From 25eb3639c71779d33e71f34cbc807a208593f053 Mon Sep 17 00:00:00 2001
From: David Hadley <davehadley@users.noreply.github.com>
Date: Wed, 12 Aug 2026 13:03:31 +0100
Subject: [PATCH] fix(workflows,kueue): kueue kyverno policy handle
 simultaneous update of Workflow phase and metadata

---
 charts/workflows/Chart.yaml                   |  2 +-
 .../workloadpriority-clusterpolicy.yaml       |  6 +-
 .../workloadpriorityclass/chainsaw-test.yaml  | 75 +++++++++++++++++--
 3 files changed, 73 insertions(+), 10 deletions(-)

diff --git a/charts/workflows/Chart.yaml b/charts/workflows/Chart.yaml
index 5309c6a3b..12ed3d79f 100644
--- a/charts/workflows/Chart.yaml
+++ b/charts/workflows/Chart.yaml
@@ -2,7 +2,7 @@ apiVersion: v2
 name: workflows
 description: Data Analysis workflow orchestration
 type: application
-version: 0.13.63
+version: 0.13.64
 dependencies:
   - name: argo-workflows
     repository: https://argoproj.github.io/argo-helm
diff --git a/charts/workflows/templates/workloadpriority-clusterpolicy.yaml b/charts/workflows/templates/workloadpriority-clusterpolicy.yaml
index 76ecde9ff..8beeb358f 100644
--- a/charts/workflows/templates/workloadpriority-clusterpolicy.yaml
+++ b/charts/workflows/templates/workloadpriority-clusterpolicy.yaml
@@ -26,7 +26,7 @@ spec:
           value: "medium"
         # Do not apply to Running Workflows as they may have created pods whose priority-class should not change
         # Argo Workflows should have applied all metadata before a Job enters Running phase
-        - key: "{{ `{{ request.object.status.phase || '' }}` }}"
+        - key: "{{ `{{ request.oldObject.status.phase || '' }}` }}"
           operator: NotEquals
           value: Running
       mutate:
@@ -52,7 +52,7 @@ spec:
         - key: "{{ `{{ request.object.spec.podMetadata.labels.\"kueue.x-k8s.io/priority-class\" || '' }}` }}"
           operator: NotEquals
           value: "high"
-        - key: "{{ `{{ request.object.status.phase || '' }}` }}"
+        - key: "{{ `{{ request.oldObject.status.phase || '' }}` }}"
           operator: NotEquals
           value: Running
       mutate:
@@ -78,7 +78,7 @@ spec:
         - key: "{{ `{{ request.object.spec.podMetadata.labels.\"kueue.x-k8s.io/priority-class\" || '' }}` }}"
           operator: NotEquals
           value: "low"
-        - key: "{{ `{{ request.object.status.phase || '' }}` }}"
+        - key: "{{ `{{ request.oldObject.status.phase || '' }}` }}"
           operator: NotEquals
           value: Running
       mutate:
diff --git a/charts/workflows/test-policy/workloadpriorityclass/chainsaw-test.yaml b/charts/workflows/test-policy/workloadpriorityclass/chainsaw-test.yaml
index 8ae33e298..d27fe0135 100644
--- a/charts/workflows/test-policy/workloadpriorityclass/chainsaw-test.yaml
+++ b/charts/workflows/test-policy/workloadpriorityclass/chainsaw-test.yaml
@@ -1,3 +1,4 @@
+---
 apiVersion: chainsaw.kyverno.io/v1alpha1
 kind: Test
 metadata:
@@ -98,8 +99,14 @@ spec:
                 podMetadata:
                   labels:
                     kueue.x-k8s.io/priority-class: medium
-
-        # Test policy applies on Workflow UPDATE
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: workloadpriorityclass-applies-on-update
+spec:
+  steps:
+    - try:
         - apply:
             resource:
               apiVersion: argoproj.io/v1alpha1
@@ -138,7 +145,14 @@ spec:
                 podMetadata:
                   labels:
                     kueue.x-k8s.io/priority-class: high
-
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: workloadpriorityclass-does-not-modify-running-workflows
+spec:
+  steps:
+    - try:
         # Test policy does not modify running Workflows
         - apply:
             resource:
@@ -168,7 +182,6 @@ spec:
               status:
                 phase: Running
               spec: {}
-
         - assert:
             resource:
               apiVersion: argoproj.io/v1alpha1
@@ -177,7 +190,6 @@ spec:
                 name: update-while-running
               status:
                 phase: Running
-
         - error:
             resource:
               apiVersion: argoproj.io/v1alpha1
@@ -190,7 +202,6 @@ spec:
                 podMetadata:
                   labels:
                     kueue.x-k8s.io/priority-class: high
-
         # Verify that the rejected update has not changed the Workflow.
         - assert:
             resource:
@@ -206,3 +217,55 @@ spec:
                     kueue.x-k8s.io/priority-class: high
               status:
                 phase: Running
+---
+apiVersion: chainsaw.kyverno.io/v1alpha1
+kind: Test
+metadata:
+  name: workloadpriorityclass-handles-simultaneous-update-of-metadata-and-phase
+spec:
+  steps:
+    - try:
+        - apply:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Workflow
+              metadata:
+                name: simultaneous-metadata-and-phase-update
+              spec: {}
+        - assert:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Workflow
+              metadata:
+                name: simultaneous-metadata-and-phase-update
+              spec:
+                podMetadata:
+                  labels:
+                    kueue.x-k8s.io/priority-class: medium
+        # Simulate Argo applying workflowMetadata in the same update that
+        # transitions the Workflow into the Running phase
+        - apply:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Workflow
+              metadata:
+                name: simultaneous-metadata-and-phase-update
+                annotations:
+                  workflows.diamond.ac.uk/type: "live"
+              spec: {}
+              status:
+                phase: Running
+        - assert:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Workflow
+              metadata:
+                name: simultaneous-metadata-and-phase-update
+                annotations:
+                  workflows.diamond.ac.uk/type: "live"
+              spec:
+                podMetadata:
+                  labels:
+                    kueue.x-k8s.io/priority-class: high
+              status:
+                phase: Running