Kapp deploy command changing K8S ServiceAccount label value

[jhflemos]

What steps did you take:

1. Ran kapp deploy -a <APP_NAME> --diff-run --diff-changes=true -f ./app.yaml --into-ns <APP_NAMESPACE> --namespace <KAPP_CONTROLER> --default-label-scoping-rules=false.

What happened:
The value of ServiceAccount label was changed/converted when I ran kapp deploy command.

Original manifest in K8S:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-name
  labels:
    github.com/sha-short: "1b85fe5e"
...

New manifest to be deployed in K8S:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-name
  labels:
    github.com/sha-short: "934881e3"
...

The new value of github.com/sha-short label is being changed/converted to "934881000" instead "934881e3".

What did you expect:
The github.com/sha-short label continues using the label as defined in the manifest.

Anything else you would like to add:
If you change the final of the value for "e1", "e2", "e4", kapp command will change/convert to "0", "00", "0000" respectively.

Environment:

• kapp version (use kapp --version): 0.62.1
• OS (e.g. from /etc/os-release): MacOs 14.5 (23F79) and Ubuntu 22.04.4
• Kubernetes version (use kubectl version): v1.30.2

---

Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

[praveenrewar]

@jhflemos kapp treats the config provided to it as the source of truth. If you want to use some value from the existing resource on cluster you can use rebase rules to copy that value from the existing source.

[jhflemos]

@praveenrewar I don't want to use the existing resource on cluster. I'm updating the manifest, in this case, a Service Account one, and the Kapp command is converting the value to a different one. Let me try to explain better:

My current manifest is:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-name
  labels:
    **github.com/sha-short: "1b85fe5e"**

Note that I have a label called "github.com/sha-short" that represents the git commit sha-short information. I have the value "1b85fe5e" in the above example, right?
When I change my source code and commit it to Git remote repository, the new git commit sha-short will be generated. Let's imagine "934881e3". So the new manifest, and right one, that will be applied to the cluster is:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-name
  labels:
    **github.com/sha-short: "934881e3"**

The point is:
The kapp command is converting that value to "934881000". The wrong manifest is:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-name
  labels:
    **github.com/sha-short: "934881000"**

[praveenrewar]

@jhflemos Apologies, I misread the issue. I think the string is being treated as a number and during marshaling-unmarshaling the e2 is getting replaced by 00. I will take a closer look at it in sometime but my guess is that it might be a bug in one of the json/yaml libraries that we are using.

As a workaround for now: Would it be possible for you to use the complete sha of the commit? As that would have at least one character and then it should be treated as a string.

[renuy]

related to #967