fix: preserve Knative-managed annotations on ksvc replace

The Knative admission webhook rejects replace (PUT) when immutable
annotations like serving.knative.dev/creator are missing. Now the
replace path fetches the existing service first and merges its
annotations and labels into the new spec.

Author: pyramation

packages/provisioning-handlers/src/handlers/function-sync-resources.ts

@@ -67,14 +67,18 @@ export const handleFunctionSyncResources: ProvisioningHandler = async (
   const serviceSpec = buildKnativeServiceSpec(fnRow, namespaceName);
 
   try {
-    // GET the existing service to retrieve its resourceVersion (required for PUT)
+    // GET the existing service to retrieve metadata required for PUT
     const existing = await client.readServingKnativeDevV1NamespacedService({
       query: {},
       path: { name: fnName, namespace: namespaceName },
     });
-    const resourceVersion = existing?.metadata?.resourceVersion;
-    if (resourceVersion && serviceSpec.metadata) {
-      serviceSpec.metadata.resourceVersion = resourceVersion;
+    if (serviceSpec.metadata) {
+      serviceSpec.metadata.resourceVersion = existing?.metadata?.resourceVersion;
+      // Preserve Knative-managed annotations (e.g. serving.knative.dev/creator)
+      const existingAnnotations = (existing?.metadata?.annotations ?? {}) as Record<string, string>;
+      serviceSpec.metadata.annotations = { ...existingAnnotations, ...serviceSpec.metadata.annotations };
+      const existingLabels = (existing?.metadata?.labels ?? {}) as Record<string, string>;
+      serviceSpec.metadata.labels = { ...existingLabels, ...serviceSpec.metadata.labels };
     }
 
     const svc = await client.replaceServingKnativeDevV1NamespacedService({

packages/provisioning-handlers/src/knative.ts

@@ -31,6 +31,8 @@ export function buildKnativeServiceSpec(
       name: string;
       namespace: string;
       resourceVersion?: string;
+      annotations?: Record<string, string>;
+      labels?: Record<string, string>;
     },
     spec: {
       template: {

packages/provisioning-handlers/src/seed.ts

@@ -191,14 +191,18 @@ export async function provision(opts: ProvisionSeedOptions): Promise<ProvisionSe
       result.functions.push({ name: fnName, namespace: namespaceName, serviceUrl, status: 'created' });
     } catch (err: unknown) {
       if (isConflict(err)) {
-        // GET the existing service to retrieve its resourceVersion (required for PUT)
+        // GET the existing service to retrieve metadata required for PUT
         const existing = await client.readServingKnativeDevV1NamespacedService({
           query: {},
           path: { name: fnName, namespace: namespaceName },
         });
-        const resourceVersion = existing?.metadata?.resourceVersion;
-        if (resourceVersion && serviceSpec.metadata) {
-          serviceSpec.metadata.resourceVersion = resourceVersion;
+        if (serviceSpec.metadata) {
+          serviceSpec.metadata.resourceVersion = existing?.metadata?.resourceVersion;
+          // Preserve Knative-managed annotations (e.g. serving.knative.dev/creator)
+          const existingAnnotations = (existing?.metadata?.annotations ?? {}) as Record<string, string>;
+          serviceSpec.metadata.annotations = { ...existingAnnotations, ...serviceSpec.metadata.annotations };
+          const existingLabels = (existing?.metadata?.labels ?? {}) as Record<string, string>;
+          serviceSpec.metadata.labels = { ...existingLabels, ...serviceSpec.metadata.labels };
         }
 
         const svc = await client.replaceServingKnativeDevV1NamespacedService({