Merge pull request #59880 from liggitt/init-container-annotations

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

Drop init container annotations during conversion

https://github.com/kubernetes/kubernetes/pull/51816/files#diff-0fa94eafdf1c7cd2171c836b53fd6323 removed special handling of init container annotations in API conversion in 1.8

However, older clients (like 1.7 kubectl) still performed that handling in some paths, which would make an object round-tripped through kubectl show up with additional annotations.

Those additions would get flagged as disallowed mutations in some objects.

This change strips init-container annotations during conversion so that old clients sending init container annotations (which are inert in 1.8+) don't trigger validation errors around immutable fields.

Fixes #54816

```release-note
Restores the ability of older clients to delete and scale jobs with initContainers
```

pkg/apis/core/v1/conversion.go

@@ -350,6 +350,10 @@ func Convert_core_PodTemplateSpec_To_v1_PodTemplateSpec(in *core.PodTemplateSpec
 		return err
 	}
 
+	// drop init container annotations so they don't take effect on legacy kubelets.
+	// remove this once the oldest supported kubelet no longer honors the annotations over the field.
+	out.Annotations = dropInitContainerAnnotations(out.Annotations)
+
 	return nil
 }
 
@@ -358,6 +362,9 @@ func Convert_v1_PodTemplateSpec_To_core_PodTemplateSpec(in *v1.PodTemplateSpec,
 		return err
 	}
 
+	// drop init container annotations so they don't show up as differences when receiving requests from old clients
+	out.Annotations = dropInitContainerAnnotations(out.Annotations)
+
 	return nil
 }
 
@@ -405,6 +412,17 @@ func Convert_v1_PodSpec_To_core_PodSpec(in *v1.PodSpec, out *core.PodSpec, s con
 	return nil
 }
 
+func Convert_v1_Pod_To_core_Pod(in *v1.Pod, out *core.Pod, s conversion.Scope) error {
+	if err := autoConvert_v1_Pod_To_core_Pod(in, out, s); err != nil {
+		return err
+	}
+
+	// drop init container annotations so they don't show up as differences when receiving requests from old clients
+	out.Annotations = dropInitContainerAnnotations(out.Annotations)
+
+	return nil
+}
+
 func Convert_core_Pod_To_v1_Pod(in *core.Pod, out *v1.Pod, s conversion.Scope) error {
 	if err := autoConvert_core_Pod_To_v1_Pod(in, out, s); err != nil {
 		return err
@@ -412,17 +430,7 @@ func Convert_core_Pod_To_v1_Pod(in *core.Pod, out *v1.Pod, s conversion.Scope) e
 
 	// drop init container annotations so they don't take effect on legacy kubelets.
 	// remove this once the oldest supported kubelet no longer honors the annotations over the field.
-	if len(out.Annotations) > 0 {
-		old := out.Annotations
-		out.Annotations = make(map[string]string, len(old))
-		for k, v := range old {
-			out.Annotations[k] = v
-		}
-		delete(out.Annotations, "pod.beta.kubernetes.io/init-containers")
-		delete(out.Annotations, "pod.alpha.kubernetes.io/init-containers")
-		delete(out.Annotations, "pod.beta.kubernetes.io/init-container-statuses")
-		delete(out.Annotations, "pod.alpha.kubernetes.io/init-container-statuses")
-	}
+	out.Annotations = dropInitContainerAnnotations(out.Annotations)
 
 	return nil
 }
@@ -570,3 +578,40 @@ func AddFieldLabelConversionsForSecret(scheme *runtime.Scheme) error {
 			}
 		})
 }
+
+var initContainerAnnotations = map[string]bool{
+	"pod.beta.kubernetes.io/init-containers":          true,
+	"pod.alpha.kubernetes.io/init-containers":         true,
+	"pod.beta.kubernetes.io/init-container-statuses":  true,
+	"pod.alpha.kubernetes.io/init-container-statuses": true,
+}
+
+// dropInitContainerAnnotations returns a copy of the annotations with init container annotations removed,
+// or the original annotations if no init container annotations were present.
+//
+// this can be removed once no clients prior to 1.8 are supported, and no kubelets prior to 1.8 can be run
+// (we don't support kubelets older than 2 versions skewed from the apiserver, but we don't prevent them, either)
+func dropInitContainerAnnotations(oldAnnotations map[string]string) map[string]string {
+	if len(oldAnnotations) == 0 {
+		return oldAnnotations
+	}
+
+	found := false
+	for k := range initContainerAnnotations {
+		if _, ok := oldAnnotations[k]; ok {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return oldAnnotations
+	}
+
+	newAnnotations := make(map[string]string, len(oldAnnotations))
+	for k, v := range oldAnnotations {
+		if !initContainerAnnotations[k] {
+			newAnnotations[k] = v
+		}
+	}
+	return newAnnotations
+}

pkg/apis/core/v1/zz_generated.conversion.go

@@ -3434,11 +3434,6 @@ func autoConvert_v1_Pod_To_core_Pod(in *v1.Pod, out *core.Pod, s conversion.Scop
 	return nil
 }
 
-// Convert_v1_Pod_To_core_Pod is an autogenerated conversion function.
-func Convert_v1_Pod_To_core_Pod(in *v1.Pod, out *core.Pod, s conversion.Scope) error {
-	return autoConvert_v1_Pod_To_core_Pod(in, out, s)
-}
-
 func autoConvert_core_Pod_To_v1_Pod(in *core.Pod, out *v1.Pod, s conversion.Scope) error {
 	out.ObjectMeta = in.ObjectMeta
 	if err := Convert_core_PodSpec_To_v1_PodSpec(&in.Spec, &out.Spec, s); err != nil {