fix(rg-eks): merge duplicate annotations blocks in cniMetricsHelperPolicy - #862
Merged
allamand merged 1 commit intoSep 4, 2026
Merged
Conversation
allamand
requested review from
elamaran11,
hmuthusamy,
punkwalker and
shapirov103
as code owners
September 4, 2026 06:10
allamand
force-pushed
the
fix/rg-eks-cni-metrics-policy-annotations
branch
from
September 4, 2026 06:22
3d03274 to
96b8158
Compare
…licy
The cniMetricsHelperPolicy resource template had two separate 'annotations:'
blocks in the same metadata section, with 'ownerReferences' between them:
metadata:
annotations:
services.k8s.aws/adoption-policy: adopt-or-create # FIRST (adoption)
services.k8s.aws/adoption-fields: ...
ownerReferences: ...
annotations: # SECOND (overwrites first!)
argocd.argoproj.io/tracking-id: ...
services.k8s.aws/region: ...
YAML merge semantics mean the second 'annotations:' block overwrites the first,
so the 'adopt-or-create' annotation was silently dropped. KRO created the
Policy CR without adoption-policy, causing ACK to fail with
'EntityAlreadyExists' when the policy already existed from a previous run
(reused account). This prevented KRO from getting the ARN, causing:
'cniMetricsHelperPolicy.status.ackResourceMetadata.arn: no such key: arn'
Fix: merge both annotation blocks into a single block with all four keys.
The order is: adoption annotations first (so they're not accidentally removed
by future edits), then tracking and region annotations.
allamand
force-pushed
the
fix/rg-eks-cni-metrics-policy-annotations
branch
from
September 4, 2026 06:26
96b8158 to
b52089d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
cniMetricsHelperPolicyresource inrg-eks.yamlhad two separateannotations:blocks in the samemetadatasection, separated byownerReferences:YAML merge semantics mean the second block silently overwrites the first, so
adoption-policy: adopt-or-createwas never applied to the CR.Consequence on reused accounts: ACK received a Policy CR without adoption annotation, failed with
EntityAlreadyExists(policy from a previous run still present), never populated.status.ackResourceMetadata.arn, causing KRO to report:This caused
task installto hang indefinitely athub:wait-for-eks.Consequence on fresh accounts: adopt-or-create has no effect on first install since the policy doesn't exist yet, but on any re-run the policy is orphaned.
Fix
Merged both annotation blocks into a single block with all four keys. One-line change.
Related
PR #835 (v0.3.0-rc3 teardown validation) — discovered during install testing on reused account kro-c1.