Introduce support for migrating API version

Signed-off-by: Matheus Pimenta <matheuscscp@gmail.com>

Author: matheuscscp

go.mod

@@ -29,7 +29,7 @@ require (
 	github.com/fluxcd/pkg/http/fetch v0.22.0
 	github.com/fluxcd/pkg/kustomize v1.29.0
 	github.com/fluxcd/pkg/runtime v0.103.0
-	github.com/fluxcd/pkg/ssa v0.70.0
+	github.com/fluxcd/pkg/ssa v0.70.1-0.20260415163824-18b0e9d64ba8
 	github.com/fluxcd/pkg/tar v0.17.0
 	github.com/fluxcd/pkg/testserver v0.13.0
 	github.com/fluxcd/source-controller/api v1.8.0

go.sum

@@ -225,8 +225,8 @@ github.com/fluxcd/pkg/runtime v0.103.0 h1:J5y5GPhWdkyqIUBlaI1FP2N02TtZmsjbWhhZub
 github.com/fluxcd/pkg/runtime v0.103.0/go.mod h1:mbo2f3azo3yVQgm7XZGxQB6/2zvzQ5Wgtd8TjRRwwAw=
 github.com/fluxcd/pkg/sourceignore v0.17.0 h1:Z72nruRMhC15zIEpWoDrAcJcJ1El6QDnP/aRDfE4WOA=
 github.com/fluxcd/pkg/sourceignore v0.17.0/go.mod h1:3e/VmYLId0pI/H5sK7W9Ibif+j0Ahns9RxNjDMtTTfY=
-github.com/fluxcd/pkg/ssa v0.70.0 h1:IBylYPiTK1IEdCC2DvjKXIhwQcbd5VufXA9WS3zO+tE=
-github.com/fluxcd/pkg/ssa v0.70.0/go.mod h1:6igtlt7/zF+nNFQpa5ZAkkvtpL6o36NRU39/PqqC+Bg=
+github.com/fluxcd/pkg/ssa v0.70.1-0.20260415163824-18b0e9d64ba8 h1:u02kshFVUoZgiJpPjCGnLTloXqbYImTCfM8fLf9h3CA=
+github.com/fluxcd/pkg/ssa v0.70.1-0.20260415163824-18b0e9d64ba8/go.mod h1:6igtlt7/zF+nNFQpa5ZAkkvtpL6o36NRU39/PqqC+Bg=
 github.com/fluxcd/pkg/tar v0.17.0 h1:uNxbFXy8ly8C7fJ8D7w3rjTNJFrb4Hp1aY/30XkfvxY=
 github.com/fluxcd/pkg/tar v0.17.0/go.mod h1:b1xyIRYDD0ket4SV5u0UXYv+ZdN/O/HmIO5jZQdHQls=
 github.com/fluxcd/pkg/testserver v0.13.0 h1:xEpBcEYtD7bwvZ+i0ZmChxKkDo/wfQEV3xmnzVybSSg=

internal/controller/kustomization_controller.go

@@ -120,6 +120,7 @@ type KustomizationReconciler struct {
 	DirectSourceFetch          bool
 	FailFast                   bool
 	GroupChangeLog             bool
+	MigrateAPIVersion          bool
 	StrictSubstitutions        bool
 }
 
@@ -867,6 +868,7 @@ func (r *KustomizationReconciler) apply(ctx context.Context,
 		fmt.Sprintf("%s/force", kustomizev1.GroupVersion.Group): kustomizev1.EnabledValue,
 	}
 	applyOpts.CustomStageKinds = r.CustomStageKinds
+	applyOpts.MigrateAPIVersion = r.MigrateAPIVersion
 
 	fieldManagers := []ssa.FieldManager{
 		{

internal/features/features.go

@@ -55,6 +55,18 @@ const (
 	// immediate processing of the new revision. This can help avoid getting
 	// stuck on failing deployments when fixes are available.
 	CancelHealthCheckOnNewRevision = "CancelHealthCheckOnNewRevision"
+
+	// MigrateAPIVersion controls whether the controller migrates the API
+	// version referenced by the managed fields entries of in-cluster objects
+	// to the API version of the applied objects when they differ.
+	//
+	// This works around a server-side apply dry-run failure that can occur
+	// after a CRD upgrade introduces a new optional field with a default
+	// value in a newer API version: the managed fields entry owned by the
+	// controller still references the old API version, and the API server
+	// reports the defaulted field as "field not declared in schema" when
+	// validating managed fields against the old version's schema.
+	MigrateAPIVersion = "MigrateAPIVersion"
 )
 
 var features = map[string]bool{
@@ -88,6 +100,9 @@ var features = map[string]bool{
 	// DirectSourceFetch
 	// opt-in from v1.8
 	controller.FeatureGateDirectSourceFetch: false,
+	// MigrateAPIVersion
+	// opt-in from v1.8.4
+	MigrateAPIVersion: false,
 }
 
 func init() {

main.go

@@ -303,6 +303,12 @@ func main() {
 		os.Exit(1)
 	}
 
+	migrateAPIVersion, err := features.Enabled(features.MigrateAPIVersion)
+	if err != nil {
+		setupLog.Error(err, "unable to check feature gate "+features.MigrateAPIVersion)
+		os.Exit(1)
+	}
+
 	var tokenCache *pkgcache.TokenCache
 	if tokenCacheOptions.MaxSize > 0 {
 		var err error
@@ -357,6 +363,7 @@ func main() {
 		KubeConfigOpts:             kubeConfigOpts,
 		Mapper:                     restMapper,
 		Metrics:                    metricsH,
+		MigrateAPIVersion:          migrateAPIVersion,
 		NoCrossNamespaceRefs:       aclOptions.NoCrossNamespaceRefs,
 		NoRemoteBases:              noRemoteBases,
 		SOPSAgeSecret:              sopsAgeSecret,