accountquotas resources cannot be edited after upgrade k8s to 1.22

[czhujer]

Hi,

we are happy user of kiosk :)

But after upgrade our k8s cluster (AKS) to version 1.22, we can't edit kiosk accountquotas resources.

for creating resources we are using this helm chart.

$ kc apply -f xxx2.yaml (i want change pods quota "manualy"..)
Warning: resource accountquotas/patrik.majer is missing the kubectl.kubernetes.io/last-applied-configuration annotation which is required by kubectl apply. kubectl apply should only be used on resources created declaratively by either kubectl create --save-config or kubectl apply. The missing annotation will be patched automatically.
Error from server (strict decoder error for {"apiVersion":"config.kiosk.sh/v1alpha1","kind":"AccountQuota","metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{"apiVersion":"config.kiosk.sh/v1alpha1","kind":"AccountQuota","metadata":{"annotations":{"meta.helm.sh/release-name":"od-account-patrik-majer-ataccama-com","meta.helm.sh/release-namespace":"kube-system"},"creationTimestamp":"2022-01-23T13:49:36Z","generation":5,"labels":{"app.kubernetes.io/instance":"od-account-patrik-majer-ataccama-com","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"ondemand-user-account","app.kubernetes.io/version":"1.0.0","helm.sh/chart":"ondemand-user-account-0.1.0"},"name":"patrik.majer","resourceVersion":"18730242","uid":"b59fa6a7-eaa3-4b00-8e52-1e7c3e9435c9"},"spec":{"account":"patrik.majer","quota":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"165"}}},"status":{"namespaces":[{"namespace":"patrik-majer","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}},{"namespace":"patrik-majer-1","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}],"total":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"65"},"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}}\n","meta.helm.sh/release-name":"od-account-patrik-majer-ataccama-com","meta.helm.sh/release-namespace":"kube-system"},"creationTimestamp":"2022-01-23T13:49:36Z","generation":6,"labels":{"app.kubernetes.io/instance":"od-account-patrik-majer-ataccama-com","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"ondemand-user-account","app.kubernetes.io/version":"1.0.0","helm.sh/chart":"ondemand-user-account-0.1.0"},"managedFields":[{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:meta.helm.sh/release-name":{},"f:meta.helm.sh/release-namespace":{}},"f:labels":{".":{},"f:app.kubernetes.io/instance":{},"f:app.kubernetes.io/managed-by":{},"f:app.kubernetes.io/name":{},"f:app.kubernetes.io/version":{},"f:helm.sh/chart":{}}},"f:spec":{".":{},"f:account":{},"f:quota":{".":{},"f:hard":{}}}},"manager":"helm","operation":"Update","time":"2022-01-23T13:49:36Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:total":{".":{},"f:hard":{".":{},"f:limits.cpu":{},"f:limits.memory":{},"f:pods":{}},"f:used":{}}}},"manager":"kiosk","operation":"Update","time":"2022-02-03T20:08:23Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:spec":{"f:quota":{"f:hard":{"f:limits.cpu":{},"f:limits.memory":{}}}}},"manager":"kubectl-edit","operation":"Update","time":"2022-02-03T20:43:08Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:namespaces":{},"f:total":{"f:used":{"f:limits.cpu":{},"f:limits.memory":{},"f:pods":{}}}}},"manager":"kiosk","operation":"Update","subresource":"status","time":"2022-02-04T11:24:06Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{"f:kubectl.kubernetes.io/last-applied-configuration":{}}},"f:spec":{"f:quota":{"f:hard":{"f:pods":{}}}}},"manager":"kubectl-client-side-apply","operation":"Update","time":"2022-02-11T09:33:39Z"}],"name":"patrik.majer","resourceVersion":"18730242","uid":"b59fa6a7-eaa3-4b00-8e52-1e7c3e9435c9"},"spec":{"account":"patrik.majer","quota":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"165"}}},"status":{"namespaces":[{"namespace":"patrik-majer","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}},{"namespace":"patrik-majer-1","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}],"total":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"65"},"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}}: v1alpha1.AccountQuota.ObjectMeta: v1.ObjectMeta.ManagedFields: []v1.ManagedFieldsEntry: v1.ManagedFieldsEntry.Time: ReadObject: found unknown field: subresource, error found in #10 byte of ...|bresource":"status",|..., bigger context ...|anager":"kiosk","operation":"Update","subresource":"status","time":"2022-02-04T11:24:06Z"},{"apiVers|...): error when applying patch:
{"metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{"apiVersion":"config.kiosk.sh/v1alpha1","kind":"AccountQuota","metadata":{"annotations":{"meta.helm.sh/release-name":"od-account-patrik-majer-ataccama-com","meta.helm.sh/release-namespace":"kube-system"},"creationTimestamp":"2022-01-23T13:49:36Z","generation":5,"labels":{"app.kubernetes.io/instance":"od-account-patrik-majer-ataccama-com","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"ondemand-user-account","app.kubernetes.io/version":"1.0.0","helm.sh/chart":"ondemand-user-account-0.1.0"},"name":"patrik.majer","resourceVersion":"18730242","uid":"b59fa6a7-eaa3-4b00-8e52-1e7c3e9435c9"},"spec":{"account":"patrik.majer","quota":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"165"}}},"status":{"namespaces":[{"namespace":"patrik-majer","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}},{"namespace":"patrik-majer-1","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}],"total":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"65"},"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}}\n"}},"spec":{"quota":{"hard":{"pods":"165"}}}}
to:
Resource: "config.kiosk.sh/v1alpha1, Resource=accountquotas", GroupVersionKind: "config.kiosk.sh/v1alpha1, Kind=AccountQuota"
Name: "patrik.majer", Namespace: ""
for: "xxx2.yaml": admission webhook "config.kiosk.sh" denied the request: strict decoder error for {"apiVersion":"config.kiosk.sh/v1alpha1","kind":"AccountQuota","metadata":{"annotations":{"kubectl.kubernetes.io/last-applied-configuration":"{"apiVersion":"config.kiosk.sh/v1alpha1","kind":"AccountQuota","metadata":{"annotations":{"meta.helm.sh/release-name":"od-account-patrik-majer-ataccama-com","meta.helm.sh/release-namespace":"kube-system"},"creationTimestamp":"2022-01-23T13:49:36Z","generation":5,"labels":{"app.kubernetes.io/instance":"od-account-patrik-majer-ataccama-com","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"ondemand-user-account","app.kubernetes.io/version":"1.0.0","helm.sh/chart":"ondemand-user-account-0.1.0"},"name":"patrik.majer","resourceVersion":"18730242","uid":"b59fa6a7-eaa3-4b00-8e52-1e7c3e9435c9"},"spec":{"account":"patrik.majer","quota":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"165"}}},"status":{"namespaces":[{"namespace":"patrik-majer","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}},{"namespace":"patrik-majer-1","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}],"total":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"65"},"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}}\n","meta.helm.sh/release-name":"od-account-patrik-majer-ataccama-com","meta.helm.sh/release-namespace":"kube-system"},"creationTimestamp":"2022-01-23T13:49:36Z","generation":6,"labels":{"app.kubernetes.io/instance":"od-account-patrik-majer-ataccama-com","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"ondemand-user-account","app.kubernetes.io/version":"1.0.0","helm.sh/chart":"ondemand-user-account-0.1.0"},"managedFields":[{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{".":{},"f:meta.helm.sh/release-name":{},"f:meta.helm.sh/release-namespace":{}},"f:labels":{".":{},"f:app.kubernetes.io/instance":{},"f:app.kubernetes.io/managed-by":{},"f:app.kubernetes.io/name":{},"f:app.kubernetes.io/version":{},"f:helm.sh/chart":{}}},"f:spec":{".":{},"f:account":{},"f:quota":{".":{},"f:hard":{}}}},"manager":"helm","operation":"Update","time":"2022-01-23T13:49:36Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{".":{},"f:total":{".":{},"f:hard":{".":{},"f:limits.cpu":{},"f:limits.memory":{},"f:pods":{}},"f:used":{}}}},"manager":"kiosk","operation":"Update","time":"2022-02-03T20:08:23Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:spec":{"f:quota":{"f:hard":{"f:limits.cpu":{},"f:limits.memory":{}}}}},"manager":"kubectl-edit","operation":"Update","time":"2022-02-03T20:43:08Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:status":{"f:namespaces":{},"f:total":{"f:used":{"f:limits.cpu":{},"f:limits.memory":{},"f:pods":{}}}}},"manager":"kiosk","operation":"Update","subresource":"status","time":"2022-02-04T11:24:06Z"},{"apiVersion":"config.kiosk.sh/v1alpha1","fieldsType":"FieldsV1","fieldsV1":{"f:metadata":{"f:annotations":{"f:kubectl.kubernetes.io/last-applied-configuration":{}}},"f:spec":{"f:quota":{"f:hard":{"f:pods":{}}}}},"manager":"kubectl-client-side-apply","operation":"Update","time":"2022-02-11T09:33:39Z"}],"name":"patrik.majer","resourceVersion":"18730242","uid":"b59fa6a7-eaa3-4b00-8e52-1e7c3e9435c9"},"spec":{"account":"patrik.majer","quota":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"165"}}},"status":{"namespaces":[{"namespace":"patrik-majer","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}},{"namespace":"patrik-majer-1","status":{"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}],"total":{"hard":{"limits.cpu":"32","limits.memory":"128G","pods":"65"},"used":{"limits.cpu":"0","limits.memory":"0","pods":"0"}}}}: v1alpha1.AccountQuota.ObjectMeta: v1.ObjectMeta.ManagedFields: []v1.ManagedFieldsEntry: v1.ManagedFieldsEntry.Time: ReadObject: found unknown field: subresource, error found in #10 byte of ...|bresource":"status",|..., bigger context ...|anager":"kiosk","operation":"Update","subresource":"status","time":"2022-02-04T11:24:06Z"},{"apiVers|...

any idea where is problem?

[somejfn]

Im just another Kiosk user and I could not reproduce this on the latest release 0.2.11 and upgrading to 1.22. One thing specific to my env: our Kiosk accounts/quotas are all Argocd managed, and these objects are applied using the config.kiosk.sh API rather that the tenancy.kiosk.sh API as pointed in #130

[czhujer]

thanks for info @somejfn ...
it's weird... because i can reproduce it even on kind (on docker desktop on my macbook)..