Repository navigation
meta: a pod annotation carries caller OCI annotations for its pushed snapshots - #36
Merged
Merged
Conversation
…snapshots vm.cocoonstack.io/snapshot-annotations holds a JSON object that the pusher stamps on every snapshot it publishes for the pod. The business layer owns the keys (owner, lineage, manifest hash) and reads them back from the registry; the engine never interprets them. Keys under cocoonstack. stay reserved so a caller cannot override the baseimage identity guard or the peer-discovery hint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
meta.AnnotationSnapshotAnnotations=vm.cocoonstack.io/snapshot-annotations: a JSON object of OCI annotations that vk-cocoon stamps on every snapshot it pushes for the pod (thehibernatepush and the delete-timelatestpush).meta.ReadSnapshotAnnotations(pod): the typed reader. Absent or empty means no annotations; a malformed value, a non-string value, or any key under thecocoonstack.prefix is an error.docs/meta.md: the key in thevm.cocoonstack.io/row and one paragraph in the snapshot contract.Why
snapshot.PushOptions.Annotationsalready lets a caller stamp manifest annotations, but vk-cocoon pushes hibernate andlatestsnapshots on its own, so a business layer that creates the pod had no way to put its own metadata (owner, lineage, manifest hash) on those artifacts. The engine stays a carrier: it copies the values and never reads them. Thecocoonstack.prefix is reserved because the wire format already uses it forcocoonstack.snapshot.baseimage(the wake identity guard) and vk-cocoon forcocoonstack.snapshot.from-node(peer discovery); a caller must not be able to override either.Consumer
vk-cocoon PR to follow, pinned to this branch's commit until this merges.
Gates
make lint0 issues on linux and darwin,make fmt-checkclean,asl ./...clean on both GOOS,go test -race ./...green (GOWORK=off). Hot path: none; the reader runs once per snapshot push.