Running the same Pulumi Kubernetes deployment from Linux and Windows causes a SSA conflict

[paleocomburo]

What happened?

We were having issue with the new SSA feature causing conflicts that we did not understand. Reading up on the feature I noticed that when you use Pulumi to updates something on Kubernetes from Linux the SSA manager will be stored as "pulumi-resource-kubernetes", but if you run the same deployment from a Windows environment, it will be stored as "pulumi-resource-kubernetes.exe". If one of these is set, you cannot run the same Pulumi deployment from the other environment, because Pulumi sees the manager name is different and report a conflict.

Steps to reproduce

Create a Pulimi project to add anything to Kubernetes. Run it from Windows.
Then update one of the values and run the Pulumi project from a Linux environment.

Expected Behavior

The Kubernetes settings are updated as requested.

Actual Behavior

You get a conflict error. For instance:

error: Preview failed: 1 error occurred:
	* the Kubernetes API server reported that "some-namespace/some-application" failed to fully initialize or become live: use `pulumi.com/patchForce` to override the conflict: Apply failed with 4 conflicts: conflicts with "pulumi-resource-kubernetes.exe" using apps/v1:
- .spec.strategy.rollingUpdate.maxUnavailable
- .spec.strategy.rollingUpdate.maxUnavailable
- .spec.template.spec.containers[name="some-application"].resources.limits.cpu
conflicts with "rancher" using apps/v1:
- .spec.replicas

Output of pulumi about

No response

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[roothorp]

Hi @paleocomburo, thanks for the issue! We've added this to our backlog for prioritization in future iterations. For the time being, SSA has been toggled to be off by default in the latest version of Pulumi Kubernetes (v3.22.1)

[lblackstone]

@paleocomburo Are you enabling Server-side Apply mode in the provider? I did some testing, and it appears that recent versions of Kubernetes will assign a field manager based on the name of the executable when a resource is created using Client-side Apply. As far as I can tell, this shouldn't happen when SSA mode is enabled.

[paleocomburo]

@paleocomburo Are you enabling Server-side Apply mode in the provider? I did some testing, and it appears that recent versions of Kubernetes will assign a field manager based on the name of the executable when a resource is created using Client-side Apply. As far as I can tell, this shouldn't happen when SSA mode is enabled.

I hadn't changed anything in our deployments. I didn't even know SSA was a thing. We just updated the Pulumi CLI, and then we ran into issues when manually deploying from my Windows laptop during testing, and then deploying from Jenkins on a Linux server.

[lblackstone]

Thanks for confirming.