<p>We have created a few month ago controller which runs great using kubebuilder.</p>
<p>Few weeks ago we added a “listener” to a secret which when the secret is changing (secret properties)
The <strong>reconcile</strong> should be invoked, the problem is that it is <strong>sometimes working</strong> and <strong>sometimes not</strong>, (you change the secret apply it and the reconcile doesn’t happens) , we are doing it for the exact <strong>same</strong> secret file.</p>
<p>We tried few days to find the root cause without success, (we change the <code>k8s.io/client-go v0.23.4</code> and also to <code>v0.22.3</code> and now  <code>v0.22.1</code> that is only working.
Any idea what the issue could be? any hint will be helpful. or Any other way to do it that we can try out.</p>
<pre><code>func (r *vtsReconciler) SetupWithManager(mgr ctrl.Manager) error {
    manager := ctrl.NewControllerManagedBy(mgr).
        For(&amp;vts.str).
        WithEventFilter(predicate.Or(predicate.AnnotationChangedPredicate{}))
    manager = manager.Watches(&amp;source.Kind{Type: &amp;v1.Secret{}}, handler.EnqueueRequestsFromMapFunc(func(a client.Object) []reconcile.Request {
        return r.SecretRequests.SecretFinder(a.GetName())
    }))
    return manager.Complete(r)
}



func (secm *SecretMapper) SecretFinder(name string) []reconcile.Request {
    v := cli.ObjectKey{Name: name}
    return secm.SecMap[v.String()]
}
</code></pre>

<p>Most likely the issue is that the <code>WithEventFIlter</code> applies to all watched objects by the controller. The generation is auto-incremented for CRDs, but this doesn't hold for all resource types.</p>
<p>From the GenerationChangedPredicate docs:</p>
<pre><code>// Caveats:
//
// * The assumption that the Generation is incremented only on writing to the spec does not hold for all APIs.
// E.g For Deployment objects the Generation is also incremented on writes to the metadata.annotations field.
// For object types other than CustomResources be sure to verify which fields will trigger a Generation increment when they are written to.
</code></pre>
<p>You can check this by creating a secret / updating a secret you will see that there is no generation set (at least not on my local k3d cluster).</p>
<p>Most likely it works for the creation as initially the controller will sync existing resources with the cluster.</p>
<p>To solve it you can use:</p>
<pre class="lang-golang prettyprint-override"><code>func (r *vtsReconciler) SetupWithManager(mgr ctrl.Manager) error {
    manager := ctrl.NewControllerManagedBy(mgr).
        For(&amp;vts.str, WithPredicates(predicate.Or(predicate.GenerationChangedPredicate{}, predicate.AnnotationChangedPredicate{}))).
    manager = manager.Watches(&amp;source.Kind{Type: &amp;v1.Secret{}}, handler.EnqueueRequestsFromMapFunc(func(a client.Object) []reconcile.Request {
        return r.SecretRequests.FindForSecret(a.GetNamespace(), a.GetName())
    }))
    return manager.Complete(r)
}
</code></pre>
<p>which should apply the predicates only to your custom resource.</p>
