@Rocky It seems the current k8s operator does not allow setting custom pod annotations for the FE Proxy

starRocksFeProxySpec

object. Is there a way to work around this without using kustomize

As of the current version of the StarRocks Kubernetes Operator, you are correct: while the

starRocksFeSpec

,

starRocksBeSpec

, and

starRocksCnSpec

objects support a dedicated

annotations

field for pod-level metadata, the

starRocksFeProxySpec

(which maps to the

StarRocksLoadSpec

in the CRD) does not currently expose this field. This appears to be a lack of parity in the CRD definition between the core cluster components and the FE Proxy component. If you cannot use Kustomize, here are the best workarounds to inject custom pod annotations: 1. Kubernetes Mutating Admission Webhook (Kyverno / OPA) This is the most robust "Kubernetes-native" workaround. If you have an admission controller like Kyverno or OPA Gatekeeper installed, you can create a policy to automatically inject annotations into any pod that matches the FE Proxy labels. Example Kyverno Policy:

yaml
apiVersion: <http://kyverno.io/v1|kyverno.io/v1>
kind: ClusterPolicy
metadata:
  name: add-fe-proxy-annotations
spec:
  rules:
  - name: inject-annotations
    match:
      any:
      - resources:
          kinds:
          - Pod
          selector:
            matchLabels:
              <http://app.kubernetes.io/component|app.kubernetes.io/component>: fe-proxy
    mutate:
      patchStrategicMerge:
        metadata:
          annotations:
            my-custom-annotation: "custom-value"

2. Helm Post-Rendering If you are deploying via Helm, you can use the built-in post-renderer feature. This allows you to pass the generated manifest through a script (even a simple

sed

or

yq

script) before it is applied to the cluster. This does not require you to maintain a Kustomize overlay. Usage:

bash
helm install kube-starrocks starrocks/kube-starrocks --post-renderer ./my-patch-script.sh

Your script can simply look for the

Deployment

named

*-fe-proxy

and inject the required metadata. 3. Service Annotations (Alternative) Note that

starRocksFeProxySpec

does support annotations at the Service level. If your goal is to configure a LoadBalancer or Ingress behavior (like AWS LB settings), you can apply them here:

yaml
starRocksFeProxySpec:
  service:
    annotations:
      <http://service.beta.kubernetes.io/aws-load-balancer-type|service.beta.kubernetes.io/aws-load-balancer-type>: "nlb"

Summary Recommendation * For immediate automation: Use a Mutating Webhook (Kyverno) if available in your cluster. * For CI/CD pipelines: Use Helm post-rendering with a tool like

yq

. * Long-term: Since this is a missing feature in the operator's CRD, I recommend opening a feature request on the StarRocks Kubernetes Operator GitHub to bring

starRocksFeProxySpec

into parity with the other component specs. References • quick_start/helm.md • faq/Others.md • administration/management/FE_configuration.md • administration/management/resource_management/Load_balance.md

I logged a bug about it -> https://github.com/StarRocks/starrocks-kubernetes-operator/issues/750