UNOFFICIAL/EXPERIMENTAL. Live receipt generated by scripts/run-ssa-conflict-gap.mjs; do not hand-edit. Regenerate with npm run ssa-conflict:proof.
Claim. cub's managed delivery uses server-side apply. When a user has manually edited a field (kubectl scale), a server-side re-apply FAILS with a field-manager conflict (a wall of Kubernetes SSA text); Helm's client-side apply silently OVERWRITES and 'just works'. cub's behavior is arguably safer (no silent clobber) but is different and confusing for a Helm user - and under 'people avoid different/confusing' it must be MANAGED with a plain-words message and a clear reconcile/force path, not surfaced raw.
Under the adoption lens (worse-than / more-confusing-than Helm, and managed?): cub's managed delivery uses server-side apply. Proven live on a throwaway kind cluster - a deployment is delivered, a user manually kubectl scales it, then it is re-delivered:
| Re-delivery | Outcome on the manually-edited field (.spec.replicas) |
|---|---|
| cub (server-side apply) | yes → CONFLICT (confusing for a Helm user) |
| Helm (client-side apply) | overwrote silently, replicas->1 (Helm's behavior) |
Overall: watch. Confirmed: cub's server-side-apply delivery conflicts on a manually-edited field where Helm silently overwrites. Defensible (safer) but different + confusing. Manage it: detect the conflict, explain in plain words ('spec.replicas was changed outside cub - reconcile, or re-apply with --force-conflicts'), and offer the choice - don't surface raw k8s SSA text.
- Not a bug - a trade-off. cub's conflict is arguably safer: it refuses to silently clobber a human's manual change. Helm's silent overwrite is convenient but can erase a hotfix.
- But it is different + confusing. A Helm user who manually tweaks one field and re-delivers gets a wall of SSA conflict text where Helm just worked - exactly the kind of surprise people bounce off of.
- Manage it: detect the conflict and say, in plain words, "
.spec.replicaswas changed outside cub - reconcile it, or re-apply with--force-conflicts", and offer the choice. Don't surface raw Kubernetes server-side-apply output. - Receipt:
runs/ssa-conflict-gap/receipt.yaml.