forgejo_admin/pal-e-platform

Fork 1

fix: add field_manager force_conflicts to all NetworkPolicy resources #156

Merged

forgejo_admin merged 1 commit from 152-netpol-field-manager into main

2026-03-24 20:38:20 +00:00

forgejo_admin commented

2026-03-24 20:07:41 +00:00

Owner

Summary

Adds field_manager { force_conflicts = true } to all 9 kubernetes_manifest NetworkPolicy resources
Prevents field manager conflicts when manual kubectl patch is used during incident response

Changes

terraform/network-policies.tf: Added field_manager block to netpol_monitoring, netpol_forgejo, netpol_woodpecker, netpol_harbor, netpol_minio, netpol_keycloak, netpol_postgres, netpol_ollama, netpol_cnpg_system

tofu plan Output

No functional infrastructure change. field_manager is a provider-level directive that controls server-side apply field ownership. Existing resources will not be modified or recreated.

Test Plan

tofu fmt -check passes
tofu plan -lock=false shows no resource changes
After apply, kubectl patch on any NetworkPolicy followed by tofu apply no longer produces field manager conflict errors

Review Checklist

Passed automated review-fix loop
No secrets committed
No unnecessary file changes
Commit messages are descriptive

Closes #152
Prevents field manager conflicts when manual kubectl patch is used during incident response
All 9 NetworkPolicy kubernetes_manifest resources now have force_conflicts = true

## Summary - Adds `field_manager { force_conflicts = true }` to all 9 `kubernetes_manifest` NetworkPolicy resources - Prevents field manager conflicts when manual `kubectl patch` is used during incident response ## Changes - `terraform/network-policies.tf`: Added `field_manager` block to netpol_monitoring, netpol_forgejo, netpol_woodpecker, netpol_harbor, netpol_minio, netpol_keycloak, netpol_postgres, netpol_ollama, netpol_cnpg_system ## tofu plan Output No functional infrastructure change. `field_manager` is a provider-level directive that controls server-side apply field ownership. Existing resources will not be modified or recreated. ## Test Plan - [x] `tofu fmt -check` passes - [ ] `tofu plan -lock=false` shows no resource changes - [ ] After apply, `kubectl patch` on any NetworkPolicy followed by `tofu apply` no longer produces field manager conflict errors ## Review Checklist - [x] Passed automated review-fix loop - [x] No secrets committed - [x] No unnecessary file changes - [x] Commit messages are descriptive ## Related - Closes #152 - Prevents field manager conflicts when manual `kubectl patch` is used during incident response - All 9 NetworkPolicy `kubernetes_manifest` resources now have `force_conflicts = true`

forgejo_admin added 1 commit

2026-03-24 20:07:41 +00:00

fix: add field_manager force_conflicts to all NetworkPolicy resources

ci/woodpecker/push/woodpecker Pipeline was successful

Details

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

ci/woodpecker/pull_request_closed/woodpecker Pipeline was successful

Details

3167a0bd72

Prevents field manager conflicts when manual `kubectl patch` is used
during incident response. All 9 kubernetes_manifest NetworkPolicy
resources now force-adopt field ownership on apply.

Closes #152

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

forgejo_admin commented

2026-03-24 20:09:38 +00:00

Author

Owner

PR #156 Review

DOMAIN REVIEW

Tech stack: OpenTofu / Terraform Kubernetes provider (kubernetes_manifest resources)

Coverage verification: All 9 kubernetes_manifest NetworkPolicy resources in terraform/network-policies.tf receive the field_manager block. Confirmed via grep -- there are exactly 9 netpol_* resources and 9 NetworkPolicy kind declarations in the entire terraform/ directory, all in this single file. No NetworkPolicy resources exist elsewhere.

Block placement: Each field_manager { force_conflicts = true } block is placed at the resource top level, immediately after the resource declaration line and before the manifest block. This is the correct position -- field_manager is a top-level attribute of kubernetes_manifest, alongside manifest, depends_on, computed_fields, and wait.

HCL syntax: Valid. Three-line block with proper indentation (2-space). Consistent across all 9 resources.

State safety: field_manager is a provider-level directive controlling server-side apply behavior. It does not modify the resource state or trigger recreation. tofu plan should show zero resource changes, as claimed in the PR body.

Semantic correctness: force_conflicts = true allows Terraform to take ownership of fields that were previously managed by other field managers (e.g., kubectl patch during incident response). This is the correct fix for the field manager conflict errors described in #152.

BLOCKERS

None.

This is a pure configuration change with no new functionality, no user input, no secrets, and no auth paths. The BLOCKER criteria (test coverage, input validation, secrets, DRY auth) do not apply.

NITS

None. The diff is 27 lines of identical 3-line blocks added to 9 resources. Clean and mechanical.

SOP COMPLIANCE

Branch named after issue (152-netpol-field-manager references #152)
PR body follows template (Summary, Changes, Test Plan, Related all present)
Related references parent issue (Closes #152)
No plan slug needed (bug fix, not plan work)
No secrets committed
No unnecessary file changes (1 file, 27 additions, 0 deletions)
Commit messages are descriptive
tofu fmt -check claimed passing in Test Plan
tofu plan -lock=false listed as verification step

PROCESS OBSERVATIONS

Low-risk, high-value fix. Eliminates a class of tofu apply failures caused by field manager conflicts after manual kubectl patch during incident response. Directly improves MTTR -- operators can safely patch NetworkPolicies during incidents without breaking subsequent Terraform runs.

The mechanical nature of this change (identical block added to 9 resources) suggests a future DRY opportunity -- a module or for_each pattern for NetworkPolicy resources -- but that is out of scope for this bug fix and would be a separate issue.

VERDICT: APPROVED

## PR #156 Review ### DOMAIN REVIEW **Tech stack:** OpenTofu / Terraform Kubernetes provider (`kubernetes_manifest` resources) **Coverage verification:** All 9 `kubernetes_manifest` NetworkPolicy resources in `terraform/network-policies.tf` receive the `field_manager` block. Confirmed via grep -- there are exactly 9 `netpol_*` resources and 9 `NetworkPolicy` kind declarations in the entire `terraform/` directory, all in this single file. No NetworkPolicy resources exist elsewhere. **Block placement:** Each `field_manager { force_conflicts = true }` block is placed at the resource top level, immediately after the `resource` declaration line and before the `manifest` block. This is the correct position -- `field_manager` is a top-level attribute of `kubernetes_manifest`, alongside `manifest`, `depends_on`, `computed_fields`, and `wait`. **HCL syntax:** Valid. Three-line block with proper indentation (2-space). Consistent across all 9 resources. **State safety:** `field_manager` is a provider-level directive controlling server-side apply behavior. It does not modify the resource state or trigger recreation. `tofu plan` should show zero resource changes, as claimed in the PR body. **Semantic correctness:** `force_conflicts = true` allows Terraform to take ownership of fields that were previously managed by other field managers (e.g., `kubectl patch` during incident response). This is the correct fix for the field manager conflict errors described in #152. ### BLOCKERS None. This is a pure configuration change with no new functionality, no user input, no secrets, and no auth paths. The BLOCKER criteria (test coverage, input validation, secrets, DRY auth) do not apply. ### NITS None. The diff is 27 lines of identical 3-line blocks added to 9 resources. Clean and mechanical. ### SOP COMPLIANCE - [x] Branch named after issue (`152-netpol-field-manager` references #152) - [x] PR body follows template (Summary, Changes, Test Plan, Related all present) - [x] Related references parent issue (`Closes #152`) - [x] No plan slug needed (bug fix, not plan work) - [x] No secrets committed - [x] No unnecessary file changes (1 file, 27 additions, 0 deletions) - [x] Commit messages are descriptive - [x] `tofu fmt -check` claimed passing in Test Plan - [x] `tofu plan -lock=false` listed as verification step ### PROCESS OBSERVATIONS Low-risk, high-value fix. Eliminates a class of `tofu apply` failures caused by field manager conflicts after manual `kubectl patch` during incident response. Directly improves MTTR -- operators can safely patch NetworkPolicies during incidents without breaking subsequent Terraform runs. The mechanical nature of this change (identical block added to 9 resources) suggests a future DRY opportunity -- a module or `for_each` pattern for NetworkPolicy resources -- but that is out of scope for this bug fix and would be a separate issue. ### VERDICT: APPROVED

forgejo_admin commented

2026-03-24 20:25:02 +00:00

Author

Owner

PR #156 Review

DOMAIN REVIEW

Tech stack: OpenTofu / Kubernetes (NetworkPolicy via kubernetes_manifest provider)

Terraform patterns -- verified correct:

field_manager { force_conflicts = true } is the correct provider-level directive for kubernetes_manifest resources that use server-side apply. When a human does kubectl patch during incident response, the field manager ownership changes from Terraform to kubectl. Without force_conflicts = true, the next tofu apply fails with a field manager conflict error because Terraform refuses to reclaim ownership. This fix is the canonical solution.
The block is placed immediately inside the resource block, before manifest, which is the conventional position and matches tofu fmt expectations.
All 9 NetworkPolicy resources in terraform/network-policies.tf now have the block:
1. netpol_monitoring
2. netpol_forgejo
3. netpol_woodpecker
4. netpol_harbor
5. netpol_minio
6. netpol_keycloak
7. netpol_postgres
8. netpol_ollama
9. netpol_cnpg_system
6 other kubernetes_manifest resources in main.tf (PrometheusRule, ServiceMonitor, CNPG Cluster, ScheduledBackup) are intentionally excluded. These resource types are not typically kubectl patch-ed during incident response, and the issue (#152) is specifically about NetworkPolicy conflicts. Scoping is correct -- no missed resources, no scope creep.
No functional infrastructure change. field_manager is a provider directive, not a manifest field. Existing resources will not be recreated or modified.

tofu compliance:

tofu fmt compliance: indentation and block structure are consistent with the rest of the file
tofu plan should show 0 changes (provider-level directive only)
No state-breaking changes

BLOCKERS

None.

NITS

None. This is a minimal, well-scoped fix. The diff is +27/-0 (pure additive), touching exactly 1 file.

SOP COMPLIANCE

Branch named after issue (152-netpol-field-manager references issue #152)
PR body follows template (Summary, Changes, tofu plan Output, Test Plan, Related)
Related section references issue #152 (Closes #152)
No secrets committed
No unnecessary file changes (1 file, network-policies.tf only)
Commit messages are descriptive
tofu fmt compliance noted in Test Plan

PROCESS OBSERVATIONS

MTTR impact: Positive. This fix removes a class of CI failures that block tofu apply after manual incident response patches. Currently, any kubectl patch on a NetworkPolicy would cause the next pipeline to fail, requiring manual state intervention. After this fix, Terraform will simply reclaim field ownership and apply cleanly.
Change failure risk: Minimal. Pure additive change with no infrastructure mutation. The field_manager block is a provider-level directive that does not alter the Kubernetes resource state.
Deployment frequency: Unblocks CI pipelines that would otherwise fail after incident response. Direct enabler for higher DF.

VERDICT: APPROVED

## PR #156 Review ### DOMAIN REVIEW **Tech stack**: OpenTofu / Kubernetes (NetworkPolicy via `kubernetes_manifest` provider) **Terraform patterns -- verified correct:** - `field_manager { force_conflicts = true }` is the correct provider-level directive for `kubernetes_manifest` resources that use server-side apply. When a human does `kubectl patch` during incident response, the field manager ownership changes from Terraform to `kubectl`. Without `force_conflicts = true`, the next `tofu apply` fails with a field manager conflict error because Terraform refuses to reclaim ownership. This fix is the canonical solution. - The block is placed immediately inside the resource block, before `manifest`, which is the conventional position and matches `tofu fmt` expectations. - All **9 NetworkPolicy** resources in `terraform/network-policies.tf` now have the block: 1. `netpol_monitoring` 2. `netpol_forgejo` 3. `netpol_woodpecker` 4. `netpol_harbor` 5. `netpol_minio` 6. `netpol_keycloak` 7. `netpol_postgres` 8. `netpol_ollama` 9. `netpol_cnpg_system` - **6 other `kubernetes_manifest` resources in `main.tf`** (PrometheusRule, ServiceMonitor, CNPG Cluster, ScheduledBackup) are intentionally excluded. These resource types are not typically `kubectl patch`-ed during incident response, and the issue (#152) is specifically about NetworkPolicy conflicts. Scoping is correct -- no missed resources, no scope creep. - No functional infrastructure change. `field_manager` is a provider directive, not a manifest field. Existing resources will not be recreated or modified. **tofu compliance:** - `tofu fmt` compliance: indentation and block structure are consistent with the rest of the file - `tofu plan` should show 0 changes (provider-level directive only) - No state-breaking changes ### BLOCKERS None. ### NITS None. This is a minimal, well-scoped fix. The diff is +27/-0 (pure additive), touching exactly 1 file. ### SOP COMPLIANCE - [x] Branch named after issue (`152-netpol-field-manager` references issue #152) - [x] PR body follows template (Summary, Changes, tofu plan Output, Test Plan, Related) - [x] Related section references issue #152 (`Closes #152`) - [x] No secrets committed - [x] No unnecessary file changes (1 file, network-policies.tf only) - [x] Commit messages are descriptive - [x] `tofu fmt` compliance noted in Test Plan ### PROCESS OBSERVATIONS - **MTTR impact**: Positive. This fix removes a class of CI failures that block `tofu apply` after manual incident response patches. Currently, any `kubectl patch` on a NetworkPolicy would cause the next pipeline to fail, requiring manual state intervention. After this fix, Terraform will simply reclaim field ownership and apply cleanly. - **Change failure risk**: Minimal. Pure additive change with no infrastructure mutation. The `field_manager` block is a provider-level directive that does not alter the Kubernetes resource state. - **Deployment frequency**: Unblocks CI pipelines that would otherwise fail after incident response. Direct enabler for higher DF. ### VERDICT: APPROVED