<p>I'm trying to understand Kubernetes behaviour as it pertains to custom resources and their subresources -- specifically the <code>status</code> subresource.</p>
<p><strong>Specifically, I want to update the <code>status</code> subresource without modifying the parent custom resource.</strong></p>
<p>To the best of my understanding, this <em>should</em> be possible. I've reviewed the documentation [here][1], but I cannot seem to get it to work as anticipated.</p>
<p>I am testing using Docker Desktop's <strong>Kubernetes <code>1.19.3</code></strong>.</p>
<p>Here is the scenario ...</p>
<ol>
<li>Create this simple CRD:</li>
</ol>
<pre><code>apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: greetings.k8s.test.io
spec:
  group: k8s.test.io
  versions:
    - name: v1alpha1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              description: Greeting is the Schema for the Greetings Operator
              type: object
              properties:
                message:
                  description: A friendly greeting
                  type: string
                  default: Hello World!
            status:
              type: object
              properties:
                ready:
                  description: The resource's readiness
                  type: boolean
      additionalPrinterColumns:
      - name: ready
        type: boolean
        description: Readiness of the created resource
        jsonPath: .status.ready
      subresources:
        status: {}
  scope: Namespaced
  names:
    plural: greetings
    singular: greeting
    kind: Greeting
    shortNames:
    - grt
</code></pre>
<ol start="2">
<li>Create a demo resource:</li>
</ol>
<pre><code>apiVersion: k8s.test.io/v1alpha1
kind: Greeting
metadata:
  name: demo
spec:
  message: Hi there!
</code></pre>
<ol start="3">
<li>Fire up a proxy:</li>
</ol>
<pre><code>kubectl proxy &amp;
</code></pre>
<ol start="4">
<li>Establish a watch on custom resource:</li>
</ol>
<pre><code>curl -L -s -X GET -H &quot;Content-Type: application/json&quot; \
-H &quot;Accept: application/json, */*&quot; \
127.0.0.1:8001/apis//k8s.test.io/v1alpha1/watch/namespaces/default/greetings
</code></pre>
<p>At this point, you should see output similar the following:</p>
<pre><code>{&quot;type&quot;:&quot;ADDED&quot;,&quot;object&quot;:{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;kind&quot;:&quot;Greeting&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;kubectl.kubernetes.io/last-applied-configuration&quot;:&quot;{\&quot;apiVersion\&quot;:\&quot;k8s.test.io/v1alpha1\&quot;,\&quot;kind\&quot;:\&quot;Greeting\&quot;,\&quot;metadata\&quot;:{\&quot;annotations\&quot;:{},\&quot;name\&quot;:\&quot;demo\&quot;,\&quot;namespace\&quot;:\&quot;default\&quot;},\&quot;spec\&quot;:{\&quot;message\&quot;:\&quot;Hi there!\&quot;}}\n&quot;},&quot;creationTimestamp&quot;:&quot;2020-12-10T04:02:55Z&quot;,&quot;generation&quot;:1,&quot;managedFields&quot;:[{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;fieldsType&quot;:&quot;FieldsV1&quot;,&quot;fieldsV1&quot;:{&quot;f:metadata&quot;:{&quot;f:annotations&quot;:{&quot;.&quot;:{},&quot;f:kubectl.kubernetes.io/last-applied-configuration&quot;:{}}},&quot;f:spec&quot;:{&quot;.&quot;:{},&quot;f:message&quot;:{}}},&quot;manager&quot;:&quot;kubectl-client-side-apply&quot;,&quot;operation&quot;:&quot;Update&quot;,&quot;time&quot;:&quot;2020-12-10T04:02:55Z&quot;}],&quot;name&quot;:&quot;demo&quot;,&quot;namespace&quot;:&quot;default&quot;,&quot;resourceVersion&quot;:&quot;532930&quot;,&quot;selfLink&quot;:&quot;/apis/k8s.test.io/v1alpha1/namespaces/default/greetings/demo&quot;,&quot;uid&quot;:&quot;40f3a618-74e5-4b14-9bd4-2eb47366d804&quot;},&quot;spec&quot;:{&quot;message&quot;:&quot;Hi there!&quot;}}}
</code></pre>
<ol start="5">
<li><code>PATCH</code> the <code>/status</code> subresource</li>
</ol>
<pre><code>curl -k -s -X PATCH -H &quot;Accept: application/json, */*&quot; \
-H &quot;Content-Type: application/merge-patch+json&quot; \
127.0.0.1:8001/apis/k8s.test.io/v1alpha1/namespaces/default/greetings/demo/status \
--data '{&quot;status&quot;:{&quot;ready&quot;:true}}'
</code></pre>
<p>Confusingly, after submitting the <code>PATCH</code> our watch on the parent resource produces ...</p>
<pre><code>{&quot;type&quot;:&quot;MODIFIED&quot;,&quot;object&quot;:{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;kind&quot;:&quot;Greeting&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;kubectl.kubernetes.io/last-applied-configuration&quot;:&quot;{\&quot;apiVersion\&quot;:\&quot;k8s.test.io/v1alpha1\&quot;,\&quot;kind\&quot;:\&quot;Greeting\&quot;,\&quot;metadata\&quot;:{\&quot;annotations\&quot;:{},\&quot;name\&quot;:\&quot;demo\&quot;,\&quot;namespace\&quot;:\&quot;default\&quot;},\&quot;spec\&quot;:{\&quot;message\&quot;:\&quot;Hi there!\&quot;}}\n&quot;},&quot;creationTimestamp&quot;:&quot;2020-12-10T04:02:55Z&quot;,&quot;generation&quot;:1,&quot;managedFields&quot;:[{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;fieldsType&quot;:&quot;FieldsV1&quot;,&quot;fieldsV1&quot;:{&quot;f:metadata&quot;:{&quot;f:annotations&quot;:{&quot;.&quot;:{},&quot;f:kubectl.kubernetes.io/last-applied-configuration&quot;:{}}},&quot;f:spec&quot;:{&quot;.&quot;:{},&quot;f:message&quot;:{}}},&quot;manager&quot;:&quot;kubectl-client-side-apply&quot;,&quot;operation&quot;:&quot;Update&quot;,&quot;time&quot;:&quot;2020-12-10T04:02:55Z&quot;},{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;fieldsType&quot;:&quot;FieldsV1&quot;,&quot;fieldsV1&quot;:{&quot;f:status&quot;:{&quot;.&quot;:{},&quot;f:ready&quot;:{}}},&quot;manager&quot;:&quot;curl&quot;,&quot;operation&quot;:&quot;Update&quot;,&quot;time&quot;:&quot;2020-12-10T04:05:22Z&quot;}],&quot;name&quot;:&quot;demo&quot;,&quot;namespace&quot;:&quot;default&quot;,&quot;resourceVersion&quot;:&quot;533184&quot;,&quot;selfLink&quot;:&quot;/apis/k8s.test.io/v1alpha1/namespaces/default/greetings/demo&quot;,&quot;uid&quot;:&quot;40f3a618-74e5-4b14-9bd4-2eb47366d804&quot;},&quot;spec&quot;:{&quot;message&quot;:&quot;Hi there!&quot;},&quot;status&quot;:{&quot;ready&quot;:true}}}
</code></pre>
<p><strong>Why is it MODIFYING the parent resource??</strong></p>
<p>And if we inspect the resource, we can see that that <code>status</code> of the subresource was definitely updated:</p>
<pre><code>$ k get grt demo
NAME   READY
demo   true
</code></pre>
<p><strong>I don't know if this behaviour is expected and my understanding is faulty OR if my <code>PATCH</code> methodology is flawed.</strong></p>
<p>Hope somebody can help out. Thanks.</p>
<p><strong>UPDATE:</strong></p>
<p>In addition to <code>PATCH</code> I can also confirm that <code>PUT</code> (while a more complicated operation) exhibits the exact same behaviour.</p>
<p>Example:</p>
<pre><code>curl -k -s -X PUT -H &quot;Accept: application/json, */*&quot; \
-H &quot;Content-Type: application/json&quot; \
127.0.0.1:8001/apis/k8s.test.io/v1alpha1/namespaces/default/greetings/demo/status \
--data '{&quot;apiVersion&quot;:&quot;k8s.test.io/v1alpha1&quot;,&quot;kind&quot;:&quot;Greeting&quot;,&quot;metadata&quot;:{&quot;name&quot;:&quot;demo&quot;,&quot;resourceVersion&quot;:&quot;533184&quot;},&quot;status&quot;:{&quot;ready&quot;:false}}'
</code></pre>
<p>¯\<em>(ツ)</em>/¯</p>

Brian Warsing
<p>The <code>status</code> subresource isn't actually a different object; it is just a separate API path that can only modify the top-level <code>status:</code> block in the object.  This is useful because you can <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">set up an RBAC policy</a> for your controller to allow read access to the whole object, but only allow writing the object's status.</p>
<p>In particular, you see this in your last command.  If you <code>kubectl get grt demo -o yaml</code>, the extended YAML syntax will include the <code>status:</code> sub-block.  The controller updating the status will cause a visible change in the <code>status:</code>, so you should reasonably expect that a watch will see this as a change.</p>
