fix(ssa): do not run auth reconcile with SSA (cherry pick of #28027 and #27601 to 3.4)

controller/appcontroller_test.go

@@ -221,7 +221,6 @@ func newFakeControllerWithResync(ctx context.Context, data *fakeData, appResyncP
 	defer cancelApp()
 	clusterCacheMock := &mocks.ClusterCache{}
 	clusterCacheMock.EXPECT().IsNamespaced(mock.Anything).Return(true, nil)
-	clusterCacheMock.EXPECT().GetOpenAPISchema().Return(nil)
 	clusterCacheMock.EXPECT().GetGVKParser().Return(nil)
 
 	mockStateCache := &mockstatecache.LiveStateCache{}

controller/sync.go

@@ -25,7 +25,6 @@ import (
 	"k8s.io/apimachinery/pkg/util/managedfields"
 	"k8s.io/client-go/kubernetes/scheme"
 	"k8s.io/client-go/rest"
-	"k8s.io/kubectl/pkg/util/openapi"
 
 	"github.com/argoproj/argo-cd/v3/controller/metrics"
 	"github.com/argoproj/argo-cd/v3/controller/syncid"
@@ -49,14 +48,6 @@ const (
 	serviceAccountDisallowedCharSet = "!*[]{}\\/"
 )
 
-func (m *appStateManager) getOpenAPISchema(server *v1alpha1.Cluster) (openapi.Resources, error) {
-	cluster, err := m.liveStateCache.GetClusterCache(server)
-	if err != nil {
-		return nil, err
-	}
-	return cluster.GetOpenAPISchema(), nil
-}
-
 func (m *appStateManager) getGVKParser(server *v1alpha1.Cluster) (*managedfields.GvkParser, error) {
 	cluster, err := m.liveStateCache.GetClusterCache(server)
 	if err != nil {
@@ -70,16 +61,11 @@ func (m *appStateManager) getGVKParser(server *v1alpha1.Cluster) (*managedfields
 // cleanup function that must be called to remove the generated kube config for this
 // server.
 func (m *appStateManager) getServerSideDiffDryRunApplier(cluster *v1alpha1.Cluster) (gitopsDiff.KubeApplier, func(), error) {
-	clusterCache, err := m.liveStateCache.GetClusterCache(cluster)
-	if err != nil {
-		return nil, nil, fmt.Errorf("error getting cluster cache: %w", err)
-	}
-
 	rawConfig, err := cluster.RawRestConfig()
 	if err != nil {
 		return nil, nil, fmt.Errorf("error getting cluster REST config: %w", err)
 	}
-	ops, cleanup, err := kubeutil.ManageServerSideDiffDryRuns(rawConfig, clusterCache.GetOpenAPISchema(), m.onKubectlRun)
+	ops, cleanup, err := kubeutil.ManageServerSideDiffDryRuns(rawConfig, m.onKubectlRun)
 	if err != nil {
 		return nil, nil, fmt.Errorf("error creating kubectl ResourceOperations: %w", err)
 	}
@@ -249,13 +235,6 @@ func (m *appStateManager) SyncAppState(app *v1alpha1.Application, project *v1alp
 		clientSideApplyManager = managerValue
 	}
 
-	openAPISchema, err := m.getOpenAPISchema(destCluster)
-	if err != nil {
-		state.Phase = common.OperationError
-		state.Message = fmt.Sprintf("failed to load openAPISchema: %v", err)
-		return
-	}
-
 	reconciliationResult := compareResult.reconciliationResult
 
 	// if RespectIgnoreDifferences is enabled, it should normalize the target
@@ -349,7 +328,6 @@ func (m *appStateManager) SyncAppState(app *v1alpha1.Application, project *v1alp
 		rawConfig,
 		m.kubectl,
 		app.Spec.Destination.Namespace,
-		openAPISchema,
 		opts...,
 	)
 	if err != nil {

gitops-engine/.mockery.yaml

@@ -0,0 +1,11 @@
+dir: '{{.InterfaceDir}}/mocks'
+filename: '{{.InterfaceName}}.go'
+include-auto-generated: true # Needed since mockery 3.6.1
+pkgname: mocks
+structname: '{{.InterfaceName}}'
+template-data:
+  unroll-variadic: true
+packages:
+  github.com/argoproj/argo-cd/gitops-engine/pkg/utils/kube:
+    interfaces:
+      KubectlOptionsRunner: {}

gitops-engine/pkg/engine/engine.go

@@ -84,7 +84,7 @@ func (e *gitOpsEngine) Sync(ctx context.Context,
 		return nil, fmt.Errorf("failed to diff objects: %w", err)
 	}
 	opts = append(opts, sync.WithSkipHooks(!diffRes.Modified))
-	syncCtx, cleanup, err := sync.NewSyncContext(revision, result, e.config, e.config, e.kubectl, namespace, e.cache.GetOpenAPISchema(), opts...)
+	syncCtx, cleanup, err := sync.NewSyncContext(revision, result, e.config, e.config, e.kubectl, namespace, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create sync context: %w", err)
 	}

gitops-engine/pkg/sync/sync_context.go

@@ -27,7 +27,6 @@ import (
 	"k8s.io/client-go/util/retry"
 	"k8s.io/klog/v2/textlogger"
 	cmdutil "k8s.io/kubectl/pkg/cmd/util"
-	"k8s.io/kubectl/pkg/util/openapi"
 
 	"github.com/argoproj/argo-cd/gitops-engine/pkg/diff"
 	"github.com/argoproj/argo-cd/gitops-engine/pkg/health"
@@ -236,7 +235,6 @@ func NewSyncContext(
 	rawConfig *rest.Config,
 	kubectl kubeutil.Kubectl,
 	namespace string,
-	openAPISchema openapi.Resources,
 	opts ...SyncOpt,
 ) (SyncContext, func(), error) {
 	dynamicIf, err := dynamic.NewForConfig(restConfig)
@@ -251,7 +249,7 @@ func NewSyncContext(
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to create extensions client: %w", err)
 	}
-	resourceOps, cleanup, err := kubectl.ManageResources(rawConfig, openAPISchema)
+	resourceOps, cleanup, err := kubectl.ManageResources(rawConfig)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to manage resources: %w", err)
 	}

gitops-engine/pkg/utils/kube/ctl.go

@@ -16,6 +16,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/version"
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/kube-openapi/pkg/util/proto"
 	"k8s.io/kubectl/pkg/util/openapi"
@@ -30,8 +31,8 @@ type CleanupFunc func()
 type OnKubectlRunFunc func(command string) (CleanupFunc, error)
 
 type Kubectl interface {
-	ManageResources(config *rest.Config, openAPISchema openapi.Resources) (ResourceOperations, func(), error)
-	ManageServerSideDiffDryRuns(config *rest.Config, openAPISchema openapi.Resources) (diff.KubeApplier, func(), error)
+	ManageResources(config *rest.Config) (ResourceOperations, func(), error)
+	ManageServerSideDiffDryRuns(config *rest.Config) (diff.KubeApplier, func(), error)
 	LoadOpenAPISchema(config *rest.Config) (openapi.Resources, *managedfields.GvkParser, error)
 	ConvertToVersion(obj *unstructured.Unstructured, group, version string) (*unstructured.Unstructured, error)
 	DeleteResource(ctx context.Context, config *rest.Config, gvk schema.GroupVersionKind, name string, namespace string, deleteOptions metav1.DeleteOptions) error
@@ -277,7 +278,7 @@ func (k *KubectlCmd) DeleteResource(ctx context.Context, config *rest.Config, gv
 	return resourceIf.Delete(ctx, name, deleteOptions)
 }
 
-func (k *KubectlCmd) ManageResources(config *rest.Config, openAPISchema openapi.Resources) (ResourceOperations, func(), error) {
+func (k *KubectlCmd) ManageResources(config *rest.Config) (ResourceOperations, func(), error) {
 	f, err := os.CreateTemp(utils.TempDir, "")
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to generate temp file for kubeconfig: %w", err)
@@ -293,17 +294,22 @@ func (k *KubectlCmd) ManageResources(config *rest.Config, openAPISchema openapi.
 		utils.DeleteFile(f.Name())
 	}
 	return &kubectlResourceOperations{
-		config:        config,
-		fact:          fact,
-		openAPISchema: openAPISchema,
-		tracer:        k.Tracer,
-		log:           k.Log,
-		onKubectlRun:  k.OnKubectlRun,
+		config: config,
+		getClientFunc: func() (kubernetes.Interface, error) {
+			return kubernetes.NewForConfig(config)
+		},
+		fact:   fact,
+		tracer: k.Tracer,
+		log:    k.Log,
+		optionsRunner: &realKubectlOptionsRunner{
+			onKubectlRun: k.OnKubectlRun,
+		},
+		outputMode: outputModeLog,
 	}, cleanup, nil
 }
 
 // ManageServerSideDiffDryRuns creates a KubeApplier for server-side diff dry runs
-func (k *KubectlCmd) ManageServerSideDiffDryRuns(config *rest.Config, openAPISchema openapi.Resources) (diff.KubeApplier, func(), error) {
+func (k *KubectlCmd) ManageServerSideDiffDryRuns(config *rest.Config) (diff.KubeApplier, func(), error) {
 	f, err := os.CreateTemp(utils.TempDir, "")
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to generate temp file for kubeconfig: %w", err)
@@ -318,13 +324,18 @@ func (k *KubectlCmd) ManageServerSideDiffDryRuns(config *rest.Config, openAPISch
 	cleanup := func() {
 		utils.DeleteFile(f.Name())
 	}
-	return &kubectlServerSideDiffDryRunApplier{
-		config:        config,
-		fact:          fact,
-		openAPISchema: openAPISchema,
-		tracer:        k.Tracer,
-		log:           k.Log,
-		onKubectlRun:  k.OnKubectlRun,
+	return &kubectlResourceOperations{
+		config: config,
+		getClientFunc: func() (kubernetes.Interface, error) {
+			return kubernetes.NewForConfig(config)
+		},
+		fact:   fact,
+		tracer: k.Tracer,
+		log:    k.Log,
+		optionsRunner: &realKubectlOptionsRunner{
+			onKubectlRun: k.OnKubectlRun,
+		},
+		outputMode: outputModeJSON,
 	}, cleanup, nil
 }
 

gitops-engine/pkg/utils/kube/kubetest/mock.go

@@ -35,7 +35,7 @@ type MockKubectlCmd struct {
 	convertToVersionFunc           *func(obj *unstructured.Unstructured, group, version string) (*unstructured.Unstructured, error)
 	getResourceFunc                *func(ctx context.Context, config *rest.Config, gvk schema.GroupVersionKind, name string, namespace string) (*unstructured.Unstructured, error)
 	loadOpenAPISchemaFunc          *func(config *rest.Config) (openapi.Resources, *managedfields.GvkParser, error)
-	manageServerSideDiffDryRunFunc *func(config *rest.Config, openAPISchema openapi.Resources) (diff.KubeApplier, func(), error)
+	manageServerSideDiffDryRunFunc *func(config *rest.Config) (diff.KubeApplier, func(), error)
 }
 
 // WithConvertToVersionFunc overrides the default ConvertToVersion behavior.
@@ -57,7 +57,7 @@ func (k *MockKubectlCmd) WithLoadOpenAPISchemaFunc(loadOpenAPISchemaFunc func(*r
 }
 
 // WithManageServerSideDiffDryRunFunc overrides the default ManageServerSideDiffDryRuns behavior.
-func (k *MockKubectlCmd) WithManageServerSideDiffDryRunFunc(manageServerSideDiffDryRunFunc func(*rest.Config, openapi.Resources) (diff.KubeApplier, func(), error)) *MockKubectlCmd {
+func (k *MockKubectlCmd) WithManageServerSideDiffDryRunFunc(manageServerSideDiffDryRunFunc func(*rest.Config) (diff.KubeApplier, func(), error)) *MockKubectlCmd {
 	k.manageServerSideDiffDryRunFunc = &manageServerSideDiffDryRunFunc
 	return k
 }
@@ -117,14 +117,14 @@ func (k *MockKubectlCmd) LoadOpenAPISchema(config *rest.Config) (openapi.Resourc
 func (k *MockKubectlCmd) SetOnKubectlRun(_ kube.OnKubectlRunFunc) {
 }
 
-func (k *MockKubectlCmd) ManageResources(_ *rest.Config, _ openapi.Resources) (kube.ResourceOperations, func(), error) {
+func (k *MockKubectlCmd) ManageResources(_ *rest.Config) (kube.ResourceOperations, func(), error) {
 	return &MockResourceOps{}, func() {
 	}, nil
 }
 
-func (k *MockKubectlCmd) ManageServerSideDiffDryRuns(config *rest.Config, openAPISchema openapi.Resources) (diff.KubeApplier, func(), error) {
+func (k *MockKubectlCmd) ManageServerSideDiffDryRuns(config *rest.Config) (diff.KubeApplier, func(), error) {
 	if k.manageServerSideDiffDryRunFunc != nil {
-		return (*k.manageServerSideDiffDryRunFunc)(config, openAPISchema)
+		return (*k.manageServerSideDiffDryRunFunc)(config)
 	}
 	return &MockKubeApplier{}, func() {}, nil
 }