fix(listener): stop perpetual diff on server-filled default actions - #101

Thanks for tracking this down. I reproduced it against a real ALB, with a local controller and on an EKS cluster where kro v0.9.3 manages the Listener. This PR stops the loop for the shapes in your tests, but three cases still need work.

What drives the rate. The delta alone doesn't produce ~3 calls/s. With no other writer, main makes no ModifyListener calls after creating an HTTP listener. The rate needs a second writer. ACK writes the DescribeListeners form of defaultActions into the spec, and kro server-side-applies the declared form back. defaultActions has no x-kubernetes-list-type, so the applier owns the whole list. Each write bumps the generation and triggers the other controller. On EKS with kro, main made 195 ModifyListener calls in 60s. This PR made 0 for the same Listener.

1. Unset members are ignored, so removals never reach AWS. I removed targetGroupStickinessConfig from a 90/10 forward action. This PR made no call, stickiness stayed enabled, and the CR reported Synced=True. main turned it off. Unit tests show the same for a removed redirect host, a removed weight and a removed OIDC scope. Instead, fill unset members on both sides with what DescribeListeners returns, then compare. Measured defaults: weight 1 for a single target group, stickiness {enabled: false}, redirect #{protocol}, #{port}, #{host}, /#{path}, #{query}, fixed-response contentType: text/plain. The OIDC/Cognito defaults are in the API docs.

2. Target groups are compared by position. DescribeListeners returned forwardConfig.targetGroups in ARN order every time, not in declared order. CreateListener's response echoes the declared order, so the loop starts at the first reconcile after create. A controller restart triggered it at ~4 calls/s. Sorting both sides by ARN fixes it.

3. HTTPS listeners still get AWS's form in the spec (aws-controllers-k8s/community#3115). For an HTTP listener this PR keeps the declared form, because the spec patch is skipped when the comparator says equal. An HTTPS listener without sslPolicy or mutualAuthentication is different. AWS fills both (ELBSecurityPolicy-2016-08 and {mode: off}), the controller writes them into the spec, and that merge patch carries the whole defaultActions list. With this PR and no other writer, such a listener ended with the expanded list in its spec. Adding set: [{method: Create, ignore: from}, {method: Update, ignore: from}] on DefaultActions, the config Rule.Conditions already uses, kept the declared form in the same test. ReadOne still fills latest for drift detection. You offered on aws-controllers-k8s/community#3115 to look at the write-back on top of this PR; I'd include it here, so both issues close together.

I prototyped all three on this branch, regenerated at v0.65.0, and ran it against the same setup. Under kro it made no ModifyListener calls for defaultActions in any shape I tried, including the reordered weighted forward. Removing stickiness took one call. An out-of-band target group change was reverted with one call, then nothing for 20 minutes. The spec kept its declared form in every case, HTTPS included. The six test cases I added fail on this branch and pass on the prototype. I can push it to your branch if that helps.

Smaller items:

• The {mode: off} delta also costs one ModifyListener after creating any HTTPS listener. It converges, so it can wait for a follow-up.
• For a single forward action, DescribeListeners returned no Order. I didn't test multiple actions.
• AWS never returns the OIDC client secret, so changing only the secret produces no delta. That can't be avoided; a code comment and a note in the description would help.
• #63 is still open, so Rule on main uses the generated comparison and loops under kro the same way. Filed as aws-controllers-k8s/community#3125.
• Please rebase onto main (v0.67.0) and add Fixes aws-controllers-k8s/community#3115 next to aws-controllers-k8s/community#3057.

Thanks, this addresses all three points. I re-tested 25acd16 against a real ALB with a local controller and kro v0.9.4:

The declared defaultActions stayed in the spec for HTTP and HTTPS listeners.

One case remains. With several actions, DescribeListeners doesn't always return them in declared order or by Order. For 3 of the 11 two-action listeners I created, including one made with the plain AWS CLI, it returned forward first although authenticate-oidc was declared first with the lower Order. The order stayed the same across reads. The comparison is positional, so those listeners make one no-op ModifyListener on every reconcile. Since the spec is no longer written back, kro doesn't turn this into a fast loop. Sorting both sides by Order fixes it; see the suggestions below. With them applied, the same listener made 0 calls over two controller starts, and the new test case fails without the sort.

Nit: the description says DescribeListeners returns "an Order for every action", but for a single action it returned none. Tide uses the description as the squash commit message, so it's worth correcting, and mentioning the action sort if you take it.