You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
bug(api): apps.cozystack.io apiserver ignores --dry-run=server and persists the write #3971
The apps.cozystack.io aggregated apiserver does not honour --dry-run=server: a server-side dry-run write to an Application resource is persisted instead of being simulated and discarded. A dry-run request must run admission and return the would-be result without mutating storage.
kubectl reports vmdisk ... patched (no (dry run) marker).
kubectl get vmdisk <name> -n <tenant> -o jsonpath='{.spec.storageClass}' → returns local. The change was written to real storage despite --dry-run=server.
Impact
Any tooling or operator that relies on server-side dry-run against Application kinds — kubectl apply --dry-run=server, kubectl diff, admission previews — mutates the cluster instead of previewing. This is dangerous precisely for the read-only workflows dry-run exists to make safe.
Suggested direction
Thread the dryRun option through the Application registry's create/update paths so a server dry-run runs defaulting/validation and returns the result object without persisting, matching apiserver semantics.
Discovered while investigating #2985 (see also #3969).
This drops DryRun, FieldManager, and FieldValidation. The sibling Create and Delete paths forward the incoming options correctly — Create at line 245 passes &client.CreateOptions{Raw: options}, and Delete at line 691 passes &client.DeleteOptions{Raw: options}[1].
Activity
dosubot commentedon Aug 26, 2026
scooby87 This is a duplicate of #2981, which has the same root-cause analysis and suggested fix.
Root cause:
REST.Update()inrest.goreceivesoptions *metav1.UpdateOptionsbut discards it. At line 609 it constructs a brand-new emptyUpdateOptions:This drops
DryRun,FieldManager, andFieldValidation. The siblingCreateandDeletepaths forward the incoming options correctly — Create at line 245 passes&client.CreateOptions{Raw: options}, and Delete at line 691 passes&client.DeleteOptions{Raw: options}[1].Fix — two spots, mirroring
Create/Delete:Main update path (line 609):
Create-on-update (upsert) path (line 502):
This affects every
apps.cozystack.iokind (Postgres, MariaDB, Kafka, VMDisk, Kubernetes, etc.), not just VMDisk [1].To reply, just mention @dosu.
Share context across your team and agents. Try Dosu.
fix(vm-disk): fail on storageClass/source edit of existing disk (#3969)