feat(chart): add podLabels for extra labels on pod templates

charts/n8n/README.md

@@ -96,6 +96,7 @@ To use the namespace's default ServiceAccount, set `name: ""`. If you set `creat
 | `ingress.enabled` | Create Ingress resource | `false` |
 | `persistence.enabled` | PVC for main pods | `false` |
 | `strategy` | Deployment update strategy | `{}` (k8s default) |
+| `podLabels` | Extra labels on every pod template | `{}` |
 | `hpa.main.enabled` | HPA for main pods | `false` |
 | `hpa.worker.enabled` | HPA for worker pods | `false` |
 | `keda.enabled` | KEDA queue-based autoscaling | `false` |

charts/n8n/templates/_helpers.tpl

@@ -140,4 +140,16 @@ Validate values — called once from deployment-main.yaml to fail fast on bad co
 {{- fail "serviceAccount.create=false but serviceAccount.name is still the chart default \"n8n\". Set serviceAccount.name to your pre-existing ServiceAccount, or to \"\" to use the namespace's default ServiceAccount." -}}
 {{- end -}}
 
+{{/* --- Pod labels --- */}}
+{{/* The chart manages a fixed set of pod-template labels (selector + recommended labels). Reject user-supplied podLabels that overlap them so we don't break the Deployment selector or produce duplicate YAML keys. Also enforce that values are strings — Kubernetes labels are map[string]string, so non-string values would fail API validation at deploy time; catch it at template time with a clearer message. */}}
+{{- $reservedPodLabels := list "app.kubernetes.io/name" "app.kubernetes.io/instance" "app.kubernetes.io/component" "app.kubernetes.io/version" "app.kubernetes.io/managed-by" "helm.sh/chart" -}}
+{{- range $k, $v := .Values.podLabels -}}
+{{- if has $k $reservedPodLabels -}}
+{{- fail (printf "podLabels.%q is a chart-managed selector/identity label and cannot be overridden. Reserved keys: %s" $k (join ", " $reservedPodLabels)) -}}
+{{- end -}}
+{{- if not (kindIs "string" $v) -}}
+{{- fail (printf "podLabels.%q must be a string (got %s). Kubernetes labels are map[string]string; quote numeric or boolean values, e.g. %q: \"true\"." $k (kindOf $v) $k) -}}
+{{- end -}}
+{{- end -}}
+
 {{- end -}}

charts/n8n/templates/deployment-main.yaml

@@ -30,6 +30,9 @@ spec:
       labels:
         {{- include "n8n.labels" . | nindent 8 }}
         app.kubernetes.io/component: main
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       {{- with include "n8n.serviceAccountName" . }}
       serviceAccountName: {{ . }}

charts/n8n/templates/deployment-webhook-processor.yaml

@@ -26,6 +26,9 @@ spec:
       labels:
         {{- include "n8n.labels" . | nindent 8 }}
         app.kubernetes.io/component: webhook-processor
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       {{- with include "n8n.serviceAccountName" . }}
       serviceAccountName: {{ . }}

charts/n8n/templates/deployment-worker.yaml

@@ -26,6 +26,9 @@ spec:
       labels:
         {{- include "n8n.labels" . | nindent 8 }}
         app.kubernetes.io/component: worker
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
     spec:
       {{- with include "n8n.serviceAccountName" . }}
       serviceAccountName: {{ . }}

charts/n8n/values.yaml

@@ -120,6 +120,21 @@ taskRunners:
 # to avoid Multi-Attach errors during upgrades.
 strategy: {}
 
+# ----- Pod Labels -----
+# Extra labels added to the main / worker / webhook-processor pod templates,
+# in addition to the chart's own selector labels. Useful for opt-in admission
+# webhooks (e.g. Azure AD Workload Identity's `azure.workload.identity/use=true`,
+# Istio's `sidecar.istio.io/inject=true`) and external scrape selectors.
+#
+# Reserved keys (managed by the chart, will fail at install time if set here):
+# - app.kubernetes.io/{name,instance,component,version,managed-by}
+# - helm.sh/chart
+# These are part of the Deployment's selector or recommended-labels set;
+# overriding them would break selector matching or produce duplicate YAML keys.
+# podLabels:
+#   azure.workload.identity/use: "true"
+podLabels: {}
+
 # ----- Main replicas (when multi-main is disabled) -----
 replicaCount: 1