kubernetes / kubernetes/cloud-provider-openstack

[manila-csi-plugin] Helm v4 upgrade fails on aggregated ClusterRoles due to SSA conflict on `.rules`

Open Beginner friendly
#3,119 0 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
720
Forks
687
Avg merge
1d 14h
Merged PRs (30d)
51

Description

/kind bug

**What happened**:
Helm v4 [defaults to server-side apply](https://helm.sh/docs/overview/#server-side-apply).
Upgrading `manila-csi` fails with a server-side apply conflict on the aggregated ClusterRole objects for the controller and node plugins.

The error is:
```text
Upgrade "manila-csi" failed: conflict occurred while applying object /manila-csi-openstack-manila-csi-controllerplugin rbac.authorization.k8s.io/v1, Kind=ClusterRole: Apply failed with 1 conflict: conflict with "clusterrole-aggregation-controller": .rules
conflict occurred while applying object /manila-csi-openstack-manila-csi-nodeplugin rbac.authorization.k8s.io/v1, Kind=ClusterRole: Apply failed with 1 conflict: conflict with "clusterrole-aggregation-controller": .rules
```

The chart renders these clusteroles using an `aggregationRule` and `rules: []`:
https://github.com/kubernetes/cloud-provider-openstack/blob/46c2161c99d0cbef6700a1f1a08ba130844ad61b/charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml#L7-L11

https://github.com/kubernetes/cloud-provider-openstack/blob/46c2161c99d0cbef6700a1f1a08ba130844ad61b/charts/manila-csi-plugin/templates/nodeplugin-clusterrole.yaml#L7-L11

But `clusterrole-aggregation-controller` takes ownership of the `.rules` field after creation and populates from matching aggregated roles:
```yaml
managedFields:
- manager: helm
operation: Apply
fieldsV1:
f:aggregationRule:
f:clusterRoleSelectors: {}
- manager: clusterrole-aggregation-controller
operation: Apply
fieldsV1:
f:rules: {}
```

So next helm upgrade results in an rbac conflict.

**What you expected to happen**:
Helm upgrades should work with SSA, i.e. the default for Helm 4

**How to reproduce it**:
1. Install manila-csi-plugin into a cluster using Helm 4, which defaults to SSA for new releases
2. Let `clusterrole-aggregation-controller` populate the aggregated rules
3. The next `helm upgrade` will fail

**Anything else we need to know?**:
Can `rules: []` just be removed?

**Environment**:
- openstack-cloud-controller-manager version: 2.35.0
- manila-csi-plugin version: 2.35.0
- Helm version: 4.2.0
- Kubernetes version: 1.34.6

Contributor guide

Open the contributing guide

Research direction

Start with charts/manila-csi-plugin/templates/controllerplugin-clusterrole.yaml and nodeplugin-clusterrole.yaml, comparing their aggregationRule and rules fields with the managedFields evidence. Reproduce the install and subsequent upgrade using Helm 4, then verify that the rendered ClusterRoles can be upgraded after clusterrole-aggregation-controller populates the rules without an SSA conflict.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.