TTL validation bug

I accidentally created a cluster spiffe id with ttl set to 5d.

It doesn't work as 'd' is not supported. This is fine. The whole controller manager is kind of broken with syncing at this point... this even is kind of fine, as its not supported and my mistake.

I then did a kubectl edit on it and tried to remove the ttl, or change it to something valid. It fails:

error: clusterspiffeids.spire.spiffe.io "spire-root-server-spire-step" could not be patched: admission webhook "vclusterspiffeid.kb.io" denied the request: time: unknown unit "d" in duration "5d"

It seems to be validating the previous version before validating the current version?

But there's now not a way to fix it.

Reproduce the failure by creating a ClusterSPIFFEID with an unsupported 5d TTL, then try editing it with kubectl to remove or replace the value. Trace the admission webhook validation path that rejects the stored invalid version before accepting the edited resource. Done means the malformed object can be repaired through kubectl while valid TTL values continue to be rejected or accepted appropriately.