Repository navigation
bug(api): apps.cozystack.io apiserver ignores --dry-run=server and persists the write #3971
Description
Activity
scooby87 This is a duplicate of #2981, which has the same root-cause analysis and suggested fix.
Root cause:
REST.Update()inrest.goreceivesoptions *metav1.UpdateOptionsbut discards it. At line 609 it constructs a brand-new emptyUpdateOptions:updateErr := r.c.Update(ctx, helmRelease, &client.UpdateOptions{Raw: &metav1.UpdateOptions{}})
This drops
DryRun,FieldManager, andFieldValidation. The siblingCreateandDeletepaths forward the incoming options correctly — Create at line 245 passes&client.CreateOptions{Raw: options}, and Delete at line 691 passes&client.DeleteOptions{Raw: options}[1].Fix — two spots, mirroring
Create/Delete:-
Main update path (line 609):
// before updateErr := r.c.Update(ctx, helmRelease, &client.UpdateOptions{Raw: &metav1.UpdateOptions{}}) // after updateErr := r.c.Update(ctx, helmRelease, &client.UpdateOptions{Raw: options})
-
Create-on-update (upsert) path (line 502):
// before createdObj, err := r.Create(ctx, obj, createValidation, &metav1.CreateOptions{}) // after createdObj, err := r.Create(ctx, obj, createValidation, &metav1.CreateOptions{DryRun: options.DryRun})
This affects every
apps.cozystack.iokind (Postgres, MariaDB, Kafka, VMDisk, Kubernetes, etc.), not just VMDisk [1].To reply, just mention @dosu.
Share context across your team and agents. Try Dosu.
-
- added a commit that references this issue
on Sep 2, 2026
Summary
The
apps.cozystack.ioaggregated apiserver does not honour--dry-run=server: a server-side dry-run write to an Application resource is persisted instead of being simulated and discarded. A dry-run request must run admission and return the would-be result without mutating storage.Reproduce (verified live)
kubectl patch vmdisk <name> -n <tenant> --type=merge -p '{"spec":{"storageClass":"local"}}' --dry-run=servervmdisk ... patched(no(dry run)marker).kubectl get vmdisk <name> -n <tenant> -o jsonpath='{.spec.storageClass}'→ returnslocal. The change was written to real storage despite--dry-run=server.Impact
Any tooling or operator that relies on server-side dry-run against Application kinds —
kubectl apply --dry-run=server,kubectl diff, admission previews — mutates the cluster instead of previewing. This is dangerous precisely for the read-only workflows dry-run exists to make safe.Suggested direction
Thread the
dryRunoption through the Application registry's create/update paths so a server dry-run runs defaulting/validation and returns the result object without persisting, matching apiserver semantics.Discovered while investigating #2985 (see also #3969).