bug(api): GET by name returns 404 for instances created with a different release prefix #2404

Changing release.prefix in an ApplicationDefinition permanently breaks GET (and therefore edit, delete, detail view) for all existing instances. LIST still shows them, so they appear in the UI list but can't be opened. Affects any external or built-in app that updates its prefix. The only workaround is restoring the old prefix or recreating instances.

Impact: kubectl get/describe/delete by name, API GET, dashboard detail page, any CRUD besides list — all return 404 for affected instances. Helm releases keep running but become unmanageable.

Description

When spec.release.prefix in an ApplicationDefinition is changed, instances whose backing Helm release was created with the old prefix become permanently inaccessible via GET. LIST continues to show them.

The root cause: GET resolves the instance name to a Helm release using the current prefix ({currentPrefix}{name}), but the actual Helm release uses the old prefix. Since the names don't match, GET returns 404. LIST works because it enumerates all Helm releases regardless of prefix.

Steps to Reproduce

# 1. Create an ApplicationDefinition with prefix "foo-"
cat <<EOF | kubectl apply --filename -
apiVersion: cozystack.io/v1alpha1
kind: ApplicationDefinition
metadata:
  name: bug-test
spec:
  application:
    kind: BugTest
    plural: bugtests
    singular: bugtest
    openAPISchema: '{"type":"object","properties":{"foo":{"type":"string","default":"bar"}}}'
  release:
    chartRef:
      kind: HelmChart
      name: some-existing-chart
      namespace: cozy-public
    prefix: foo-
EOF

# 2. Create an instance (Helm release will be named "foo-myapp")
cat <<EOF | kubectl apply --filename -
apiVersion: apps.cozystack.io/v1alpha1
kind: BugTest
metadata:
  name: myapp
  namespace: tenant-root
spec:
  foo: hello
EOF

# 3. Verify both LIST and GET work
kubectl get bugtests --namespace tenant-root
# NAME    READY   AGE   VERSION
# myapp   True    30s   ...

kubectl get bugtests myapp --namespace tenant-root
# NAME    READY   AGE   VERSION
# myapp   True    30s   ...

# 4. Change prefix
kubectl patch applicationdefinition bug-test --type merge \
  --patch '{"spec":{"release":{"prefix":"foo-bar-"}}}'

# 5. Wait for API server to pick up the change
sleep 20

# 6. LIST shows the instance with old prefix baked into the name
kubectl get bugtests --namespace tenant-root
# NAME         READY   AGE   VERSION
# foo-myapp    True    2m    ...

# 7. GET by any name — 404
kubectl get bugtests myapp --namespace tenant-root
# Error from server (NotFound)

kubectl get bugtests foo-myapp --namespace tenant-root
# Error from server (NotFound)

Expected Behavior

Either:

• GET should resolve instances by matching against actual Helm release names, not by constructing the name from the current prefix
• Or the API should prevent prefix changes when existing instances would become inaccessible
• Or the API should migrate existing Helm releases to the new prefix

Actual Behavior

• LIST returns the instance (it enumerates Helm releases directly)
• GET returns 404 NotFound (it constructs {currentPrefix}{name} which doesn't match the actual Helm release)
• The instance is permanently inaccessible via GET — it does not self-heal over time
• The backing Helm release is healthy and running

Notes

• Restoring the original prefix makes GET work again (the name formula matches the Helm release)
• New instances created after the prefix change work correctly
• Only instances created with the old prefix are affected

Environment

• Cozystack API: v1.2.0 (likely affects all versions)
• Discovered with external-apps-example where prefix changed from minecraft- to minecraft-server-