fix "total" logic, fix target selection, add protection label

Author: kreicer

README.md

@@ -75,6 +75,24 @@ Protection is enforced in two places:
 - **Validating webhook** — rejects `Experiment` objects whose `spec.selector.namespace` is in the protected list at admission time.
 - **Controller** — filters out any pods in protected namespaces during target selection, even for cluster-scoped selectors.
 
+## Safety: Pod-level Opt-out
+
+Individual pods can be excluded from all chaos experiments by adding the annotation `chaos.kreicer.dev/ignore: "true"`. This is useful for pods running critical in-flight work (e.g., database migrations, stateful leaders) that must not be interrupted.
+
+```bash
+kubectl annotate pod <pod-name> chaos.kreicer.dev/ignore=true
+```
+
+Or in the pod template:
+
+```yaml
+metadata:
+  annotations:
+    chaos.kreicer.dev/ignore: "true"
+```
+
+The annotated pod is removed from the eligible list before selection. If all matching pods carry the annotation, the run transitions to `Skipped` automatically.
+
 ## Run locally (against Kind or Minikube)
 
 ### Prerequisites
@@ -203,6 +221,8 @@ kubectl describe experimentrun <run-name>
 
 Events use `Normal` type for successful transitions (`PreviewGenerated`, `Approved`, `Running`, `Completed`) and `Warning` for failure states (`Failed`, `Expired`).
 
+The `TOTAL` column in `kubectl get expruns` is populated as soon as targets are selected during the `PreviewGenerated` phase, so you can see how many pods will be affected before the run executes.
+
 ## Safe Deletion
 
 `Experiment` objects carry a finalizer (`chaos.omen.com/finalizer`). When an `Experiment` is deleted, the controller first deletes all owned `ExperimentRun`s and waits for them to be removed before releasing the finalizer. This prevents orphaned runs from executing chaos actions after the parent is gone.

api/v1alpha1/experiment_types.go

@@ -20,6 +20,12 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+const (
+	// IgnoreAnnotation is the pod annotation that opts a pod out of target selection.
+	// Set to "true" on any pod to exclude it from all chaos experiments.
+	IgnoreAnnotation = "chaos.kreicer.dev/ignore"
+)
+
 // RunPolicyType defines how often an Experiment executes.
 // +kubebuilder:validation:Enum=Once;Repeat
 type RunPolicyType string

internal/controller/experiment_controller.go

@@ -274,6 +274,7 @@ func (r *ExperimentReconciler) scheduleRun(ctx context.Context, experiment *chao
 		run.Status.Phase = chaosv1alpha1.PhasePreviewGenerated
 		run.Status.PreviewTargets = targets
 		run.Status.ScheduledAt = &scheduledAt
+		run.Status.Summary = &chaosv1alpha1.RunSummary{Total: len(targets)}
 		if err := r.Status().Update(ctx, run); err != nil {
 			return ctrl.Result{}, err
 		}
@@ -425,10 +426,18 @@ func (r *ExperimentReconciler) selectTargets(ctx context.Context, experiment *ch
 		if pod.Status.Phase != corev1.PodRunning {
 			continue
 		}
+		// Skip pods already marked for deletion (terminating).
+		if !pod.DeletionTimestamp.IsZero() {
+			continue
+		}
 		// Self-exclusion: skip pods belonging to the Omen operator itself.
 		if pod.Labels[omenAppLabel] == omenAppName {
 			continue
 		}
+		// Skip pods that have opted out of chaos via annotation.
+		if pod.Annotations[chaosv1alpha1.IgnoreAnnotation] == "true" {
+			continue
+		}
 		eligible = append(eligible, pod.Name)
 	}