From 38387944b94d77410e88e95581517b12fdc5c7b4 Mon Sep 17 00:00:00 2001
From: Levi Blackstone <levi@pulumi.com>
Date: Tue, 16 Aug 2022 11:28:52 -0600
Subject: [PATCH] Another fix for managed-by label in SSA mode. (#2140)

#2138 attempted to fix the case where a resource was created using CSA, and then updated to use SSA. For this case, the resource should retain the "managed-by" label. However, there was a bug in the conditional logic, so that fix was not effective. This change fixes this logic so that the label is only created for CSA resources, but is retained once present on a resource in both cases.
---
 CHANGELOG.md                      |  1 +
 provider/pkg/provider/provider.go | 22 ++++++++++------------
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e421d43240..d6ad48d56a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## Unreleased
 
 - Update autonaming to use NewUniqueName for deterministic update plans. (https://github.com/pulumi/pulumi-kubernetes/pull/2137)
+- Another fix for managed-by label in SSA mode. (https://github.com/pulumi/pulumi-kubernetes/pull/2140)
 
 ## 3.20.4 (August 15, 2022)
 
diff --git a/provider/pkg/provider/provider.go b/provider/pkg/provider/provider.go
index f82082c9bf..fe26708957 100644
--- a/provider/pkg/provider/provider.go
+++ b/provider/pkg/provider/provider.go
@@ -1293,24 +1293,22 @@ func (k *kubeProvider) Check(ctx context.Context, req *pulumirpc.CheckRequest) (
 		contract.Assert(oldInputs.GetName() != "")
 		metadata.AdoptOldAutonameIfUnnamed(newInputs, oldInputs)
 
-		// If this resource does not have a "managed-by: pulumi" label in its inputs, it is likely we are importing
-		// a resource that was created out-of-band. In this case, we do not add the `managed-by` label here, as doing
-		// so would result in a persistent failure to import due to a diff that the user cannot correct.
+		// If the resource has existing state, we only set the "managed-by: pulumi" label if it is already present. This
+		// avoids causing diffs for cases where the resource is being imported, or was created using SSA. The goal in
+		// both cases is to leave the resource unchanged. The label is added if already present, or omitted if not.
 		if metadata.HasManagedByLabel(oldInputs) {
-			if !k.serverSideApplyMode {
-				_, err = metadata.TrySetManagedByLabel(newInputs)
-				if err != nil {
-					return nil, pkgerrors.Wrapf(err,
-						"Failed to create object because of a problem setting managed-by labels")
-				}
+			_, err = metadata.TrySetManagedByLabel(newInputs)
+			if err != nil {
+				return nil, pkgerrors.Wrapf(err,
+					"Failed to create object because of a problem setting managed-by labels")
 			}
 		}
 	} else {
 		metadata.AssignNameIfAutonamable(req.RandomSeed, newInputs, news, urn)
 
-		// Set a "managed-by: pulumi" label on resources created with Client-Side Apply. To avoid churn on previously
-		// created resources, keep the label in SSA mode if it's already present on the resource.
-		if !k.serverSideApplyMode || metadata.HasManagedByLabel(oldInputs) {
+		// Set a "managed-by: pulumi" label on resources created with Client-Side Apply. Do not set this label for SSA
+		// resources since the fieldManagers field contains granular information about the managers.
+		if !k.serverSideApplyMode {
 			_, err = metadata.TrySetManagedByLabel(newInputs)
 			if err != nil {
 				return nil, pkgerrors.Wrapf(err,