Agent permissions is actually breaking (you cannot patch .status of any CR with sub-resource)

[alexec]

I made a mistake here, and learnt something.

Once you introduce a status sub-resource, you can no longer patch the whole resource, for example:

kubectl patch wfts template-executor-jfmfn -p '{"status": {"nodes": {"template-executor-jfmfn": {"message": "ok"}}}}' --type merge
workflowtaskset.argoproj.io/template-executor-jfmfn patched (no change)

See that there was "no change".

That means that changing to use workflowtaskset/status is a breaking change.

For users that are impacted by this, there is an espace hatch - do not install new manifests. This is a bad solution.

[terrytangyuan]

This hasn't been released yet though, right? #7987

Should we try to cover this in tests and make sure we can always patch the resource?

[alexec]

It's not fixable. And I don't want to fix it. We could delay #7987 to v3.4.