feat: Make TwingateConnector's containerExtra and podExtra mutable

deploy/twingate-operator/crds/twingate.com.twingateconnector.yaml

@@ -19,10 +19,6 @@ spec:
               x-kubernetes-validations:
                 - rule: (!has(oldSelf.id) || self.id == oldSelf.id)
                   message: "id is immutable once set"
-                - rule: (!has(oldSelf.containerExtra) || self.containerExtra == oldSelf.containerExtra)
-                  message: "containerExtra is immutable once set"
-                - rule: (!has(oldSelf.podExtra) || self.podExtra == oldSelf.podExtra)
-                  message: "podExtra is immutable once set"
                 - rule: (has(self.image) && !has(self.imagePolicy)) || (!has(self.image) && has(self.imagePolicy)) || (!has(self.image) && !has(self.imagePolicy))
                   message: "Can define either `image` or `imagePolicy`, not both."
               properties:

tests_integration/test_connector_flows.py

@@ -90,6 +90,24 @@ def test_connector_flows(run_kopf, ci_run_number):
         assert pod["metadata"]["ownerReferences"][0]["name"] == connector_name
         assert pod["metadata"]["ownerReferences"][0]["kind"] == "TwingateConnector"
 
+        # Check patching TwingateConnector updates the pod
+        kubectl_patch(
+            f"tc/{connector_name}",
+            {
+                "spec": {
+                    "containerExtra": {"env": [{"name": "FOO", "value": "bar"}]},
+                    "podExtra": {"restartPolicy": "OnFailure"},
+                }
+            },
+        )
+        time.sleep(10)
+        pod = kubectl_get("pod", connector_name)
+
+        assert pod["status"]["phase"] == "Running"
+        assert pod["spec"]["restartPolicy"] == "OnFailure"
+        assert pod["spec"]["containers"][0]["env"][-1]["name"] == "FOO"
+        assert pod["spec"]["containers"][0]["env"][-1]["value"] == "bar"
+
         kubectl_delete(f"tc/{connector_name}")
         time.sleep(10)