feat: support consumer labels from metadata labels

[AlinsRan]

Summary

• reuse ApisixConsumer.metadata.labels and Consumer.metadata.labels as consumer labels
• add a shared label helper so controller-generated labels always win on conflicts
• align ApisixRoute with the same merge behavior and add coverage

Consumer labels

This change is mainly for propagating CRD labels into data plane resource labels.

Both ApisixConsumer.metadata.labels and Consumer.metadata.labels are propagated to the generated APISIX consumer as custom labels, so users can inject business metadata such as tenant, team, or plan from the Kubernetes CRD into the data plane resource.

If a user-defined label key conflicts with a controller-generated reserved label, the controller-generated value is preserved.

ApisixConsumer CRD example

apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
  namespace: ingress-apisix
  name: alice
  labels:
    team: payments
    plan: gold
spec:
  ingressClassName: apisix
  authParameter:
    keyAuth:
      value:
        key: alice-primary-key

Consumer CRD example

apiVersion: apisix.apache.org/v1alpha1
kind: Consumer
metadata:
  namespace: ingress-apisix
  name: bob
  labels:
    team: platform
    tenant: internal
spec:
  gatewayRef:
    name: apisix
  credentials:
  - type: key-auth
    name: bob-key
    config:
      key: bob-primary-key

Data plane result example

The generated APISIX consumer will carry the injected labels together with controller-managed labels, for example:

{
  "username": "ingress-apisix_alice",
  "labels": {
    "team": "payments",
    "plan": "gold",
    "k8s/name": "alice",
    "k8s/namespace": "ingress-apisix",
    "k8s/kind": "ApisixConsumer",
    "k8s/controller-name": "apisix.apache.org/apisix-ingress-controller",
    "manager-by": "apisix-ingress-controller"
  }
}

The same merge behavior also applies to Consumer resources, so labels defined on either CRD can be consumed directly on the data plane side.

Testing

• go test ./internal/controller/label ./internal/adc/translator
• go test $(go list ./... | grep -v /e2e | grep -v /conformance) (the benchmark package still requires a live Kubernetes endpoint in this environment)