs. 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"hoophq","repo":"hoop","pullNumber":1721}],"data":{"repositoryId":"4079","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/3a3e5e36584ad4c4c22bdabdec3e6580?key=AUmcP819auuksApfW8l0zJTj1ohtgXloAasOphGmb98p1V3lz7u3Cbnl%2FV2VG9SVj3zYtGWZgVyJtO37vDzZwRwcDT9KTTr61Moi8Ymd3XB3su22nq2YzWmwR1vdgXEP93hZdGhOqKwea0KRJoWtIWqOY9Pu7OKg8HWhTgMVfli9X7rEbvO4349inQ%3D%3D","externalProvider":"github","login":"ananhagyahya","type":"User","url":"https://github.com/ananhagyahya"},"authorId":"91012958","baseRefName":"main","closedAt":null,"comments":6,"createdAt":"2026-08-18T08:26:53Z","headRefName":"ananhagyahya/feat/helm-pod-labels","id":"4873941","isDraft":false,"labels":[],"number":1721,"repository":{"name":"hoop","owner":"hoophq","provider":"forgejo"},"state":"open","title":"feat(helm): add podLabels support to the agent and gateway charts","updatedAt":"2026-08-18T08:52:48Z","url":"https://trylle.com/hoophq/hoop/pulls/1721","body":"$78","additions":35,"deletions":0,"changedFiles":7,"commits":3,"reviewComments":2,"headSha":"626eddf8a019134e49b8ee5d434f6b83fa2d4108","baseSha":"d5126d8ae3603bdbd31e56c4e9c085cc12d42be8","headRepoOwner":"hoophq","headRepoName":"hoop","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1721"},"comments":[{"id":26265728,"graphqlId":"26265728","body":"All contributors have signed the CLA ✍️ ✅
_{Posted by the ****CLA Assistant Lite bot****.}","createdAt":"2026-08-18T08:27:06Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265730,"graphqlId":"26265730","body":"$79","createdAt":"2026-08-18T08:27:52Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265731,"graphqlId":"26265731","body":"$7a","createdAt":"2026-08-18T08:30:17Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265732,"graphqlId":"26265732","body":"I have read the CLA Document and I hereby sign the CLA","createdAt":"2026-08-18T08:48:13Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/3a3e5e36584ad4c4c22bdabdec3e6580?key=AUmcP819auuksApfW8l0zJTj1ohtgXloAasOphGmb98p1V3lz7u3Cbnl%2FV2VG9SVj3zYtGWZgVyJtO37vDzZwRwcDT9KTTr61Moi8Ymd3XB3su22nq2YzWmwR1vdgXEP93hZdGhOqKwea0KRJoWtIWqOY9Pu7OKg8HWhTgMVfli9X7rEbvO4349inQ%3D%3D","externalProvider":"github","login":"ananhagyahya","type":"User","url":"https://github.com/ananhagyahya"}}],"commits":[{"sha":"626eddf8a019134e49b8ee5d434f6b83fa2d4108","message":"fix: merge dataMasking.envoyProxy.podLabels into proxy pod template","createdAt":"2026-08-18T11:44:39+03:00","author":{"avatarUrl":"","login":"","name":"Anan","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"fd103b27e6d29e932e7c0cc6549ba9af93a78166","message":"fix: add podLabels support to dataMasking.envoyProxy","createdAt":"2026-08-18T11:44:03+03:00","author":{"avatarUrl":"","login":"","name":"Anan","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"3a1028dcbc405588e66ca6c0100404f49afc569f","message":"$7b","createdAt":"2026-08-18T11:26:04+03:00","author":{"avatarUrl":"","login":"","name":"Anan Hag Yahya","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[{"id":26259331,"event":"reviewed","createdAt":"2026-08-18T08:30:19Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"reviewId":3430528,"reviewState":"COMMENT"},{"id":26259334,"event":"reviewed","createdAt":"2026-08-18T08:52:48Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/3a3e5e36584ad4c4c22bdabdec3e6580?key=AUmcP819auuksApfW8l0zJTj1ohtgXloAasOphGmb98p1V3lz7u3Cbnl%2FV2VG9SVj3zYtGWZgVyJtO37vDzZwRwcDT9KTTr61Moi8Ymd3XB3su22nq2YzWmwR1vdgXEP93hZdGhOqKwea0KRJoWtIWqOY9Pu7OKg8HWhTgMVfli9X7rEbvO4349inQ%3D%3D","externalProvider":"github","login":"ananhagyahya","type":"User","url":"https://github.com/ananhagyahya"},"reviewId":3430529,"reviewState":"COMMENT"}],"reviews":[{"id":3430528,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"submittedAt":"2026-08-18T08:30:19Z","official":false},{"id":3430529,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/3a3e5e36584ad4c4c22bdabdec3e6580?key=AUmcP819auuksApfW8l0zJTj1ohtgXloAasOphGmb98p1V3lz7u3Cbnl%2FV2VG9SVj3zYtGWZgVyJtO37vDzZwRwcDT9KTTr61Moi8Ymd3XB3su22nq2YzWmwR1vdgXEP93hZdGhOqKwea0KRJoWtIWqOY9Pu7OKg8HWhTgMVfli9X7rEbvO4349inQ%3D%3D","externalProvider":"github","login":"ananhagyahya","type":"User","url":"https://github.com/ananhagyahya"},"submittedAt":"2026-08-18T08:52:48Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":6,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793510128841}],"children":"$L7c"}] 64:null 6b:[["$","title","0",{"children":"Commits · feat(helm): add podLabels support to the agent and gateway charts · hoophq/hoop | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on feat(helm): add podLabels support to the agent and gateway charts (#1721) in hoophq/hoop."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · feat(helm): add podLabels support to the agent and gateway charts · hoophq/hoop, hoophq/hoop, hoophq/hoop repository, hoop, Go repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/hoophq/hoop/pulls/1721/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/hoophq/hoop/pulls/1721/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · feat(helm): add podLabels support to the agent and gateway charts · hoophq/hoop | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on feat(helm): add podLabels support to the agent and gateway charts (#1721) in hoophq/hoop."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/hoophq/hoop/pulls/1721/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · feat(helm): add podLabels support to the agent and gateway charts · hoophq/hoop | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on feat(helm): add podLabels support to the agent and gateway charts (#1721) in hoophq/hoop."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","32",{"name":"twitter:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7d","36",{}]]

Commits on Tue, Aug 18, 2026