@opensoha/contracts 0.1.24 → 0.1.26

package/resource/runtime/node_drain.go

@@ -0,0 +1,124 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"sync"
+
+	"github.com/opensoha/soha-contracts/resource"
+	policyv1 "k8s.io/api/policy/v1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/kubernetes"
+	policyclient "k8s.io/client-go/kubernetes/typed/policy/v1"
+	policybetaclient "k8s.io/client-go/kubernetes/typed/policy/v1beta1"
+)
+
+// DrainClient observes eviction failures while leaving kubectl drain semantics intact.
+type DrainClient struct {
+	kubernetes.Interface
+	failures sync.Map
+}
+
+func NewDrainClient(client kubernetes.Interface) *DrainClient {
+	return &DrainClient{Interface: client}
+}
+
+func (c *DrainClient) PolicyV1() policyclient.PolicyV1Interface {
+	return drainPolicy{PolicyV1Interface: c.Interface.PolicyV1(), observer: c}
+}
+
+func (c *DrainClient) PolicyV1beta1() policybetaclient.PolicyV1beta1Interface {
+	return drainBetaPolicy{PolicyV1beta1Interface: c.Interface.PolicyV1beta1(), observer: c}
+}
+
+func (c *DrainClient) observe(namespace, name string, err error) error {
+	key := namespace + "/" + name
+	if err == nil || apierrors.IsNotFound(err) {
+		c.failures.Delete(key)
+	} else {
+		c.failures.Store(key, err)
+	}
+	return err
+}
+
+func (c *DrainClient) Failure(ctx context.Context, err error) error {
+	if err == nil {
+		return nil
+	}
+	code := "node_drain_failed"
+	var denied error
+	c.failures.Range(func(_, value any) bool {
+		failure, ok := value.(error)
+		if !ok {
+			return true
+		}
+		switch {
+		case apierrors.IsForbidden(failure) || apierrors.IsUnauthorized(failure):
+			denied = failure
+		case apierrors.HasStatusCause(failure, policyv1.DisruptionBudgetCause):
+			code = "node_drain_pdb_blocked"
+		case apierrors.IsTooManyRequests(failure) && code != "node_drain_pdb_blocked":
+			code = "node_drain_eviction_blocked"
+		}
+		return true
+	})
+	if denied != nil {
+		return denied
+	}
+	if errors.Is(ctx.Err(), context.Canceled) {
+		code = "node_drain_canceled"
+	} else if code == "node_drain_failed" && errors.Is(ctx.Err(), context.DeadlineExceeded) {
+		code = "node_drain_timeout"
+	}
+	return &resource.NodeDrainError{Code: code, Cause: err}
+}
+
+type drainPolicy struct {
+	policyclient.PolicyV1Interface
+	observer *DrainClient
+}
+
+func (c *DrainClient) PodSelectionFailure(ctx context.Context, failures []error) error {
+	for _, err := range failures {
+		if apierrors.IsForbidden(err) || apierrors.IsUnauthorized(err) || apierrors.IsNotFound(err) {
+			return err
+		}
+	}
+	err := errors.Join(failures...)
+	if ctx.Err() != nil {
+		return c.Failure(ctx, err)
+	}
+	return &resource.NodeDrainError{Code: "node_drain_pod_selection", Cause: err}
+}
+
+func (c drainPolicy) Evictions(namespace string) policyclient.EvictionInterface {
+	return drainEvictions{EvictionInterface: c.PolicyV1Interface.Evictions(namespace), observer: c.observer}
+}
+
+type drainEvictions struct {
+	policyclient.EvictionInterface
+	observer *DrainClient
+}
+
+func (c drainEvictions) Evict(ctx context.Context, eviction *policyv1.Eviction) error {
+	return c.observer.observe(eviction.Namespace, eviction.Name, c.EvictionInterface.Evict(ctx, eviction))
+}
+
+type drainBetaPolicy struct {
+	policybetaclient.PolicyV1beta1Interface
+	observer *DrainClient
+}
+
+func (c drainBetaPolicy) Evictions(namespace string) policybetaclient.EvictionInterface {
+	return drainBetaEvictions{EvictionInterface: c.PolicyV1beta1Interface.Evictions(namespace), observer: c.observer}
+}
+
+type drainBetaEvictions struct {
+	policybetaclient.EvictionInterface
+	observer *DrainClient
+}
+
+func (c drainBetaEvictions) Evict(ctx context.Context, eviction *policyv1beta1.Eviction) error {
+	return c.observer.observe(eviction.Namespace, eviction.Name, c.EvictionInterface.Evict(ctx, eviction))
+}

package/resource/runtime/node_drain_test.go

@@ -0,0 +1,95 @@
+package runtime
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/opensoha/soha-contracts/resource"
+	policyv1 "k8s.io/api/policy/v1"
+	policyv1beta1 "k8s.io/api/policy/v1beta1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/kubernetes/fake"
+	ktesting "k8s.io/client-go/testing"
+)
+
+func TestDrainFeedbackClassifiesTypedEvictionCausesAndClearsRecoveredBlockers(t *testing.T) {
+	pdb := &apierrors.StatusError{ErrStatus: metav1.Status{Code: 429, Reason: metav1.StatusReasonTooManyRequests, Message: "private provider message", Details: &metav1.StatusDetails{Causes: []metav1.StatusCause{{Type: policyv1.DisruptionBudgetCause}}}}}
+	for _, beta := range []bool{false, true} {
+		t.Run(map[bool]string{false: "v1", true: "v1beta1"}[beta], func(t *testing.T) {
+			client := fake.NewClientset()
+			var evictionError error = pdb
+			client.PrependReactor("create", "pods", func(ktesting.Action) (bool, runtime.Object, error) { return true, nil, evictionError })
+			observed := NewDrainClient(client)
+			evict := func() error {
+				meta := metav1.ObjectMeta{Name: "pod", Namespace: "team"}
+				if beta {
+					return observed.PolicyV1beta1().Evictions("team").Evict(context.Background(), &policyv1beta1.Eviction{ObjectMeta: meta})
+				}
+				return observed.PolicyV1().Evictions("team").Evict(context.Background(), &policyv1.Eviction{ObjectMeta: meta})
+			}
+			_ = evict()
+			assertDrainCode(t, observed.Failure(context.Background(), errors.New("private token")), "node_drain_pdb_blocked")
+			evictionError = apierrors.NewTooManyRequests("private throttle", 1)
+			_ = evict()
+			assertDrainCode(t, observed.Failure(context.Background(), errors.New("private")), "node_drain_eviction_blocked")
+			evictionError = nil
+			_ = evict()
+			ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
+			defer cancel()
+			assertDrainCode(t, observed.Failure(ctx, errors.New("private")), "node_drain_timeout")
+			evictionError = apierrors.NewForbidden(schema.GroupResource{Resource: "pods"}, "pod", errors.New("private"))
+			_ = evict()
+			if !apierrors.IsForbidden(observed.Failure(context.Background(), errors.New("private"))) {
+				t.Fatal("eviction RBAC denial must retain forbidden semantics")
+			}
+		})
+	}
+}
+
+func TestDrainFeedbackKeepsCancellationAndSuccessDistinct(t *testing.T) {
+	client := NewDrainClient(fake.NewClientset())
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	assertDrainCode(t, client.Failure(ctx, ctx.Err()), "node_drain_canceled")
+	if err := client.Failure(ctx, nil); err != nil {
+		t.Fatalf("success changed: %v", err)
+	}
+	if resource.IsNodeDrainErrorCode("provider_arbitrary_error") {
+		t.Fatal("untrusted error code accepted")
+	}
+}
+
+func TestDrainFeedbackDoesNotHidePermissionDenialBehindPDB(t *testing.T) {
+	client := NewDrainClient(fake.NewClientset())
+	client.failures.Store("invalid", struct{}{})
+	assertDrainCode(t, client.Failure(context.Background(), errors.New("private")), "node_drain_failed")
+	blocked := &apierrors.StatusError{ErrStatus: metav1.Status{Code: 429, Details: &metav1.StatusDetails{Causes: []metav1.StatusCause{{Type: policyv1.DisruptionBudgetCause}}}}}
+	_ = client.observe("team", "blocked", blocked)
+	canceled, cancel := context.WithCancel(context.Background())
+	cancel()
+	assertDrainCode(t, client.Failure(canceled, canceled.Err()), "node_drain_canceled")
+	_ = client.observe("team", "denied", apierrors.NewForbidden(schema.GroupResource{Resource: "pods/eviction"}, "denied", errors.New("private")))
+	if err := client.Failure(canceled, canceled.Err()); !apierrors.IsForbidden(err) {
+		t.Fatalf("permission denial hidden: %v", err)
+	}
+	if err := client.PodSelectionFailure(context.Background(), []error{apierrors.NewForbidden(schema.GroupResource{Resource: "pods"}, "", errors.New("private"))}); !apierrors.IsForbidden(err) {
+		t.Fatalf("pod list permission hidden: %v", err)
+	}
+}
+
+func assertDrainCode(t *testing.T, err error, want string) {
+	t.Helper()
+	var failure *resource.NodeDrainError
+	if !errors.As(err, &failure) || failure.Code != want {
+		t.Fatalf("got %v; want %s", err, want)
+	}
+	if strings.Contains(err.Error(), "private") {
+		t.Fatal("provider text leaked")
+	}
+}

package/resource/runtime/relations.go

@@ -0,0 +1,161 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+	"time"
+
+	resource "github.com/opensoha/soha-contracts/resource"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/rest"
+)
+
+// ReadRelationSnapshot reads metadata only. Its caller must authorize every
+// collection and namespace; Kubernetes RBAC still applies to the actual reads.
+func ReadRelationSnapshot(ctx context.Context, client rest.Interface, clusterID string, input resource.RelationSnapshotRequest) (resource.RelationSnapshot, error) {
+	if err := resource.ValidateRelationSnapshotRequest(input); err != nil {
+		return resource.RelationSnapshot{}, err
+	}
+	if client == nil {
+		return resource.RelationSnapshot{}, fmt.Errorf("resource metadata client unavailable")
+	}
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+	out := resource.RelationSnapshot{Version: resource.RelationSnapshotFeature, Sources: []resource.RelationSourceResult{}}
+	budget := &topologyReadBudget{remaining: 8 << 20}
+	for _, query := range input.Queries {
+		out.Sources = append(out.Sources, readRelationSource(ctx, client, clusterID, query, budget))
+	}
+	return out, nil
+}
+
+func readRelationSource(ctx context.Context, client rest.Interface, clusterID string, q resource.RelationQuery, budget *topologyReadBudget) resource.RelationSourceResult {
+	out := resource.RelationSourceResult{Coverage: resource.RelationCoverage{QueryID: q.ID, State: "available"}, Objects: []resource.RelationObject{}}
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	group, version := relationGroupVersion(q.Source.APIVersion)
+	base := topologyAPIBase(group, version)
+	data, err := boundedTopologyGET(ctx, client, base, false, budget)
+	if err == nil {
+		err = validateRelationDiscovery(data, q.Source)
+	}
+	if err != nil {
+		out.Coverage.State, out.Coverage.ReasonCode = relationReadError(err)
+		return out
+	}
+	path := base + "/namespaces/" + q.Source.Namespace + "/" + q.Source.Resource
+	if q.Name != "" {
+		path += "/" + q.Name
+	}
+	request := client.Get().AbsPath(path)
+	if q.Name == "" {
+		request = request.Param("limit", "200").SetHeader("Accept", "application/json;as=PartialObjectMetadataList;g=meta.k8s.io;v=v1")
+	} else {
+		request = request.SetHeader("Accept", "application/json;as=PartialObjectMetadata;g=meta.k8s.io;v=v1")
+	}
+	if len(q.Selector) > 0 {
+		terms := []string{}
+		for k, v := range q.Selector {
+			terms = append(terms, k+"="+v)
+		}
+		sort.Strings(terms)
+		request = request.Param("labelSelector", strings.Join(terms, ","))
+	}
+	stream, err := request.Stream(ctx)
+	if err != nil {
+		out.Coverage.State, out.Coverage.ReasonCode = relationReadError(err)
+		return out
+	}
+	defer func() { _ = stream.Close() }()
+	data, err = io.ReadAll(io.LimitReader(&topologyBudgetReader{reader: stream, budget: budget}, (512<<10)+1))
+	if err != nil || len(data) > 512<<10 {
+		out.Coverage.State = "partial"
+		out.Coverage.ReasonCode = "byte_budget"
+		out.Coverage.Truncated = true
+		return out
+	}
+	return relationMetadataResult(out, clusterID, q, data)
+}
+
+func relationMetadataResult(out resource.RelationSourceResult, clusterID string, q resource.RelationQuery, data []byte) resource.RelationSourceResult {
+	var objects []metav1.PartialObjectMetadata
+	if q.Name != "" {
+		var object metav1.PartialObjectMetadata
+		if json.Unmarshal(data, &object) != nil {
+			out.Coverage.State = "error"
+			out.Coverage.ReasonCode = "invalid_response"
+			return out
+		}
+		objects = append(objects, object)
+	} else {
+		var list metav1.PartialObjectMetadataList
+		if json.Unmarshal(data, &list) != nil {
+			out.Coverage.State = "error"
+			out.Coverage.ReasonCode = "invalid_response"
+			return out
+		}
+		objects = list.Items
+		if list.Continue != "" || len(objects) > resource.RelationMaxItems {
+			out.Coverage.State = "partial"
+			out.Coverage.ReasonCode = "item_budget"
+			out.Coverage.Truncated = true
+		}
+	}
+	for i, object := range objects {
+		if i >= resource.RelationMaxItems {
+			break
+		}
+		if object.Name == "" || object.UID == "" || object.Namespace != q.Source.Namespace || (q.Name != "" && q.Name != object.Name) || len(object.OwnerReferences) > 32 {
+			out.Coverage.State = "partial"
+			out.Coverage.ReasonCode = "invalid_identity"
+			continue
+		}
+		item := resource.RelationObject{Resource: resource.ResourceRef{ClusterID: clusterID, APIVersion: q.Source.APIVersion, Kind: q.Source.Kind, Namespace: object.Namespace, Name: object.Name, UID: string(object.UID), ResourceVersion: object.ResourceVersion, ScopeMode: resource.ResourceScopeModeNamespace}}
+		for _, owner := range object.OwnerReferences {
+			item.Owners = append(item.Owners, resource.RelationOwner{APIVersion: owner.APIVersion, Kind: owner.Kind, Name: owner.Name, UID: string(owner.UID), Controller: owner.Controller != nil && *owner.Controller})
+		}
+		out.Objects = append(out.Objects, item)
+	}
+	return out
+}
+
+func relationGroupVersion(apiVersion string) (string, string) {
+	parts := strings.SplitN(apiVersion, "/", 2)
+	if len(parts) == 1 {
+		return "", parts[0]
+	}
+	return parts[0], parts[1]
+}
+
+func validateRelationDiscovery(data []byte, source resource.RelationSource) error {
+	var list metav1.APIResourceList
+	if json.Unmarshal(data, &list) != nil {
+		return fmt.Errorf("invalid discovery response")
+	}
+	for _, item := range list.APIResources {
+		if item.Name == source.Resource && item.Kind == source.Kind && item.Namespaced {
+			return nil
+		}
+	}
+	return errRelationSourceNotServed
+}
+
+var errRelationSourceNotServed = errors.New("resource definition not served")
+
+func relationReadError(err error) (string, string) {
+	if errors.Is(err, context.DeadlineExceeded) {
+		return "error", "timeout"
+	}
+	if errors.Is(err, context.Canceled) {
+		return "error", "cancelled"
+	}
+	if errors.Is(err, errRelationSourceNotServed) {
+		return "not_installed", "source_not_served"
+	}
+	return topologyReadError(err)
+}

package/resource/runtime/relations_test.go

@@ -0,0 +1,100 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+)
+
+func TestRelationMetadataProjectionAndPartialCoverage(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/apis/widgets.test/v1" {
+			_, _ = w.Write([]byte(`{"resources":[{"name":"widgets","kind":"Widget","namespaced":true}]}`))
+			return
+		}
+		if strings.Contains(r.Header.Get("Accept"), "q=0.9") {
+			t.Error("full JSON fallback must not be negotiated")
+		}
+		if r.URL.Query().Get("limit") != "200" || r.URL.Query().Get("labelSelector") != "app=demo" {
+			t.Errorf("unbounded or different query: %s", r.URL.String())
+		}
+		_, _ = w.Write([]byte(`{"metadata":{"continue":"next"},"items":[{"metadata":{"name":"child","namespace":"team","uid":"child-uid","annotations":{"password":"synthetic-private"},"labels":{"token":"synthetic-private"},"ownerReferences":[{"apiVersion":"widgets.test/v1","kind":"Widget","name":"root","uid":"root-uid"}]},"spec":{"password":"synthetic-private"},"status":{"secret":"synthetic-private"}}]}`))
+	}))
+	defer server.Close()
+	client, err := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	q := cr.RelationQuery{ID: "unknown", Source: cr.RelationSource{APIVersion: "widgets.test/v1", Resource: "widgets", Kind: "Widget", Namespace: "team"}, Selector: map[string]string{"app": "demo"}}
+	view, err := ReadRelationSnapshot(context.Background(), client.CoreV1().RESTClient(), "cluster", cr.RelationSnapshotRequest{Queries: []cr.RelationQuery{q}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(view.Sources) != 1 || view.Sources[0].Coverage.State != "partial" || !view.Sources[0].Coverage.Truncated || len(view.Sources[0].Objects) != 1 {
+		t.Fatalf("incorrect result: %+v", view)
+	}
+	data, _ := json.Marshal(view)
+	if strings.Contains(string(data), "synthetic-private") {
+		t.Fatal("configuration value leaked")
+	}
+	object := view.Sources[0].Objects[0]
+	if object.Resource.UID != "child-uid" || object.Owners[0].UID != "root-uid" {
+		t.Fatal("UID evidence lost")
+	}
+	q.Source.Kind = "DifferentKind"
+	view, err = ReadRelationSnapshot(context.Background(), client.CoreV1().RESTClient(), "cluster", cr.RelationSnapshotRequest{Queries: []cr.RelationQuery{q}})
+	if err != nil || len(view.Sources[0].Objects) != 0 || view.Sources[0].Coverage.State == "available" {
+		t.Fatal("unverified GVR/kind accepted")
+	}
+}
+
+func TestRelationMetadataNegotiationFailsClosed(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/api/v1" {
+			_, _ = w.Write([]byte(`{"resources":[{"name":"secrets","kind":"Secret","namespaced":true}]}`))
+			return
+		}
+		if strings.Contains(r.Header.Get("Accept"), ",application/json") {
+			t.Error("full Secret requested")
+		}
+		w.WriteHeader(http.StatusNotAcceptable)
+	}))
+	defer server.Close()
+	client, err := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	query := cr.RelationQuery{ID: "secrets", Source: cr.RelationSource{APIVersion: "v1", Resource: "secrets", Kind: "Secret", Namespace: "team"}}
+	snapshot, err := ReadRelationSnapshot(context.Background(), client.CoreV1().RESTClient(), "cluster", cr.RelationSnapshotRequest{Queries: []cr.RelationQuery{query}})
+	if err != nil || len(snapshot.Sources[0].Objects) != 0 || snapshot.Sources[0].Coverage.State == "available" {
+		t.Fatalf("metadata refusal not closed: %+v %v", snapshot, err)
+	}
+}
+
+func TestRelationReadErrorsRetainCoverageReasons(t *testing.T) {
+	for _, tc := range []struct {
+		err           error
+		state, reason string
+	}{
+		{fmt.Errorf("request: %w", context.DeadlineExceeded), "error", "timeout"},
+		{context.Canceled, "error", "cancelled"},
+		{errRelationSourceNotServed, "not_installed", "source_not_served"},
+		{errors.New("opaque server response"), "error", "source_unavailable"},
+	} {
+		state, reason := relationReadError(tc.err)
+		if state != tc.state || reason != tc.reason {
+			t.Fatalf("%v became %s/%s", tc.err, state, reason)
+		}
+	}
+}

package/resource/runtime/resource_edit.go

@@ -0,0 +1,128 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/util/csaupgrade"
+	"k8s.io/utils/ptr"
+)
+
+// ApplyResourceEdit preserves SSA conflicts while migrating this editor's own Create/Update fields.
+// Dry-run migration validates a complete manifest with Update; it never changes live ownership.
+func ApplyResourceEdit(ctx context.Context, resource dynamic.ResourceInterface, current, desired *unstructured.Unstructured, manager string, dryRun bool) (*unstructured.Unstructured, error) {
+	patch, err := json.Marshal(desired.Object)
+	if err != nil {
+		return nil, err
+	}
+	options := metav1.PatchOptions{FieldManager: manager, Force: ptr.To(false)}
+	if dryRun {
+		options.DryRun = []string{metav1.DryRunAll}
+	}
+	migration, err := resourceEditMigrationPatch(current, manager)
+	if err != nil {
+		return nil, err
+	}
+	if len(migration) == 0 {
+		return resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+	}
+	if dryRun {
+		// Probe foreign ownership first; an initial list merge can also fail validation
+		// until this creator's Update ownership is migrated.
+		probed, probeErr := resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+		if probeErr == nil {
+			return probed, nil
+		}
+		if !resourceEditPortMergeInvalid(current, probeErr) && !onlyResourceEditConflicts(current, probeErr, manager) {
+			return nil, probeErr
+		}
+		return resource.Update(ctx, desired, metav1.UpdateOptions{FieldManager: manager, DryRun: []string{metav1.DryRunAll}})
+	}
+	migrated, err := resource.Patch(ctx, desired.GetName(), types.JSONPatchType, migration, metav1.PatchOptions{})
+	if err != nil {
+		return nil, err
+	}
+	desired = desired.DeepCopy()
+	desired.SetResourceVersion(migrated.GetResourceVersion())
+	patch, err = json.Marshal(desired.Object)
+	if err != nil {
+		return nil, err
+	}
+	return resource.Patch(ctx, desired.GetName(), types.ApplyPatchType, patch, options)
+}
+
+func onlyResourceEditConflicts(current *unstructured.Unstructured, conflict error, manager string) bool {
+	var status apierrors.APIStatus
+	if !apierrors.IsConflict(conflict) || !errors.As(conflict, &status) {
+		return false
+	}
+	details := status.Status().Details
+	if details == nil || len(details.Causes) == 0 {
+		return false
+	}
+	prefix := fmt.Sprintf("conflict with %q using %s", manager, current.GetAPIVersion())
+	for _, cause := range details.Causes {
+		if cause.Type != metav1.CauseTypeFieldManagerConflict || cause.Field == "" || (cause.Message != prefix && !strings.HasPrefix(cause.Message, prefix+" at ")) {
+			return false
+		}
+	}
+	return true
+}
+
+func resourceEditMigrationPatch(current *unstructured.Unstructured, manager string) ([]byte, error) {
+	if manager == "" || current.GetUID() == "" || current.GetResourceVersion() == "" {
+		return nil, nil
+	}
+	updates := 0
+	for _, entry := range current.GetManagedFields() {
+		if entry.Manager != manager || entry.Subresource != "" {
+			continue
+		}
+		// client-go's upgrader discards other Update versions; fail closed instead.
+		if entry.APIVersion != current.GetAPIVersion() {
+			return nil, nil
+		}
+		if entry.Operation == metav1.ManagedFieldsOperationUpdate {
+			updates++
+		}
+	}
+	if updates != 1 {
+		return nil, nil
+	}
+	patch, err := csaupgrade.UpgradeManagedFieldsPatch(current, sets.New(manager), manager)
+	if err != nil || len(patch) == 0 {
+		return patch, err
+	}
+	var operations []map[string]any
+	if err := json.Unmarshal(patch, &operations); err != nil {
+		return nil, err
+	}
+	operations = append([]map[string]any{{"op": "test", "path": "/metadata/uid", "value": string(current.GetUID())}}, operations...)
+	return json.Marshal(operations)
+}
+
+func resourceEditPortMergeInvalid(current *unstructured.Unstructured, err error) bool {
+	var status apierrors.APIStatus
+	if current.GetKind() != "Service" || !apierrors.IsInvalid(err) || !errors.As(err, &status) {
+		return false
+	}
+	details := status.Status().Details
+	if details == nil || len(details.Causes) == 0 {
+		return false
+	}
+	for _, cause := range details.Causes {
+		if cause.Type != metav1.CauseTypeFieldValueRequired || !strings.HasPrefix(cause.Field, "spec.ports[") || !strings.HasSuffix(cause.Field, "].name") {
+			return false
+		}
+	}
+	return true
+}