Changing spec.strategy to "Recreate" causes Forbidden error even when rollingUpdate is not set

[morgan-cromell]

What happened?

In C# updating spec.strategy.type in a deployment to Recreate causes error when running pulumi up or preview:
spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy type is 'Recreate'

spec.strategy.rollingUpdate is not set. This happens even if I explicitly set it to null.

Example

Update an existing deployment where Spec.Strategy was not specifed to:

Strategy = new DeploymentStrategyArgs
{
    Type = "Recreate"
},

Output of pulumi about

CLI
Version      3.104.0
Go Version   go1.21.6
Go Compiler  gc

Plugins
NAME          VERSION
azure-native  2.28.0
azuread       5.47.1
docker        4.4.3
dotnet        unknown
kubernetes    4.7.1
mssql         0.0.8

Host
OS       Microsoft Windows 11 Pro
Version  10.0.22631 Build 22631
Arch     x86_64

This project is written in dotnet: executable='C:\Program Files\dotnet\dotnet.exe' version='8.0.102'

Current Stack: Bovra/consumer-partner-project-integration-service/dev

TYPE                                                         URN
pulumi:pulumi:Stack                                          urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:pulumi:Stack::consumer-partner-project-integration-service-dev
pulumi:providers:pulumi                                      urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:providers:pulumi::default
bovra:azure:WorkloadIdentity                                 urn:pulumi:dev::consumer-partner-project-integration-service::bovra:azure:WorkloadIdentity::workload-identity
pulumi:providers:docker                                      urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:providers:docker::default_4_4_3
docker:index/image:Image                                     urn:pulumi:dev::consumer-partner-project-integration-service::docker:index/image:Image::image
pulumi:providers:azure-native                                urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:providers:azure-native::default_2_28_0
pulumi:pulumi:StackReference                                 urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:pulumi:StackReference::Bovra/common/dev
bovra:kubernetes:AppWithServiceAndIngress                    urn:pulumi:dev::consumer-partner-project-integration-service::bovra:kubernetes:AppWithServiceAndIngress::background-service
pulumi:pulumi:StackReference                                 urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:pulumi:StackReference::Bovra/kubernetes/dev
pulumi:providers:kubernetes                                  urn:pulumi:dev::consumer-partner-project-integration-service::pulumi:providers:kubernetes::k8sprovider
azure-native:managedidentity:UserAssignedIdentity            urn:pulumi:dev::consumer-partner-project-integration-service::bovra:azure:WorkloadIdentity$azure-native:managedidentity:UserAssignedIdentity::managedIdentity
azure-native:sql:Database                                    urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database::database
azure-native:managedidentity:FederatedIdentityCredential     urn:pulumi:dev::consumer-partner-project-integration-service::bovra:azure:WorkloadIdentity$azure-native:managedidentity:FederatedIdentityCredential::federatedIdentityCredential
pulumi:providers:mssql                                       urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database$pulumi:providers:mssql::sql-provider
azure-native:authorization:RoleAssignment                    urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:authorization:RoleAssignment::serviceBus
mssql:index/azureadServicePrincipal:AzureadServicePrincipal  urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database$mssql:index/azureadServicePrincipal:AzureadServicePrincipal::sql-db-user
kubernetes:core/v1:ServiceAccount                            urn:pulumi:dev::consumer-partner-project-integration-service::bovra:kubernetes:AppWithServiceAndIngress$kubernetes:core/v1:ServiceAccount::service-account
mssql:index/databaseRoleMember:DatabaseRoleMember            urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database$mssql:index/databaseRoleMember:DatabaseRoleMember::db-role-member-db_ddladmin
mssql:index/databaseRoleMember:DatabaseRoleMember            urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database$mssql:index/databaseRoleMember:DatabaseRoleMember::db-role-member-db_datareader
mssql:index/databaseRoleMember:DatabaseRoleMember            urn:pulumi:dev::consumer-partner-project-integration-service::azure-native:sql:Database$mssql:index/databaseRoleMember:DatabaseRoleMember::db-role-member-db_datawriter
kubernetes:apps/v1:Deployment                                urn:pulumi:dev::consumer-partner-project-integration-service::bovra:kubernetes:AppWithServiceAndIngress$kubernetes:apps/v1:Deployment::deployment

Found no pending operations associated with Bovra/dev

Backend
Name           pulumi.com
URL            https://app.pulumi.com/morgancromell
User           morgancromell
Organizations  morgancromell, Bovra
Token type     personal

Dependencies:
NAME                VERSION
Pulumi              3.59.0
Pulumi.AzureAD      5.47.1
Pulumi.AzureNative  2.28.0
Pulumi.Docker       4.4.3
Pulumi.Kubernetes   4.7.1
Pulumiverse.Mssql   0.0.8

Pulumi locates its logs in C:\Users\morga\AppData\Local\Temp by default

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[mjeffryes]

Thanks for the bug report @morgan-cromell. Can you confirm that the error does not occur if the strategy is set initially, but only when updating the strategy to "Recreate"?

[morgan-cromell]

@mjeffryes
It happens if I initially omit setting the strategy, making it default to rollingUpdate. I have not tried it if I initially set the strategy to rollingUpdate during creation.

[AdamNowotny]

Having same issue, seems related to kubernetes/kubernetes#24198
in which case DeploymentStrategy needs an explicit null for rollingUpdate but that's not supported by the interface.
A workaround is to modify the deployment manifests on the server and replacing existing RollingUpdate strategy with

strategy:
    type: Recreate