When updating a NetworkAttachmentDefinition with an empty spec, the validation returns an error preventing you from updating the object.

Error from server (Forbidden): network-attachment-definitions.k8s.cni.cncf.io "empty-spec" is forbidden: expression 'oldObject == null || object == null || object.spec != oldObject.spec' resulted in error: no such key: spec    

    4.19.7, 4.20

    Easily

    1. Create a NetworkAttachmentDefinition with an empty spec

apiVersion: k8s.cni.cncf.io/v1
kind: NetworkAttachmentDefinition
metadata:
  name: empty-spec
  namespace: default

    2. Try and update it: 

kubectl patch network-attachment-definitions.k8s.cni.cncf.io empty-spec --type=json -p '[{"op": "add", "path": "/metadata/annotations/test", "value": "val"}]'   

    Error from server (Forbidden): network-attachment-definitions.k8s.cni.cncf.io "empty-spec" is forbidden: expression 'oldObject == null || object == null || object.spec != oldObject.spec' resulted in error: no such key: spec

    Successful update

Issue is not present on 4.19.6 but shows up in 4.19.7 and on 4.20