Operator-sdk: Secret Watches fail to detect changes

[mew2057]

Bug Report

What did you do?
Added a watch on Secrets in the watches.yaml file:

---
- version: v1alpha1
  group: scale.ibm.com
  kind: CSIScaleOperator
  role: /opt/ansible/roles/csi-scale

- version: v1
  kind: Secret
  role: /opt/ansible/roles/csi-scale-secret
  manageStatus: false # Note this was required, otherwise the container crashed.

What did you expect to see?
I expected that changes to Secrets would be captured and call the /opt/ansible/roles/csi-scale-secret role.

What did you see instead? Under which circumstances?
Secrets would trigger the /opt/ansible/roles/csi-scale-secret role once at startup and never again. Changes to secrets would not yield additional responses.

Environment

• operator-sdk version: v0.10.0

• go version: go version go1.13.1 linux/amd64

• Kubernetes version information:

Client Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:18:23Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.2", GitCommit:"c97fe5036ef3df2967d086711e6c0c405941e14b", GitTreeState:"clean", BuildDate:"2019-10-15T19:09:08Z", GoVersion:"go1.12.10", Compiler:"gc", Platform:"linux/amd64"}

• Kubernetes cluster kind: remote

• Are you writing your operator in ansible, helm, or go? ansible

Possible Solution

Additional context
I've moved temporarily to a go based solution which invokes my ansible role, so my environment is currently not the same (would prefer to return to pure ansible).

[mew2057]

#1944

[mew2057]

I just reverted from my go environment to verify that the change is not detected, however, new secrets will be detected.

Creating a new secret does trigger the reconciliation.

[aabouzaid]

The same issue happens with ConfigMap and Pod (and I think it will be like that with all core resources)

[etsauer]

bump. Any ideas on why this might be happening?

Also, I created a ConfigMap reproducer here: https://github.com/etsauer/ansible-configmap-operator

[estroz]

Person to contact: @fabianvf

[fabianvf]

It looks like this is because we use the generationChanged predicate to filter events, but not all resources have a generation so some events are skipped unintentionally.