Summary
When a v2 XR runs through multiple function-patch-and-transform pipeline steps, the auto-composed connection Secret reference can be unintentionally reset by a later step that omits input.writeConnectionSecretToRef.
For cluster-scoped XRs, this can clear the Secret namespace and cause reconcile failures (an empty namespace may not be set when a resource name is provided).
Repro
- Use a v2, cluster-scoped XR (no XR namespace).
- In step A, extract connection details and set
input.writeConnectionSecretToRef via patches (including namespace).
- In step B (later in pipeline), run
function-patch-and-transform again, extract connection details, but omit input.writeConnectionSecretToRef.
- Observe the desired composed connection
Secret reference in step B loses namespace and falls back to defaults.
Current Behavior
- Each step composes a new connection
Secret reference from scratch.
- If a later step has no
writeConnectionSecretToRef, the ref can lose previously established non-empty values.
Expected Behavior
- If a desired connection
Secret already exists from a previous step, reuse that ref as the base in subsequent steps.
- Allow explicit step input / patches to override fields intentionally.
Impact
- Multi-step pipelines can become order-sensitive in unexpected ways.
- Cluster-scoped XRs can enter persistent reconcile errors due to missing namespace in composed
Secret refs.
Workaround
- Put
writeConnectionSecretToRef in the last function-patch-and-transform step only.
- Or repeat
writeConnectionSecretToRef in every function-patch-and-transform step.
Proposed Fix
Use the existing desired connection Secret reference as the base before composing the next step's connection Secret, then apply explicit input and patch overrides.
Summary
When a v2 XR runs through multiple
function-patch-and-transformpipeline steps, the auto-composed connectionSecretreference can be unintentionally reset by a later step that omitsinput.writeConnectionSecretToRef.For cluster-scoped XRs, this can clear the
Secretnamespace and cause reconcile failures (an empty namespace may not be set when a resource name is provided).Repro
input.writeConnectionSecretToRefvia patches (including namespace).function-patch-and-transformagain, extract connection details, but omitinput.writeConnectionSecretToRef.Secretreference in step B loses namespace and falls back to defaults.Current Behavior
Secretreference from scratch.writeConnectionSecretToRef, the ref can lose previously established non-empty values.Expected Behavior
Secretalready exists from a previous step, reuse that ref as the base in subsequent steps.Impact
Secretrefs.Workaround
writeConnectionSecretToRefin the lastfunction-patch-and-transformstep only.writeConnectionSecretToRefin everyfunction-patch-and-transformstep.Proposed Fix
Use the existing desired connection
Secretreference as the base before composing the next step's connectionSecret, then apply explicit input and patch overrides.