kustomize build failed: filter cannot create or delete objects

[autarchprinceps]

Describe the bug

Using a strategic merge yaml patch in kustomize build with delete option $patch: delete now causes a kustomize build failed: filter cannot create or delete objects exception in flux. Locally this still works with kustomize build, and it did work in older versions of flux onmodified.

To Reproduce

Create a base folder with some kubernetes resources, reference it in a kustomization.yaml, alongside a strategic merge patch containing one resource to be omitted:

kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
bases:
- ../../../../products/base/prometheus/custom-resources
patchesStrategicMerge:
- patch.yaml

patch.yaml

---
$patch: delete  
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: kube2iam.rules
  namespace: monitoring

And point to the folder containing the kustomization.yaml in a Kustomization Resource looking something like this:

apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: prometheus-custom-resources
  namespace: flux-system
spec:
  interval: 10m0s
  path: ./patches/preprod/prometheus/custom-resources
  dependsOn:
  - name: prometheus-release
  - name: traefik-release
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  validation: client

Expected behavior

kustomize build doesn't contain the element, even though it is present in the bases.

Additional context

• Kubernetes version: 1.18
• Git provider: GitHub
• kustomization controller image version (broken): 0.6 - 0.10
• kustomization controller image version (definitively still working): 0.5.3

[stefanprodan]

I think this is caused by https://github.com/fluxcd/kustomize-controller/blob/main/controllers/kustomization_generator.go#L335-L356 as we have disabled AllowResourceIdChanges.

[stefanprodan]

Tested this with AllowResourceIdChanges = true and it still breaks, seem that this is a bug in sigs.k8s.io/kustomize/api v0.7.4 and we can't upgrade to latest due to kyaml panics and other breaking changes (fluxcd/flux2#918).

[autarchprinceps]

Allow Resoure ID Changes? We definitively also use Kustomization features like namespace override and nameSuffix and the likes. I didn't see an issue there yet, though we also still have 0.5.3 kustomization controller in that cluster as well.

[windnod]

same problem on kustomization controller version 0.12.0

[stefanprodan]

Please give this a try and comment on the PR if it fixes the bug: #343