Premature Kubectl Wait Return For Composite Resource Readiness

[humoflife]

When waiting for a composite resource to assume the Ready state, kubectl wait may return prematurely. This could imply that the Ready state is briefly set and then revoked.

Example:
kubectl-v1.27.3 wait vault.sec.upbound.io configuration-vault --for=condition=Ready --timeout 5m

After kubectl wait returned, crossplane beta trace vault.sec.upbound.io configuration-vault shows that the resource is not yet ready.

NAME                                                                       SYNCED   READY   STATUS
Vault/configuration-vault (default)                                        True     False   Waiting: ...resource claim is waiting for composite resource to become Ready
└─ XVault/configuration-vault-mhtj5                                        True     False   Creating: Unready resources: xVaultAuth, xVaultPolicies, and xVaultSecrets
   ├─ XAuth/configuration-vault-mhtj5-g2cbg                                True     False   Creating: Unready resources: generic-endpoint, userpass-auth-backend
   │  ├─ Backend/configuration-vault-auth-backend-userpass                 True     True    Available
   │  └─ Endpoint/configuration-vault-auth-generic-endpoint                True     False   Creating

[humoflife]

Below we can see how the condition was reported as met by kubectl wait and then Ready state was false when queried 3 seconds later with kubectl get.

vault.sec.upbound.io/configuration-vault created
s="False"; \
        while [ ${s} != "True" ] ; do \
	    /Users/markuss/upbound/dev/go/src/github.com/upbound/configuration-vault/.cache/tools/darwin_arm64/kubectl-v1.27.3 wait vault.sec.upbound.io configuration-vault --for=condition=Ready --timeout 20m ; \
	    sleep 3 ; \
	    s=`/Users/markuss/upbound/dev/go/src/github.com/upbound/configuration-vault/.cache/tools/darwin_arm64/kubectl-v1.27.3 get vault.sec.upbound.io configuration-vault -o jsonpath='{.status.conditions[1].status}'|awk '{print }'`; \
	    echo $s ; \
        done; \
        true
vault.sec.upbound.io/configuration-vault condition met
False

Note that an immediate kubectl get after the kubectl wait shows Ready state is True as seen below. And consecutively False when running a crossplane beta trace after it.

vault.sec.upbound.io/configuration-vault created
s="False"; \
        while [ ${s} != "True" ] ; do \
	    /Users/markuss/upbound/dev/go/src/github.com/upbound/configuration-vault/.cache/tools/darwin_arm64/kubectl-v1.27.3 wait vault.sec.upbound.io configuration-vault --for=condition=Ready --timeout 20m ; \
	    s=`/Users/markuss/upbound/dev/go/src/github.com/upbound/configuration-vault/.cache/tools/darwin_arm64/kubectl-v1.27.3 get vault.sec.upbound.io configuration-vault -o jsonpath='{.status.conditions[1].status}'|awk '{print }'`; \
	    echo $s ; \
        done; \
        true
vault.sec.upbound.io/configuration-vault condition met
True
crossplane beta trace vault.sec.upbound.io configuration-vault
NAME                                                                       SYNCED   READY   STATUS
Vault/configuration-vault (default)                                        True     False   Waiting: ...resource claim is waiting for composite resource to become Ready
...

[negz]

Did you mean to open this issue against this specific function?