fix: Update K8s Spec for read-only resources when AWS state diverges

[Mallikarjunadevops]

Fixes aws-controllers-k8s/community#2856

What is this PR?

This PR fixes a bug where adopted resources with read-only mode enabled do not update their K8s Spec when the underlying AWS resource changes (e.g., an EKS cluster upgrade from 1.33 to 1.34).

Why?

When a resource is read-only, the aws-controllers-k8s/runtime reads the latest state from AWS, compares it to the desired state in K8s, and detects differences. However, previously the reconciler would log "desired resource state has changed, but resource is read-only - skipping update" and return the resource WITHOUT patching the K8s API. This caused the K8s resource to become perpetually stale.

With this PR, when the runtime detects a difference in Spec for a read-only resource, it will now correctly patch the K8s API with the latest state fetched from AWS.

Testing Evidence

Ran existing unit test suite in pkg/runtime/... via go test which successfully passed. Verified the changes apply exactly as intended for read-only sync logic.

[ack-prow]

Hi @Mallikarjunadevops. Thanks for your PR.

I'm waiting for a aws-controllers-k8s member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[michaelhtm]

Hey @Mallikarjunadevops
Skipping patching metadata.Spec when the resource is read-only was done by design. We can maybe try using a new annotation, or an annotation value read-only: always, that can patch the metadata.Spec
This may require a design PR exploring different options

[ack-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Mallikarjunadevops
Once this PR has been reviewed and has the lgtm label, please ask for approval from michaelhtm. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Mallikarjunadevops]

@michaelhtm Thanks for the review and the insight! That makes total sense.

I have updated the PR to follow your suggestion: instead of always syncing the spec for read-only resources, I updated the logic so it strictly preserves the default read-only: true behavior (skips patching). It now specifically checks if the annotation value is read-only: always before proceeding to patch the K8s Spec and Metadata.

Testing Evidence:

• I have run the existing unit test suite via go test ./pkg/runtime/... locally and all tests continue to pass cleanly with this modified logic.

Please let me know if this implementation looks good or if you'd still prefer a separate design PR to explore other options!