Children of objects handled in Response are pruned, although they aren't touched by the Router

[antoineco]

Context

I am using baaah to manage Tekton TaskRun objects.

When baaah creates those TaskRuns, they are automatically labeled with apply.acorn.io/hash, as expected.

Problem

Tekton propagates labels from the parent TaskRun to its children Pods, but baaah uses the aforementioned label to determine whether it should prune objects, and ends up pruning Pods which it doesn't manage.

Demonstration

Here is a debug session as an illustration, where the code snippets correspond to the breakpoints I set:

https://github.com/acorn-io/baaah/blob/5d519d272865e746b74b6f1eb63bd26a2202a081/pkg/apply/desiredset_process.go#L184-L187

(dlv) print set
k8s.io/apimachinery/pkg/labels.Selector(k8s.io/apimachinery/pkg/labels.internalSelector) [
        {
                key: "apply.acorn.io/hash",
                operator: "=",
                strValues: []string len: 1, cap: 1, [
                        "576cd23303466727e7fab759412925c6f2bf8934",
                ],},
]

(dlv) print existing
map[github.com/acorn-io/baaah/pkg/apply/objectset.ObjectKey]sigs.k8s.io/controller-runtime/pkg/client.Object [
        {Name: "pod-managed-by-tekton", Namespace: "default"}: *k8s.io/api/core/v1.Pod {
                TypeMeta: (*"k8s.io/apimachinery/pkg/apis/meta/v1.TypeMeta")(0xc000a3a000),
                ObjectMeta: (*"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta")(0xc000a3a020),
                Spec: (*"k8s.io/api/core/v1.PodSpec")(0xc000a3a108),
                Status: (*"k8s.io/api/core/v1.PodStatus")(0xc000a3a328),},
        {Name: "pod-managed-by-baaah", Namespace: "default"}: *k8s.io/api/core/v1.Pod {
                TypeMeta: (*"k8s.io/apimachinery/pkg/apis/meta/v1.TypeMeta")(0xc000a3a428),
                ObjectMeta: (*"k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta")(0xc000a3a448),
                Spec: (*"k8s.io/api/core/v1.PodSpec")(0xc000a3a530),
                Status: (*"k8s.io/api/core/v1.PodStatus")(0xc000a3a750),},
]

https://github.com/acorn-io/baaah/blob/5d519d272865e746b74b6f1eb63bd26a2202a081/pkg/apply/desiredset_process.go#L189-L193

(dlv) print toDelete
[]github.com/acorn-io/baaah/pkg/apply/objectset.ObjectKey len: 1, cap: 1, [
        {
                Name: "pod-managed-by-tekton",
                Namespace: "default",},
]

As seen above, baaah matches on the Pod managed by Tekton, and ends up pruning that Pod, despite the Router's client never ever interacting with that particular Pod.