Three times in one upgrade campaign, a chart bump changed a helm-hook-shaped one-shot Job's template and the bootstrap apply failed on Job spec.template immutability: cert-manager's startupapicheck (twice, both planes) and flux2's flux-check. The remedy is always the same and always manual: delete the COMPLETED Job, re-run — never --force-recreate the whole group for a one-shot.
Proposal: when apply hits 'field is immutable' on a batch/v1 Job whose live status is Complete (succeeded>=1, no active pods), delete-and-recreate that Job automatically and log it. Guard: never auto-delete a Job that is active or failed — those are a human's call. This keeps --force-recreate's blast radius for real conflicts while removing the one class that is provably safe.
Evidence: the upgrade campaign's audit trail records all three instances with identical resolution.
Three times in one upgrade campaign, a chart bump changed a helm-hook-shaped one-shot Job's template and the bootstrap apply failed on Job spec.template immutability: cert-manager's startupapicheck (twice, both planes) and flux2's flux-check. The remedy is always the same and always manual: delete the COMPLETED Job, re-run — never --force-recreate the whole group for a one-shot.
Proposal: when apply hits 'field is immutable' on a batch/v1 Job whose live status is Complete (succeeded>=1, no active pods), delete-and-recreate that Job automatically and log it. Guard: never auto-delete a Job that is active or failed — those are a human's call. This keeps --force-recreate's blast radius for real conflicts while removing the one class that is provably safe.
Evidence: the upgrade campaign's audit trail records all three instances with identical resolution.