-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
reapplying CRD yaml with conversion webhook enabled causes unexpected CRD resourceVersion update #1684
Comments
Yeah, I think that comment predated 1.13, possibly. the fix sounds good, plus it'll be more correct with SSA (since we don't want to own that field anyway). |
matthchr
added a commit
to matthchr/azure-service-operator
that referenced
this issue
Sep 24, 2020
- This prevents resourceVersion change when CRD is reapplied. - See kubernetes-sigs/kubebuilder#1684 for more details. - Fixes Azure#1261.
matthchr
added a commit
to Azure/azure-service-operator
that referenced
this issue
Sep 24, 2020
- This prevents resourceVersion change when CRD is reapplied. - See kubernetes-sigs/kubebuilder#1684 for more details. - Fixes #1261.
matthchr
added a commit
to matthchr/kubebuilder
that referenced
this issue
Sep 29, 2020
matthchr
added a commit
to matthchr/kubebuilder
that referenced
this issue
Sep 29, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What broke
kubectl apply -f
of a Kubebuilder generated CRD with conversion webhook enabled causesresourceVersion
of CRD to be updated (which triggers watches to expire, which triggers re-list + reconciliation of all CRs of that CRD type).What did I expect to happen?
resourceVersion
shouldn't be changed.The reason
resourceVersion
was changed is because of this section of the enablewebhook_patch template.What ends up happening is:
caBundle
isCg==
).cert-manager
sees thecert-manager.io/inject-ca-from
annotation and updatescaBundle
to the actual ca value.kubectl apply -f
of the CRD happens again some time later (for example due to a GitOps tool like flux, or just because somebody is reapplying CRDs for whatever reason).caBundle
is reset toCg==
(causing aresourceVersion
change).cert-manager
reapplys thecaBundle
(causing anotherresourceVersion
change).Suggested solution
If instead of having a default of
caBundle: Cg==
, Kubebuilder generated patches that omittedcaBundle
entirely, this workflow would work much better, as per the documented behavior of apply and how it considers last-applied-configuration.The comment:
doesn't seem correct anyway since as far as I can tell this field has been optional since Kubernetes 1.13
I've tested this manually and confirmed that if I remove
caBundle: Cg==
from the yaml and reapply it on the CRD, it is accepted and subsequent reapplies don't change theresourceVersion
./kind bug
The text was updated successfully, but these errors were encountered: