reapplying CRD yaml with conversion webhook enabled causes unexpected CRD resourceVersion update

[matthchr]

What broke

kubectl apply -f of a Kubebuilder generated CRD with conversion webhook enabled causes resourceVersion of CRD to be updated (which triggers watches to expire, which triggers re-list + reconciliation of all CRs of that CRD type).

What did I expect to happen?

resourceVersion shouldn't be changed.

The reason resourceVersion was changed is because of this section of the enablewebhook_patch template.

What ends up happening is:

1. Kustomize generates a CRD which includes the following snippet:

webhookClientConfig:
      # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
      # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)
      caBundle: Cg==

2. That CRD is initially applied (so caBundle is Cg==).
3. cert-manager sees the cert-manager.io/inject-ca-from annotation and updates caBundle to the actual ca value.
4. kubectl apply -f of the CRD happens again some time later (for example due to a GitOps tool like flux, or just because somebody is reapplying CRDs for whatever reason).
5. The caBundle is reset to Cg== (causing a resourceVersion change).
6. cert-manager reapplys the caBundle (causing another resourceVersion change).

Suggested solution

If instead of having a default of caBundle: Cg==, Kubebuilder generated patches that omitted caBundle entirely, this workflow would work much better, as per the documented behavior of apply and how it considers last-applied-configuration.

The comment:

  # this is "\n" used as a placeholder, otherwise it will be rejected by the apiserver for being blank,
  # but we're going to set it later using the cert-manager (or potentially a patch if not using cert-manager)

doesn't seem correct anyway since as far as I can tell this field has been optional since Kubernetes 1.13

I've tested this manually and confirmed that if I remove caBundle: Cg== from the yaml and reapply it on the CRD, it is accepted and subsequent reapplies don't change the resourceVersion.

• go version: 1.13
• kubebuilder version: 2.3.1
• Kubernetes version: 1.16.13

/kind bug

[DirectXMan12]

Yeah, I think that comment predated 1.13, possibly. the fix sounds good, plus it'll be more correct with SSA (since we don't want to own that field anyway).