Unexpected result when combining AnnotationsTransformer with ValueAddTransformer

[dippynark]

What happened?

I am trying to use a kustomize transformer to set a default severity for PrometheusRules and then override this default severity using additional transformers for specific alerts. However, when combining these transformers I get an unexpected result compared to when they are applied individually

What did you expect to happen?

I'd expect each transformer to apply independently so that they can be combined

How can we reproduce it (as minimally and precisely as possible)?

# kustomization.yaml
resources:
  - prometheus-rule.yaml

transformers:
  - transformer-severity-default.yaml
  - transformer-severity-example-bar.yaml

# prometheus-rule.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: example
spec:
  groups:
    - name: Example
      rules:
        - alert: ExampleFoo
        - alert: ExampleBar

# transformer-severity-default.yaml
apiVersion: builtin
kind: AnnotationsTransformer
metadata:
  name: severity-default
annotations:
  severity: MAJOR
fieldSpecs:
  - kind: PrometheusRule
    path: spec/groups/rules/annotations
    create: true

# transformer-severity-example-bar.yaml
apiVersion: builtin
kind: ValueAddTransformer
metadata:
  name: severity-example-bar
value: WARNING
targets:
  - selector:
      apiVersion: monitoring.coreos.com/v1
      kind: PrometheusRule
      name: example
    fieldPath: spec/groups/[name=Example]/rules/[alert=ExampleBar]/annotations/severity

Expected output

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: example
spec:
  groups:
  - name: Example
    rules:
    - alert: ExampleFoo
      annotations:
        severity: MAJOR
    - alert: ExampleBar
      annotations:
        severity: WARNING

Actual output

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: example
spec:
  groups:
  - name: Example
    rules:
    - alert: ExampleFoo
      annotations:
        severity: WARNING
    - alert: ExampleBar
      annotations:
        severity: WARNING

Confusingly, each transformer works as expected when applied individually (e.g. commenting them out in turn they work correctly)

Kustomize version

v5.5.0

Operating system

MacOS

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[sda399]

Hi,
AnnotationsTransformer keeps in sync the values of the annotations when modified by ValueAdd.

maybe change the strategy to set the default value:

#! /bin/sh

base=base
[ ! -d $base ] || rm -r $base
mkdir -p $base/base

cat <<EOF > $base/kustomization.yaml
# kustomization.yaml
resources:
  - prometheus-rule.yaml

patches:
  - target:
      kind: PrometheusRule
    patch: |-
      - op: add
        path: /spec/groups/0/rules/0/annotations
        value: {severity: MAJOR}

replacements:
  - source:
      kind: PrometheusRule
      fieldPath: spec.groups.0.rules.0.annotations.severity
    targets:
      - select:
          kind: PrometheusRule
        fieldPaths: [spec.groups.*.rules.*.annotations.severity]
        options:
          create: true

transformers:
  - transformer-severity-example-bar.yaml
EOF

cat <<EOF > $base/prometheus-rule.yaml
# prometheus-rule.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: example
spec:
  groups:
    - name: Example
      rules:
        - alert: foo
        - alert: bar
        - alert: baz

EOF

cat <<EOF > $base/transformer-severity-example-bar.yaml
# transformer-severity-example-bar.yaml
apiVersion: builtin
kind: ValueAddTransformer
metadata:
  name: severity-example-bar
value: WARNING
targets:
  - selector:
      apiVersion: monitoring.coreos.com/v1
      kind: PrometheusRule
      name: example
    fieldPath: spec/groups/[name=Example]/rules/[alert=bar]/annotations/severity
EOF

cat <<EOF > expected.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: example
spec:
  groups:
  - name: Example
    rules:
    - alert: foo
      annotations:
        severity: MAJOR
    - alert: bar
      annotations:
        severity: WARNING
    - alert: baz
      annotations:
        severity: MAJOR
EOF

#---
kustomize build --stack-trace $base > result.yaml
printf "%-64s%s\n" expected.yaml result.yaml
printf "%130s\n" " " | tr ' ' '-'
diff -W130 -y expected.yaml result.yaml

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.