Update operation in state provider does not check existing object annotations

[linyguo]

In k8s state provider, when update an existing object, the annotations are directly adopted from the incoming request https://github.com/eclipse-symphony/symphony/blob/7971d7ec6ac13314096e12eb147fef9f64ac3732/api/pkg/apis/v1alpha1/providers/states/k8s/k8s.go#L246-L256

If the upsert request does not contain previous object's summary id, the summar id will be reset to 1 and cause inconsistency between expectedRunningJobId and runningJobId.

For example, an existing target box-truck with job id 4 and status success exists. When I try to update the target with rest API "/targets/registry", it will reset the job id to 1 and the job will be pending because the expected job id 4 is greater than 1:

apiVersion: v1
items:
- apiVersion: fabric.symphony/v1
  kind: Target
  metadata:
    annotations:
      SummaryJobIdKey: "1"
      management.azure.com/correlationId: b3be2a9b-4869-4115-aa84-037034691240
      management.azure.com/runningCorrelationId: b3be2a9b-4869-4115-aa84-037034691240
      target.fabric.symphony/started-at: "2024-11-19T08:19:15Z"
    creationTimestamp: "2024-11-19T05:30:53Z"
    finalizers:
    - target.fabric.symphony/finalizer
    generation: 4
    name: box-truck
    namespace: default
    resourceVersion: "25944"
    uid: 5385d9aa-cd29-4b08-9514-b72d48ec54a4
  spec:
    displayName: box-truck
    properties:
      capacity: "100"
      destination: 0,0
      driver: mike
      fuel: "100"
      image.url: box-truck
      location: 0,0
      status: available
      temperature: "-18"
      weight: "1000"
    scope: default
    topologies:
    - bindings:
      - config:
          brokerAddress: tcp://mosquitto-service:1883
          clientID: office-2
          name: mqtt-proxy
          requestTopic: coa-request
          responseTopic: coa-response
        provider: providers.target.mqtt
        role: instance
  status:
    lastModified: "2024-11-19T08:19:16Z"
    properties:
      deployed: pending
      expectedRunningJobId: "1"
      generation: "3"
      runningJobId: "4"
      status: Reconciling
      status-details: ""
      targets: pending
    provisioningStatus:
      error: {}
      operationId: ""
      status: Reconciling
kind: List
metadata:
  resourceVersion: ""

We need to think of a solution to ensure the upsert operation preserve the correct summary job id.

[linyguo]

Current proposals:

• From client side RestAPI, get the current object first and compare the annotations with the request body. Compare and merge the annotations before update the object. We should also update the ResourceVersion when we perform the update operation. The drawback is it will not support clean up annotations on purpose.
• Add an inspection in webhook for correctness of annotations. However, we should only allow internal updates to change the system level information, and protect the system data (eg. jobId) from customer changes. For this approach, we need to investigate if we can distinguish the request identity.