@opensoha/contracts 0.1.16 → 0.1.18

package/resource/runtime/operator_integration_test.go

@@ -0,0 +1,174 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/wait"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func TestWorkloadCronJobWithKubernetes(t *testing.T) {
+	path, namespace, image := os.Getenv("SOHA_OPERATOR_TEST_KUBECONFIG"), os.Getenv("SOHA_OPERATOR_TEST_NAMESPACE"), os.Getenv("SOHA_OPERATOR_TEST_IMAGE")
+	if path == "" {
+		t.Skip("set SOHA_OPERATOR_TEST_KUBECONFIG, namespace and digest-pinned image for the isolated controller fixture")
+	}
+	if !strings.HasPrefix(namespace, "soha-workflow-r6-") || !strings.Contains(image, "@sha256:") {
+		t.Fatal("isolated namespace and pinned image are required")
+	}
+	config, err := clientcmd.BuildConfigFromFlags("", path)
+	operatorRequire(t, err)
+	endpoint, err := url.Parse(config.Host)
+	if err != nil || endpoint.Hostname() != "127.0.0.1" {
+		t.Fatal("only the loopback integration cluster is supported")
+	}
+	config.Timeout = 10 * time.Second
+	client, err := dynamic.NewForConfig(config)
+	operatorRequire(t, err)
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	name := "periodic-" + uuid.NewString()[:8]
+	deployments := client.Resource(schema.GroupVersionResource{Group: "apps", Version: "v1", Resource: "deployments"}).Namespace(namespace)
+	roots := client.Resource(schema.GroupVersionResource{Group: "workloads.soha.io", Version: "v1alpha1", Resource: "workloadcronjobs"}).Namespace(namespace)
+	targets := client.Resource(schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "cronjobs"}).Namespace(namespace)
+	source, root := operatorIntegrationObjects(t, namespace, name, image)
+	options := metav1.PatchOptions{FieldManager: "soha-operator-integration"}
+	t.Cleanup(func() {
+		cleanup, stop := context.WithTimeout(context.Background(), 10*time.Second)
+		defer stop()
+		_ = deployments.Delete(cleanup, name, metav1.DeleteOptions{})
+	})
+	t.Cleanup(func() {
+		cleanup, stop := context.WithTimeout(context.Background(), 10*time.Second)
+		defer stop()
+		_ = roots.Delete(cleanup, name, metav1.DeleteOptions{})
+	})
+	_, err = ApplyManifest(ctx, deployments, source, options)
+	operatorRequire(t, err)
+	_, err = ApplyManifest(ctx, roots, root, options)
+	operatorRequire(t, err)
+	live := operatorWaitHealth(t, ctx, client, roots, name, "healthy")
+	target, err := targets.Get(ctx, name, metav1.GetOptions{})
+	operatorRequire(t, err)
+	if metav1.GetControllerOf(target) == nil || metav1.GetControllerOf(target).UID != live.GetUID() {
+		t.Fatal("target ownership missing")
+	}
+	// This task is deliberately suspended; synchronization does not imply a Job ran.
+	jobs, err := client.Resource(schema.GroupVersionResource{Group: "batch", Version: "v1", Resource: "jobs"}).Namespace(namespace).List(ctx, metav1.ListOptions{})
+	operatorRequire(t, err)
+	for _, job := range jobs.Items {
+		if owner := metav1.GetControllerOf(&job); owner != nil && owner.UID == target.GetUID() {
+			t.Fatal("suspended fixture unexpectedly ran a Job")
+		}
+	}
+	for _, schedule := range []string{"0 3 * * *", "0 2 * * *"} {
+		operatorRequire(t, unstructured.SetNestedField(root.Object, schedule, "spec", "cronJobSpec", "schedule"))
+		_, err = ApplyManifest(ctx, roots, root, options)
+		operatorRequire(t, err)
+		operatorWaitHealth(t, ctx, client, roots, name, "healthy")
+		target, err = targets.Get(ctx, name, metav1.GetOptions{})
+		operatorRequire(t, err)
+		actual, _, _ := unstructured.NestedString(target.Object, "spec", "schedule")
+		if actual != schedule {
+			t.Fatalf("schedule = %s, want %s", actual, schedule)
+		}
+	}
+	// Even force must not write the Operator-owned child directly.
+	yes := true
+	if _, err := ApplyManifest(ctx, targets, target, metav1.PatchOptions{FieldManager: "other-delivery", Force: &yes, DryRun: []string{metav1.DryRunAll}}); err == nil {
+		t.Fatal("second writer was accepted")
+	}
+	// A missing source must degrade, and recreating it must recover with a new UID.
+	operatorRequire(t, deployments.Delete(ctx, name, metav1.DeleteOptions{}))
+	operatorWaitHealth(t, ctx, client, roots, name, "degraded")
+	_, err = ApplyManifest(ctx, deployments, source, options)
+	operatorRequire(t, err)
+	operatorWaitHealth(t, ctx, client, roots, name, "healthy")
+	operatorVerifyDeletion(t, ctx, client, roots, targets, name)
+	t.Log("real Operator: owned CronJob, generation/version observation, update/rollback, second-writer rejection, source-loss recovery and finalizer/foreground deletion passed")
+}
+
+func operatorWaitHealth(t *testing.T, ctx context.Context, client dynamic.Interface, roots dynamic.ResourceInterface, name, want string) *unstructured.Unstructured {
+	t.Helper()
+	var live *unstructured.Unstructured
+	var health string
+	err := wait.PollUntilContextCancel(ctx, 500*time.Millisecond, true, func(ctx context.Context) (bool, error) {
+		var err error
+		live, err = roots.Get(ctx, name, metav1.GetOptions{})
+		if err != nil {
+			return false, err
+		}
+		health, err = ManifestHealth(ctx, client, live)
+		return health == want, err
+	})
+	if err != nil {
+		t.Fatalf("Operator health = %s, want %s: %v", health, want, err)
+	}
+	return live
+}
+
+func operatorVerifyDeletion(t *testing.T, ctx context.Context, client dynamic.Interface, roots, targets dynamic.ResourceInterface, name string) {
+	t.Helper()
+	_, err := roots.Patch(ctx, name, types.MergePatchType, []byte(`{"metadata":{"finalizers":["integration.soha.io/hold"]}}`), metav1.PatchOptions{})
+	operatorRequire(t, err)
+	if err := DeleteManifest(ctx, roots, name, "old-root-uid"); !apierrors.IsConflict(err) {
+		t.Fatalf("replacement fence: %v", err)
+	}
+	operatorRequire(t, DeleteManifest(ctx, roots, name, ""))
+	live, err := roots.Get(ctx, name, metav1.GetOptions{})
+	operatorRequire(t, err)
+	if live.GetDeletionTimestamp() == nil || len(live.GetFinalizers()) == 0 {
+		t.Fatal("finalizer did not preserve deleting state")
+	}
+	health, err := ManifestHealth(ctx, client, live)
+	operatorRequire(t, err)
+	if health != "degraded" {
+		t.Fatal("deleting object was healthy")
+	}
+	if _, err := ApplyManifest(ctx, roots, live, metav1.PatchOptions{FieldManager: "soha-operator-integration"}); err == nil {
+		t.Fatal("deleting root accepted a new write")
+	}
+	// Only the fixture removes its own hold finalizer. Production never does this.
+	operatorRequire(t, wait.PollUntilContextCancel(ctx, 500*time.Millisecond, true, func(ctx context.Context) (bool, error) {
+		_, err := targets.Get(ctx, name, metav1.GetOptions{})
+		return apierrors.IsNotFound(err), nil
+	}))
+	_, err = roots.Patch(ctx, name, types.MergePatchType, []byte(`{"metadata":{"finalizers":[]}}`), metav1.PatchOptions{})
+	operatorRequire(t, err)
+	operatorRequire(t, wait.PollUntilContextCancel(ctx, 500*time.Millisecond, true, func(ctx context.Context) (bool, error) {
+		_, err := roots.Get(ctx, name, metav1.GetOptions{})
+		return apierrors.IsNotFound(err), nil
+	}))
+}
+
+func operatorIntegrationObjects(t *testing.T, namespace, name, image string) (*unstructured.Unstructured, *unstructured.Unstructured) {
+	t.Helper()
+	decode := func(raw string) *unstructured.Unstructured {
+		var object map[string]any
+		operatorRequire(t, json.Unmarshal([]byte(raw), &object))
+		return &unstructured.Unstructured{Object: object}
+	}
+	source := decode(fmt.Sprintf(`{"apiVersion":"apps/v1","kind":"Deployment","metadata":{"name":%q,"namespace":%q},"spec":{"replicas":1,"selector":{"matchLabels":{"app":%q}},"template":{"metadata":{"labels":{"app":%q}},"spec":{"containers":[{"name":"app","image":%q,"command":["sleep","3600"]}]}}}}`, name, namespace, name, name, image))
+	root := decode(fmt.Sprintf(`{"apiVersion":"workloads.soha.io/v1alpha1","kind":"WorkloadCronJob","metadata":{"name":%q,"namespace":%q},"spec":{"sourceRef":{"kind":"Deployment","name":%q,"container":"app"},"targetContainer":"task","cronJobSpec":{"schedule":"0 2 * * *","suspend":true,"jobTemplate":{"spec":{"template":{"spec":{"restartPolicy":"Never","containers":[{"name":"task","image":%q,"command":["true"]}]}}}}}}}`, name, namespace, name, image))
+	return source, root
+}
+
+func operatorRequire(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+}

package/resource/runtime/ownership.go

@@ -0,0 +1,178 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/util/csaupgrade"
+	"k8s.io/client-go/util/retry"
+)
+
+// ManifestAgentProviderPrefix prevents legacy runners from claiming operations
+// that require frozen controller resources and ownership-fenced writes.
+const ManifestAgentProviderPrefix = "manifest_agent_v3."
+const ManifestAgentCapability = "manifest.execution.v3"
+
+var ErrResourceOwnership = errors.New("resource mutation is blocked by ownership")
+
+// ApplyManifest serializes the ownership check with the write. Creation uses
+// create semantics so a concurrent external owner cannot be silently adopted.
+func ApplyManifest(ctx context.Context, client dynamic.ResourceInterface, desired *unstructured.Unstructured, options metav1.PatchOptions) (*unstructured.Unstructured, error) {
+	if IsArgoApplication(desired) {
+		return nil, fmt.Errorf("%w: Argo CD Applications require frozen GitOps execution", ErrResourceOwnership)
+	}
+	if IsArgoRollout(desired) || desired.GetAnnotations()[RolloutOwnerAnnotation] != "" {
+		return nil, fmt.Errorf("%w: progressive resources require frozen rollout execution", ErrResourceOwnership)
+	}
+	live, err := client.Get(ctx, desired.GetName(), metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		created, createErr := client.Create(ctx, desired, metav1.CreateOptions{FieldManager: options.FieldManager, DryRun: options.DryRun, FieldValidation: options.FieldValidation})
+		if createErr != nil || len(options.DryRun) != 0 {
+			return created, createErr
+		}
+		live, err = created, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	expectedUID := live.GetUID()
+	var applied *unstructured.Unstructured
+	err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
+		current, readErr := client.Get(ctx, desired.GetName(), metav1.GetOptions{})
+		if readErr != nil {
+			return readErr
+		}
+		if current.GetUID() != expectedUID {
+			return fmt.Errorf("resource was replaced during apply")
+		}
+		if ownerErr := ValidateDirectManifestOwner(current); ownerErr != nil {
+			return ownerErr
+		}
+		applied, readErr = applyObservedManifest(ctx, client, desired, current, options)
+		return readErr
+	})
+	return applied, err
+}
+
+func applyObservedManifest(ctx context.Context, client dynamic.ResourceInterface, desired, live *unstructured.Unstructured, options metav1.PatchOptions) (*unstructured.Unstructured, error) {
+	if len(options.DryRun) == 0 {
+		// Native migration moves only this manager's Create/Update ownership to
+		// Apply and guards resourceVersion; other field owners stay intact.
+		upgrade, err := csaupgrade.UpgradeManagedFieldsPatch(live, sets.New(options.FieldManager), options.FieldManager)
+		if err != nil {
+			return nil, err
+		}
+		if len(upgrade) != 0 {
+			live, err = client.Patch(ctx, desired.GetName(), types.JSONPatchType, upgrade, metav1.PatchOptions{FieldManager: options.FieldManager})
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return patchOwnedManifest(ctx, client, desired, live, options)
+}
+
+func patchOwnedManifest(ctx context.Context, client dynamic.ResourceInterface, desired, live *unstructured.Unstructured, options metav1.PatchOptions) (*unstructured.Unstructured, error) {
+	write := desired.DeepCopy()
+	write.SetResourceVersion(live.GetResourceVersion())
+	write.SetUID(live.GetUID())
+	body, err := json.Marshal(write.Object)
+	if err != nil {
+		return nil, err
+	}
+	return client.Patch(ctx, desired.GetName(), types.ApplyPatchType, body, options)
+}
+
+// ValidateDirectManifestOwner keeps direct SSA from becoming a second writer
+// for a controller's child, a Helm release or a registered GitOps resource.
+func ValidateDirectManifestOwner(object metav1.Object) error {
+	if object == nil {
+		return nil
+	}
+	if object.GetDeletionTimestamp() != nil {
+		return fmt.Errorf("%w: resource is being deleted; wait for finalizers to finish", ErrResourceOwnership)
+	}
+	return validateExternalManifestOwner(object)
+}
+
+func validateExternalManifestOwner(object metav1.Object) error {
+	if resource, ok := object.(*unstructured.Unstructured); ok && IsArgoRollout(resource) {
+		return fmt.Errorf("%w: Argo Rollouts require frozen progressive execution", ErrResourceOwnership)
+	}
+	if object.GetAnnotations()[RolloutOwnerAnnotation] != "" {
+		return fmt.Errorf("%w: resource belongs to a progressive rollout", ErrResourceOwnership)
+	}
+	if resource, ok := object.(*unstructured.Unstructured); ok && IsArgoApplication(resource) {
+		return fmt.Errorf("%w: Argo CD Applications require frozen GitOps execution", ErrResourceOwnership)
+	}
+	if metav1.GetControllerOf(object) != nil {
+		return fmt.Errorf("%w: resource is managed by a controller; update its owning resource", ErrResourceOwnership)
+	}
+	labels, annotations := object.GetLabels(), object.GetAnnotations()
+	if labels["app.kubernetes.io/managed-by"] == "Helm" || annotations["meta.helm.sh/release-name"] != "" ||
+		labels["argocd.argoproj.io/instance"] != "" || annotations["argocd.argoproj.io/tracking-id"] != "" ||
+		labels["kustomize.toolkit.fluxcd.io/name"] != "" || labels["helm.toolkit.fluxcd.io/name"] != "" {
+		return fmt.Errorf("%w: resource has an external delivery owner", ErrResourceOwnership)
+	}
+	for _, field := range object.GetManagedFields() {
+		if strings.HasPrefix(field.Manager, "argocd") || field.Manager == "kustomize-controller" || field.Manager == "helm-controller" {
+			return fmt.Errorf("%w: resource is managed by a GitOps controller", ErrResourceOwnership)
+		}
+	}
+	return nil
+}
+
+// UpdateManifest preserves the user's optimistic lock and refuses updates to
+// externally managed or deleting roots, including attempts to remove finalizers.
+func UpdateManifest(ctx context.Context, client dynamic.ResourceInterface, desired *unstructured.Unstructured) (*unstructured.Unstructured, error) {
+	live, err := client.Get(ctx, desired.GetName(), metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+	if err := ValidateDirectManifestOwner(live); err != nil {
+		return nil, err
+	}
+	write := desired.DeepCopy()
+	if write.GetUID() == "" {
+		write.SetUID(live.GetUID())
+	}
+	if write.GetResourceVersion() == "" {
+		write.SetResourceVersion(live.GetResourceVersion())
+	}
+	return client.Update(ctx, write, metav1.UpdateOptions{})
+}
+
+// DeleteManifest requests deletion of the observed root. A nil error confirms
+// acceptance only; finalizers are never removed and completion must be observed.
+func DeleteManifest(ctx context.Context, client dynamic.ResourceInterface, name, expectedUID string) error {
+	live, err := client.Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+	uid, version := live.GetUID(), live.GetResourceVersion()
+	if uid == "" || version == "" || expectedUID != "" && string(uid) != expectedUID {
+		return apierrors.NewConflict(schema.GroupResource{Resource: live.GetKind()}, name, fmt.Errorf("resource identity changed; refresh before deleting"))
+	}
+	if err := validateExternalManifestOwner(live); err != nil {
+		return err
+	}
+	if live.GetDeletionTimestamp() != nil {
+		return nil
+	}
+	options := metav1.DeleteOptions{Preconditions: &metav1.Preconditions{UID: &uid, ResourceVersion: &version}}
+	if live.GetAPIVersion() == "workloads.soha.io/v1alpha1" && live.GetKind() == "WorkloadCronJob" {
+		foreground := metav1.DeletePropagationForeground
+		options.PropagationPolicy = &foreground
+	}
+	return client.Delete(ctx, name, options)
+}

package/resource/runtime/ownership_test.go

@@ -0,0 +1,178 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic/fake"
+	ktesting "k8s.io/client-go/testing"
+)
+
+func TestManifestDeleteFencesUIDAndWaitsForFinalizers(t *testing.T) {
+	for _, mode := range []string{"accepted", "replaced", "deleting", "external"} {
+		t.Run(mode, func(t *testing.T) {
+			live := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "workloads.soha.io/v1alpha1", "kind": "WorkloadCronJob", "metadata": map[string]any{"name": "periodic", "namespace": "demo", "uid": "root-uid", "resourceVersion": "12"}}}
+			live.SetFinalizers([]string{"operator.example/hold"})
+			if mode == "deleting" {
+				now := metav1.Now()
+				live.SetDeletionTimestamp(&now)
+			}
+			if mode == "external" {
+				live.SetLabels(map[string]string{"argocd.argoproj.io/instance": "external"})
+			}
+			client := fake.NewSimpleDynamicClient(runtime.NewScheme(), live)
+			writes := 0
+			client.PrependReactor("delete", "workloadcronjobs", func(action ktesting.Action) (bool, runtime.Object, error) {
+				writes++
+				deleteAction, ok := action.(ktesting.DeleteAction)
+				if !ok {
+					t.Fatal("unexpected delete action")
+				}
+				options := deleteAction.GetDeleteOptions()
+				if options.Preconditions == nil || *options.Preconditions.UID != live.GetUID() || *options.Preconditions.ResourceVersion != "12" || options.PropagationPolicy == nil || *options.PropagationPolicy != metav1.DeletePropagationForeground {
+					t.Fatalf("missing delete fences: %+v", options)
+				}
+				return true, nil, nil
+			})
+			uid := "root-uid"
+			if mode == "replaced" {
+				uid = "previous-uid"
+			}
+			resources := client.Resource(schema.GroupVersionResource{Group: "workloads.soha.io", Version: "v1alpha1", Resource: "workloadcronjobs"}).Namespace("demo")
+			err := DeleteManifest(context.Background(), resources, "periodic", uid)
+			if mode == "replaced" && !apierrors.IsConflict(err) || mode == "external" && err == nil || (mode == "accepted" || mode == "deleting") && err != nil {
+				t.Fatalf("delete: %v", err)
+			}
+			if (mode == "accepted" && writes != 1) || (mode != "accepted" && writes != 0) {
+				t.Fatalf("delete calls: %d", writes)
+			}
+			for _, action := range client.Actions() {
+				if action.GetVerb() != "get" && action.GetVerb() != "delete" {
+					t.Fatalf("unexpected finalizer write: %s", action.GetVerb())
+				}
+			}
+		})
+	}
+}
+
+func TestManifestUpdatePreservesCallerVersion(t *testing.T) {
+	live := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "settings", "namespace": "demo", "uid": "current", "resourceVersion": "12"}}}
+	client := fake.NewSimpleDynamicClient(runtime.NewScheme(), live)
+	desired := live.DeepCopy()
+	desired.SetUID("previous")
+	desired.SetResourceVersion("11")
+	client.PrependReactor("update", "configmaps", func(action ktesting.Action) (bool, runtime.Object, error) {
+		update, ok := action.(ktesting.UpdateAction)
+		if !ok {
+			t.Fatal("unexpected update action")
+		}
+		write, ok := update.GetObject().(*unstructured.Unstructured)
+		if !ok {
+			t.Fatal("unexpected update object")
+		}
+		if write.GetUID() != "previous" || write.GetResourceVersion() != "11" {
+			t.Fatal("caller version was overwritten")
+		}
+		return true, nil, apierrors.NewConflict(schema.GroupResource{Resource: "configmaps"}, "settings", nil)
+	})
+	_, err := UpdateManifest(context.Background(), client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}).Namespace("demo"), desired)
+	if !apierrors.IsConflict(err) {
+		t.Fatalf("update: %v", err)
+	}
+}
+
+func TestDirectManifestRequiresOneWriter(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		change func(*unstructured.Unstructured)
+	}{
+		{"controller", func(object *unstructured.Unstructured) {
+			yes := true
+			object.SetOwnerReferences([]metav1.OwnerReference{{Controller: &yes, UID: "owner"}})
+		}},
+		{"deleting", func(object *unstructured.Unstructured) { now := metav1.Now(); object.SetDeletionTimestamp(&now) }},
+		{"Helm", func(object *unstructured.Unstructured) {
+			object.SetAnnotations(map[string]string{"meta.helm.sh/release-name": "external"})
+		}},
+		{"Argo CD", func(object *unstructured.Unstructured) {
+			object.SetAnnotations(map[string]string{"argocd.argoproj.io/tracking-id": "external"})
+		}},
+		{"Flux", func(object *unstructured.Unstructured) {
+			object.SetLabels(map[string]string{"kustomize.toolkit.fluxcd.io/name": "external"})
+		}},
+		{"GitOps manager", func(object *unstructured.Unstructured) {
+			object.SetManagedFields([]metav1.ManagedFieldsEntry{{Manager: "argocd-controller"}})
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			object := &unstructured.Unstructured{Object: map[string]any{}}
+			if err := ValidateDirectManifestOwner(object); err != nil {
+				t.Fatal(err)
+			}
+			test.change(object)
+			if err := ValidateDirectManifestOwner(object); err == nil {
+				t.Fatal("external ownership was accepted")
+			}
+		})
+	}
+}
+
+func TestManifestWritePreservesDryRunAndIdentity(t *testing.T) {
+	for _, exists := range []bool{false, true} {
+		t.Run(map[bool]string{false: "create", true: "apply"}[exists], func(t *testing.T) {
+			desired := &unstructured.Unstructured{Object: map[string]any{"apiVersion": "v1", "kind": "ConfigMap", "metadata": map[string]any{"name": "settings", "namespace": "demo"}}}
+			client := fake.NewSimpleDynamicClient(runtime.NewScheme())
+			verb := "create"
+			if exists {
+				live := desired.DeepCopy()
+				live.SetUID("settings-uid")
+				live.SetResourceVersion("12")
+				client = fake.NewSimpleDynamicClient(runtime.NewScheme(), live)
+				verb = "patch"
+			}
+			writes := 0
+			client.PrependReactor(verb, "configmaps", func(action ktesting.Action) (bool, runtime.Object, error) {
+				writes++
+				if exists {
+					patch, ok := action.(ktesting.PatchAction)
+					if !ok {
+						t.Fatal("unexpected patch action")
+					}
+					var body unstructured.Unstructured
+					if err := json.Unmarshal(patch.GetPatch(), &body); err != nil {
+						t.Fatal(err)
+					}
+					if body.GetUID() != "settings-uid" || body.GetResourceVersion() != "12" {
+						t.Fatal("ownership read was not fenced")
+					}
+					patchOptions, ok := action.(interface{ GetPatchOptions() metav1.PatchOptions })
+					if !ok {
+						t.Fatal("unexpected patch options")
+					}
+					if len(patchOptions.GetPatchOptions().DryRun) != 1 {
+						t.Fatal("patch lost dry-run")
+					}
+				} else {
+					createOptions, ok := action.(interface{ GetCreateOptions() metav1.CreateOptions })
+					if !ok {
+						t.Fatal("unexpected create options")
+					}
+					if len(createOptions.GetCreateOptions().DryRun) != 1 {
+						t.Fatal("create lost dry-run")
+					}
+				}
+				return true, desired.DeepCopy(), nil
+			})
+			_, err := ApplyManifest(context.Background(), client.Resource(schema.GroupVersionResource{Version: "v1", Resource: "configmaps"}).Namespace("demo"), desired, metav1.PatchOptions{FieldManager: "soha-test", DryRun: []string{metav1.DryRunAll}})
+			if err != nil || writes != 1 || desired.GetUID() != "" || desired.GetResourceVersion() != "" {
+				t.Fatalf("write = %d, %v; desired = %#v", writes, err, desired)
+			}
+		})
+	}
+}