@opensoha/contracts 0.1.24 → 0.1.25

package/resource/runtime/network_topology.go

@@ -0,0 +1,232 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	resource "github.com/opensoha/soha-contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/rest"
+)
+
+// ReadNetworkTopologySnapshot performs only fixed, discovery-verified, bounded reads.
+// The caller authenticates and authorizes each query before invoking this reader.
+func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clusterID string, input resource.NetworkTopologySnapshotRequest) (resource.NetworkTopologySnapshot, error) {
+	if err := resource.ValidateNetworkTopologySnapshotRequest(input); err != nil {
+		return resource.NetworkTopologySnapshot{}, err
+	}
+	if client == nil {
+		return resource.NetworkTopologySnapshot{}, fmt.Errorf("kubernetes REST client unavailable")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	output := resource.NetworkTopologySnapshot{Version: resource.NetworkTopologySnapshotFeature, Sources: make([]resource.NetworkTopologySourceResult, len(input.Queries))}
+	budget := &topologyReadBudget{remaining: resource.NetworkTopologyMaxTotalBytes}
+	sem := make(chan struct{}, 4)
+	var wg sync.WaitGroup
+	for index, query := range input.Queries {
+		wg.Add(1)
+		go func(index int, query resource.NetworkTopologySourceQuery) {
+			defer wg.Done()
+			select {
+			case sem <- struct{}{}:
+				defer func() { <-sem }()
+			case <-ctx.Done():
+				output.Sources[index] = topologySourceFailure(query, "error", "timeout")
+				return
+			}
+			output.Sources[index] = readTopologySource(ctx, client, clusterID, query, budget)
+		}(index, query)
+	}
+	wg.Wait()
+	total := 0
+	for i := range output.Sources {
+		source := &output.Sources[i]
+		kept := source.Objects[:0]
+		for _, object := range source.Objects {
+			size := len(object.Content)
+			if total+size > resource.NetworkTopologyMaxTotalBytes {
+				source.Coverage.State = "partial"
+				source.Coverage.Truncated = true
+				source.Coverage.ReasonCode = "total_budget"
+				continue
+			}
+			total += size
+			kept = append(kept, object)
+		}
+		source.Objects = kept
+	}
+	return output, nil
+}
+
+func topologySourceFailure(query resource.NetworkTopologySourceQuery, state, reason string) resource.NetworkTopologySourceResult {
+	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
+	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
+}
+
+func readTopologySource(ctx context.Context, client rest.Interface, clusterID string, query resource.NetworkTopologySourceQuery, budget *topologyReadBudget) resource.NetworkTopologySourceResult {
+	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
+	result := topologySourceFailure(query, "available", "")
+	version, err := discoverTopologySource(ctx, client, definition, budget)
+	if err != nil {
+		result.Coverage.State, result.Coverage.ReasonCode = topologyReadError(err)
+		return result
+	}
+	base := topologyAPIBase(definition.Group, version)
+	if query.Namespace != "" {
+		base += "/namespaces/" + query.Namespace
+	}
+	raw, err := boundedTopologyGET(ctx, client, base+"/"+definition.Resource, true, budget)
+	if err != nil {
+		result.Coverage.State, result.Coverage.ReasonCode = topologyReadError(err)
+		return result
+	}
+	var list struct {
+		Metadata struct {
+			Continue string `json:"continue"`
+		} `json:"metadata"`
+		Items []map[string]any `json:"items"`
+	}
+	if json.Unmarshal(raw, &list) != nil {
+		result.Coverage.State = "error"
+		result.Coverage.ReasonCode = "invalid_response"
+		return result
+	}
+	result.Coverage.ObservedAt = time.Now().UTC().Format(time.RFC3339)
+	if len(list.Items) > resource.NetworkTopologyMaxSourceItems || list.Metadata.Continue != "" {
+		result.Coverage.Truncated = true
+		result.Coverage.State = "partial"
+		result.Coverage.ReasonCode = "item_budget"
+	}
+	for index, object := range list.Items {
+		if index >= resource.NetworkTopologyMaxSourceItems {
+			break
+		}
+		projected, err := resource.ProjectNetworkTopologyObject(query.SourceID, object)
+		if err != nil {
+			result.Coverage.Truncated = true
+			result.Coverage.State = "partial"
+			result.Coverage.ReasonCode = "object_budget"
+			continue
+		}
+		metadata, _ := projected["metadata"].(map[string]any)
+		name, _ := metadata["name"].(string)
+		namespace, _ := metadata["namespace"].(string)
+		if name == "" || (query.Namespace != "" && namespace != query.Namespace) {
+			result.Coverage.State = "partial"
+			result.Coverage.ReasonCode = "invalid_identity"
+			continue
+		}
+		uid, _ := metadata["uid"].(string)
+		rv, _ := metadata["resourceVersion"].(string)
+		generation, _ := metadata["generation"].(float64)
+		content, _ := json.Marshal(projected)
+		result.Objects = append(result.Objects, resource.NetworkTopologySourceObject{Resource: resource.ResourceRef{ClusterID: clusterID, APIVersion: strings.TrimPrefix(definition.Group+"/"+version, "/"), ScopeMode: topologyScope(definition.Namespaced), Kind: definition.Kind, Namespace: namespace, Name: name, UID: uid, ResourceVersion: rv}, Generation: int64(generation), Content: string(content)})
+	}
+	return result
+}
+
+func topologyAPIBase(group, version string) string {
+	if group == "" {
+		return "/api/" + version
+	}
+	return "/apis/" + group + "/" + version
+}
+
+func discoverTopologySource(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget) (string, error) {
+	versions := []string{definition.Version}
+	if definition.FallbackVersion != "" {
+		versions = append(versions, definition.FallbackVersion)
+	}
+	for _, version := range versions {
+		raw, err := boundedTopologyGET(ctx, client, topologyAPIBase(definition.Group, version), false, budget)
+		if apierrors.IsNotFound(err) {
+			continue
+		}
+		if err != nil {
+			return "", err
+		}
+		var list metav1.APIResourceList
+		if err := json.Unmarshal(raw, &list); err != nil {
+			return "", fmt.Errorf("invalid discovery")
+		}
+		for _, item := range list.APIResources {
+			if item.Name == definition.Resource && item.Kind == definition.Kind && item.Namespaced == definition.Namespaced {
+				return version, nil
+			}
+		}
+	}
+	return "", apierrors.NewNotFound(schema.GroupResource{Group: definition.Group, Resource: definition.Resource}, "")
+}
+
+func boundedTopologyGET(ctx context.Context, client rest.Interface, path string, list bool, budget *topologyReadBudget) ([]byte, error) {
+	request := client.Get().AbsPath(path).SetHeader("Accept", "application/json")
+	if list {
+		request = request.Param("limit", fmt.Sprint(resource.NetworkTopologyMaxSourceItems))
+	}
+	stream, err := request.Stream(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = stream.Close() }()
+	body, err := io.ReadAll(io.LimitReader(&topologyBudgetReader{reader: stream, budget: budget}, resource.NetworkTopologyMaxSourceBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	if len(body) > resource.NetworkTopologyMaxSourceBytes {
+		return nil, fmt.Errorf("topology byte budget")
+	}
+	return body, nil
+}
+
+func topologyReadError(err error) (string, string) {
+	switch {
+	case apierrors.IsForbidden(err) || apierrors.IsUnauthorized(err):
+		return "denied", "kubernetes_rbac"
+	case apierrors.IsNotFound(err):
+		return "not_installed", "source_not_served"
+	case strings.Contains(err.Error(), "budget"):
+		return "partial", "byte_budget"
+	default:
+		return "error", "source_unavailable"
+	}
+}
+
+func topologyScope(namespaced bool) resource.ResourceScopeMode {
+	if namespaced {
+		return resource.ResourceScopeModeNamespace
+	}
+	return resource.ResourceScopeModeCluster
+}
+
+type topologyReadBudget struct {
+	mu        sync.Mutex
+	remaining int
+}
+type topologyBudgetReader struct {
+	reader io.Reader
+	budget *topologyReadBudget
+}
+
+func (r *topologyBudgetReader) Read(data []byte) (int, error) {
+	r.budget.mu.Lock()
+	available := min(len(data), r.budget.remaining)
+	r.budget.remaining -= available
+	r.budget.mu.Unlock()
+	if available <= 0 {
+		return 0, errors.New("topology total byte budget")
+	}
+	count, err := r.reader.Read(data[:available])
+	r.budget.mu.Lock()
+	r.budget.remaining += available - count
+	r.budget.mu.Unlock()
+	return count, err
+}

package/resource/runtime/network_topology_test.go

@@ -0,0 +1,62 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func TestTopologySnapshotBoundsDiscoveryAndProjection(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/v1":
+			_, _ = fmt.Fprint(w, `{"resources":[{"name":"pods","kind":"Pod","namespaced":true},{"name":"services","kind":"Service","namespaced":true}]}`)
+		case "/api/v1/namespaces/team/pods":
+			if r.URL.Query().Get("limit") != "200" {
+				t.Error("missing item bound")
+			}
+			_, _ = fmt.Fprint(w, `{"metadata":{"continue":"next"},"items":[{"metadata":{"name":"p","namespace":"team","uid":"uid","resourceVersion":"9"},"spec":{"secret":"credential"},"status":{"phase":"Running"}}]}`)
+		case "/api/v1/namespaces/team/services":
+			http.Error(w, `{"kind":"Status","apiVersion":"v1","reason":"Forbidden","code":403}`, http.StatusForbidden)
+		case "/apis/traefik.io/v1alpha1":
+			http.NotFound(w, r)
+		default:
+			t.Errorf("unexpected path: %s", r.URL.Path)
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	client, err := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	output, err := ReadNetworkTopologySnapshot(context.Background(), client.CoreV1().RESTClient(), "cluster", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: "kubernetes.pods", Namespace: "team"}, {SourceID: "kubernetes.services", Namespace: "team"}, {SourceID: "traefik.ingressroutes", Namespace: "team"}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if output.Sources[0].Coverage.State != "partial" || !output.Sources[0].Coverage.Truncated || output.Sources[1].Coverage.State != "denied" || output.Sources[2].Coverage.State != "not_installed" {
+		t.Fatalf("coverage: %+v", output.Sources)
+	}
+	raw, _ := json.Marshal(output)
+	if strings.Contains(string(raw), "credential") {
+		t.Fatal("full manifest escaped")
+	}
+	if output.Sources[0].Objects[0].Resource.ResourceVersion != "9" {
+		t.Fatal("identity lost")
+	}
+}
+
+func TestTopologySnapshotDoesNotReadArbitrarySources(t *testing.T) {
+	_, err := ReadNetworkTopologySnapshot(context.Background(), nil, "c", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: "secrets"}}})
+	if err == nil {
+		t.Fatal("unknown source accepted")
+	}
+}

package/resource/runtime/node_drain.go

@@ -0,0 +1,124 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	"github.com/opensoha/soha-contracts/resource"
+	policyv1 "k8s.io/api/policy/v1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/kubernetes"
+	policyclient "k8s.io/client-go/kubernetes/typed/policy/v1"
+	policybetaclient "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
+)
+
+// DrainClient observes eviction failures while leaving kubectl drain semantics intact.
+type DrainClient struct {
+	kubernetes.Interface
+	failures sync.Map
+}
+
+func NewDrainClient(client kubernetes.Interface) *DrainClient {
+	return &DrainClient{Interface: client}
+}
+
+func (c *DrainClient) PolicyV1() policyclient.PolicyV1Interface {
+	return drainPolicy{PolicyV1Interface: c.Interface.PolicyV1(), observer: c}
+}
+
+func (c *DrainClient) PolicyV1beta1() policybetaclient.PolicyV1beta1Interface {
+	return drainBetaPolicy{PolicyV1beta1Interface: c.Interface.PolicyV1beta1(), observer: c}
+}
+
+func (c *DrainClient) observe(namespace, name string, err error) error {
+	key := namespace + "/" + name
+	if err == nil || apierrors.IsNotFound(err) {
+		c.failures.Delete(key)
+	} else {
+		c.failures.Store(key, err)
+	}
+	return err
+}
+
+func (c *DrainClient) Failure(ctx context.Context, err error) error {
+	if err == nil {
+		return nil
+	}
+	code := "node_drain_failed"
+	var denied error
+	c.failures.Range(func(_, value any) bool {
+		failure, ok := value.(error)
+		if !ok {
+			return true
+		}
+		switch {
+		case apierrors.IsForbidden(failure) || apierrors.IsUnauthorized(failure):
+			denied = failure
+		case apierrors.HasStatusCause(failure, policyv1.DisruptionBudgetCause):
+			code = "node_drain_pdb_blocked"
+		case apierrors.IsTooManyRequests(failure) && code != "node_drain_pdb_blocked":
+			code = "node_drain_eviction_blocked"
+		}
+		return true
+	})
+	if denied != nil {
+		return denied
+	}
+	if errors.Is(ctx.Err(), context.Canceled) {
+		code = "node_drain_canceled"
+	} else if code == "node_drain_failed" && errors.Is(ctx.Err(), context.DeadlineExceeded) {
+		code = "node_drain_timeout"
+	}
+	return &resource.NodeDrainError{Code: code, Cause: err}
+}
+
+type drainPolicy struct {
+	policyclient.PolicyV1Interface
+	observer *DrainClient
+}
+
+func (c *DrainClient) PodSelectionFailure(ctx context.Context, failures []error) error {
+	for _, err := range failures {
+		if apierrors.IsForbidden(err) || apierrors.IsUnauthorized(err) || apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	err := errors.Join(failures...)
+	if ctx.Err() != nil {
+		return c.Failure(ctx, err)
+	}
+	return &resource.NodeDrainError{Code: "node_drain_pod_selection", Cause: err}
+}
+
+func (c drainPolicy) Evictions(namespace string) policyclient.EvictionInterface {
+	return drainEvictions{EvictionInterface: c.PolicyV1Interface.Evictions(namespace), observer: c.observer}
+}
+
+type drainEvictions struct {
+	policyclient.EvictionInterface
+	observer *DrainClient
+}
+
+func (c drainEvictions) Evict(ctx context.Context, eviction *policyv1.Eviction) error {
+	return c.observer.observe(eviction.Namespace, eviction.Name, c.EvictionInterface.Evict(ctx, eviction))
+}
+
+type drainBetaPolicy struct {
+	policybetaclient.PolicyV1beta1Interface
+	observer *DrainClient
+}
+
+func (c drainBetaPolicy) Evictions(namespace string) policybetaclient.EvictionInterface {
+	return drainBetaEvictions{EvictionInterface: c.PolicyV1beta1Interface.Evictions(namespace), observer: c.observer}
+}
+
+type drainBetaEvictions struct {
+	policybetaclient.EvictionInterface
+	observer *DrainClient
+}
+
+func (c drainBetaEvictions) Evict(ctx context.Context, eviction *policyv1beta1.Eviction) error {
+	return c.observer.observe(eviction.Namespace, eviction.Name, c.EvictionInterface.Evict(ctx, eviction))
+}

package/resource/runtime/node_drain_test.go

@@ -0,0 +1,95 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/opensoha/soha-contracts/resource"
+	policyv1 "k8s.io/api/policy/v1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/kubernetes/fake"
+	ktesting "k8s.io/client-go/testing"
+)
+
+func TestDrainFeedbackClassifiesTypedEvictionCausesAndClearsRecoveredBlockers(t *testing.T) {
+	pdb := &apierrors.StatusError{ErrStatus: metav1.Status{Code: 429, Reason: metav1.StatusReasonTooManyRequests, Message: "private provider message", Details: &metav1.StatusDetails{Causes: []metav1.StatusCause{{Type: policyv1.DisruptionBudgetCause}}}}}
+	for _, beta := range []bool{false, true} {
+		t.Run(map[bool]string{false: "v1", true: "v1beta1"}[beta], func(t *testing.T) {
+			client := fake.NewClientset()
+			var evictionError error = pdb
+			client.PrependReactor("create", "pods", func(ktesting.Action) (bool, runtime.Object, error) { return true, nil, evictionError })
+			observed := NewDrainClient(client)
+			evict := func() error {
+				meta := metav1.ObjectMeta{Name: "pod", Namespace: "team"}
+				if beta {
+					return observed.PolicyV1beta1().Evictions("team").Evict(context.Background(), &policyv1beta1.Eviction{ObjectMeta: meta})
+				}
+				return observed.PolicyV1().Evictions("team").Evict(context.Background(), &policyv1.Eviction{ObjectMeta: meta})
+			}
+			_ = evict()
+			assertDrainCode(t, observed.Failure(context.Background(), errors.New("private token")), "node_drain_pdb_blocked")
+			evictionError = apierrors.NewTooManyRequests("private throttle", 1)
+			_ = evict()
+			assertDrainCode(t, observed.Failure(context.Background(), errors.New("private")), "node_drain_eviction_blocked")
+			evictionError = nil
+			_ = evict()
+			ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
+			defer cancel()
+			assertDrainCode(t, observed.Failure(ctx, errors.New("private")), "node_drain_timeout")
+			evictionError = apierrors.NewForbidden(schema.GroupResource{Resource: "pods"}, "pod", errors.New("private"))
+			_ = evict()
+			if !apierrors.IsForbidden(observed.Failure(context.Background(), errors.New("private"))) {
+				t.Fatal("eviction RBAC denial must retain forbidden semantics")
+			}
+		})
+	}
+}
+
+func TestDrainFeedbackKeepsCancellationAndSuccessDistinct(t *testing.T) {
+	client := NewDrainClient(fake.NewClientset())
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	assertDrainCode(t, client.Failure(ctx, ctx.Err()), "node_drain_canceled")
+	if err := client.Failure(ctx, nil); err != nil {
+		t.Fatalf("success changed: %v", err)
+	}
+	if resource.IsNodeDrainErrorCode("provider_arbitrary_error") {
+		t.Fatal("untrusted error code accepted")
+	}
+}
+
+func TestDrainFeedbackDoesNotHidePermissionDenialBehindPDB(t *testing.T) {
+	client := NewDrainClient(fake.NewClientset())
+	client.failures.Store("invalid", struct{}{})
+	assertDrainCode(t, client.Failure(context.Background(), errors.New("private")), "node_drain_failed")
+	blocked := &apierrors.StatusError{ErrStatus: metav1.Status{Code: 429, Details: &metav1.StatusDetails{Causes: []metav1.StatusCause{{Type: policyv1.DisruptionBudgetCause}}}}}
+	_ = client.observe("team", "blocked", blocked)
+	canceled, cancel := context.WithCancel(context.Background())
+	cancel()
+	assertDrainCode(t, client.Failure(canceled, canceled.Err()), "node_drain_canceled")
+	_ = client.observe("team", "denied", apierrors.NewForbidden(schema.GroupResource{Resource: "pods/eviction"}, "denied", errors.New("private")))
+	if err := client.Failure(canceled, canceled.Err()); !apierrors.IsForbidden(err) {
+		t.Fatalf("permission denial hidden: %v", err)
+	}
+	if err := client.PodSelectionFailure(context.Background(), []error{apierrors.NewForbidden(schema.GroupResource{Resource: "pods"}, "", errors.New("private"))}); !apierrors.IsForbidden(err) {
+		t.Fatalf("pod list permission hidden: %v", err)
+	}
+}
+
+func assertDrainCode(t *testing.T, err error, want string) {
+	t.Helper()
+	var failure *resource.NodeDrainError
+	if !errors.As(err, &failure) || failure.Code != want {
+		t.Fatalf("got %v; want %s", err, want)
+	}
+	if strings.Contains(err.Error(), "private") {
+		t.Fatal("provider text leaked")
+	}
+}

package/resource/runtime/resource_edit.go

@@ -0,0 +1,128 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/util/csaupgrade"
+	"k8s.io/utils/ptr"
+)
+
+// ApplyResourceEdit preserves SSA conflicts while migrating this editor's own Create/Update fields.
+// Dry-run migration validates a complete manifest with Update; it never changes live ownership.
+func ApplyResourceEdit(ctx context.Context, resource dynamic.ResourceInterface, current, desired *unstructured.Unstructured, manager string, dryRun bool) (*unstructured.Unstructured, error) {
+	patch, err := json.Marshal(desired.Object)
+	if err != nil {
+		return nil, err
+	}
+	options := metav1.PatchOptions{FieldManager: manager, Force: ptr.To(false)}
+	if dryRun {
+		options.DryRun = []string{metav1.DryRunAll}
+	}
+	migration, err := resourceEditMigrationPatch(current, manager)
+	if err != nil {
+		return nil, err
+	}
+	if len(migration) == 0 {
+		return resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+	}
+	if dryRun {
+		// Probe foreign ownership first; an initial list merge can also fail validation
+		// until this creator's Update ownership is migrated.
+		probed, probeErr := resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+		if probeErr == nil {
+			return probed, nil
+		}
+		if !resourceEditPortMergeInvalid(current, probeErr) && !onlyResourceEditConflicts(current, probeErr, manager) {
+			return nil, probeErr
+		}
+		return resource.Update(ctx, desired, metav1.UpdateOptions{FieldManager: manager, DryRun: []string{metav1.DryRunAll}})
+	}
+	migrated, err := resource.Patch(ctx, desired.GetName(), types.JSONPatchType, migration, metav1.PatchOptions{})
+	if err != nil {
+		return nil, err
+	}
+	desired = desired.DeepCopy()
+	desired.SetResourceVersion(migrated.GetResourceVersion())
+	patch, err = json.Marshal(desired.Object)
+	if err != nil {
+		return nil, err
+	}
+	return resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+}
+
+func onlyResourceEditConflicts(current *unstructured.Unstructured, conflict error, manager string) bool {
+	var status apierrors.APIStatus
+	if !apierrors.IsConflict(conflict) || !errors.As(conflict, &status) {
+		return false
+	}
+	details := status.Status().Details
+	if details == nil || len(details.Causes) == 0 {
+		return false
+	}
+	prefix := fmt.Sprintf("conflict with %q using %s", manager, current.GetAPIVersion())
+	for _, cause := range details.Causes {
+		if cause.Type != metav1.CauseTypeFieldManagerConflict || cause.Field == "" || (cause.Message != prefix && !strings.HasPrefix(cause.Message, prefix+" at ")) {
+			return false
+		}
+	}
+	return true
+}
+
+func resourceEditMigrationPatch(current *unstructured.Unstructured, manager string) ([]byte, error) {
+	if manager == "" || current.GetUID() == "" || current.GetResourceVersion() == "" {
+		return nil, nil
+	}
+	updates := 0
+	for _, entry := range current.GetManagedFields() {
+		if entry.Manager != manager || entry.Subresource != "" {
+			continue
+		}
+		// client-go's upgrader discards other Update versions; fail closed instead.
+		if entry.APIVersion != current.GetAPIVersion() {
+			return nil, nil
+		}
+		if entry.Operation == metav1.ManagedFieldsOperationUpdate {
+			updates++
+		}
+	}
+	if updates != 1 {
+		return nil, nil
+	}
+	patch, err := csaupgrade.UpgradeManagedFieldsPatch(current, sets.New(manager), manager)
+	if err != nil || len(patch) == 0 {
+		return patch, err
+	}
+	var operations []map[string]any
+	if err := json.Unmarshal(patch, &operations); err != nil {
+		return nil, err
+	}
+	operations = append([]map[string]any{{"op": "test", "path": "/metadata/uid", "value": string(current.GetUID())}}, operations...)
+	return json.Marshal(operations)
+}
+
+func resourceEditPortMergeInvalid(current *unstructured.Unstructured, err error) bool {
+	var status apierrors.APIStatus
+	if current.GetKind() != "Service" || !apierrors.IsInvalid(err) || !errors.As(err, &status) {
+		return false
+	}
+	details := status.Status().Details
+	if details == nil || len(details.Causes) == 0 {
+		return false
+	}
+	for _, cause := range details.Causes {
+		if cause.Type != metav1.CauseTypeFieldValueRequired || !strings.HasPrefix(cause.Field, "spec.ports[") || !strings.HasSuffix(cause.Field, "].name") {
+			return false
+		}
+	}
+	return true
+}