Overlay pod annotations not applied

[Roxyrob]

Version: v2.0.0

Problem

spec.template.spec.overlay.pod.metadata.annotations defined on PDGroup/TiKVGroup CRDs are not applied to the actual Pod. The operator stores them internally but never writes them to Pod metadata.

Reproduce

apiVersion: core.pingcap.com/v1alpha1
kind: PDGroup
metadata:
  name: tidb1-pd
spec:
  cluster:
    name: tidb1
  replicas: 3
  template:
    spec:
      version: "v8.5.0"
      overlay:
        pod:
          metadata:
            annotations:
              prometheus.io/scheme: "https"

Evidence

Pod only gets the 3 hardcoded annotations (prometheus.io/scrape, /port, /path). The custom annotation is absent.

But core.pingcap.com/last-instance-template on the same Pod contains:

{"metadata":{"annotations":{"prometheus.io/scheme":"https"}}, "spec":{...}}

The operator records the overlay intent but does not apply it.

Expected

Pod metadata.annotations should include prometheus.io/scheme: "https" per the Overlay documentation which states: "you can update Pod and PVC labels or annotations without restarting the Pod".

Code reference

pkg/overlay/overlay.go → OverlayPod() → overlayObjectMeta() uses maps.Copy correctly. The Instance controller does not appear to call this for metadata at pod creation.

Impact

Cannot inject prometheus.io/scheme for HTTPS metrics scraping when tlsCluster is enabled. OTel/Prometheus collectors default to HTTP → TLS handshake errors on PD (2379) and TiKV (20180).

Related

PR #6982 (v2.2.0-alpha.4) fixes a similar annotation gap for DM pods.

[ti-chi-bot]

Welcome @Roxyrob! It looks like this is your first issue to pingcap/tidb-operator 🎉