Fix server-side diff when immutable properties change

pkg/openapi/match.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	jsonpatch "github.com/evanphx/json-patch"
 	"k8s.io/client-go/util/jsonpath"
@@ -27,20 +28,19 @@ func PatchPropertiesChanged(patch map[string]interface{}, paths []string) ([]str
 	j := jsonpath.New("")
 	matches := []string{}
 	for _, path := range paths {
-		j.AllowMissingKeys(true)
+		j.AllowMissingKeys(false) // Explicitly handle any returned errors.
 		err := j.Parse(fmt.Sprintf("{%s}", path))
 		if err != nil {
 			return nil, err
 		}
 		buf := new(bytes.Buffer)
 		err = j.Execute(buf, patch)
-		if err != nil {
+		if err != nil && strings.Contains(err.Error(), "not found") {
 			continue
 		}
 
-		if len(buf.String()) > 0 {
-			matches = append(matches, path)
-		}
+		// If no error was returned, then this is a match.
+		matches = append(matches, path)
 	}
 
 	return matches, nil

pkg/provider/provider.go

@@ -20,6 +20,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
+	"net/http"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -1165,15 +1166,22 @@ func (k *kubeProvider) Diff(
 		patch, patchBase, err = k.dryRunPatch(oldInputs, newInputs)
 
 		// Fall back to input patch.
-		se, isStatusError := err.(*errors.StatusError)
-		if isStatusError && se.Status().Code == 400 &&
-			(se.Status().Message == "the dryRun alpha feature is disabled" ||
-				se.Status().Message == "the dryRun beta feature is disabled" ||
-				strings.Contains(se.Status().Message, "does not support dry run")) {
-
-			isInputPatch = true
-			patch, err = k.inputPatch(oldInputs, newInputs)
-			patchBase = oldInputs
+		if se, isStatusError := err.(*errors.StatusError); isStatusError {
+			if se.Status().Code == http.StatusBadRequest &&
+				(se.Status().Message == "the dryRun alpha feature is disabled" ||
+					se.Status().Message == "the dryRun beta feature is disabled" ||
+					strings.Contains(se.Status().Message, "does not support dry run")) {
+
+				isInputPatch = true
+				patch, err = k.inputPatch(oldInputs, newInputs)
+				patchBase = oldInputs
+			} else if se.Status().Code == http.StatusUnprocessableEntity ||
+				strings.Contains(se.ErrStatus.Message, "field is immutable") {
+				// Immutable field requires replacement.
+				isInputPatch = true
+				patch, err = k.inputPatch(oldInputs, newInputs)
+				patchBase = oldInputs
+			}
 		}
 	} else {
 		isInputPatch = true