kubernetes / kubernetes/cloud-provider-openstack
[manila-csi-plugin] Helm v4 upgrade fails on aggregated ClusterRoles due to SSA conflict on `.rules`
- Dominant language
- Go
- Stars
- 720
- Forks
- 687
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 51
Description
/kind bug
**What happened**:
Helm v4 [defaults to server-side apply](https://helm.sh/docs/overview/#server-side-apply).
Upgrading `manila-csi` fails with a server-side apply conflict on the aggregated ClusterRole objects for the controller and node plugins.
The error is:
```text
Upgrade "manila-csi" failed: conflict occurred while applying object /manila-csi-openstack-manila-csi-controllerplugin rbac.authorization.k8s.io/v1, Kind=ClusterRole: Apply failed with 1 conflict: conflict with "clusterrole-aggregation-controller": .rules
conflict occurred while applying object /manila-csi-openstack-manila-csi-nodeplugin rbac.authorization.k8s.io/v1, Kind=ClusterRole: Apply failed with 1 conflict: conflict with "clusterrole-aggregation-controller": .rules
```
The chart renders these clusteroles using an `aggregationRule` and `rules: []`:
https://github.com/kubernetes/cloud-provider-openstack/blob/46c2161c99d0cbef6700a1f1a08ba130844ad61b/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml#L7-L11
https://github.com/kubernetes/cloud-provider-openstack/blob/46c2161c99d0cbef6700a1f1a08ba130844ad61b/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml#L7-L11
But `clusterrole-aggregation-controller` takes ownership of the `.rules` field after creation and populates from matching aggregated roles:
```yaml
managedFields:
- manager: helm
operation: Apply
fieldsV1:
f:aggregationRule:
f:clusterRoleSelectors: {}
- manager: clusterrole-aggregation-controller
operation: Apply
fieldsV1:
f:rules: {}
```
So next helm upgrade results in an rbac conflict.
**What you expected to happen**:
Helm upgrades should work with SSA, i.e. the default for Helm 4
**How to reproduce it**:
1. Install manila-csi-plugin into a cluster using Helm 4, which defaults to SSA for new releases
2. Let `clusterrole-aggregation-controller` populate the aggregated rules
3. The next `helm upgrade` will fail
**Anything else we need to know?**:
Can `rules: []` just be removed?
**Environment**:
- openstack-cloud-controller-manager version: 2.35.0
- manila-csi-plugin version: 2.35.0
- Helm version: 4.2.0
- Kubernetes version: 1.34.6
Contributor guide
Research direction
Start with charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml and nodeplugin-clusterrole.yaml, comparing their aggregationRule and rules fields with the managedFields evidence. Reproduce the install and subsequent upgrade using Helm 4, then verify that the rendered ClusterRoles can be upgraded after clusterrole-aggregation-controller populates the rules without an SSA conflict.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100