Extension namespace labels block proxy inject for linkerd viz

[gerryg80]

This module creates linkerd-viz in a state where it isn't usable. "linkerd viz tap" did not work until I cleaned up the namespace labels.

The issue originates from the loop that creates all namespaces with identical annotations and labels. In particular the label config.linkerd.io/admission-webhooks: disabled on the linkerd-viz namespace prevents the pods from getting the proxy sidecar:

$ k get ns linkerd-viz -o json | jq .metadata.labels
{
  "config.linkerd.io/admission-webhooks": "disabled",
  "kubernetes.io/metadata.name": "linkerd-viz",
  "linkerd.io/control-plane-ns": "linkerd-viz",
  "linkerd.io/extension": "viz",
  "linkerd.io/is-control-plane": "true"
}

The extra labels also declare this to be the linker control-plane-ns (which is actually just linkerd). Not clear that interferes with anything but a default install of linkerd-viz using the CLI only has these labels on the namespace:

$ k get ns linkerd-viz -o json  | jq .metadata.labels 
{
  "kubernetes.io/metadata.name": "linkerd-viz",
  "linkerd.io/extension": "viz"
}

The module also creates the namespace with the linkerd.io/inject: disabled annotation. This is confusing but doesn't appear to interfere with the proxy once the admission webhook has been fixed.

This was the state before the fix - linkerd viz check returned only warnings but linkerd viz tap could not connect to workloads.

$ kubectl get po -n linkerd-viz 
NAME                            READY   STATUS    RESTARTS   AGE
metrics-api-6b6dfb4c8d-gfpkw    1/1     Running   0          25h
prometheus-6f5fdddb9c-fs6gq     1/1     Running   0          24h
tap-6ccc558b78-9pb4g            1/1     Running   0          25h
tap-injector-6cc44d7b76-b8rnf   1/1     Running   0          25h
web-85dcd74f4d-fz7tj            1/1     Running   0          25h

$ linkerd viz check 
linkerd-viz
-----------
√ linkerd-viz Namespace exists
√ linkerd-viz ClusterRoles exist
√ linkerd-viz ClusterRoleBindings exist
√ tap API server has valid cert
‼ tap API server cert is valid for at least 60 days
    certificate will expire on 2022-11-30T14:16:08Z
    see https://linkerd.io/2/checks/#l5d-tap-cert-not-expiring-soon for hints
√ tap API service is running
‼ linkerd-viz pods are injected
    could not find proxy container for metrics-api-6b6dfb4c8d-gfpkw pod
    see https://linkerd.io/2/checks/#l5d-viz-pods-injection for hints
‼ viz extension pods are running
    container "linkerd-proxy" in pod "metrics-api-6b6dfb4c8d-gfpkw" is not ready
    see https://linkerd.io/2/checks/#l5d-viz-pods-running for hints
‼ viz extension proxies are healthy
    no "linkerd-proxy" containers found in the "linkerd" namespace
    see https://linkerd.io/2/checks/#l5d-viz-proxy-healthy for hints
√ viz extension proxies are up-to-date
√ viz extension proxies and cli versions match
√ prometheus is installed and configured correctly
√ can initialize the client
√ viz extension self-check

Status check results are √