[vault-secrets-webhook] use kubernetes Server-Side Apply (SSA) and set a FieldManager on inline-mutated fields

[jkirkham-ratehub]

Is your feature request related to a problem? Please describe.

When using ArgoCD (or similar) GitOps deployment tools, a lot of extra work needs to be done to set ignoreRules for each mutated resource (in particular inline mutated Secrets). Without the ignoreRules set on mutated fields ArgoCD will have issue syncing the resource since both it and VSWH are trying to modify it.
If instead SSA was used, a custom FieldManager could be set on mutated fields. This would make it easier for ArgoCD to automatically detect changes "externally" managed by VSWH.

Describe the solution you'd like

Use kubernetes SSA and set the FieldManager to something like vault-secrets-webhook for mutated fields. There is a simple example described here.

Describe alternatives you've considered

The alternative is to manually manage ignoreRules for each mutated field in resources mutated by VSWH.

Additional context

Note that this does not affect Deployment (or similar application resources). ArgoCd manages the Deployment resource, but not the actual Pod resources so when they are created and mutated by VSWH there are no sync issues. This likely only applies to resources that are modified with "inline mutation".
SSA is GA (considered "stable") in kubernetes 1.22 and later.

[thekoma]

any update on that?

[thekoma]

/unstale