Skip to content

include workload allowed_annotations in crio config output #9468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
prasad89 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

include workload allowed_annotations in crio config output #9468

prasad89 wants to merge 2 commits into from

Conversation

@prasad89
Copy link

@prasad89 prasad89 commented Sep 17, 2025

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR updates pkg/config/template.go to include allowed_annotations in the generated crio config output for each workload.
Previously, even if allowed_annotations were set in crio.conf, they were missing from the printed configuration, making it hard for users to verify workload configuration.

Which issue(s) this PR fixes:

Fixes #9467

Special notes for your reviewer:

  • Added template logic to print allowed_annotations when non-empty
  • Added unit tests to verify both presence (when set) and absence (when empty)
  • Verified manually that bin/crio config now shows allowed_annotations as expected

Does this PR introduce a user-facing change?

crio config` now includes workload `allowed_annotations` when defined in `crio.conf.

@prasad89 prasad89 requested a review from mrunalp as a code owner September 17, 2025 15:07
@openshift-ci openshift-ci bot added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Sep 17, 2025
@openshift-ci openshift-ci bot added dco-signoff: no Indicates the PR's author has not DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. labels Sep 17, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 17, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: prasad89
Once this PR has been reviewed and has the lgtm label, please assign kolyshkin for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Sep 17, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Sep 17, 2025

Hi @prasad89. Thanks for your PR.

I'm waiting for a cri-o member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-ci openshift-ci bot added dco-signoff: yes Indicates the PR's author has DCO signed all their commits. and removed dco-signoff: no Indicates the PR's author has not DCO signed all their commits. labels Sep 17, 2025
@bitoku
Copy link
Contributor

bitoku commented Sep 23, 2025

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 23, 2025
@codecov
Copy link

codecov bot commented Sep 23, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.16%. Comparing base (81e69a5) to head (6e38744).
⚠️ Report is 184 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (81e69a5) and HEAD (6e38744). Click for more details.

HEAD has 24 uploads less than BASE
Flag BASE (81e69a5) HEAD (6e38744)
35 11
Additional details and impacted files 
@@             Coverage Diff             @@
##             main    #9468       +/-   ##
===========================================
- Coverage   67.24%   56.16%   -11.08%     
===========================================
  Files         202      191       -11     
  Lines       28025    27969       -56     
===========================================
- Hits        18845    15710     -3135     
- Misses       7602    10525     +2923     
- Partials     1578     1734      +156
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@prasad89
Copy link
Author

prasad89 commented Sep 26, 2025

/test e2e-aws-ovn

bitoku
bitoku reviewed Sep 30, 2025
View reviewed changes
pkg/config/template_test.go Outdated
Comment on lines 49 to 52
Expect(output).To(ContainSubstring("allowed_annotations = ["))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.userns-mode",`))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.umask",`))
Expect(output).To(ContainSubstring(`"io.kubernetes.cri-o.Devices",`))
Copy link
Contributor

@bitoku bitoku Sep 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you modify it to check if it has the whole array to enforce it has allowed_annotations in the expected format?

allowed_annotations = [
    "io.kubernetes.cri-o.userns-mode",
    "io.kubernetes.cri-o.umask",
    "io.kubernetes.cri-o.Devices",
]

@bitoku
Copy link
Contributor

bitoku commented Sep 30, 2025

Thank you for the fix! @prasad89
I added some comments.

@prasad89 @bitoku
Update pkg/config/template.go
6e38744 
Co-authored-by: Ayato Tokubi <[email protected]>
Signed-off-by: Prasad Bhalerao <[email protected]>
Signed-off-by: prasad89 <[email protected]>
@prasad89 prasad89 requested a review from bitoku October 1, 2025 01:33
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 1, 2025

@prasad89: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/ci-e2e-conmonrs 6e38744 link true /test ci-e2e-conmonrs

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@bitoku
Copy link
Contributor

bitoku commented Oct 1, 2025

@prasad89 It seems you need to fix the unit tests

@github-actions
Copy link

github-actions bot commented Nov 13, 2025

A friendly reminder that this PR had no activity for 30 days.

@github-actions github-actions bot added lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Nov 13, 2025
@github-actions
Copy link

github-actions bot commented Dec 14, 2025

A friendly reminder that this PR had no activity for 30 days.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 14, 2025
@github-actions github-actions bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Dec 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@hasan4791 hasan4791 Awaiting requested review from hasan4791

@littlejawa littlejawa Awaiting requested review from littlejawa

@bitoku bitoku Awaiting requested review from bitoku

Assignees

No one assigned

Labels

dco-signoff: yes Indicates the PR's author has DCO signed all their commits. kind/bug Categorizes issue or PR as related to a bug. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

crio config doesn't print workload's allowed_annotations

2 participants

@prasad89 @bitoku