Bug?: (Helm) unable to add rule to previously created (default) firewall

The helm template for the CloudFirewall has one big if statement around it:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/helm/controller/templates/firewall.yaml#L1-L1

This means that if you install the helm chart with default values, no (Helm managed) CloudFirewall will be created. However the Golang controller code will create a default firewall if no CloudFirewall exists:

https://github.com/linode/cloud-firewall-controller/blob/8eae0593716403589d4b070840967399b0b153d7/internal/controller/cloudfirewall_controller.go#L660-L679

Later on adding a rule via Helm however will now fail, because it will try to create a Helm managed CloudFirewall (see above) where the object already exists. Helm will fail with:

╷
│ Error: Unable to continue with update: CloudFirewall "primary" in namespace "kube-system" exists and cannot be imported into the current release: invalid ownership metadata; label validation error: missing key "app.kubernetes.io/managed-by": must be set to "Helm"; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "cloud-firewall-controller"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "kube-system"
│ 
│   with helm_release.linode_firewall_controller,
│   on main.tf line 70, in resource "helm_release" "linode_firewall_controller":
│   70: resource "helm_release" "linode_firewall_controller" {
│ 
╵

Note: the above is actually a failure of Helm wrapped in Terraform because I'm doing the helm install via Terraform, but that's besides the point. Helm is correct in the sense that because the original CloudFirewall was not created by Helm previously, it should not suddenly manage it and will therefor fail.

Inizia da helm/controller/templates/firewall.yaml e internal/controller/cloudfirewall_controller.go intorno alle righe collegate. Confronta i metadati di proprietà di Helm con il CloudFirewall predefinito creato dal controller, quindi riproduci l'installazione con i valori predefiniti seguita dall'aggiunta di una regola. Il lavoro è completato quando quel flusso di lavoro non fallisce più perché Helm non può adottare il firewall esistente.