Traefik Mesh control plane and Traefik Proxy data plane interoperability when rolling back after a CRD schema change

Answer

Yes – adding a version‑aware conversion webhook lets Traefik Mesh upgrade and downgrade its control plane without requiring administrators to manually convert existing MeshService, TrafficSplit, or MeshPolicy objects.

Confirmed facts

• As of Traefik Mesh v1.2.x the controller ships no built‑in conversion webhook, so a CRD schema bump forces a manual migration step.
• Rolling back the controller before completing that migration leaves objects in a version the API server no longer serves, causing reconciliation loops or stale sidecar configurations.

Likely explanation of trade‑offs

1. Operational overhead – a webhook service must be deployed, given RBAC permissions, and kept highly available; its failure blocks all CRD operations unless the API server is configured to ignore unknown versions.
2. Latency – each CRD create/update triggers a webhook call, adding a small but measurable delay.
3. Maintenance burden** – conversion logic must be written and tested for every schema version; bugs could silently corrupt specifications.

Impact on rollback procedure

With a conversion webhook:

1. Downgrade the Traefik Mesh controller image to the previous version.
2. Ensure the webhook pod is running and serving the old CRD version.
3. The API server automatically converts stored objects to the old version via the webhook.
4. The data‑plane sidecars receive the expected configuration; verify with kubectl get meshservice or similar.

Without a conversion webhook:

1. Complete the manual migration of all MeshService, TrafficSplit, and MeshPolicy objects to the new schema.
2. Only then downgrade the controller; attempting to roll back earlier will be rejected by the API server.

Missing diagnostic detail

To confirm whether the webhook is already providing conversion, check if the API server lists both the old and new versions for the CRD (e.g., kubectl get crd meshservice -o yaml). If only the new version appears, the webhook is not active or not configured, which would change the recommendation to deploy the webhook first.