Getting ownership error when using `exists` annotation for resources created by kapp-controller App CRs

[praveenrewar]

What steps did you take:
kapp deploy -a myapp -f one.yaml -f two.yaml

one.yaml has an App CR which internally creates a CRD (C).
two.yaml has a mock CRD (C) with the exists annotation and a CR of kind (C)

What happened:
When I tried deploying myapp again I got ownership error

kapp deploy -a myapp -f one.yaml -f two.yaml
kapp: Error: Ownership errors:
- Resource 'customresourcedefinition/customresource.mydomain.io (apiextensions.k8s.io/v1) cluster' is already associated with a different app

What did you expect:
The app should have been successfully deployed the second time as well.

Anything else you would like to add:
Slack thread

---

Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

[praveenrewar]

We get the ownership error because App CRs would internally use kapp to deploy resources, hence they would have a kapp ownership label present for them. So when a consecutive deployment is done, kapp throws an error for the placeholder resources that they are already part of another kapp app.
As a workaround for now, we could use --dangerous-override-ownership-of-existing-resources flag, which will ask kapp to override the ownership (shouldn't affect the diff as the resources are annotated with kapp.k14s.io/exists)

[voor]

It's not ideal, but as a workaround I'm slapping everything into an App CR that is in a different changegroup:

---
apiVersion: kappctrl.k14s.io/v1alpha1
kind: App
metadata:
  name: postinstall
  annotations:
    kapp.k14s.io/change-rule.0: "upsert after upserting gitops.tanzu.vmware.com/cert-manager"
    kapp.k14s.io/change-rule.1: "upsert after upserting gitops.tanzu.vmware.com/secretgen-controller"
spec:
  fetch:
  - inline:
      paths:
        postinstall.yaml: #@ yaml.encode(postinstall())
  template:
  - ytt: {}
  - kbld: {}
  deploy:
  - kapp: {}

[cmoulliard]

I also I struggle with a package to be deployed as kapp always reports

kapp: Error: Ownership errors:
- Resource 'service/packaging-api (v1) namespace: kapp-controller' is already associated with a different label 'kapp.k14s.io/app=1654257223139022148'
- Resource 'clusterrolebinding/kapp-controller-cluster-role-binding (rbac.authorization.k8s.io/v1) cluster' is already associated with a different label 'kapp.k14s.io/app=1654257223139022148'
- Resource 'secret/kapp-controller-registry-creds (v1) namespace: kapp-controller' is already associated with a different label 'kapp.k14s.io/app=1654257223139022148'
...

Is there a workaround ?

[praveenrewar]

Fix available as part of v0.50.0