Add an optional way to pass additional labels and annotations to pods as well

[fgiorgetti]

Is your feature request related to a problem? Please describe.
Today when a configmap is labeled with skupper.io/label-template: "", the controller will get all of its labels and annotations and pass them along to its owned resources, like, Deployment, Services, ConfigMaps.

But the Deployment's pod(s) do not get annotated/labeled (possibly to avoid a router restart).

We could evaluate an optional way to tell the Controller to pass the labels/annotations to the Deployment's pod(s) as well.

Describe the solution you'd like

As an example, an extra label could be added to signal that pods should also be annotated? Or eventually depending on the value set to skupper.io/label-template?

Not sure what the best approach is, but we could experiment something.

[michaelalang]

Dear folks, the feature of adding additional labels and annotations to the skupper-router pods is very important in particular for compliance and regulation scenarios.

the full zero trust path including skupper with it's own mTLS isn't possible as neither a serviceMesh inclusion or a ZeroTrustWorkloadIdentity Manager inclusion can be set/added to the router pod without using server-side applies for CI/CD deployments.