only kmm tolerations appear in nmc status

Until now, the  nmc status reflected all pod
tolerations, including those unrelated to KMM.

This commit updates the behavior to source
tolerations from a dedicated annotation instead,
ensuring only KMM-specific tolerations
appear in the status.

Author: TomerNewman

internal/controllers/nmc_reconciler.go

@@ -563,15 +563,23 @@ func (h *nmcReconcilerHelperImpl) SyncStatus(ctx context.Context, nmcObj *kmmv1b
 					errs,
 					fmt.Errorf("%s: could not unmarshal the ModuleConfig from YAML: %v", podNSN, err),
 				)
-
 				continue
 			}
+			tolerationsAnnotation := h.podManager.GetTolerationsAnnotation(&p)
+			if tolerationsAnnotation != "" {
+				if err = yaml.UnmarshalStrict([]byte(tolerationsAnnotation), &status.Tolerations); err != nil {
+					errs = append(
+						errs,
+						fmt.Errorf("%s: could not unmarshal the ModuleConfig from YAML: %v", podNSN, err),
+					)
+					continue
+				}
+			}
 
 			if p.Spec.ImagePullSecrets != nil {
 				status.ImageRepoSecret = &p.Spec.ImagePullSecrets[0]
 			}
 			status.ServiceAccountName = p.Spec.ServiceAccountName
-			status.Tolerations = p.Spec.Tolerations
 
 			status.BootId = node.Status.NodeInfo.BootID
 

internal/controllers/nmc_reconciler_test.go

@@ -1229,10 +1229,14 @@ var _ = Describe("nmcReconcilerHelperImpl_SyncStatus", func() {
 		b, err := yaml.Marshal(cfg)
 		Expect(err).NotTo(HaveOccurred())
 
+		tolerations, err := yaml.Marshal(p.Spec.Tolerations)
+		Expect(err).NotTo(HaveOccurred())
+
 		gomock.InOrder(
 			mockWorkerPodManager.EXPECT().ListWorkerPodsOnNode(ctx, nmcName).Return([]v1.Pod{p}, nil),
 			mockWorkerPodManager.EXPECT().IsUnloaderPod(&p).Return(false),
 			mockWorkerPodManager.EXPECT().GetConfigAnnotation(&p).Return(string(b)),
+			mockWorkerPodManager.EXPECT().GetTolerationsAnnotation(&p).Return(string(tolerations)),
 			kubeClient.EXPECT().Status().Return(sw),
 			sw.EXPECT().Patch(ctx, nmc, gomock.Any()),
 			mockWorkerPodManager.EXPECT().DeletePod(ctx, &p),

internal/pod/mock_workerpodmanager.go

@@ -40,26 +40,28 @@ type WorkerPodManager interface {
 	IsUnloaderPod(p *v1.Pod) bool
 	GetConfigAnnotation(p *v1.Pod) string
 	HashAnnotationDiffer(p1, p2 *v1.Pod) bool
+	GetTolerationsAnnotation(p *v1.Pod) string
 }
 
 const (
 	NodeModulesConfigFinalizer = "kmm.node.kubernetes.io/nodemodulesconfig-reconciler"
 	WorkerContainerName        = "worker"
 
-	volMountPointConfig = "/etc/kmm-worker"
-	configFileName      = "config.yaml"
-	configFullPath      = volMountPointConfig + "/" + configFileName
-	volNameConfig       = "config"
-	sharedFilesDir      = "/tmp"
-	volNameTmp          = "tmp"
-	volumeNameConfig    = "config"
-	initContainerName   = "image-extractor"
-	modulesOrderKey     = "kmm.node.kubernetes.io/modules-order"
-	workerActionLoad    = "Load"
-	workerActionUnload  = "Unload"
-	actionLabelKey      = "kmm.node.kubernetes.io/worker-action"
-	configAnnotationKey = "kmm.node.kubernetes.io/worker-config"
-	hashAnnotationKey   = "kmm.node.kubernetes.io/worker-hash"
+	volMountPointConfig      = "/etc/kmm-worker"
+	configFileName           = "config.yaml"
+	configFullPath           = volMountPointConfig + "/" + configFileName
+	volNameConfig            = "config"
+	sharedFilesDir           = "/tmp"
+	volNameTmp               = "tmp"
+	volumeNameConfig         = "config"
+	initContainerName        = "image-extractor"
+	modulesOrderKey          = "kmm.node.kubernetes.io/modules-order"
+	workerActionLoad         = "Load"
+	workerActionUnload       = "Unload"
+	actionLabelKey           = "kmm.node.kubernetes.io/worker-action"
+	configAnnotationKey      = "kmm.node.kubernetes.io/worker-config"
+	hashAnnotationKey        = "kmm.node.kubernetes.io/worker-hash"
+	tolerationsAnnotationKey = "kmm.node.kubernetes.io/worker-tolerations"
 )
 
 var (
@@ -195,6 +197,9 @@ func (wpmi *workerPodManagerImpl) LoaderPodTemplate(ctx context.Context, nmc cli
 	if err = setWorkerConfigAnnotation(pod, nms.Config); err != nil {
 		return nil, fmt.Errorf("could not set worker config: %v", err)
 	}
+	if err = setWorkerTolerationsAnnotation(pod, nms.Tolerations); err != nil {
+		return nil, fmt.Errorf("could not set worker tolerations: %v", err)
+	}
 
 	if err = setWorkerSecurityContext(pod, wpmi.workerCfg, privileged); err != nil {
 		return nil, fmt.Errorf("could not set the worker Pod as privileged: %v", err)
@@ -220,6 +225,9 @@ func (wpmi *workerPodManagerImpl) UnloaderPodTemplate(ctx context.Context, nmc c
 	if err = setWorkerConfigAnnotation(pod, nms.Config); err != nil {
 		return nil, fmt.Errorf("could not set worker config: %v", err)
 	}
+	if err = setWorkerTolerationsAnnotation(pod, nms.Tolerations); err != nil {
+		return nil, fmt.Errorf("could not set worker tolerations: %v", err)
+	}
 
 	if err = setWorkerSecurityContext(pod, wpmi.workerCfg, false); err != nil {
 		return nil, fmt.Errorf("could not set the worker Pod's security context: %v", err)
@@ -284,6 +292,14 @@ func (wpmi *workerPodManagerImpl) GetConfigAnnotation(p *v1.Pod) string {
 
 	return p.Annotations[configAnnotationKey]
 }
+func (wpmi *workerPodManagerImpl) GetTolerationsAnnotation(p *v1.Pod) string {
+
+	if p == nil {
+		return ""
+	}
+
+	return p.Annotations[tolerationsAnnotationKey]
+}
 
 func (wpmi *workerPodManagerImpl) HashAnnotationDiffer(p1, p2 *v1.Pod) bool {
 
@@ -455,6 +471,15 @@ func setWorkerConfigAnnotation(pod *v1.Pod, cfg kmmv1beta1.ModuleConfig) error {
 	return nil
 }
 
+func setWorkerTolerationsAnnotation(pod *v1.Pod, tolerations []v1.Toleration) error {
+	b, err := yaml.Marshal(tolerations)
+	if err != nil {
+		return fmt.Errorf("could not marshal the Tolerations to YAML: %v", err)
+	}
+	meta.SetAnnotation(pod, tolerationsAnnotationKey, string(b))
+	return nil
+}
+
 func setWorkerSofdepConfig(pod *v1.Pod, modulesLoadingOrder []string) error {
 	softdepAnnotationValue := getModulesOrderAnnotationValue(modulesLoadingOrder)
 	meta.SetAnnotation(pod, modulesOrderKey, softdepAnnotationValue)

internal/pod/workerpodmanager.go

@@ -485,6 +485,7 @@ cp -R /firmware-path/* /tmp/firmware-path;
 	} else {
 		configAnnotationValue = strings.ReplaceAll(configAnnotationValue, "firmwarePath: /firmware-path\n  ", "")
 	}
+	tolerationAnotationValue := "- effect: NoExecute\n  key: test-key\n  value: test-value\n"
 	pod := v1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      WorkerPodName(nmcName, moduleName),
@@ -497,8 +498,9 @@ cp -R /firmware-path/* /tmp/firmware-path;
 				constants.ModuleNameLabel:     moduleName,
 			},
 			Annotations: map[string]string{
-				configAnnotationKey: configAnnotationValue,
-				modulesOrderKey:     modulesOrderValue,
+				configAnnotationKey:      configAnnotationValue,
+				modulesOrderKey:          modulesOrderValue,
+				tolerationsAnnotationKey: tolerationAnotationValue,
 			},
 		},
 		Spec: v1.PodSpec{