Unable to select without matchLabels filter.

[martivo]

What happened?

I want to select all resources without using the "matchLabels" field.

  - step: pull-extra-resources
    functionRef:
      name: function-extra-resources
    input:
      apiVersion: extra-resources.fn.crossplane.io/v1beta1
      kind: Input
      spec:
        extraResources:
          - kind: XFirewallRules
            into: XFirewallRules
            apiVersion: example.com/v1
            type: Selector
            selector:
              minMatch: 1
              maxMatch: 10

I also tried

  - step: pull-extra-resources
    functionRef:
      name: function-extra-resources
    input:
      apiVersion: extra-resources.fn.crossplane.io/v1beta1
      kind: Input
      spec:
        extraResources:
          - kind: XFirewallRules
            into: XFirewallRules
            apiVersion: example.com/v1
            type: Selector
            selector:
              minMatch: 1
              maxMatch: 10
              matchLabels: []

This however finds no objects at all. When I change it to have some "matchLabels" then it works.

  - step: pull-extra-resources
    functionRef:
      name: function-extra-resources
    input:
      apiVersion: extra-resources.fn.crossplane.io/v1beta1
      kind: Input
      spec:
        extraResources:
          - kind: XFirewallRules
            into: XFirewallRules
            apiVersion: example.com/v1
            type: Selector
            selector:
              minMatch: 1
              maxMatch: 10
              matchLabels:
              - key: crossplane.io/claim-namespace
                type: Value
                value: default

I also tried

              matchLabels:
                - key: crossplane.io/composite
                  operator: Exists

But this is not supported by the spec.

How should this work?

As a workaround I have added static labels to all objects so the matchLabels has something to match against.

How can we reproduce it?

Create an extraResource of type Selector that has no "matchLabels" field.

What environment did it happen in?

Function version: 0.1.0 (latest at the moment)

• Crossplane version 1.20.1

• Cloud provider or hardware configuration
  AWS

• Kubernetes version (use kubectl version)
  Client Version: v1.31.3
  Kustomize Version: v5.4.2
  Server Version: v1.32.6-eks-931bdca

• Kubernetes distribution
  EKS

[phisco]

indeed, selecting all resources is not supported to avoid requesting too many resources by mistake. I have to double check, but iirc crossplane itself is not accepting that. Adding a label to all resources sounds like the right thing to do. Sure, we could add one more knob allowing to request all resources, if you feel strongly about it, please open an issue on the crossplane repository to support that.

[martivo]

indeed, selecting all resources is not supported to avoid requesting too many resources by mistake. I have to double check, but iirc crossplane itself is not accepting that. Adding a label to all resources sounds like the right thing to do. Sure, we could add one more knob allowing to request all resources, if you feel strongly about it, please open an issue on the crossplane repository to support that.

I feel pretty strongly about it. It is not a mistake either. Do I understand correctly that the issue is within crossplane itself and not the function? So the function does try to get all objects when "matchLabels" field is not defined or empty list but crossplane itself will not give all objects?

At the moment I masked it into a "feature" requiring users to set a "active: true" label themselves in order for it to be processed. Though it would more sense for it to be under spec.active instead. Unfortunately it seems the composition of the claim can not change the labels of the X object. So there is not even a good way to automatically add some static labels.

Background: We need to enable users to specify firewall rules for AWS Firewall in their namespaces. Due to AWS limitations it makes sense to create only a single Firewall RuleGroup resource/object per cluster. So we need to gather and deduplicate all the users rules and create a single RuleGroup object that contains the rules.

[tvandinther]

I also think this is a valid feature to support. "Requesting too many resources by mistake" is something developers should be avoiding by testing and inspecting their compositions. To temporarily work around the namespace limitation I wanted to get all resources and filter them in a subsequent function (just to test the design feasibility). However, due to this I cannot even do that. Especially in the event of a namespaced selection, it is a very valid scenario to select all Ingress resources in namespace foo for example.

[yzdann]

I have to double check, but iirc crossplane itself is not accepting that

I looked into it (e2e with crossplane), and it appears that crossplane allows it.
I also think it makes sense to support this behavior especially if it's limited to the namespace, since you can also run kubectl get pods -l "" and it returns all pods in a namespace.

You can easily test it by just commenting the following line and set the input.spec.extraResouces.selector to {}. I'm not suggesting this as a solution but just as a proof of concept. You can have a look at my PoC yzdann/function-extra-resources.

function-extra-resources/fn.go

Lines 156 to 158 in f2099c2

	if len(matchLabels) == 0 {
	continue
	}

      spec:
        extraResources:
          - kind: Cluster
            into: AllClusters
            apiVersion: example.crossplane.io/v1
            type: Selector
            selector: {}