SSA markers fails on Observation for multi-item lists

[fernandezcuesta]

What happened?

When ServerSideApplyMergeStrategies is configured with an InjectedKey, upjet generates +listType=map, +listMapKey=<key>, and +kubebuilder:default:="0" markers on all struct variants, including *Observation structs.

This causes the API server to reject status updates when a list in status.atProvider contains +1 item.

How can we reproduce it?

Found in provider-pagerduty v1.1.1 in an OrchestrationRouter like:

apiVersion: event.pagerduty.crossplane.io/v1alpha1
kind: OrchestrationRouter
metadata:
  annotations:
    crossplane.io/composition-resource-name: router
  name: orchestration-test
spec:
  deletionPolicy: Delete
  forProvider:
    catchAll:
    - actions:
      - index: "0"
        routeTo: unrouted
      index: "0"
    eventOrchestration: eeeefffff-4444-6666-8888-aaaabbbbccccdddd
    eventOrchestrationRef:
      name: orchestration-test
    eventOrchestrationSelector:
      matchControllerRef: true
      matchLabels: {}
    set:
    - id: start
      index: "0"
      rule:
      - actions:
        - index: "0"
          routeTo: PE74748
          routeToServiceRef:
            name: test-e2e-service-1
          routeToServiceSelector:
            matchLabels:
              service: test-e2e-service-1
        condition:
        - expression: raw_event.payload.custom_details.firing matches regex 'namespace
            = foo-bar'
          index: "0"
        - expression: raw_event.payload.custom_details.firing matches regex 'job_name
            = e2e-test-pagerduty-orchestrator'
          index: "1"
        index: "0"
        label: Sample rule for e2e test 1
      - actions:
        - index: "1"
          routeTo: PH53537
          routeToServiceRef:
            name: test-e2e-service-2
          routeToServiceSelector:
            matchLabels:
              service: test-e2e-service-2
        condition:
        - expression: raw_event.payload.custom_details.firing matches regex 'namespace
            = bar-baz'
          index: "0"
        - expression: raw_event.payload.custom_details.firing matches regex 'job_name
            = e2e-test-pagerduty-orchestrator'
          index: "1"
        index: "1"
        label: Sample rule for e2e test 2

Potentially applies to any resource with ServerSideApplyMergeStrategies on a list that has multiple items at runtime:

r.ServerSideApplyMergeStrategies["set.rule"] = config.MergeStrategy{
    ListMergeStrategy: config.ListMergeStrategy{
        MergeStrategy: config.ListTypeMap,
        ListMapKeys: config.ListMapKeys{
            InjectedKey: config.InjectedKey{
                Key:          "index",
                DefaultValue: `"0"`,
            },
        },
    },
}

The resource will be created externally but never reach Ready: True because the status update is rejected.

Observed behaviour

status.atProvider remains empty, Synced/Ready is True/False. An event mentions:

Warning  CannotUpdateManagedResource  34m   managed/event.pagerduty.crossplane.io/v1alpha1, kind=orchestrationrouter  Operation cannot be fulfilled on orchestrationrouters.event.pagerduty.crossplane.io "orchestration-test": the object has been modified; please apply your changes to the latest version and try again

[fernandezcuesta]

Validated with a workaround to remove the observation markers here

[jonasz-lasut]

Hi @fernandezcuesta thank you for opening this issue and PR! This bug has been present in provider-upjet-azure as well and has been a blocker for long time, I'll try to find some time this week to review your contribution as it will unblock official providers as well