Remove non KMM related tolerations from the NMC status

Until now, the  nmc status reflected all pod
tolerations, including those unrelated to KMM.

This commit updates the behavior to source
tolerations from a dedicated annotation instead,
ensuring only KMM-specific tolerations
appear in the status.

Author: TomerNewman

internal/controllers/nmc_reconciler.go

@@ -563,15 +563,21 @@ func (h *nmcReconcilerHelperImpl) SyncStatus(ctx context.Context, nmcObj *kmmv1b
 					errs,
 					fmt.Errorf("%s: could not unmarshal the ModuleConfig from YAML: %v", podNSN, err),
 				)
-
+				continue
+			}
+			tolerationsAnnotation := h.podManager.GetTolerationsAnnotation(&p)
+			if err = yaml.UnmarshalStrict([]byte(tolerationsAnnotation), &status.Tolerations); err != nil {
+				errs = append(
+					errs,
+					fmt.Errorf("%s: could not unmarshal the ModuleConfig from YAML: %v", podNSN, err),
+				)
 				continue
 			}
 
 			if p.Spec.ImagePullSecrets != nil {
 				status.ImageRepoSecret = &p.Spec.ImagePullSecrets[0]
 			}
 			status.ServiceAccountName = p.Spec.ServiceAccountName
-			status.Tolerations = p.Spec.Tolerations
 
 			status.BootId = node.Status.NodeInfo.BootID
 

internal/controllers/nmc_reconciler_test.go

@@ -1229,10 +1229,14 @@ var _ = Describe("nmcReconcilerHelperImpl_SyncStatus", func() {
 		b, err := yaml.Marshal(cfg)
 		Expect(err).NotTo(HaveOccurred())
 
+		tolerations, err := yaml.Marshal(p.Spec.Tolerations)
+		Expect(err).NotTo(HaveOccurred())
+
 		gomock.InOrder(
 			mockWorkerPodManager.EXPECT().ListWorkerPodsOnNode(ctx, nmcName).Return([]v1.Pod{p}, nil),
 			mockWorkerPodManager.EXPECT().IsUnloaderPod(&p).Return(false),
 			mockWorkerPodManager.EXPECT().GetConfigAnnotation(&p).Return(string(b)),
+			mockWorkerPodManager.EXPECT().GetTolerationsAnnotation(&p).Return(string(tolerations)),
 			kubeClient.EXPECT().Status().Return(sw),
 			sw.EXPECT().Patch(ctx, nmc, gomock.Any()),
 			mockWorkerPodManager.EXPECT().DeletePod(ctx, &p),

internal/pod/mock_workerpodmanager.go

@@ -40,26 +40,28 @@ type WorkerPodManager interface {
 	IsUnloaderPod(p *v1.Pod) bool
 	GetConfigAnnotation(p *v1.Pod) string
 	HashAnnotationDiffer(p1, p2 *v1.Pod) bool
+	GetTolerationsAnnotation(p *v1.Pod) string
 }
 
 const (
 	NodeModulesConfigFinalizer = "kmm.node.kubernetes.io/nodemodulesconfig-reconciler"
 	WorkerContainerName        = "worker"
 
-	volMountPointConfig = "/etc/kmm-worker"
-	configFileName      = "config.yaml"
-	configFullPath      = volMountPointConfig + "/" + configFileName
-	volNameConfig       = "config"
-	sharedFilesDir      = "/tmp"
-	volNameTmp          = "tmp"
-	volumeNameConfig    = "config"
-	initContainerName   = "image-extractor"
-	modulesOrderKey     = "kmm.node.kubernetes.io/modules-order"
-	workerActionLoad    = "Load"
-	workerActionUnload  = "Unload"
-	actionLabelKey      = "kmm.node.kubernetes.io/worker-action"
-	configAnnotationKey = "kmm.node.kubernetes.io/worker-config"
-	hashAnnotationKey   = "kmm.node.kubernetes.io/worker-hash"
+	volMountPointConfig      = "/etc/kmm-worker"
+	configFileName           = "config.yaml"
+	configFullPath           = volMountPointConfig + "/" + configFileName
+	volNameConfig            = "config"
+	sharedFilesDir           = "/tmp"
+	volNameTmp               = "tmp"
+	volumeNameConfig         = "config"
+	initContainerName        = "image-extractor"
+	modulesOrderKey          = "kmm.node.kubernetes.io/modules-order"
+	workerActionLoad         = "Load"
+	workerActionUnload       = "Unload"
+	actionLabelKey           = "kmm.node.kubernetes.io/worker-action"
+	configAnnotationKey      = "kmm.node.kubernetes.io/worker-config"
+	hashAnnotationKey        = "kmm.node.kubernetes.io/worker-hash"
+	tolerationsAnnotationKey = "kmm.node.kubernetes.io/worker-tolerations"
 )
 
 var (
@@ -195,6 +197,9 @@ func (wpmi *workerPodManagerImpl) LoaderPodTemplate(ctx context.Context, nmc cli
 	if err = setWorkerConfigAnnotation(pod, nms.Config); err != nil {
 		return nil, fmt.Errorf("could not set worker config: %v", err)
 	}
+	if err = setWorkerTolerationsAnnotation(pod, nms.Tolerations); err != nil {
+		return nil, fmt.Errorf("could not set worker tolerations: %v", err)
+	}
 
 	if err = setWorkerSecurityContext(pod, wpmi.workerCfg, privileged); err != nil {
 		return nil, fmt.Errorf("could not set the worker Pod as privileged: %v", err)
@@ -220,6 +225,9 @@ func (wpmi *workerPodManagerImpl) UnloaderPodTemplate(ctx context.Context, nmc c
 	if err = setWorkerConfigAnnotation(pod, nms.Config); err != nil {
 		return nil, fmt.Errorf("could not set worker config: %v", err)
 	}
+	if err = setWorkerTolerationsAnnotation(pod, nms.Tolerations); err != nil {
+		return nil, fmt.Errorf("could not set worker tolerations: %v", err)
+	}
 
 	if err = setWorkerSecurityContext(pod, wpmi.workerCfg, false); err != nil {
 		return nil, fmt.Errorf("could not set the worker Pod's security context: %v", err)
@@ -284,6 +292,14 @@ func (wpmi *workerPodManagerImpl) GetConfigAnnotation(p *v1.Pod) string {
 
 	return p.Annotations[configAnnotationKey]
 }
+func (wpmi *workerPodManagerImpl) GetTolerationsAnnotation(p *v1.Pod) string {
+
+	if p == nil {
+		return ""
+	}
+
+	return p.Annotations[tolerationsAnnotationKey]
+}
 
 func (wpmi *workerPodManagerImpl) HashAnnotationDiffer(p1, p2 *v1.Pod) bool {
 
@@ -455,6 +471,18 @@ func setWorkerConfigAnnotation(pod *v1.Pod, cfg kmmv1beta1.ModuleConfig) error {
 	return nil
 }
 
+func setWorkerTolerationsAnnotation(pod *v1.Pod, tolerations []v1.Toleration) error {
+	if len(tolerations) != 0 {
+		b, err := yaml.Marshal(tolerations)
+		if err != nil {
+			return fmt.Errorf("could not marshal the Tolerations to YAML: %v", err)
+		}
+		meta.SetAnnotation(pod, tolerationsAnnotationKey, string(b))
+	}
+
+	return nil
+}
+
 func setWorkerSofdepConfig(pod *v1.Pod, modulesLoadingOrder []string) error {
 	softdepAnnotationValue := getModulesOrderAnnotationValue(modulesLoadingOrder)
 	meta.SetAnnotation(pod, modulesOrderKey, softdepAnnotationValue)

internal/pod/workerpodmanager.go

@@ -485,6 +485,7 @@ cp -R /firmware-path/* /tmp/firmware-path;
 	} else {
 		configAnnotationValue = strings.ReplaceAll(configAnnotationValue, "firmwarePath: /firmware-path\n  ", "")
 	}
+	tolerationAnotationValue := "- effect: NoExecute\n  key: test-key\n  value: test-value\n"
 	pod := v1.Pod{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      WorkerPodName(nmcName, moduleName),
@@ -497,8 +498,9 @@ cp -R /firmware-path/* /tmp/firmware-path;
 				constants.ModuleNameLabel:     moduleName,
 			},
 			Annotations: map[string]string{
-				configAnnotationKey: configAnnotationValue,
-				modulesOrderKey:     modulesOrderValue,
+				configAnnotationKey:      configAnnotationValue,
+				modulesOrderKey:          modulesOrderValue,
+				tolerationsAnnotationKey: tolerationAnotationValue,
 			},
 		},
 		Spec: v1.PodSpec{