Openshift: Project object contains (some) immutable fields

project namespace OpenShift immutable label annotation

2 min read | by Jordi Prats

There are just slight differences between a Project and a Namespace in OpenShift, what can be shocking is the fact that Project's metadata is (with exceptions) immutable.

Creating a Project we'll get the Namespace object created as well:

$ kubectl get project test-project
NAME           DISPLAY NAME   STATUS
test-project                  Active
$ kubectl get ns test-project
NAME           STATUS   AGE
test-project   Active   23h

But if we try to edit the Project like so (or reapplying it's definition):

$ kubectl edit project test-project

We'll get an error if we try to add or update one labels:

* metadata.labels[test]: Invalid value: "demo": field is immutable, , try updating the namespace

Or annotations

* metadata.annotations[test]: Invalid value: "demo": field is immutable, try updating the namespace

As the error says, we can edit the Namespace object instead, but then it kind of misses the point of creating Projects.

There's an exception, we'll be able to update the annotations that starts with openshift.io, for example to change it's Display name:

apiVersion: project.openshift.io/v1
kind: Project
metadata:
  annotations:
    openshift.io/display-name: a
(...)

If you are expecting some consistency, these annotations should be immutable if we are changing them using the Namespace object, right?

$ kubectl edit ns test-project

Unfortunately, there is no such restriction, we'll be able to update all the annotations (no exceptions) using the Namespace object instead of the Project

apiVersion: v1
kind: Namespace
metadata:
  annotations:
    openshift.io/display-name: b

Posted on 04/11/2022

Categories