Adding .spec.pod.metadata.annotations to prebackup pod does not work

[oliverisaac]

When I try to create a prebackup pod with annotations I get an error from kuberntes saying invalid path:

strict decoding error: unknown field "spec.pod.metadata.annotations"

Example manifest:

apiVersion: k8up.io/v1
kind: PreBackupPod
metadata:
  name: vault-backup
  namespace: vault
spec:
  backupCommand: >-
    /bin/sh -c 'VAULT_TOKEN=$(cat /vault/secrets/token)
    VAULT_ADDR=https://vault.example.com vault operator raft snapshot save /tmp/backup.snap && base64 /tmp/backup.snap'
  fileExtension: .raft.b64
  pod:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: 'true'
        vault.hashicorp.com/agent-inject-token: 'true'
        vault.hashicorp.com/role: vault
    spec:
      containers:
        - command:
            - sleep
            - infinity
          image: hashicorp/vault:latest
          name: vault-backup

The relevant CRD bit is here, where we define the metadata object but not the subkeys:

k8up/charts/k8up/crds/k8up.io_prebackuppods.yaml

Lines 53 to 59 in bead14f

	properties:
	metadata:
	description: |-
	Standard object's metadata.
	More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	type: object
	spec:

(If someone else gets here by googling, here is how I worked around the problem:

apiVersion: k8up.io/v1
kind: PreBackupPod
metadata:
  name: vault-backup
  namespace: *name
spec:
  fileExtension: .raft.b64
  backupCommand: base64 -w0 /tmp/backup.snap
  pod:
    spec:
      containers:
        - name: vault-backup
          image: hashicorp/vault:latest
          env:
            - name: VAULT_ADDR
              value: https://vault.example.com
            - name: VAULT_AUTH_BACKEND
              value: k8s-k3s
            - name: VAULT_AUTH_ROLE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          command:
            - /bin/sh
            - -c
            - |
              set -eEuo pipefail;

              runid="vaultbackup-$(date +%s)";
              function log() {
                echo >&2 "$runid: ${*}";
              };

              log "Starting vault backup of $VAULT_ADDR";

              JWT=$( cat /var/run/secrets/kubernetes.io/serviceaccount/token );

              log "Going to login to $VAULT_AUTH_BACKEND/login role $VAULT_AUTH_ROLE";
              VAULT_TOKEN=$(vault write -field=token auth/$VAULT_AUTH_BACKEND/login role=$VAULT_AUTH_ROLE jwt=$JWT)
              export VAULT_TOKEN;

              log "Going to backup";
              vault operator raft snapshot save /tmp/backup.snap >&2;

              log "Done with vault backup to /tmp/backup.snap";
              touch /tmp/ready;

              sleep infinity;
          readinessProbe:
            exec:
              command:
              - ls
              - /tmp/ready
            initialDelaySeconds: 0
            periodSeconds: 5            

)

[arska]

This is likely a known issue with how kubebuilder generates CRD OpenAPI schemas for embedded PodTemplateSpec. The Pod struct in api/v1/prebackuppod_types.go wraps corev1.PodTemplateSpec inline, but the CRD schema generation may not preserve the metadata field from the embedded type.

The PodTemplateSpec does have a .metadata field (of type ObjectMeta), so .spec.pod.metadata.annotations is structurally correct — but the generated CRD may be using x-kubernetes-preserve-unknown-fields or similar annotations incorrectly.

As a workaround, you may be able to use kubectl apply --server-side which is more lenient with schema validation, or apply with --validate=false.

A proper fix would need changes to how the CRD is generated — potentially adding a marker like +kubebuilder:pruning:PreserveUnknownFields or restructuring the Pod type.