The `kubectl` managed fields are removed when SSA policy is set to `Merge`

[alvaroaleman]

The kustomize-controller hardcodes kubectl as one of the fieldManagers whose changes it will always override:

kustomize-controller/internal/controller/kustomization_controller.go

Lines 860 to 869 in 3ce3fc1

	{
	// to undo changes made with 'kubectl apply --server-side --force-conflicts'
	Name: "kubectl",
	OperationType: metav1.ManagedFieldsOperationApply,
	},
	{
	// to undo changes made with 'kubectl apply'
	Name: "kubectl",
	OperationType: metav1.ManagedFieldsOperationUpdate,
	},

This is not always the right thing to do. It is totally possible for example that the kubectl usage is restricted through RBAC and only allowed during incidents. It is possible to work around this by setting a custom field manager in kubectl commands, but that is unintuitive and easy to forget, especially in stressful situations like incidents.

It would be great if there was an option to remove kubectl from this list.

[stefanprodan]

Flux will always override all fields declared in Git, see the FAQ. During incidents, the correct procedure is to suspend the Flux Kustomization with flux suspend, then edit the workloads. Removing kubectl from here, will not help much, unless you only add fields not present in the desired state, which is IMO almost never the case during incidents.

[alvaroaleman]

Flux will always override all fields declared in Git, see the FAQ.

Yeah, I am aware but we for example have a bunch of custom CRDs that all have fields to pause them and that doesn't interfere with the syncing. Same for for example appsv1/Deployment.

The issue with using flux suspend is that it suspends the entire kustomization which may affect a lot of objects if you have a large config repo.

[stefanprodan]

There is a way to do this by adding the kustomize.toolkit.fluxcd.io/ssa: Merge annotation:

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: webapp
  namespace: apps
spec:
  commonMetadata:
    annotations:
      kustomize.toolkit.fluxcd.io/ssa: Merge

The Merge policy will allow any manager to own fields that do not overlap with the Flux-managed ones.

[alvaroaleman]

There is a way to do this by adding the kustomize.toolkit.fluxcd.io/ssa: Merge annotation:

Yes, I have that configured but flux will still remove fields owned by the kubectl fieldManager, they only stay when using a custom --field-manager

[stefanprodan]

I'm tagging this as a bug, Merge should ignore the override rules. Thanks for the report @alvaroaleman

[matheuscscp]

@alvaroaleman I tried really hard to reproduce the issue with Merge but was unsuccessful, it always works as expected. Can you please share more details of your setup?

[stefanprodan]

We can not reproduce this with kustomize.toolkit.fluxcd.io/ssa: Merge. Please re open if you have a way to reproduce it.