From b64faa79b3c0dd395cb4b90bd9dcb897f7dc3b3a Mon Sep 17 00:00:00 2001
From: Nigel Foucha <nigel@defenseunicorns.com>
Date: Wed, 18 Dec 2024 17:24:49 -0500
Subject: [PATCH 1/2] fix: ignore container ordering for pod diff

---
 pkg/resources/nifi/nifi.go | 66 ++++++++++++++++++++++++++++++++------
 1 file changed, 56 insertions(+), 10 deletions(-)

diff --git a/pkg/resources/nifi/nifi.go b/pkg/resources/nifi/nifi.go
index c758c6e280..b0f9926c59 100644
--- a/pkg/resources/nifi/nifi.go
+++ b/pkg/resources/nifi/nifi.go
@@ -2,6 +2,7 @@ package nifi
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"reflect"
 	"sort"
@@ -691,7 +692,6 @@ func (r *Reconciler) reconcileNifiPod(log zap.Logger, desiredPod *corev1.Pod) (e
 					uniqueContainers = append(uniqueContainers, c)
 				}
 			}
-			desiredPod.Spec.InitContainers = uniqueContainers
 		}
 		// If there are extra containers from webhook injections we need to add them
 		if len(currentPod.Spec.Containers) > len(desiredPod.Spec.Containers) {
@@ -704,7 +704,6 @@ func (r *Reconciler) reconcileNifiPod(log zap.Logger, desiredPod *corev1.Pod) (e
 					uniqueContainers = append(uniqueContainers, c)
 				}
 			}
-			desiredPod.Spec.Containers = uniqueContainers
 		}
 		// Remove problematic fields if istio
 		if _, ok := currentPod.Annotations["istio.io/rev"]; ok {
@@ -712,21 +711,22 @@ func (r *Reconciler) reconcileNifiPod(log zap.Logger, desiredPod *corev1.Pod) (e
 			delete(currentPod.Annotations, "prometheus.io/port")
 			delete(desiredPod.Annotations, "prometheus.io/port")
 			// Liveness probe port is overridden by istio injection
-			desiredContainer := corev1.Container{}
-			for _, c := range desiredPod.Spec.Containers {
+			currentContainer := corev1.Container{}
+			for _, c := range currentPod.Spec.Containers {
 				if c.Name == "nifi" {
-					desiredContainer = c
+					currentContainer = c
 				}
 			}
-			currentContainers := []corev1.Container{}
-			for _, c := range currentPod.Spec.Containers {
+			desiredContainers := []corev1.Container{}
+			for _, c := range desiredPod.Spec.Containers {
 				if c.Name == "nifi" {
-					c.LivenessProbe = desiredContainer.LivenessProbe
+					c.LivenessProbe = currentContainer.LivenessProbe
 				}
-				currentContainers = append(currentContainers, c)
+				desiredContainers = append(desiredContainers, c)
 			}
-			currentPod.Spec.Containers = currentContainers
+			desiredPod.Spec.Containers = desiredContainers
 		}
+
 		// Check if the resource actually updated
 		patchResult, err := patch.DefaultPatchMaker.Calculate(currentPod, desiredPod, opts...)
 		if err != nil {
@@ -755,6 +755,52 @@ func (r *Reconciler) reconcileNifiPod(log zap.Logger, desiredPod *corev1.Pod) (e
 				return nil, k8sutil.PodReady(currentPod)
 			}
 		} else {
+			// We want to check if the only part of the patch is element ordering, in which case we ignore it due to injection
+			var patch map[string]interface{}
+			if err := json.Unmarshal(patchResult.Patch, &patch); err == nil {
+				ignoreSpec := false
+				if len(patch) == 1 {
+					if spec, ok := patch["spec"].(map[string]interface{}); ok {
+						// If we only have one item in the spec then we check for container or initContainer ordering
+						if len(spec) == 1 {
+							if _, ok := spec["$setElementOrder/containers"]; ok {
+								ignoreSpec = true
+							} else if _, ok := spec["$setElementOrder/initContainers"]; ok {
+								ignoreSpec = true
+							}
+							// If we have two items in the spec then we check for container and initContainer ordering
+						} else if len(spec) == 2 {
+							if _, ok := spec["$setElementOrder/containers"]; ok {
+								if _, ok := spec["$setElementOrder/initContainers"]; ok {
+									ignoreSpec = true
+								}
+							}
+						}
+					}
+				}
+				// Since we can ignore the spec diff due to it only including $setElementOrder we'll proceed as if the pod is in sync
+				if ignoreSpec {
+					if !k8sutil.IsPodTerminatedOrShutdown(currentPod) &&
+						r.NifiCluster.Status.NodesState[currentPod.Labels["nodeId"]].ConfigurationState == v1.ConfigInSync {
+						if val, found := r.NifiCluster.Status.NodesState[desiredPod.Labels["nodeId"]]; found &&
+							val.GracefulActionState.State == v1.GracefulUpscaleRunning &&
+							val.GracefulActionState.ActionStep == v1.ConnectStatus &&
+							k8sutil.PodReady(currentPod) {
+							if err := k8sutil.UpdateNodeStatus(r.Client, []string{desiredPod.Labels["nodeId"]}, r.NifiCluster, r.NifiClusterCurrentStatus,
+								v1.GracefulActionState{ErrorMessage: "", State: v1.GracefulUpscaleSucceeded}, log); err != nil {
+								return errorfactory.New(errorfactory.StatusUpdateError{},
+									err, "could not update node graceful action state"), false
+							}
+						}
+
+						log.Debug("pod resource is in sync",
+							zap.String("clusterName", r.NifiCluster.Name),
+							zap.String("podName", currentPod.Name))
+
+						return nil, k8sutil.PodReady(currentPod)
+					}
+				}
+			}
 			log.Debug("resource diffs",
 				zap.String("patch", string(patchResult.Patch)),
 				zap.String("current", string(patchResult.Current)),

From bca5f2476e09ee13bd1d35cf4fbabfa31d5d830a Mon Sep 17 00:00:00 2001
From: Nigel Foucha <nigel@defenseunicorns.com>
Date: Thu, 19 Dec 2024 10:57:01 -0500
Subject: [PATCH 2/2] update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7e2f295e5d..af5e713d62 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@
 ### Fixed Bugs
 
 - [PR #476](https://github.com/konpyutaika/nifikop/pull/476) - **[Operator/NifiCluster]** Fixed istio init race condition and pod reconciliation.
+- [PR #499](https://github.com/konpyutaika/nifikop/pull/499) - **[Operator/NifiCluster]** Fixed istio container ordering pod reconciliation.
 
 ### Deprecated