Empty updates to GCP during SQLInstance reconciliation

[knp-sap]

Checklist

• I did not find a related open issue.
• I did not find a solution in the troubleshooting guide: (https://cloud.google.com/config-connector/docs/troubleshooting)
• If this issue is time-sensitive, I have submitted a corresponding issue with GCP support.

Bug Description

Updating to Config Connector 1.129.2 causes empty updates to be sent to GCP during each reconciliation of SQLInstance, interfering with the daily scheduled backups and preventing them from being taken.

Additional Diagnostic Information

With the update, all SQLInstance types are reconciled using the new direct controller (instead of the legacy Terraform-based controller).

Kubernetes Cluster Version

v1.31.6

Config Connector Version

1.129.2

Config Connector Mode

cluster mode

Log Output

No response

Steps to reproduce the issue

Update Config Connector from 1.128.0 to 1.129.2 and then watch the operations of the SQL Instance in GCP.

YAML snippets

apiVersion: sql.cnrm.cloud.google.com/v1beta1
kind: SQLInstance
metadata:
  annotations:
    cnrm.cloud.google.com/deletion-policy: abandon
    cnrm.cloud.google.com/management-conflict-prevention-policy: none
    cnrm.cloud.google.com/mutable-but-unreadable-fields: '{}'
    cnrm.cloud.google.com/observed-secret-versions: '{}'
    cnrm.cloud.google.com/project-id: "test"
    cnrm.cloud.google.com/state-into-spec: absent
  finalizers:
  - cnrm.cloud.google.com/finalizer
  - cnrm.cloud.google.com/deletion-defender
  name: test
  namespace: test
spec:
  databaseVersion: POSTGRES_13
  region: europe-west3
  resourceID: test
  settings:
    availabilityType: REGIONAL
    backupConfiguration:
      backupRetentionSettings:
        retainedBackups: 30
      enabled: true
      pointInTimeRecoveryEnabled: true
    databaseFlags:
    - name: temp_file_limit
      value: "3145728"
    deletionProtectionEnabled: true
    diskSize: 10
    insightsConfig:
      queryInsightsEnabled: true
    ipConfiguration:
      requireSsl: true
    tier: db-g1-small

[jingyih]

I actually tried to reproduce this in #4227. I used the same yaml configuration but I am not seeing any unexpected diff. In other words, no update call was made to the GCP API during the test.

[yuwenma]

Thank you for your report, @knp-sap.

We have collaborated with Google Cloud SQL team. We expect this issue (reset enablement of SQL backups) would be fixed after Cloud Next (currently it is code freeze). We will keep updating this thread once the rollout fix is done.

[yuwenma]

One thing worths noticing about the SQLInstance periodic (empty) updates: Since 1.129, the SQLInstance no longer relies on mutable-but-unreadable annotation (this exposes the encrypted password in k8s annotation) but always calls the updates in each reconciliation. This is a trade-off of temporarily considering the password as short-lived sensitive field than exposing it further. This is something we want to improve, and here's a full plan. I saw your SQLInstance does not use the roopassword, but if you have any thoughts, please feel free to share in #4230 as well.