Explicitly specifying nonexistent trigger plan is silently treated as deploy

[porridge]

What happened:

I specified a non-existent plan name in a parameter's trigger attribute. The validation passed and I run an update:

$ cat params.yaml 
apiVersion: kudo.dev/v1beta1
parameters:
- name: NAME
  required: False
  trigger: nonexistent
$ PATH=/home/porridge/Desktop/work/mesosphere/code/kudo/bin:$PATH kubectl kudo package verify .
package is valid
$ PATH=/home/porridge/Desktop/work/mesosphere/code/kudo/bin:$PATH kubectl kudo update --instance minimal-foo6 -p NAME=minimal-foo6-changed
Instance minimal-foo6 was updated.$

This resulted in the deploy plan running.

$ kubectl describe instance minimal-foo6
Name:         minimal-foo6
Namespace:    default
Labels:       kudo.dev/operator=minimal
Annotations:  kudo.dev/last-applied-instance-state: {"operatorVersion":{"name":"minimal-0.6.0"},"parameters":{"NAME":"minimal-foo6-changed"}}
API Version:  kudo.dev/v1beta1
Kind:         Instance
Metadata:
  Creation Timestamp:  2020-01-14T12:27:20Z
  Generation:          2
  Resource Version:    10888
  Self Link:           /apis/kudo.dev/v1beta1/namespaces/default/instances/minimal-foo6
  UID:                 407a9322-d6f7-4f11-a38f-dbcef3983871
Spec:
  Operator Version:
    Name:  minimal-0.6.0
  Parameters:
    NAME:  minimal-foo6-changed
Status:
  Aggregated Status:
    Status:  COMPLETE
  Plan Status:
    Deploy:
      Last Finished Run:  2020-01-14T12:28:06Z
      Name:               deploy
      Phases:
        Name:    main
        Status:  COMPLETE
        Steps:
          Name:    app
          Status:  COMPLETE
      Status:      COMPLETE
      UID:         0804dd5f-d45b-49ba-b519-07a01730e3c4
Events:
  Type    Reason        Age               From                 Message
  ----    ------        ----              ----                 -------
  Normal  PlanStarted   7s (x2 over 53s)  instance-controller  Execution of plan deploy started
  Normal  PlanFinished  7s (x2 over 53s)  instance-controller  Execution of plan deploy finished with status COMPLETE
$

What you expected to happen:

Verification should fail, and an error should be returned at update time complaining about the wrong plan name.

How to reproduce it (as minimally and precisely as possible):

See above.

[zen-dog]

This is by design: we use update and deploy plans as the fallback when the triggered plan couldn't be found.

[porridge]

It's fine to use update or deploy if there is no trigger plan specified at all. However silently falling back to a different plan than explicitly specified is dangerous. A typo can have dear consequences.

@gerred agreed when I asked him before filing this issue.

[zen-dog]

However silently falling back to a different plan than explicitly specified is dangerous.

ah, that I agree with. I'll fix this as part of admission webhook work

[ANeumann82]

This wasn't fixed in #1188 so I fixed it in another PR