Repository navigation
Converge generated-resource updates across version conflicts #5691
Description
🤖 Generated by the Agentic Engineer
Problem and evidence
A fresh read-only observation on 1 November captured a GeneratingPolicy update failing with Kubernetes Conflict while updating an existing generated resource. Coroot reports the failed operation as an application log error. The resource remains present with its original identity and a current status; its failed update request is no longer present. These observations do not prove data loss, a stuck queue or which concurrent writer caused the conflict.
The released Kyverno v1.19.2 generation path reads the existing object, copies its UID and resource version into the rendered update, and returns any update error directly. A legitimate concurrent status or metadata update can make that version stale. This is distinct from the already-absent downstream cleanup in #5527.
Hypothesis and acceptance
- Reproduce the real generation path with a controlled concurrent version change and an unchanged positive control. Establish the retry behavior before changing production source.
- If confirmed, use bounded retries for optimistic-concurrency conflicts with a fresh read on each attempt. Preserve resource UID, policy and trigger ownership; a replaced or foreign object must not be adopted.
- Keep permission, transport, malformed-object and unrelated write failures visible. Exhausted conflicts must still fail. Do not lower log severity, suppress errors, broaden RBAC or change policy enforcement.
- Verify the affected native packages and existing generation/cleanup controls, then prove the separately reviewed runtime's published executable, provenance, signature and deployed identity.
- Observe generation convergence and a fresh attributable Coroot window after protected delivery. An absent update request or a quiet window alone does not prove the fix.
Planning
Bug; medium priority and medium effort. Capture in Backlog pending the controlled reproduction and a safe delivery slot. No urgent security deadline or production outage is inferred. This issue does not authorize an additional draft beyond the current run's limit.
Part of #4981.
Source: released generation update path.
Activity
coderabbitai commentedon Nov 1, 2026
🔗 Related PRs
#5632 - feat(security): verify the Kyverno migration runtime with its publisher [closed]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Nov 1, 2026
The controlled reproduction now runs the real
GenerateResourcesmethod from unmodified release sourcee63308f1e16c05cd009ac4864be6ec25c66b49beagainst a deterministic Kubernetes API boundary:resourceVersionbetween that read and write and rejects the stale update. The real generator returnsConflictafter one read and one write, with no generated-resource receipt. The expected-convergence assertion fails for this behavior, rather than a build or parser failure.This establishes the missing immediate convergence for that controlled case. It does not identify the competing writer in production, prove a permanently stuck update, or substitute for published-runtime and deployment acceptance. The existing resource's identity and recommendation remain present in the read-only observation. No controller, policy, permission, retry deadline or log-level change has been deployed.
The issue is typed Bug, linked to its parent and captured in Backlog with Medium priority/effort and Standard service class. The remaining step is a bounded ownership-preserving remedy and its normal reviewed delivery; the reproduction no longer blocks refinement.