Overlay pod annotations not applied

Version: v2.0.0

Problem

spec.template.spec.overlay.pod.metadata.annotations defined on PDGroup/TiKVGroup CRDs are not applied to the actual Pod. The operator stores them internally but never writes them to Pod metadata.

Reproduce

apiVersion: core.pingcap.com/v1alpha1
kind: PDGroup
metadata:
  name: tidb1-pd
spec:
  cluster:
    name: tidb1
  replicas: 3
  template:
    spec:
      version: "v8.5.0"
      overlay:
        pod:
          metadata:
            annotations:
              prometheus.io/scheme: "https"

Evidence

Pod only gets the 3 hardcoded annotations (prometheus.io/scrape, /port, /path). The custom annotation is absent.

But core.pingcap.com/last-instance-template on the same Pod contains:

{"metadata":{"annotations":{"prometheus.io/scheme":"https"}}, "spec":{...}}

The operator records the overlay intent but does not apply it.

Expected

Pod metadata.annotations should include prometheus.io/scheme: "https" per the Overlay documentation which states: "you can update Pod and PVC labels or annotations without restarting the Pod".

Code reference

pkg/overlay/overlay.go → OverlayPod() → overlayObjectMeta() uses maps.Copy correctly. The Instance controller does not appear to call this for metadata at pod creation.

Impact

Cannot inject prometheus.io/scheme for HTTPS metrics scraping when tlsCluster is enabled. OTel/Prometheus collectors default to HTTP → TLS handshake errors on PD (2379) and TiKV (20180).

Related

PR #6982 (v2.2.0-alpha.4) fixes a similar annotation gap for DM pods.

Start in pkg/overlay/overlay.go at OverlayPod() and overlayObjectMeta(), then trace how the Instance controller creates Pods and handles metadata. Confirm that the overlay annotations from PDGroup and TiKVGroup templates reach Pod metadata without losing the existing hardcoded annotations. Reproduce with the YAML example and verify that prometheus.io/scheme appears on the Pod.