Document auto computed label behavior in OpenAPI

[lobkovilya]

Description

This information is currently scattered across code and docs. There are currently 2 categories:

User should never set

• kuma.io/zone
• k8s.kuma.io/namespace
• kuma.io/policy-role
• kuma.io/proxy-type
• k8s.kuma.io/service-account // missing from the list I linked

User can set, but if unset backend will provide default:

• kuma.io/mesh (if missing defaults to default)
• kuma.io/origin (if missing defaults to either zone or global depending where applied)
• kuma.io/env (if missing defaults to either universal or kubernetes) // that’s actually weird, I think it should be in the first category

It would be great if we could have this info somehow persisted in the Open API:

labels:
  additionalProperties:
    type: string
  description: The labels to help identity resources
  type: object
  properties:
    "kuma.io/zone":
      type: string
      readOnly: true
      description: Always computed by the CP

IMPORTANT: verify code generation still works in all downstream Terraform repos!

[lahabana]

Slack thread: https://kongstrong.slack.com/archives/C7J8S9N6Q/p1761649885254219

[lukidzi]

Triage: We need to find a good way to do it