Detect and report resource membership conflicts

[a-hilaly]

Feature Description

When multiple sources produce resources with the same GVK/namespace/name, kro currently silently overrides the desired state, claims membership, and overwrites source identifying labels.

Conflict scenarios:

• different graph nodes in the same instance produce identical resources
• different collection items from the same collection producing identical resources
• different instances of the same RGD produce identical resources
• different RGDs producing identical resources

Before applying, kro should check existing resources and verify membership labels (kro.run/resource-graph-definition-id, kro.run/instance-id, kro.run/node-id, kro.run/collection-index) match. On mismatch, fail and surface the error in instance status.

[Avr8]

I have been able to reproduce this bug in my local, Created a simple RGD with a deployment resource and created two instances with same deployment name. I could see the following membership labels changing
applyset.kubernetes.io/part-of:
kro.run/instance-id:
kro.run/instance-name:

[Avr8]

I Would like to try adding a fix for this, if thats okay

[shivansh-gohem]

Hi @Avr8 , thanks for digging into this and reproducing the bug!

Sorry about the overlap—I’ve actually already been discussing this specific feature with @a-hilaly and was planning to implement the fix myself. I'll be picking this one up. Thanks for understanding!