How to let third parties update Java Operator SDK controlled resources

[juangon]

Hi!
Due to how some third party controllers work (in this case, cert-manager) there is a chance that some resources controlled by Java Operator SDK (in my case, an Ingress dependent resource) can be edited by them. I would like to know the approach of how to let those parties make those changes without Java Operator SDK kick in and update the resource again (as the initial "desired" method).

This due to the need of cert-manager to edit the same ingress (acme.cert-manager.io/http01-edit-in-place annotation).

Thanks very much!

[csviri]

Hi @juangon,

it can be done by overriding the matcher and/or handling this in the desired state.
So if something is just added by other controllers, you can skip those in the matcher.

Recently a sample was added that, shows how to make sure that some parts of the the desired are not modifiable, see:
#1746

So basically in this sample the desired is calculated based on actual resource (that contains already parts added by other controllers), you can use those and add those parts into the controller.

[juangon]

Thanks! Can you elaborate on the matcher please? I think I can't apply the "desired" approach as I don't know how to get the new changes from the desired method itself (and probably wouldn't make sense).

[csviri]

Hmm, thinking more of it, desired actually is necessary. See sample here:

https://github.com/java-operator-sdk/java-operator-sdk/blob/dba990f2c63ac8000f94d68579f82764096556c7/operator-framework/src/test/java/io/javaoperatorsdk/operator/sample/unmodifiabledependentpart/UnmodifiablePartConfigMapDependent.java#L22-L27

So on matcher you can skip the parts from matching that is added by to controller, like if those parts are changed which were not added by your DR.

[juangon]

But how I can get the updated parts from "desired"? Desired is supposed to be created from scratch, how I can get the changes added by other controllers?

Additionally, can you point me to some matcher example?

Thanks very much!

[csviri]

You just read the actual state with as in example:
var actual = getSecondaryResource(primary, context);
And you know which parts are added by the controller, basically the parts are not added by you.

Regarding the matcher, you can just simply override it, and match is as you please:

https://github.com/java-operator-sdk/java-operator-sdk/blob/dba990f2c63ac8000f94d68579f82764096556c7/sample-operators/mysql-schema/src/main/java/io/javaoperatorsdk/operator/sample/dependent/SecretDependentResource.java#L57-L58

[juangon]

It works following your recommended approach (desired method checking the actual resource and matching the resource if actual contains what the other controller added).

Thanks very much!

[juangon]

Hi again @csviri , I was reviewing this approach again. It's clear that desired should be modiified in order to get changes from actual resource. But how about "match"? In your example it wasn`t implemented. Is it really needed?
Thanks very much!

[metacosm]

Overriding match is only useful if you can detect whether the actual state matches the desired state without needing to compute that state or if you want to optimise how matching is performed. In your case, you could avoid computing the desired state by overriding match to simply check whether your resource has been touched by the other controller. However, things get tricky because there might have been other changes that your controller might want to react to. Generally speaking, it's usually a good practice to only have one controller handling a given type of resources.