Resources with serverside apply unable to sync managedFields must be nil

[j00p34]

We use sever-side apply on multiple resources but the sync fails with: metadata.managedFields must be nil
We use this among others things to patch the default namespace with an extra label.
When we manually reset the managedfields to an empty array the sync succeeds one time.
After the sync the managedfields are back again and arogcd is not able to sync the same resource again
This is the patch we are trying to apply

apiVersion: v1
kind: Namespace
metadata:
name: default
annotations:
argocd.argoproj.io/sync-options: ServerSideApply=true, Validate=false
labels:
network.openshift.io/policy-group: policygroup

Are we missing something here?

[andrii-korotkov-verkada]

Do you or something else set managedFields in the target manifests?

[j00p34]

thanks for your reply,

No we are not setting them, here are the managedfields after the first sync for the default namespace, seems like this is generated by k8s or argo

argocd or k8s :
managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            f:argocd.argoproj.io/sync-options: {}
            f:openshift.io/sa.scc.mcs: {}
            f:openshift.io/sa.scc.supplemental-groups: {}
            f:openshift.io/sa.scc.uid-range: {}
          f:labels:
            f:app.kubernetes.io/[redacted]: {}
            f:kubernetes.io/metadata.name: {}
            f:network.openshift.io/policy-group: {}
            f:pod-security.kubernetes.io/audit: {}
            f:pod-security.kubernetes.io/enforce: {}
            f:pod-security.kubernetes.io/warn: {}
        f:spec:
          f:finalizers: {}
      manager: argocd-controller
      operation: Apply
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:argocd.argoproj.io/sync-options: {}
            f:openshift.io/sa.scc.mcs: {}
            f:openshift.io/sa.scc.supplemental-groups: {}
            f:openshift.io/sa.scc.uid-range: {}
          f:labels:
            .: {}
            f:app.kubernetes.io/[redacted] {}
            f:kubernetes.io/metadata.name: {}
            f:network.openshift.io/policy-group: {}
            f:pod-security.kubernetes.io/audit: {}
            f:pod-security.kubernetes.io/enforce: {}
            f:pod-security.kubernetes.io/warn: {}
        f:spec:
          f:finalizers: {}
      manager: before-first-apply
      operation: Update
      time: '2024-11-08T15:00:58Z'``

[andrii-korotkov-verkada]

Ah, interesting, why is argocd.argoproj.io/sync-options among managed fields?

[j00p34]

No Idea, maybe it's because we are setting server-side apply?

metadata: 
  annotations:
    argocd.argoproj.io/sync-options: ServerSideApply=true, Validate=false

[andrii-korotkov-verkada]

Why are there two managers for roughly the same field? What does before-first-apply manager do?

[j00p34]

I'm not sure, but I think that's there because I cleared the managedfields with a patch so the sync would work. It seems like k8s is setting this