Skip to content

refactor(falco): migrate to Server-Side Apply for resource management#223

Merged
poiana merged 6 commits intofalcosecurity:mainfrom
c2ndev:refactor/ssa-and-tests
Feb 5, 2026
Merged

refactor(falco): migrate to Server-Side Apply for resource management#223
poiana merged 6 commits intofalcosecurity:mainfrom
c2ndev:refactor/ssa-and-tests

Conversation

@c2ndev
Copy link
Contributor

@c2ndev c2ndev commented Jan 30, 2026

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area falco-operator

/area artifact-operator

/area pkg

/area api

/area docs

What this PR does / why we need it:

This PR refactors the Falco controller to use Kubernetes Server-Side Apply (SSA) instead of the previous dry-run + diff pattern for creating and updating resources.

Key improvements:

  • Simplified resource management using SSA with field ownership tracking
  • Change detection by extracting and comparing only the fields managed by the controller, avoiding spurious updates on Kubernetes < 1.31 (in future we can replace this with a change detection based on ResourceVersion comparison which is correctly supported by Kubernetes >= 1.31)
  • Aligned finalizer operations across all artifact controllers to use Patch instead of Update, reducing conflict likelihood
  • Added integration test to verify SSA ResourceVersion behavior with a real API server

Benefits:

  • Cleaner, more maintainable reconciliation logic
  • Native conflict resolution through Kubernetes field management
  • Reduced risk of concurrent modification conflicts on finalizers
  • Better alignment with Kubernetes best practices for controller development

Which issue(s) this PR fixes:

Fixes #222

Special notes for your reviewer:

During deletion, the informer cache may trigger multiple reconciliations for the same event. This results in duplicate log entries (cosmetic) but has no functional impact — the finalizer removal patch is idempotent and only the first one takes effect.

@c2ndev c2ndev force-pushed the refactor/ssa-and-tests branch from 5cde9ee to d20089c Compare February 2, 2026 13:46
@c2ndev
Copy link
Contributor Author

c2ndev commented Feb 2, 2026

@alacuku I have reintroduced the diff mechanism as you suggested. When you want, you can procede with the review :) Thank you!

EDIT: I'm still implementing the managedFields diff

@c2ndev c2ndev changed the title refactor(falco): migrate to Server-Side Apply for resource management wip: refactor(falco): migrate to Server-Side Apply for resource management Feb 2, 2026
@c2ndev c2ndev force-pushed the refactor/ssa-and-tests branch 4 times, most recently from 9c34a1f to 6db5493 Compare February 3, 2026 09:25
@c2ndev c2ndev changed the title wip: refactor(falco): migrate to Server-Side Apply for resource management refactor(falco): migrate to Server-Side Apply for resource management Feb 3, 2026
@c2ndev c2ndev requested a review from alacuku February 3, 2026 09:29
@c2ndev c2ndev force-pushed the refactor/ssa-and-tests branch from aa56878 to 31b08d3 Compare February 4, 2026 09:28
@c2ndev c2ndev requested a review from alacuku February 4, 2026 09:30
@c2ndev c2ndev force-pushed the refactor/ssa-and-tests branch from 31b08d3 to af483c8 Compare February 4, 2026 11:02
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
Signed-off-by: c2ndev <cannarella.dev@gmail.com>
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
Signed-off-by: cannarelladev <cannarella.dev@gmail.com>
@c2ndev c2ndev force-pushed the refactor/ssa-and-tests branch from af483c8 to d2bf61d Compare February 4, 2026 13:18
Copy link
Member

@alacuku alacuku left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@poiana
Copy link

poiana commented Feb 5, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alacuku, c2ndev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link

poiana commented Feb 5, 2026

LGTM label has been added.

DetailsGit tree hash: a73efe05950259b80ccdc5bea896e056809d9b26

@poiana poiana added the approved label Feb 5, 2026
@poiana poiana merged commit 5fce1c9 into falcosecurity:main Feb 5, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Migrate Falco controller to Server-Side Apply for resource management

3 participants