+
Skip to content

include workload allowed_annotations in crio config output #9468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

include workload allowed_annotations in crio config output #9468

wants to merge 2 commits into from

Conversation

prasad89
Copy link

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR updates pkg/config/template.go to include allowed_annotations in the generated crio config output for each workload.
Previously, even if allowed_annotations were set in crio.conf, they were missing from the printed configuration, making it hard for users to verify workload configuration.

Which issue(s) this PR fixes:

Fixes #9467

Special notes for your reviewer:

  • Added template logic to print allowed_annotations when non-empty
  • Added unit tests to verify both presence (when set) and absence (when empty)
  • Verified manually that bin/crio config now shows allowed_annotations as expected

Does this PR introduce a user-facing change?

crio config` now includes workload `allowed_annotations` when defined in `crio.conf.

@prasad89 prasad89 requested a review from mrunalp as a code owner September 17, 2025 15:07
@openshift-ci openshift-ci bot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Sep 17, 2025
@openshift-ci openshift-ci bot added dco-signoff: no Indicates the PR's author has not DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. labels Sep 17, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Sep 17, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: prasad89
Once this PR has been reviewed and has the lgtm label, please assign kolyshkin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 17, 2025
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Sep 17, 2025

Hi @prasad89. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@prasad89
include workload allowed_annotations in crio config output
1cfad5d 
Signed-off-by: prasad89 <vdbhaleraovb@gmail.com>
@openshift-ci openshift-ci bot added dco-signoff: yes Indicates the PR's author has DCO signed all their commits. and removed dco-signoff: no Indicates the PR's author has not DCO signed all their commits. labels Sep 17, 2025
@bitoku
Copy link
Contributor

bitoku commented Sep 23, 2025

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 23, 2025
@codecov Codecov
Copy link

codecov bot commented Sep 23, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.16%. Comparing base (81e69a5) to head (6e38744).
⚠️ Report is 51 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (81e69a5) and HEAD (6e38744). Click for more details.

HEAD has 24 uploads less than BASE
Flag BASE (81e69a5) HEAD (6e38744)
35 11
Additional details and impacted files 
@@             Coverage Diff             @@
##             main    #9468       +/-   ##
===========================================
- Coverage   67.24%   56.16%   -11.08%     
===========================================
  Files         202      191       -11     
  Lines       28025    27969       -56     
===========================================
- Hits        18845    15710     -3135     
- Misses       7602    10525     +2923     
- Partials     1578     1734      +156
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@prasad89
Copy link
Author

/test e2e-aws-ovn

bitoku
bitoku reviewed Sep 30, 2025
View reviewed changes
pkg/config/template_test.go Outdated
Comment on lines 49 to 52
Expect(output).To(ContainSubstring("allowed_annotations = ["))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.userns-mode",`))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.umask",`))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.Devices",`))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you modify it to check if it has the whole array to enforce it has allowed_annotations in the expected format?

allowed_annotations = [
    "io.kubernetes.cri-o.userns-mode",
    "io.kubernetes.cri-o.umask",
    "io.kubernetes.cri-o.Devices",
]

@bitoku
Copy link
Contributor

bitoku commented Sep 30, 2025

Thank you for the fix! @prasad89
I added some comments.

@prasad89 @bitoku
Update pkg/config/template.go
6e38744 
Co-authored-by: Ayato Tokubi <atokubi@redhat.com>
Signed-off-by: Prasad Bhalerao <67261499+prasad89@users.noreply.github.com>
Signed-off-by: prasad89 <vdbhaleraovb@gmail.com>
@prasad89 prasad89 requested a review from bitoku October 1, 2025 01:33
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 1, 2025

@prasad89: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ci-e2e-conmonrs 6e38744 link true /test ci-e2e-conmonrs

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@bitoku
Copy link
Contributor

bitoku commented Oct 1, 2025

@prasad89 It seems you need to fix the unit tests

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@hasan4791 hasan4791 Awaiting requested review from hasan4791

@littlejawa littlejawa Awaiting requested review from littlejawa

@bitoku bitoku Awaiting requested review from bitoku

Assignees

No one assigned

Labels

dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

crio config doesn't print workload's allowed_annotations

2 participants

@prasad89 @bitoku
点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载