From 83b2f71f483d0c0d3f3006960c75e84f3853d855 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <andrei.kvapil@aenix.io>
Date: Tue, 2 Jun 2026 01:58:20 +0200
Subject: [PATCH 1/2] fix(kubernetes): stamp application lineage labels on
 worker node VMs

Worker-node VMs of a tenant Kubernetes cluster are created by Cluster API
and the KubeVirt provider, so their virt-launcher pods were never stamped
with the apps.cozystack.io/application.{group,kind,name} lineage labels the
chart already sets on its other resources (ingress, cloud-config). Without
them the dashboard cannot attribute those pods to the owning Kubernetes
application instance.

Add the labels to the worker VM template (KubevirtMachineTemplate ->
virtualMachineTemplate.spec.template.metadata.labels), mirroring the
existing stamping in ingress.yaml/cloud-config.yaml. KubeVirt propagates
them to the VMI and virt-launcher pods (the same path as the existing
cluster.x-k8s.io/deployment-name label).

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
(cherry picked from commit 99360dab297c25f37c190990ed5d60395f594bde)
---
 packages/apps/kubernetes/templates/cluster.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index a4508a600..d1cf6270a 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -55,6 +55,9 @@ spec:
           annotations:
             kubevirt.io/allow-pod-bridge-network-live-migration: "true"
           labels:
+            apps.cozystack.io/application.group: apps.cozystack.io
+            apps.cozystack.io/application.kind: Kubernetes
+            apps.cozystack.io/application.name: {{ $.Release.Name | trimPrefix "kubernetes-" }}
             {{- range .group.roles }}
             node-role.kubernetes.io/{{ . }}: ""
             {{- end }}

From f8b88f934e19da9197af2e7fdd7d0e6ba9373a3c Mon Sep 17 00:00:00 2001
From: Aleksei Sviridkin <f@lex.la>
Date: Tue, 2 Jun 2026 19:46:01 +0300
Subject: [PATCH 2/2] fix(kubernetes): quote worker-VM application.name label
 and cover it with tests

Pin the apps.cozystack.io/application.{group,kind,name} labels stamped on the
worker VM template, including a case that trims the kubernetes- release prefix.
Also quote application.name so a purely-numeric cluster name renders a YAML
string rather than an integer that a label value would reject.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
(cherry picked from commit 7d1096b8dab3ace3b164bb6afd7b335e5be2a796)
---
 .../apps/kubernetes/templates/cluster.yaml    |  2 +-
 .../apps/kubernetes/tests/cluster_test.yaml   | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index d1cf6270a..9f8977725 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -57,7 +57,7 @@ spec:
           labels:
             apps.cozystack.io/application.group: apps.cozystack.io
             apps.cozystack.io/application.kind: Kubernetes
-            apps.cozystack.io/application.name: {{ $.Release.Name | trimPrefix "kubernetes-" }}
+            apps.cozystack.io/application.name: {{ $.Release.Name | trimPrefix "kubernetes-" | quote }}
             {{- range .group.roles }}
             node-role.kubernetes.io/{{ . }}: ""
             {{- end }}
diff --git a/packages/apps/kubernetes/tests/cluster_test.yaml b/packages/apps/kubernetes/tests/cluster_test.yaml
index 88fc71180..93f72f7f3 100644
--- a/packages/apps/kubernetes/tests/cluster_test.yaml
+++ b/packages/apps/kubernetes/tests/cluster_test.yaml
@@ -444,3 +444,38 @@ tests:
                 if /root/kubelet --version ; then mv /root/kubelet /usr/bin/kubelet ; fi
                 if /root/kubeadm version ; then mv /root/kubeadm /usr/bin/kubeadm ; fi
         documentIndex: 4
+
+  ###############################################
+  # application lineage labels on worker VMs    #
+  ###############################################
+
+  - it: stamps application lineage labels on the worker VM template
+    release:
+      name: test-k8s
+      namespace: tenant-test
+    asserts:
+      - isKind:
+          of: KubevirtMachineTemplate
+        documentIndex: 5
+      - equal:
+          path: spec.template.spec.virtualMachineTemplate.spec.template.metadata.labels["apps.cozystack.io/application.group"]
+          value: apps.cozystack.io
+        documentIndex: 5
+      - equal:
+          path: spec.template.spec.virtualMachineTemplate.spec.template.metadata.labels["apps.cozystack.io/application.kind"]
+          value: Kubernetes
+        documentIndex: 5
+      - equal:
+          path: spec.template.spec.virtualMachineTemplate.spec.template.metadata.labels["apps.cozystack.io/application.name"]
+          value: test-k8s
+        documentIndex: 5
+
+  - it: derives application.name by trimming the kubernetes- release prefix
+    release:
+      name: kubernetes-foo
+      namespace: tenant-test
+    asserts:
+      - equal:
+          path: spec.template.spec.virtualMachineTemplate.spec.template.metadata.labels["apps.cozystack.io/application.name"]
+          value: foo
+        documentIndex: 5