ACK Lambda Function code is not updated for zipFile

[itaiatu]

Describe the bug
Lambda function code is not updated when updating spec.code.zipFile

Steps to reproduce
Create a Function object from lambda.services.k8s.aws group

apiVersion: lambda.services.k8s.aws/v1alpha1
kind: Function
metadata:
  annotations:
    services.k8s.aws/region: us-east-1
  labels:
    environment: dev
  name: test-function-itaiatu
  namespace: ethos103-dev-va6
spec:
  architectures:
  - x86_64
  code:
    zipFile: <REDACTED>
  environment:
    variables:
      ...
  ephemeralStorage:
    size: 512
  handler: splunk_logger/index.handler
  loggingConfig:
    logFormat: Text
    logGroup: /aws/lambda/ethos103-dev-va6-cw2splunk
  memorySize: 128
  name: test-function-itaiatu
  packageType: Zip
  runtime: nodejs18.x
  ...

Update the spec.code.zipFile with another base64-encoded lambda function code

zip -r splunk_logger.zip splunk_logger
base64 -i splunk_logger.zip | pbcopy
`k -n ethos103-dev-va6 edit function test-function-itaiatu`
Change the `spec.code.zipFile`

Controller doesn't react on this change (maybe ack delta says that there is no difference)

I have also tried to add the code.sha256 field as mentioned in aws-controllers-k8s/lambda-controller#88 and #1689 (those issue & PR are for S3 Bucket alternative)

code:
  sha256: <REDACTED>

but the controller logged

{"level":"info","ts":"2025-07-11T13:54:07.761Z","logger":"ackrt","msg":"desired resource state has changed","kind":"Function","namespace":"ethos103-dev-va6","name":"test-function-itaiatu","account":"164592617289","role":"arn:aws:iam::164592617289:role/ethos-core-ethos996-stage-or2-ack-lambda-assumedrole","region":"us-east-1","is_adopted":false,"generation":3,"diff":[{"Path":{"Parts":["Spec","Code","SHA256"]},"A":"YmZiNzJhZDBiN2VmZGY5ZjE4ZjU0YzExZjFmODNhMmEyNWExYmY2NGNiOTM1ODhkNjNmM2NmZTA4YmRlY2QxNA==","B":"P0TqxO/LRAWxNgaIMXxfZiK66jhzzP7TTpsR+wWvR3o="}]}
{"level":"error","ts":"2025-07-11T13:54:07.896Z","msg":"Reconciler error","controller":"function","controllerGroup":"lambda.services.k8s.aws","controllerKind":"Function","Function":{"name":"test-function-itaiatu","namespace":"ethos103-dev-va6"},"namespace":"ethos103-dev-va6","name":"test-function-itaiatu","reconcileID":"2cc144d8-e65c-405d-bb9b-688be83e8534","error":"operation error Lambda: UpdateFunctionCode, https response error StatusCode: 400, RequestID: f3172054-41a5-4a6a-b949-a3aa83ced4dc, InvalidParameterValueException: Please provide a source for function code.","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"}

Expected outcome
Update the code of the Lambda Function

Environment

• Kubernetes version: 1.31
• Using EKS (yes/no), if so version? EKS 1.31
• AWS service targeted (S3, RDS, etc.) Lambda

[github-actions]

Hello @itaiatu 👋 Thank you for opening an issue in ACK! A maintainer will triage this issue soon.

We encourage community contributions, so if you're interested in tackling this yourself or suggesting a solution, please check out our Contribution and Code of Conduct guidelines.

You can find more information about ACK on our website.

[a-hilaly]

Hey there! Let me explain why updating Lambda function code through the CRD isn't as straightforward as you might expect.

there are two main challenges here:
1/ Unlike tools like SAM or CDK that can directly access your files, package them and put them in S3, the ACK controller only talks to the Lambda API. It doesn't have direct access to your code or S3. (Lambda controller only talks to lambda)
2/ When you update function code, AWS Lambda ControlPlane actually copies your code to a different bucket with a different name. This makes it impossible for the ACK controller to compare what's there now vs what you want to deploy, since the names never match.

on the bright side we've added support for the sha256 field as a workaround. To make code updates work, you'll need to set both the "file name" AND its "sha256 digest" (that needs to be computed properly). The sha256 lets us detect actual changes since Lambda returns this for the deployed code.

@itaiatu have you tried to set both the zipFile and the sha256?

[itaiatu]

Yes, I have also tried to update both the spec.code.zipFile and spec.code.sha256 field

{
    "level": "info",
    "ts": "2025-07-14T14:46:53.016Z",
    "logger": "ackrt",
    "msg": "desired resource state has changed",
    "kind": "Function",
    "namespace": "ethos103-dev-va6"
    ...
    "diff": [
        {
            "Path": {
                "Parts": [
                    "Spec",
                    "Code",
                    "SHA256"
                ]
            },
            "A": "ixFwHCiazmzuGwqF3Vc1QkyuYEB5cni0UyTUsrgGT0g=",
            "B": "tHQ0eXmh+2yypZ6xJyNEWhM+k6i3SiNDF899ffQ0+9U="
        }
    ]
}

But we get this

{
    "level": "error",
    "ts": "2025-07-14T14:46:53.157Z",
    "msg": "Reconciler error",
    "controller": "function",
    "controllerGroup": "lambda.services.k8s.aws",
    "controllerKind": "Function",
    "Function": {
        "name": "test-function-itaiatu",
        "namespace": "ethos103-dev-va6"
    },
    "namespace": "ethos103-dev-va6",
    "name": "test-function-itaiatu",
    "reconcileID": "926815bf-4aca-4ea5-9b66-29eb6c1a87e3",
    "error": "operation error Lambda: UpdateFunctionCode, https response error StatusCode: 400, RequestID: 425b55dc-5683-48fc-acf6-5697809c1b9c, InvalidParameterValueException: Please provide a source for function code.",
    "stacktrace": "sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:347\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:294\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.20.4/pkg/internal/controller/controller.go:255"
}

InvalidParameterValueException: Please provide a source for function code.

---

I have tested it with an S3 Bucket (instead of zipFile) and it works if I recompute the sha256 field, but it doesn't work for zipFile. Maybe this is because of a wrong call made by the controller to AWS in our zip base64 encoded case.

[rushmash91]

Hey @itaiatu!
Thanks again for the detailed bug report - it helped us identify this!

The fix has been merged in https://gallery.ecr.aws/aws-controllers-k8s/lambda-chart.
This should resolve the issue you were experiencing with zipFile-based Lambda function code updates.

A couple of notes for using zipFile:

• There is a 1.5MB size limit for direct code uploads(Kubernetes API server enforces a maximum request size for a single API object)
• For production workloads, we recommend using S3-based deployment

[itaiatu]

Tested it and it now sends the zipCode when performing the AWS API call.
Thanks for the explanation regarding production environments. 👍