fix: use hybrid approach to distinguish customizations from GitRepo targets

Fixes bug where targetCustomizations with identical selectors to GitRepo
targets were misclassified as GitRepo targets and skipped.

The hybrid approach uses an explicit Source field ("customization" or
"gitrepo") for new bundles, with position-based detection as fallback
for backward compatibility. This fixes the collision bug immediately
for all bundles without requiring recreation.

Changes:
- Add optional Source field to BundleTarget with enum validation
- Update bundlereader to populate Source field for all target types
- Replace hasMatchingRestriction() with determineIsCustomization()
- Add comprehensive tests for hybrid logic and collision cases

Author: p-se

charts/fleet-crd/templates/crds.yaml

@@ -3211,6 +3211,34 @@ spec:
                           this deployment.
                         nullable: true
                         type: string
+                      source:
+                        description: 'Source indicates the origin of this target.
+
+                          "customization" - target comes from fleet.yaml targetCustomizations
+
+                          "gitrepo" - target comes from GitRepo.Spec.Targets (via
+                          targets file)
+
+
+                          If empty, provenance is determined by position in the Targets
+                          array:
+
+                          - First N targets are customizations where N = len(Targets)
+                          - len(TargetRestrictions)
+
+                          - Remaining targets are GitRepo targets
+
+
+                          This field enables explicit provenance tracking for better
+                          maintainability
+
+                          while maintaining backward compatibility with Bundles created
+                          before this field existed.'
+                        enum:
+                          - customization
+                          - gitrepo
+                          - ''
+                        type: string
                       yaml:
                         description: 'YAML options, if using raw YAML these are names
                           that map to
@@ -9471,6 +9499,34 @@ spec:
                           this deployment.
                         nullable: true
                         type: string
+                      source:
+                        description: 'Source indicates the origin of this target.
+
+                          "customization" - target comes from fleet.yaml targetCustomizations
+
+                          "gitrepo" - target comes from GitRepo.Spec.Targets (via
+                          targets file)
+
+
+                          If empty, provenance is determined by position in the Targets
+                          array:
+
+                          - First N targets are customizations where N = len(Targets)
+                          - len(TargetRestrictions)
+
+                          - Remaining targets are GitRepo targets
+
+
+                          This field enables explicit provenance tracking for better
+                          maintainability
+
+                          while maintaining backward compatibility with Bundles created
+                          before this field existed.'
+                        enum:
+                          - customization
+                          - gitrepo
+                          - ''
+                        type: string
                       yaml:
                         description: 'YAML options, if using raw YAML these are names
                           that map to

internal/bundlereader/read.go

@@ -184,7 +184,11 @@ func bundleFromDir(ctx context.Context, name, baseDir string, bundleData []byte,
 		})
 	}
 
-	fy.Targets = append(fy.Targets, fy.TargetCustomizations...)
+	// Mark targetCustomizations with explicit source
+	for _, tc := range fy.TargetCustomizations {
+		tc.Source = "customization"
+		fy.Targets = append(fy.Targets, tc)
+	}
 	fy.BundleSpec.TargetCustomizationMode = fy.TargetCustomizationMode
 
 	meta, err := readMetadata(bundleData)
@@ -245,6 +249,7 @@ func bundleFromDir(ctx context.Context, name, baseDir string, bundleData []byte,
 				ClusterSelector:      target.ClusterSelector,
 				ClusterGroup:         target.ClusterGroup,
 				ClusterGroupSelector: target.ClusterGroupSelector,
+				Source:               "gitrepo", // OverrideTargets replace GitRepo targets
 			})
 			bundle.Spec.TargetRestrictions = append(bundle.Spec.TargetRestrictions, fleet.BundleTargetRestriction(target))
 		}
@@ -329,7 +334,11 @@ func appendTargets(def *fleet.Bundle, targetsFile string) (*fleet.Bundle, error)
 		return nil, err
 	}
 
-	def.Spec.Targets = append(def.Spec.Targets, spec.Targets...)
+	// Mark GitRepo targets with explicit source
+	for _, target := range spec.Targets {
+		target.Source = "gitrepo"
+		def.Spec.Targets = append(def.Spec.Targets, target)
+	}
 	def.Spec.TargetRestrictions = append(def.Spec.TargetRestrictions, spec.TargetRestrictions...)
 
 	return def, nil

internal/cmd/controller/target/matcher/bundlematch.go

@@ -1,8 +1,6 @@
 package matcher
 
 import (
-	"reflect"
-
 	fleet "github.com/rancher/fleet/pkg/apis/fleet.cattle.io/v1alpha1"
 )
 
@@ -115,6 +113,11 @@ type matcher struct {
 func (a *BundleMatch) initMatcher() error {
 	m := &matcher{}
 
+	// Calculate position-based split point for fallback
+	// The first N targets are customizations, where N = total - restrictions
+	numRestrictions := len(a.bundle.Spec.TargetRestrictions)
+	numCustomizations := len(a.bundle.Spec.Targets) - numRestrictions
+
 	for i, target := range a.bundle.Spec.Targets {
 		clusterMatcher, err := NewClusterMatcher(target.ClusterName, target.ClusterGroup, target.ClusterGroupSelector, target.ClusterSelector)
 		if err != nil {
@@ -123,7 +126,7 @@ func (a *BundleMatch) initMatcher() error {
 		t := targetMatch{
 			bundleTarget:    &a.bundle.Spec.Targets[i],
 			criteria:        clusterMatcher,
-			isCustomization: !hasMatchingRestriction(target, a.bundle.Spec.TargetRestrictions),
+			isCustomization: determineIsCustomization(target, i, numCustomizations),
 		}
 
 		m.matches = append(m.matches, t)
@@ -141,20 +144,24 @@ func (a *BundleMatch) initMatcher() error {
 	return nil
 }
 
-// hasMatchingRestriction returns true if the target has an equivalent entry in the
-// TargetRestrictions list. GitRepo targets always have one (bundlereader adds them
-// in parallel); fleet.yaml targetCustomizations never do.
-func hasMatchingRestriction(target fleet.BundleTarget, restrictions []fleet.BundleTargetRestriction) bool {
-	for _, r := range restrictions {
-		if r.Name == target.Name &&
-			r.ClusterName == target.ClusterName &&
-			r.ClusterGroup == target.ClusterGroup &&
-			reflect.DeepEqual(r.ClusterSelector, target.ClusterSelector) &&
-			reflect.DeepEqual(r.ClusterGroupSelector, target.ClusterGroupSelector) {
-			return true
-		}
+// determineIsCustomization uses explicit Source field if present,
+// falls back to position-based detection for backward compatibility.
+func determineIsCustomization(target fleet.BundleTarget, index int, numCustomizations int) bool {
+	// NEW BUNDLES: Source field is populated by bundlereader
+	// This is the preferred method for long-term maintainability
+	if target.Source != "" {
+		return target.Source == "customization"
 	}
-	return false
+
+	// OLD BUNDLES: Source field is empty (created before this field existed)
+	// Use position-based detection as fallback:
+	// - bundlereader appends targetCustomizations first (read.go:187)
+	// - Then appends GitRepo targets from targets file (read.go:332)
+	// - Therefore: first N targets are customizations
+	//   where N = len(Targets) - len(TargetRestrictions)
+	//
+	// This fixes the collision bug for old Bundles without requiring recreation
+	return index < numCustomizations
 }
 
 func (m *matcher) isRestricted(clusterName, clusterGroup string, clusterGroupLabels, clusterLabels map[string]string) bool {