checksum label created when kustomize.toolkit.fluxcd.io/prune is disabled

[almorgv]

Describe the bug

Annotating manifests with kustomize.toolkit.fluxcd.io/prune: disabled does not prevent kustomize-controller to label it with checksum.
We really need this to deal with other operator behavior that restarts pods when labels has changed without manually creating Kustomization with prune: false.

To Reproduce

Steps to reproduce the behaviour:

apiVersion: v1
kind: Namespace
metadata:
  labels:
    kustomize.toolkit.fluxcd.io/prune: disabled
  annotations:
    kustomize.toolkit.fluxcd.io/prune: disabled
  name: test
spec: {}

kubectl get ns test -oyaml

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    cattle.io/status: '{"Conditions":[{"Type":"ResourceQuotaInit","Status":"True","Message":"","LastUpdateTime":"2021-06-03T13:23:51Z"},{"Type":"InitialRolesPopulated","Status":"True","Message":"","LastUpdateTime":"2021-06-03T13:23:52Z"}]}'
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{"kustomize.toolkit.fluxcd.io/prune":"disabled"},"labels":{"kustomize.toolkit.fluxcd.io/checksum":"0c136b62906ab0a3976c5bbcc5fd7aa8ab54de61","kustomize.toolkit.fluxcd.io/name":"flux-system","kustomize.toolkit.fluxcd.io/namespace":"flux-system","kustomize.toolkit.fluxcd.io/prune":"disabled"},"name":"test"},"spec":{}}
    kustomize.toolkit.fluxcd.io/prune: disabled
    lifecycle.cattle.io/create.namespace-auth: "true"
  creationTimestamp: "2021-06-03T13:23:50Z"
  finalizers:
  - controller.cattle.io/namespace-auth
  labels:
    kustomize.toolkit.fluxcd.io/checksum: 0c136b62906ab0a3976c5bbcc5fd7aa8ab54de61
    kustomize.toolkit.fluxcd.io/name: flux-system
    kustomize.toolkit.fluxcd.io/namespace: flux-system
    kustomize.toolkit.fluxcd.io/prune: disabled
  name: test
  resourceVersion: "6955830"
  uid: c67e05cf-bac2-461d-965d-37fddcaad6cb
spec:
  finalizers:
  - kubernetes
status:
  phase: Active

Expected behavior

Resource without label kustomize.toolkit.fluxcd.io/checksum: 0c136b62906ab0a3976c5bbcc5fd7aa8ab54de61

[hiddeco]

This is expected behavior, as the prune annotation is used to exclude objects during pruning, and not to disable tracking of the resources applied by the controller.

[almorgv]

But disabling prune is the only way to deal with such operators. For example see fluxcd/flux2#414. And #305 is clearly declares that disabling prune also disables checksum label generation

[hiddeco]

What is described there is the behavior when spec.prune is set to false, not when the annotation is placed in a resource.

[almorgv]

Exactly. But from a base perspective these are the same exact setting that disables pruning feature. And behavior of the one is different from another. This is a bit confusing