DevFW-CICD/poc-core-deploy

Fork 0

fix/provider-controller-watch-cluster-workspace #43

Open

daniil.gorshkov wants to merge 12 commits from fix/provider-controller-watch-cluster-workspace into main

daniil.gorshkov commented

2026-06-24 12:07:57 +00:00

Member

No description provided.

daniil.gorshkov added 12 commits

2026-06-24 12:07:58 +00:00

feat(provider-controller): real in-cluster deploy against root:controllers:provider 055fa7e2f5

- values: build-from-source image tag 0.0.3-local, drop --mock-crossplane
- kubeconfig ExternalSecret: point at root:controllers:provider (user's APIExport)
- add OTC Crossplane RBAC for provider-controller-dev ServiceAccount

provider-controller: grant SA namespaces get/create for OTC ns mirroring 2a5dedec76

controllers: bootstrap real OTC provider-controller (image, Crossplane+OTC, KCP provider workspace) before Argo apply 0119a1ad2b

controllers: wait for KCP front-proxy + base workspaces (root:controllers, root:orgs) Ready before kcp-provider-setup (fresh-cluster race) 3eed1a1f2d

fix(provider-controller): watch cluster-controller APIExport in root:controllers:cluster cefc6198f9

The provider-controller-kubeconfig Secret targeted root:controllers:provider,
but the provider-controller's access-content/endpointslice RBAC lives in
root:controllers:cluster, causing CrashLoopBackOff (failed to get server groups:
unknown). The cluster-controller's kubernetesclusters APIExport already serves
both the platform and provider KubernetesCluster schemas, so the provider
controller watches that single export. Removed the conflicting kcp-provider-setup
(separate root:controllers:provider APIExport + root:orgs rebind) from
provider-controller-otc.

chore: drop local-build scaffolding for provider-controller 175414f0e2

provider-controller is now published to the registry, so the local
docker-build/kind-load bootstrap is no longer needed:
- remove the provider-controller-otc Makefile target, PC_* vars and the
  controllers dependency on it
- pin image tag back to 0.0.3 (registry) instead of 0.0.3-local

Keeps the real fix: provider-controller-kubeconfig targets
root:controllers:cluster and its OTC RBAC manifest.

feat: foundation installs Crossplane+OTC and OTC creds (gated) b1c8b95ec0

Add a gated crossplane-otc step to 'make foundation' that installs
Crossplane + the OTC provider into the local cluster and creates the OTC
credentials secret the real (non-mock) provider-controller needs.

- enabled via: make foundation OTC_ACCESS_KEY=<ak> OTC_SECRET_KEY=<sk>
- single-shell recipe so the gate actually stops the recipe
- skips cleanly (exit 0) when creds/docker/kind/jq or the
  provider-controller checkout are absent, so it never blocks foundation
  on clusters/CI without OTC access
- delegates to provider-controller's crossplane-kind and
  crossplane-create-otc-secret targets; no image build/load

Install Crossplane/OTC via ArgoCD; gate real-vs-mock on OTC creds 4f7ee8375c

Move Crossplane core + the OTC provider + ClusterProviderConfig out of the
kind/docker-coupled Makefile target into declarative ArgoCD Applications
(argocd/crossplane.yaml + argocd/crossplane-otc.yaml, manifests under
crossplane-otc/manifests). 'make controllers' now enables real OTC mode when
OTC_ACCESS_KEY+OTC_SECRET_KEY are supplied (the creds secret is created via
plain kubectl) or OTC_EXISTING_SECRET=true (secret pre-provisioned, e.g.
Vault/ESO); otherwise provider-controller runs with --mock-crossplane and
Crossplane is not installed. Removes the kind/docker-specific crossplane-otc
target and its sibling-checkout dependency, making the bootstrap portable.

crossplane-otc: add CCE composite XRD, Composition and functions 17033d1f45

argocd: permit crossplane helm repo in core project; provider-controller OTC RBAC for CCE composite XR f8843f5a72

- core-project: allow https://charts.crossplane.io/stable so the crossplane
  ArgoCD app can sync (was InvalidSpecError: repo not permitted in project core).
- provider-controller OTC ClusterRole: grant otc.test.example.com cces/cces/status
  instead of the old cce/compute/vpc managed-resource groups, matching the
  reconciler's switch to a single CCE composite XR.

crossplane-otc: drop writeConnectionSecretToRef.namespace from keypair patch 18734fc617

Crossplane v2 namespaced managed resources expose writeConnectionSecretToRef
with only .name (the secret is written into the MR's own namespace); the OTC
KeypairV2 schema has no .spec.writeConnectionSecretToRef.namespace, so the
composition failed with 'field not declared in schema' and produced no
composed resources.

argocd: normalize YAML quote style (formatter, no functional change) 4eeff544d1

Patrick.Sy approved these changes

2026-06-24 14:16:05 +00:00

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin fix/provider-controller-watch-cluster-workspace:fix/provider-controller-watch-cluster-workspace

git switch fix/provider-controller-watch-cluster-workspace

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff fix/provider-controller-watch-cluster-workspace

git switch fix/provider-controller-watch-cluster-workspace

git rebase main

git switch main

git merge --ff-only fix/provider-controller-watch-cluster-workspace

git switch fix/provider-controller-watch-cluster-workspace

git rebase main

git switch main

git merge --no-ff fix/provider-controller-watch-cluster-workspace

git switch main

git merge --squash fix/provider-controller-watch-cluster-workspace

git switch main

git merge --ff-only fix/provider-controller-watch-cluster-workspace

git switch main

git merge fix/provider-controller-watch-cluster-workspace

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

DevFW-CICD/poc-core-deploy!43

No description provided.

Rows
Columns