add a test case for container_annotations

Signed-off-by: Mike Brown <brownwm@us.ibm.com>

pkg/server/container_create_unix_test.go

@@ -98,7 +98,7 @@ func getCreateContainerTestData() (*runtime.ContainerConfig, *runtime.PodSandbox
 			},
 		},
 		Labels:      map[string]string{"a": "b"},
-		Annotations: map[string]string{"c": "d"},
+		Annotations: map[string]string{"ca-c": "ca-d"},
 		Linux: &runtime.LinuxContainerConfig{
 			Resources: &runtime.LinuxContainerResources{
 				CpuPeriod:          100,
@@ -367,7 +367,64 @@ func TestPodAnnotationPassthroughContainerSpec(t *testing.T) {
 			}
 		})
 	}
+}
 
+func TestContainerAnnotationPassthroughContainerSpec(t *testing.T) {
+	testID := "test-id"
+	testSandboxID := "sandbox-id"
+	testPid := uint32(1234)
+
+	for desc, test := range map[string]struct {
+		podAnnotations       []string
+		containerAnnotations []string
+		configChange         func(*runtime.PodSandboxConfig)
+		specCheck            func(*testing.T, *runtimespec.Spec)
+	}{
+		"passthrough annotations from pod and container should be passed as an OCI annotation": {
+			podAnnotations:       []string{"c"},
+			containerAnnotations: []string{"c*"}, // wildcard should pick up ca-c->ca-d pair in container
+			specCheck: func(t *testing.T, spec *runtimespec.Spec) {
+				assert.Equal(t, "d", spec.Annotations["c"])
+				assert.Equal(t, "ca-d", spec.Annotations["ca-c"])
+			},
+		},
+		"annotations should not pass through if no passthrough annotations are configured": {
+			podAnnotations:       []string{},
+			containerAnnotations: []string{},
+			specCheck: func(t *testing.T, spec *runtimespec.Spec) {
+				assert.Equal(t, "", spec.Annotations["c"])
+				assert.Equal(t, "", spec.Annotations["ca-c"])
+			},
+		},
+		"unmatched annotations should not pass through even if passthrough annotations are configured": {
+			podAnnotations:       []string{"x"},
+			containerAnnotations: []string{"x*"},
+			specCheck: func(t *testing.T, spec *runtimespec.Spec) {
+				assert.Equal(t, "", spec.Annotations["c"])
+				assert.Equal(t, "", spec.Annotations["ca-c"])
+			},
+		},
+	} {
+		t.Run(desc, func(t *testing.T) {
+			c := newTestCRIService()
+			containerConfig, sandboxConfig, imageConfig, specCheck := getCreateContainerTestData()
+			if test.configChange != nil {
+				test.configChange(sandboxConfig)
+			}
+			ociRuntime := config.Runtime{
+				PodAnnotations:       test.podAnnotations,
+				ContainerAnnotations: test.containerAnnotations,
+			}
+			spec, err := c.containerSpec(testID, testSandboxID, testPid, "",
+				containerConfig, sandboxConfig, imageConfig, nil, ociRuntime)
+			assert.NoError(t, err)
+			assert.NotNil(t, spec)
+			specCheck(t, testID, testSandboxID, testPid, spec)
+			if test.specCheck != nil {
+				test.specCheck(t, spec)
+			}
+		})
+	}
 }
 
 func TestContainerSpecReadonlyRootfs(t *testing.T) {