Handle forbidden fields for statefulsets with forcenew plan fix #84

kustomize/resource_kustomization.go

@@ -17,6 +17,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	k8sschema "k8s.io/apimachinery/pkg/runtime/schema"
 	k8stypes "k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/validation/field"
 )
 
 func kustomizationResource() *schema.Resource {
@@ -251,10 +252,21 @@ func kustomizationResourceDiff(d *schema.ResourceDiff, m interface{}) error {
 			if k8serrors.IsInvalid(err) {
 				as := err.(k8serrors.APIStatus).Status()
 
-				// if there is exactly 1 cause and that cause is due to an immutable field force a delete and re-create plan
-				if len(as.Details.Causes) == 1 && strings.HasSuffix(as.Details.Causes[0].Message, ": field is immutable") == true {
-					d.ForceNew("manifest")
-					return nil
+				// ForceNew only when exact single cause
+				if len(as.Details.Causes) == 1 {
+					msg := as.Details.Causes[0].Message
+
+					// if cause is immutable field force a delete and re-create plan
+					if k8serrors.HasStatusCause(err, k8smetav1.CauseTypeFieldValueInvalid) && strings.HasSuffix(msg, ": field is immutable") == true {
+						d.ForceNew("manifest")
+						return nil
+					}
+
+					// if cause is statefulset forbidden fields error force a delete and re-create plan
+					if k8serrors.HasStatusCause(err, k8smetav1.CauseType(field.ErrorTypeForbidden)) && strings.HasPrefix(msg, "Forbidden: updates to statefulset spec for fields") == true {
+						d.ForceNew("manifest")
+						return nil
+					}
 				}
 
 				// if StrategicMergePatchType fall back to MergePatchType before returning an error to the user

kustomize/resource_kustomization_test.go

@@ -329,6 +329,50 @@ resource "kustomization_resource" "dep1" {
 `
 }
 
+//
+//
+// Update_Recreate_StatefulSet Test
+func TestAccResourceKustomization_updateRecreateStatefulSet(t *testing.T) {
+
+	resource.Test(t, resource.TestCase{
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			//
+			//
+			// Applying initial statefulset
+			{
+				Config: testAccResourceKustomizationConfig_updateRecreateStatefulSet("test_kustomizations/update_recreate_statefulset/initial"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet("kustomization_resource.ns", "id"),
+					resource.TestCheckResourceAttrSet("kustomization_resource.ss", "id"),
+				),
+			},
+			//
+			//
+			// Applying modified statefulset that requires a destroy and recreate
+			{
+				Config: testAccResourceKustomizationConfig_updateRecreateStatefulSet("test_kustomizations/update_recreate_statefulset/modified"),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttrSet("kustomization_resource.ns", "id"),
+					resource.TestCheckResourceAttrSet("kustomization_resource.ss", "id"),
+				),
+			},
+		},
+	})
+}
+
+func testAccResourceKustomizationConfig_updateRecreateStatefulSet(path string) string {
+	return testAccDataSourceKustomizationConfig_basic(path) + `
+resource "kustomization_resource" "ns" {
+	manifest = data.kustomization_build.test.manifests["~G_v1_Namespace|~X|test-update-recreate-statefulset"]
+}
+
+resource "kustomization_resource" "ss" {
+	manifest = data.kustomization_build.test.manifests["apps_v1_StatefulSet|test-update-recreate-statefulset|test"]
+}
+`
+}
+
 //
 //
 // CRD Test

kustomize/test_kustomizations/update_recreate_statefulset/initial/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: test-update-recreate-statefulset
+
+resources:
+- namespace.yaml
+- statefulset.yaml

kustomize/test_kustomizations/update_recreate_statefulset/initial/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test-update-recreate-statefulset

kustomize/test_kustomizations/update_recreate_statefulset/initial/statefulset.yaml

@@ -0,0 +1,22 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: test
+spec:
+  selector:
+    matchLabels:
+      app: nginx
+  serviceName: "nginx"
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: nginx
+    spec:
+      terminationGracePeriodSeconds: 10
+      containers:
+      - name: nginx
+        image: nginx
+        ports:
+        - containerPort: 80
+          name: web

kustomize/test_kustomizations/update_recreate_statefulset/modified/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: test-update-recreate-statefulset
+
+resources:
+- ../initial
+
+commonLabels:
+  test-label: "triggers-labelSelector-change"