Skip to content

kuberesource: remove pod-role annotation from runtime#2510

Closed
burgerdev wants to merge 1 commit into
burgerdev/anno-labelfrom
burgerdev/no-runtime-role
Closed

kuberesource: remove pod-role annotation from runtime#2510
burgerdev wants to merge 1 commit into
burgerdev/anno-labelfrom
burgerdev/no-runtime-role

Conversation

@burgerdev

Copy link
Copy Markdown
Member

The pod role is used in the manifest to apply special considerations to some pods (notably, Coordinators). Since the runtime is never a confidential pod, it does not make sense to annotate it with a pod role. https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ are a more natural fit for this.

@burgerdev burgerdev requested a review from davidweisse July 6, 2026 16:45
@burgerdev burgerdev added the changelog PRs that should be part of the release notes label Jul 7, 2026
@burgerdev burgerdev requested a review from sespiros July 7, 2026 07:11
@burgerdev burgerdev added this to the v1.23.0 milestone Jul 8, 2026

@sespiros sespiros left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks.

This will break

kubectl get pods --all-namespaces -o jsonpath='{.items[?(@.metadata.annotations.contrast\.edgeless\.systems/pod-role=="contrast-node-installer")].metadata.name}' |

We would either need to select node installers by matching on *-nodeinstaller pod-name pattern or give the installer a stable label.

WithLabels(map[string]string{"app.kubernetes.io/name": name}).
WithAnnotations(map[string]string{
ContrastRoleLabelKey: string(manifest.RoleNodeInstaller),
"contrast.edgeless.systems/platform": platform.String(),

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do we have this? As far as I can see we don't use this anywhere as well.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know either.

@burgerdev

Copy link
Copy Markdown
Member Author

Thanks.

This will break

kubectl get pods --all-namespaces -o jsonpath='{.items[?(@.metadata.annotations.contrast\.edgeless\.systems/pod-role=="contrast-node-installer")].metadata.name}' |

We would either need to select node installers by matching on *-nodeinstaller pod-name pattern or give the installer a stable label.

Then ... I guess it's used after all and we can keep it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

changelog PRs that should be part of the release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants