Skip to content

(bug) Fix post-render patch filtering for remove operations#625

Merged
gianlucam76 merged 1 commit into
projectsveltos:mainfrom
gianlucam76:patcher
May 12, 2026
Merged

(bug) Fix post-render patch filtering for remove operations#625
gianlucam76 merged 1 commit into
projectsveltos:mainfrom
gianlucam76:patcher

Conversation

@gianlucam76
Copy link
Copy Markdown
Member

@gianlucam76 gianlucam76 commented May 12, 2026

When using post-render patches, Sveltos filters out remove operations that target a path which doesn't exist on the object. This avoids errors when a patch is written defensively (e.g. "remove this label if it's there"). This PR fixes two issues in that logic:

  1. JSON Pointer escape sequences were not decoded.
  2. JSON Pointer paths use ~1 to represent a / character and ~0 to represent ~. A label key like velero.io/exclude-from-backup is written in a patch path as velero.io~1exclude-from-backup. The old code looked up that literal string as the map key, which never matched the actual key velero.io/exclude-from-backup. As a result, a remove operation targeting an existing label with a slash in its name was incorrectly treated as targeting a missing path and silently dropped.

Array segments in paths were not handled.
If a path traverses a list, for example /spec/containers/0/image, the old code tried to look up "0" as a map key, which always fails since list elements are not keyed by index. Any remove operation whose path passed through an array index was therefore always treated as missing and dropped.

Multi-operation patches were only partially inspected. A single patch entry can contain multiple operations. Previously only the first operation was checked, so a remove on a missing path later in the same patch was never filtered and would cause an error at apply time. The fix inspects every operation individually: remove operations targeting missing paths are stripped, the rest are kept. If all operations survive, the patch is returned unchanged; if all are stripped, the patch is dropped entirely.

Strategic merge patches without a resource name now produce a clear error. A strategic merge patch identifies its target resource by nam. It is essentially a partial resource object that gets merged into the real one. When such a patch has no metadata.name, kustomize rejects it with an opaque internal error that is hard to understand. This typically happens when a user writes a strategic merge patch expecting a regex target.name selector to handle the matching (which only works for JSON patches). Sveltos now detects this case early and returns a message that explains the problem and points to the JSON patch format as the solution.

When using post-render patches, Sveltos filters out remove operations that target a path which doesn't
exist on the object. This avoids errors when a patch is written defensively (e.g. "remove this label
if it's there"). This PR fixes two issues in that logic:

1. JSON Pointer escape sequences were not decoded.
2. JSON Pointer paths use ~1 to represent a / character and ~0 to represent ~. A label key like
velero.io/exclude-from-backup is written in a patch path as velero.io~1exclude-from-backup. The
old code looked up that literal string as the map key, which never matched the actual key
velero.io/exclude-from-backup. As a result, a remove operation targeting an existing label with a
slash in its name was incorrectly treated as targeting a missing path and silently dropped.

Array segments in paths were not handled.
If a path traverses a list, for example /spec/containers/0/image, the old code tried to look up "0"
as a map key, which always fails since list elements are not keyed by index. Any remove operation whose
path passed through an array index was therefore always treated as missing and dropped.

Multi-operation patches were only partially inspected.
A single patch entry can contain multiple operations. Previously only the first operation was checked,
so a remove on a missing path later in the same patch was never filtered and would cause an error at
apply time. The fix inspects every operation individually: remove operations targeting missing paths are
stripped, the rest are kept. If all operations survive, the patch is returned unchanged; if all are stripped,
the patch is dropped entirely.

Strategic merge patches without a resource name now produce a clear error.
A strategic merge patch identifies its target resource by nam. It is essentially a partial resource object that
gets merged into the real one. When such a patch has no metadata.name, kustomize rejects it with an opaque internal
error that is hard to understand. This typically happens when a user writes a strategic merge patch expecting a regex
target.name selector to handle the matching (which only works for JSON patches).
Sveltos now detects this case early and returns a message that explains the problem and points to the JSON patch format
as the solution.
@gianlucam76 gianlucam76 merged commit 3d4679d into projectsveltos:main May 12, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant