kpt live apply should install resource group

[phanimarupaka]

In kpt 1.0, installing resource group can be a pre step for live commands. Users should not be prompted to install resource group explicitly.

[frankfarzan]

There is a flag (--install-resource-group) that specifies this behavior (whether to automatically install or not), so the question is what is the default value of this flag. We have gone back and forth on this. There was a concern that a "preview" command was installing the CRD. I think with the recent change to using --dry-run instead of preview, having the default be automatically install is the more reasonable behavior. The additional friction caused by not automatically installing the CRD is the bigger of the two evils.

[frankfarzan]

cc @mortent @seans3

[mortent]

I still don't think we should install anything in the cluster when users provide the --dry-run flag. I don't see how changing from a separate preview command to a --dry-run flag changes this.

[frankfarzan]

Previously, preview was a prominent part of the user flow. Because of the limitation in how dry-run works, we made it a flag. This is a trade-off, and we should favor streamlining the UX for apply.

Related: The Quickstart guide actually glosses over this implication: https://kpt.dev/book/01-getting-started/02-quickstart?id=apply-the-package. Having to run init and install-crd before apply is too cumbersome if you're coming from a tool like kubectl.

One possible way to ask permission for installing the CRD for dry-run:

• If --dry-run is specified, then require --install-resource-group flag if the resource is missing from the cluster. Otherwise, error out.
• If --dry-run is not specified, then install automatically.

However, having default values of flags change is somewhat convoluted.

[seans3]

I agree with @mortent: we should not be mutating during a dry-run

[frankfarzan]

What's the interaction of --dry-run and --install-resource-group: https://kpt.dev/reference/live/apply/
I think at least for sake of scriptability, you want to allow the user to explicitly allow installing the CRD if they want.

[seans3]

For scriptability, we have the command kpt live install-resource-group if users want to install the CRD, then do an apply --dry-run. So I don't think we should allow the flags --dry-run with install-resource-group; this should be an error.

[mortent]

So we have had discussions around this. I think we all agree that mutating the cluster by default during dry-run would be surprising behavior, but we also want to reduce the friction for people adopting kpt. I think the compromise here is that we let the --install-resource-group flag default to false when the --dry-run flag is provided, but default to true otherwise. Having different default values isn't ideal, but I think it is the best tradeoff here.

The result will be:

• kpt does not install the resource-group CRD by default during dry-run.
• Users can override this by adding the install-resource-group flag. So kpt live apply --dry-run --install-resource-group will install the resource-group CRD.
• kpt live apply (without dry-run) will install the resource-group CRD by default.

The only change required here is to have the --install-resource-group flag default to true if it is not a dry-run. The behavior for the --install-resource-group flag currently works the correct way.

[seans3]

/assign @mortent