Brian Kane 566b72b882 feat: add filterUserMetadata for secure policy context ...

Add filterUserMetadata() function to filter out internal/system
labels and annotations from policy context, preventing policies
from accessing sensitive KubeVela/Kubernetes internal metadata.

Implementation:
- Uses map-based prefix lookup for O(1) performance
- Filters prefixes: app.oam.dev/, oam.dev/, kubectl.kubernetes.io/,
  kubernetes.io/, k8s.io/, helm.sh/, app.kubernetes.io/
- Optimized for hot path (runs on every reconciliation with policies)
- Returns nil for empty results to avoid unnecessary allocations

Tests:
- Filter internal vs user metadata
- Handle empty inputs
- Handle keys without prefixes
- Verify all internal prefixes are excluded

Part of Policy Refactor Plan v3 - Part 1.1: Foundation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

2026-02-13 20:30:18 +00:00

..

common

Chore: remove outdated apis(v1alppha2 ApplicationConfiguration Component, and HealthScope, Rollout) (#6041)

2023-06-01 09:32:49 +08:00

core.oam.dev

feat: add filterUserMetadata for secure policy context

2026-02-13 20:30:18 +00:00

utils

Chore: (deps): Update k8s to 1.29 (#6654)

2025-01-03 07:54:42 +08:00

flags.go

Chore: remove outdated apis(v1alppha2 ApplicationConfiguration Component, and HealthScope, Rollout) (#6041)

2023-06-01 09:32:49 +08:00