Skip to content

kube: alias OCI runtime annotations without underscores#28977

Open
jiwahn wants to merge 1 commit into
podman-container-tools:mainfrom
jiwahn:fix-kube-oci-annotation-roundtrip
Open

kube: alias OCI runtime annotations without underscores#28977
jiwahn wants to merge 1 commit into
podman-container-tools:mainfrom
jiwahn:fix-kube-oci-annotation-roundtrip

Conversation

@jiwahn

@jiwahn jiwahn commented Jun 19, 2026

Copy link
Copy Markdown
Contributor

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

  • Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
    commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
    the sign-off email address. See CONTRIBUTING.md
    for more information.
  • Referenced issues using Fixes: #00000 in commit message (if applicable)
  • Tests have been added/updated (or no tests are needed)
  • Documentation has been updated (or no documentation changes are needed)
  • All commits pass make validatepr (format/lint checks)
  • Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

Fixed `podman kube generate` output for OCI runtime annotations with underscores so the generated YAML can be used with `podman kube play`.

Description

Fixes: #26871

podman kube generate could emit OCI runtime annotations such as run.oci.keep_original_groups and run.oci.mount_context_type directly into Pod YAML. Since these keys contain underscores, the generated YAML failed Kubernetes annotation validation when reused with podman kube play.

Use Kubernetes-valid Podman aliases in generated YAML and restore the original OCI runtime annotations during podman kube play, preserving the runtime-facing run.oci.* keys. Hope this makes sense.

@Honny1 Honny1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I have some comments.

Comment thread test/e2e/play_kube_test.go
Comment thread test/e2e/play_kube_test.go Outdated
Comment thread libpod/define/annotations.go
cdiparser "tags.cncf.io/container-device-interface/pkg/parser"
)

var kubeToOCIRuntimeAnnotations = map[string]string{

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like having two mapping tables.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @Honny1, thanks for the comments!

I was also unhappy with having these redundant mappings. But I don't see an adequate place to put a shared mapping table. Since this mapping is just for a narrow use case, kube generate and play, I thought putting it in libpod/define is a bit much.

Alternatively, I can do this for each conversion instead of having a table:

func kubeAnnotationAlias(annotationKey string) string {
	switch annotationKey {
	case define.RunOCIKeepOriginalGroups:
		return define.KubeKeepOriginalGroupsAnnotation
	case define.RunOCIMountContextType:
		return define.KubeMountContextTypeAnnotation
	default:
		return annotationKey
	}
}

What do you think?

Fixes: podman-container-tools#26871
Signed-off-by: Jiwoo Ahn <ikwydls1314@gmail.com>
@jiwahn jiwahn force-pushed the fix-kube-oci-annotation-roundtrip branch from a5dd6fc to e1b01ed Compare June 23, 2026 05:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

run.oci.keep_original_groups in YAMLs from podman kube generate fail annotation checks

2 participants