From 158c857c27e031967b4b1fc6673b11dac063ad8c Mon Sep 17 00:00:00 2001
From: Patrick Hermann <patrick.hermann@sva.de>
Date: Tue, 22 Sep 2026 12:07:51 +0000
Subject: [PATCH] feat(crossplane): derived CR names as an opt-in
 (derivedNames), p&t twin v0.10.9

stuttgart-things/flux#506. The flux machinery profile and
xplane-crossplane-catalog name every Provider and Configuration after the
path Crossplane derives from its package. These helmfiles still used short
names for four of them, so the two install paths put the same source on a
cluster under two CR names -- a duplicate Lock node.

- `derivedNames` state value, default false. With
  `--state-values-set derivedNames=true` an entry that carries
  `derivedName` switches to it:
    provider-opentofu   -> upbound-provider-opentofu
    provider-kubeconfig -> stuttgart-things-provider-kubeconfig-xpkg
    namespace           -> stuttgart-things-crossplane-configurations-namespace
    volume-claim        -> stuttgart-things-crossplane-configurations-volume-claim
  The providers template computes the name once, so the CR, its
  DeploymentRuntimeConfig, the serviceAccountTemplate and the
  ClusterRoleBinding move together.

- Opt-in, not the new default, because a rename on a live cluster is
  destructive either way: helm replaces the CR (deleting the old
  Provider/Configuration takes its CRDs/XRDs and everything on them), or
  both names coexist (duplicate Lock node, every package Healthy=False).
  kind_machinery pins this repo and checks for old names before setting
  the flag; plays/kind-machinery-test.yaml, the
  platform-engineering-showcase Taskfile/bundle and dev3-kind apply these
  helmfiles from main with no such check, and keep their names.

- crossplane-contrib-function-patch-and-transform v0.10.8 -> v0.10.9, the
  version of its short-named sibling (catalog 0.7.0). Same CR name, so an
  in-place upgrade on existing clusters; the digest is identical on both
  mirrors, the pattern function-kcl runs healthy on kind5.

Rendered with `helmfile template`: without the flag the output is
byte-identical to main apart from the p&t tag; with it only the names
above change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 cicd/crossplane-config.yaml.gotmpl            | 28 ++++++++++++++++++-
 cicd/crossplane-providers.yaml.gotmpl         | 22 +++++++++++++++
 ...ossplane-configurations.values.yaml.gotmpl |  6 +++-
 .../crossplane-providers.values.yaml.gotmpl   | 21 ++++++++++----
 4 files changed, 69 insertions(+), 8 deletions(-)

diff --git a/cicd/crossplane-config.yaml.gotmpl b/cicd/crossplane-config.yaml.gotmpl
index 15e6e227..21690182 100644
--- a/cicd/crossplane-config.yaml.gotmpl
+++ b/cicd/crossplane-config.yaml.gotmpl
@@ -3,6 +3,25 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # derivedNames: false (default) keeps every CR name as it has always
+      # been. true switches each entry that carries a `derivedName` to it --
+      # the name Crossplane itself derives from the package path, and the one
+      # the flux machinery profile and the xplane-crossplane-catalog use
+      # (stuttgart-things/flux#506). Set it with
+      #   helmfile apply ... --state-values-set derivedNames=true
+      #
+      # FRESH CLUSTERS ONLY. A rename on a live cluster is not a rename: the
+      # release creates the new CR and helm deletes the old one, and deleting
+      # a Configuration takes its XRDs -- and every XR on them -- with it. Leaving the old CR in place instead
+      # gives two CRs for one source, a duplicate Lock node, and every package
+      # on the cluster goes Healthy=False. The kind_machinery play checks for
+      # CRs under the old names before it sets this, and stops.
+      #
+      # Opt-in rather than the default because not every consumer pins this
+      # repo: plays/kind-machinery-test.yaml (ansible), the
+      # platform-engineering-showcase Taskfile/bundle and dev3-kind apply
+      # these helmfiles from main, with no preflight in front of them.
+      - derivedNames: false
       - functions:
           autoReady:
             name: function-auto-ready
@@ -57,7 +76,12 @@ environments:
             name: crossplane-contrib-function-patch-and-transform
             apiVersion: pkg.crossplane.io/v1
             image: xpkg.crossplane.io/crossplane-contrib/function-patch-and-transform
-            tag: v0.10.8
+            # v0.10.9, the version of the short-named entry above: two versions
+            # of one function add nothing. Every dependsOn allows it
+            # (>=v0.10.6,<v0.11.0) and the digest is identical on both mirrors
+            # -- the pattern function-kcl already runs healthy on kind5.
+            # Level with xplane-crossplane-catalog 0.7.0.
+            tag: v0.10.9
       # Migrated from the decommissioned ghcr.io/stuttgart-things/crossplane/...
       # registry to ghcr.io/stuttgart-things/crossplane-configurations/...
       # (Crossplane v2, namespaced XRs). Entries are re-added one at a time as
@@ -65,10 +89,12 @@ environments:
       - configurations:
           namespace:
             name: namespace
+            derivedName: stuttgart-things-crossplane-configurations-namespace
             image: ghcr.io/stuttgart-things/crossplane-configurations/namespace
             tag: v0.1.2
           volumeClaim:
             name: volume-claim
+            derivedName: stuttgart-things-crossplane-configurations-volume-claim
             image: ghcr.io/stuttgart-things/crossplane-configurations/volume-claim
             tag: v0.1.0
 ---
diff --git a/cicd/crossplane-providers.yaml.gotmpl b/cicd/crossplane-providers.yaml.gotmpl
index 93056210..4456c36a 100644
--- a/cicd/crossplane-providers.yaml.gotmpl
+++ b/cicd/crossplane-providers.yaml.gotmpl
@@ -3,6 +3,26 @@ environments:
   default:
     values:
       - namespace: crossplane-system
+      # derivedNames: false (default) keeps every CR name as it has always
+      # been. true switches each entry that carries a `derivedName` to it --
+      # the name Crossplane itself derives from the package path, and the one
+      # the flux machinery profile and the xplane-crossplane-catalog use
+      # (stuttgart-things/flux#506). Set it with
+      #   helmfile apply ... --state-values-set derivedNames=true
+      #
+      # FRESH CLUSTERS ONLY. A rename on a live cluster is not a rename: the
+      # release creates the new CR and helm deletes the old one, and deleting
+      # a Provider or Configuration takes its CRDs/XRDs -- and every managed
+      # resource or XR on them -- with it. Leaving the old CR in place instead
+      # gives two CRs for one source, a duplicate Lock node, and every package
+      # on the cluster goes Healthy=False. The kind_machinery play checks for
+      # CRs under the old names before it sets this, and stops.
+      #
+      # Opt-in rather than the default because not every consumer pins this
+      # repo: plays/kind-machinery-test.yaml (ansible), the
+      # platform-engineering-showcase Taskfile/bundle and dev3-kind apply
+      # these helmfiles from main, with no preflight in front of them.
+      - derivedNames: false
       # Provider CRs (installed here rather than via the upstream crossplane
       # chart's provider.packages so they can carry a runtimeConfigRef).
       #   rbac: optional. When set, additionally emits a DeploymentRuntimeConfig
@@ -41,6 +61,7 @@ environments:
               clusterRole: cluster-admin
           providerOpentofu:
             name: provider-opentofu
+            derivedName: upbound-provider-opentofu
             package: xpkg.upbound.io/upbound/provider-opentofu:v1.1.6
             rbac:
               clusterRole: cluster-admin
@@ -67,6 +88,7 @@ environments:
                 memory: 2Gi
           providerKubeconfig:
             name: provider-kubeconfig
+            derivedName: stuttgart-things-provider-kubeconfig-xpkg
             package: ghcr.io/stuttgart-things/provider-kubeconfig-xpkg:v0.13.2
           # provider-kubernetes and provider-proxmox-bpg come in only through
           # Configurations' dependsOn. Not pinned, a fresh cluster got whatever
diff --git a/cicd/values/crossplane-configurations.values.yaml.gotmpl b/cicd/values/crossplane-configurations.values.yaml.gotmpl
index d7cf4008..a2b85cc3 100644
--- a/cicd/values/crossplane-configurations.values.yaml.gotmpl
+++ b/cicd/values/crossplane-configurations.values.yaml.gotmpl
@@ -1,10 +1,14 @@
 customresources:
 {{- range $key, $fn := .Values.configurations }}
+  {{- $crName := $fn.name | required (printf "configurations.%s.name is required" $key) }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $fn "derivedName") }}
+  {{- $crName = $fn.derivedName }}
+  {{- end }}
   {{ $key }}:
     apiVersion: pkg.crossplane.io/v1
     kind: Configuration
     metadata:
-      name: {{ $fn.name | required (printf "functions.%s.name is required" $key) }}
+      name: {{ $crName }}
     spec:
       package: {{ printf "%s:%s" $fn.image $fn.tag | required (printf "functions.%s.image and tag are required" $key) }}
 {{- end }}
diff --git a/cicd/values/crossplane-providers.values.yaml.gotmpl b/cicd/values/crossplane-providers.values.yaml.gotmpl
index 557c5493..4f539fd0 100644
--- a/cicd/values/crossplane-providers.values.yaml.gotmpl
+++ b/cicd/values/crossplane-providers.values.yaml.gotmpl
@@ -1,30 +1,35 @@
 ---
 customresources:
 {{- range $key, $p := .Values.providers }}
+  {{- /* One name for the CR, its DeploymentRuntimeConfig, SA and binding -- they move together or not at all. */}}
+  {{- $crName := $p.name | required (printf "providers.%s.name is required" $key) }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $p "derivedName") }}
+  {{- $crName = $p.derivedName }}
+  {{- end }}
   {{ $key }}:
     apiVersion: {{ dig "apiVersion" "pkg.crossplane.io/v1" $p }}
     kind: Provider
     metadata:
-      name: {{ $p.name | required (printf "providers.%s.name is required" $key) }}
+      name: {{ $crName }}
     spec:
       package: {{ $p.package | required (printf "providers.%s.package is required" $key) }}
       {{- if or (hasKey $p "rbac") (hasKey $p "env") (hasKey $p "resources") }}
       runtimeConfigRef:
         apiVersion: pkg.crossplane.io/v1beta1
         kind: DeploymentRuntimeConfig
-        name: {{ $p.name }}
+        name: {{ $crName }}
       {{- end }}
   {{- if or (hasKey $p "rbac") (hasKey $p "env") (hasKey $p "resources") }}
   {{ $key }}Runtimeconfig:
     apiVersion: pkg.crossplane.io/v1beta1
     kind: DeploymentRuntimeConfig
     metadata:
-      name: {{ $p.name }}
+      name: {{ $crName }}
     spec:
       {{- if hasKey $p "rbac" }}
       serviceAccountTemplate:
         metadata:
-          name: {{ $p.name }}
+          name: {{ $crName }}
       {{- end }}
       {{- if or (hasKey $p "env") (hasKey $p "resources") }}
       # env, not args: every provider flag also has an environment variable,
@@ -54,15 +59,19 @@ customresources:
 
 clusterRoleBindings:
 {{- range $key, $p := .Values.providers }}
+  {{- $crName := $p.name }}
+  {{- if and (eq (toString (dig "derivedNames" false $.Values)) "true") (hasKey $p "derivedName") }}
+  {{- $crName = $p.derivedName }}
+  {{- end }}
   {{- if hasKey $p "rbac" }}
-  crossplane-{{ $p.name }}:
+  crossplane-{{ $crName }}:
     roleRef:
       kind: ClusterRole
       name: {{ $p.rbac.clusterRole }}
       apiGroup: rbac.authorization.k8s.io
     subjects:
       - kind: ServiceAccount
-        name: {{ $p.name }}
+        name: {{ $crName }}
         namespace: {{ $.Values.namespace }}
   {{- end }}
 {{- end }}