Open Knowledge Format for Crossplane v2
LLM wiki kit
First committed by jkroepke
Published in jkroepke/okf-crossplane-v2. Publisher page
37 GitHub stars
What it is
LLM-wiki in OKF (Open Knowledge Format) for Crossplane v2
AutoGineer overview, from the brain’s own files
The okf-crossplane-v2 repository provides a versioned, source-backed knowledge catalog designed to help AI agents and developers navigate the Crossplane v2 ecosystem. It aggregates information from Go API types, CRDs, package metadata, and documentation into a structured format. By utilizing the Open Knowledge Format (OKF), it enables agents to perform precise lookups on providers, composition functions, and API definitions. The project includes a dedicated MCP server that allows agents to query live repository data, such as CRD definitions, versioning, and examples, ensuring that the information retrieved is grounded in specific, versioned source code.
How it works
Memory model: LLM wiki
AutoGineer overview, from the brain’s own files
The system organizes technical knowledge into a catalog of Markdown files stored in the catalog folder. These files contain OKF metadata and provenance links. An MCP server, which can be self-hosted or used via a public endpoint, ingests this catalog into a DuckDB instance. Agents interact with this data through specific tools that resolve provider versions, search CRDs, and retrieve documentation or examples. The system relies on specialized researcher agents defined in the .agents folder to maintain and validate the knowledge base, ensuring that facts are linked to stable source code and documentation.
| Folder | Role | Files |
|---|---|---|
| .codex | agent-config | 25 |
| .github | agent-config | 2 |
| skills | agent-instructions | 1 |
| .agents | folder | 37 |
| .codex-plugin | folder | 1 |
| .okf | folder | 2 |
| .pi | folder | 27 |
| .plugin | folder | 1 |
| catalog | folder | 120 |
| mcp | folder | 12 |
Requirements
Apps: Docker
API keys (by name): GITHUB_TOKEN
Works with: Claude Code, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Amp, Cline, JetBrains Junie, Devin (ex-Windsurf)
Set it up
- Download the brain as a ZIP and unzip it where you keep your notes or project: https://mp-staging.autogineer.com/agent-brains/jkroepke/okf-crossplane-v2/download
Point Claude Code at .codex-plugin/plugin.json: it does not read that file on its own.
cd okf-crossplane-v2 && claude
AutoGineer scanned these files at commit df24ac2.
Add crossplane-v2-okf to .mcp.json:
{ "mcpServers": { "crossplane-v2-okf": { "type": "http", "url": "https://crossplane.mcp.jkroepke.de/mcp" } } }Or add it with the Claude Code CLI:
claude mcp add --transport http crossplane-v2-okf https://crossplane.mcp.jkroepke.de/mcpYour data is sent to crossplane.mcp.jkroepke.de.
First committed by jkroepke. Published in jkroepke/okf-crossplane-v2. Licence: Apache License 2.0.
Usage
AutoGineer overview, from the brain’s own files
- Querying CRD definitions for specific Crossplane providers
- Retrieving versioned examples for composition functions
- Resolving stable provider versions and their associated documentation
- Integrating Crossplane knowledge into AI agent workflows via MCP
- “Find the latest version of the AWS provider and list its CRDs.”
- The agent uses the get_versions and provider_crd_search tools to return the canonical repository name and a list of available CRDs for the specified provider.
- “Show me the definition for the S3Bucket CRD in the latest AWS provider.”
- The agent retrieves the YAML definition of the requested CRD using the provider_crd_get_definition tool, ensuring the output is token-efficient.
Documentation by jkroepke
Image: CI Image: GitHub license Image: GitHub Repo stars Image: BundleDex
Open Knowledge Format for Crossplane v2
This repository provides a structured knowledge catalog for the Crossplane v2 ecosystem using Open Knowledge Format v0.2.
The goal is to make Crossplane concepts, APIs, providers, composition functions, documentation, and practical examples easier to discover and understand. The catalog is designed for both humans and knowledge-aware tools.
Installation
WARNING
The public MCP server is a temporary early-access service for early adopters. Its availability is not guaranteed, and it may change or be removed without notice. It is intended to bridge the current tooling gap until the OKF ecosystem provides practical, end-user-friendly solutions that run locally. For reliable or production use, self-host the included container.
Install the companion skill and hosted OKF-aware MCP server together as a plugin for every detected supported agent:
npx plugins add jkroepke/okf-crossplane-v2Pass --target codex to install only in Codex. Restart the selected agents
after installation.
Alternatively, install the hosted OKF-aware MCP server globally:
npx add-mcp \
https://crossplane.mcp.jkroepke.de/mcp \
--name crossplane-v2-okf \
--globalThen install the companion skill so the agent prefers this bundle over generic documentation providers for Crossplane v2 questions:
npx skills add jkroepke/okf-crossplane-v2 \
--skill crossplane-v2-okf \
--globalBoth standalone installers detect supported agents and ask where the integration should be installed. Restart the selected agent after installation.
The public MCP health endpoint is available at https://crossplane.mcp.jkroepke.de/healthz.
Self-hosting the MCP server
The included container fetches this repository, ingests catalog/ into a DuckDB catalog, and serves the okf-mcp tools over Streamable HTTP.
docker compose up --build --detachTo authenticate the server's GitHub requests, export GITHUB_TOKEN before
starting the container. The token is optional.
The local MCP endpoint is http://127.0.0.1:8000/mcp. Put it behind a TLS reverse proxy for crossplane.mcp.jkroepke.de.
The catalog is refreshed at container startup. If fetching or ingestion fails and a previous catalog exists in the volume, the server continues with that last successful catalog.
The MCP tools are read-only, but the public endpoint has no application-level authentication. Apply request limits and access controls at the reverse proxy when required.
Crossplane package tools
The server adds these tools backed by OSS GitHub repositories:
get_versions(name)resolves an OSS provider or function repository and returns its canonical repository name,versions.latest, a compact list of recent stable versions, and tag counts. Pass the returned provider name to the CRD tools.provider_crd_search(provider_name, provider_version, crd_search_term)searches CRDs in one explicit provider package version. The search term supports case-insensitive shell-style wildcards.provider_crd_get_definition(provider_name, provider_version, crd_name, path?)returns the complete CRD definition as token-efficient YAML. Use a dotted path such as.specor.spec.versions[0]to return only a subtree.provider_crd_get_examples(provider_name, provider_version, crd_name)returns GitHub repository paths for generated and handwritten examples. Without an API version, it selects the latest served CRD API version, for exampleexamples-generated/namespaced/ec2/v1beta2/route.yaml.provider_crd_get_terraform_docs(provider_name, provider_version, crd_name)returns the Terraform provider repository, version, and documentation path. It reads the Crossplane provider Makefile and the generated controller mapping instead of inferring the Terraform resource name.
crd_name accepts a Kind, group/Kind, group/version/Kind, or a YAML fragment containing apiVersion and kind.
Use an OSS GitHub repository name such as crossplane-contrib/provider-upjet-aws or crossplane-contrib/function-go-templating. A small set of historical package aliases is mapped to their known OSS source repositories; unmapped upbound/... names are rejected rather than guessed.
The CRD tools require an explicit provider version. The value latest is also supported and selects the highest stable semantic-version Git tag. Self-hosted deployments need outbound HTTPS access to GITHUB_API_URL and GITHUB_RAW_URL.
Successful remote fetches are cached in memory. Git tag listings use the configurable short FETCH_CACHE_TTL_SECONDS (default: 300 seconds); CRDs, definitions, examples, and Terraform metadata resolved at immutable Git tags are cached for 30 days. FETCH_CACHE_MAX_ENTRIES (default: 512) bounds memory use.
Why this repository exists
Crossplane knowledge is distributed across many repositories and kinds of sources:
Go API types and runtime implementations
CustomResourceDefinitions and OpenAPI schemas
package metadata
tests and executable examples
official Crossplane documentation
community implementations and real-world composition examples
Upjet-based providers add another layer. Their Crossplane managed resources are generated from Terraform provider resources, while the Terraform documentation often contains more details about the underlying cloud APIs and configuration fields.
This repository connects these sources in one versioned catalog without replacing the original documentation.
Knowledge structure
Knowledge is stored as small Markdown documents under catalog/. Each document represents an independently useful concept and includes OKF metadata, provenance in sources, keyed claim footnotes, and relationships to related concepts.
Repository validation pins okf-ingest 0.11.0, which adds OKF v0.2 core support, including generated.at freshness fallback and preservation of the new frontmatter families (upstream support commit).
If the task is to build a Crossplane v2 Composition, start with the Composition developer route. It routes agents through separate API/provider, pipeline/security, and testing/packaging concepts without pretending that provider-specific schemas or credentials are universal.
The catalog is intended to be:
Source-backed: important statements link to source code, schemas, tests, examples, or official documentation.
Version-aware: sources are tied to specific repository revisions.
Navigable: overview documents connect related concepts without requiring readers to know the source repository layout.
Incremental: providers, functions, services, documentation areas, and example repositories can be added in focused batches.
License
This project is licensed under the Apache License 2.0.
.okf/claim-ledger.md
type: Evidence Ledger title: Crossplane catalog claim ledger
Scope
xprin v0.5.0 function container reuse
Selected update candidate [email protected]:F05. Advanced the xprin lock from
v0.2.0 to v0.5.0 (eb5d7131c596e9a5663da349149184d54d704f42), the highest stable tag. Commit fffb1d7
(merged in eb5d713, PR #165) is an ancestor of v0.5.0 and not of v0.4.0; v0.4.0
has neither the flag nor the containers package, so reuse was default-on from
its first release (git ancestry; GitHub API unavailable, research timestamp
2026-10-16). The reuse markers are Kubernetes annotations on the temporary
Function copies, not Docker labels. The statelessness rationale is recorded as
xprin project documentation only. No legacy content applies.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| tools/xprin-function-container-reuse | Reuse is on by default for test and update-goldens; --no-container-reuse opts out. | API | primary and project-documentation | corroborated | Not stated by selected sources; test, update-goldens, docs |
| tools/xprin-function-container-reuse | v0.4.0 test flags had no container-reuse option. | release-history | primary | direct | Not stated by selected sources; v0.4.0 |
| tools/xprin-function-container-reuse | xprin sets runtime-docker-name and runtime-docker-cleanup: Orphan on Functions in the temporary copy and keeps user-set values. | behavior | primary | direct | Not stated by selected sources; annotations, wiring, tests |
| tools/xprin-function-container-reuse | Containers are named from the run id and image, one per image per run. | behavior | primary and project-documentation | corroborated | Not stated by selected sources; names, docs |
| tools/xprin-function-container-reuse | On CLI v2.3.0 or later one xprin-net network is passed as --crossplane-docker-network. | behavior | primary | direct | Not stated by selected sources; network, render, tiers, docs |
| tools/xprin-function-container-reuse | Containers and the network are removed best-effort at the end of the run. | behavior | primary | direct | Not stated by selected sources; cleanup, docker |
| tools/xprin-function-container-reuse | The Crossplane controller container is not reused; abrupt kills leave resources behind. | documented-guidance | project-documentation | direct | Not stated by selected sources; docs |
xprin v0.5.0 Crossplane version pinning
Selected update candidate [email protected]:F04. Advanced the xprin lock from
v0.2.0 to v0.5.0 (eb5d7131c596e9a5663da349149184d54d704f42), the highest stable tag. Commit c12006b
(PR #145) is an ancestor of v0.3.0 and not of v0.2.0, so xprin test --crossplane-version is available since v0.3.0; update-goldens with the
same flag also arrived in v0.3.0 (git ancestry; GitHub API unavailable,
research timestamp 2026-10-16). The flag is not render-only for xprin test:
it also sets the validate image. Render-side meaning inside the Crossplane CLI
is not claimed from xprin sources. No legacy content applies.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| tools/xprin-crossplane-version | xprin test and xprin update-goldens accept --crossplane-version with no default. | API | primary | direct | Not stated by selected sources; test, update-goldens |
| tools/xprin-crossplane-version | The test flag exists in v0.3.0. | release-history | primary | direct | Not stated by selected sources; v0.3.0 |
| tools/xprin-crossplane-version | Render gets --crossplane-version only on CLI v2.3.0 or later. | behavior | primary | direct | Not stated by selected sources; runner, tiers |
| tools/xprin-crossplane-version | Validation gets --crossplane-image=xpkg.crossplane.io/crossplane/crossplane:<value> on every tier when CRDs are supplied. | behavior | primary | direct; e2e covers the v2 tier only | Not stated by selected sources; runner, e2e |
| tools/xprin-crossplane-version | Older CLIs skip the render argument with a debug message. | behavior | primary | corroborated | Not stated by selected sources; message, tests |
| tools/xprin-crossplane-version | update-goldens stops after render, so only render is pinned. | behavior | primary | direct | Not stated by selected sources; stop |
xprin v0.5.0 Crossplane CLI tier detection
Selected update candidate [email protected]:F03. Advanced the xprin lock from
v0.2.0 to v0.5.0 (eb5d7131c596e9a5663da349149184d54d704f42), the highest stable tag. Commits 7060b7f,
29b57f0, 9d90058, 12e46a7, 844731b and 9d662a9 are ancestors of v0.3.0 and not
of v0.2.0, so detection is available since v0.3.0 (git ancestry; GitHub API
unavailable, research timestamp 2026-10-16). The tier picks the validate
subcommand and render flags, not the render subcommand. The project docs say
v2.0+ applies the XRD-default patch and also passes --xrd; the v0.5.0 code
skips the patch on --xrd tiers. That disagreement is kept on the page.
Excluded as legacy: the LegacyCluster XRD rationale for --xrd, Claim
conversion that reads patches.xrd, and the xrd_legacy.yaml fixture. The
v1 tier names a Crossplane v1.x CLI binary; v1 workflows are not described.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| tools/xprin-crossplane-cli-tiers | Tiers v2 (>= v2.3.0), v2legacy (< v2.3.0) and v1 set the validate subcommand and render flag support. | behavior | primary and project-documentation | corroborated | Not stated by selected sources; tiers, capabilities, docs |
| tools/xprin-crossplane-cli-tiers | Tier detection exists in v0.3.0. | release-history | primary | direct | Not stated by selected sources; v0.3.0 tiers |
| tools/xprin-crossplane-cli-tiers | Detection probes render --help for --xrd and resource validate --help. | behavior | primary | direct | Not stated by selected sources; detect |
| tools/xprin-crossplane-cli-tiers | Default render is render --include-full-xr; default validate is the tier subcommand with --error-on-missing-schemas. | behavior | primary | direct | Not stated by selected sources; defaults, load |
| tools/xprin-crossplane-cli-tiers | Explicit subcommands override detection; only render/beta render and resource validate/beta validate forms are accepted. | behavior | primary and project-documentation | corroborated | Not stated by selected sources; checker, docs |
| tools/xprin-crossplane-cli-tiers | On --xrd tiers xprin passes --xrd and skips its own XRD-default patch; docs say both happen. | behavior | primary | direct (code); disagreement with docs | Not stated by selected sources; runner, docs |
| tools/xprin-crossplane-cli-tiers | xprin check reports the tier; --xpcli-info prints it for e2e tests. | behavior | primary | direct | Not stated by selected sources; check, flag, output |
xprin v0.5.0 test artifacts export
Selected update candidate [email protected]:F02. Advanced the xprin lock from
v0.2.0 to v0.5.0 (eb5d7131c596e9a5663da349149184d54d704f42), the highest stable tag. Commit
3965f41144409dc5adf01c2bea5a53aaa3e8a076 (merged through PR #153) is an ancestor of v0.3.0, v0.4.0 and
v0.5.0 and not of v0.2.0, so the flag is available since v0.3.0 (git ancestry;
GitHub API unavailable, research timestamp 2026-10-16). The existing suite page
stays pinned to v0.2.0; its export step was clarified as id-based test
chaining, which the v0.2.0 execution sequence describes, and cross-linked. No
legacy content applies. Nothing was copied beyond one command line and a
paraphrased directory layout.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| tools/xprin-test-artifacts-export | The flag first appears in v0.3.0. | release-history | primary | direct | Not stated by selected sources; v0.3.0 flag |
| tools/xprin-test-artifacts-export | The run-directory timestamp uses local time. | behavior | primary | direct | Not stated by selected sources; run dir |
| tools/xprin-test-artifacts-export | xprin test -a/--artifacts-dir exports each test case's inputs and outputs; empty disables export. | API | primary and project-documentation | corroborated | Not stated by selected sources; flag, default, guide |
| tools/xprin-test-artifacts-export | One xprin-artifacts-<YYYYMMDDHHMMSS> run directory per invocation, with suite and NN_name test-case directories holding inputs and outputs. | behavior | primary | direct | Not stated by selected sources; run dir, layout, tests |
| tools/xprin-test-artifacts-export | Copies run on every exit path before cleanup; copy errors only warn. | behavior | primary | direct | Not stated by selected sources; copy, defer |
| tools/xprin-test-artifacts-export | The suite artifacts path is printed to standard error. | behavior | primary | corroborated | Not stated by selected sources; runner, guide |
| tools/xprin-test-artifacts-export | Outputs can include assertions.txt with all executed assertion results. | behavior | primary | direct | Not stated by selected sources; runner |
| tools/xprin-test-artifacts-export | Test chaining is separate: id-based outputs referenced through .Tests.<id>.Outputs and cleaned up. | behavior | project-documentation | direct | Not stated by selected sources; docs |
xprin v0.5.0 update-goldens command
Selected update candidate [email protected]:F01. Advanced the xprin lock from
v0.2.0 to v0.5.0 (eb5d7131c596e9a5663da349149184d54d704f42), the highest stable tag. Commit
60189256d1c80ea463a2699dd83952e50cb74aab (merged through PR #157) is an ancestor of v0.3.0, v0.4.0 and
v0.5.0 and not of v0.2.0, so the command is available since v0.3.0 (git
ancestry; GitHub API unavailable, research timestamp 2026-10-16). The existing
suite page stays pinned to v0.2.0 and gains one cross-link. The Claim-to-XR
conversion step and Claim-name golden reuse were excluded as legacy. Nothing
was copied beyond one command line.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| tools/xprin-update-goldens | The command is registered in v0.3.0. | release-history | primary | direct | Not stated by selected sources; v0.3.0 registration |
| tools/xprin-update-goldens | xprin update-goldens regenerates expected files for diff and dyff assertions. | API | primary | corroborated | Not stated by selected sources; registration, flags |
| tools/xprin-update-goldens | Targets match xprin test; at v0.5.0 flags are -v, -q, --debug, --color, --crossplane-version and --no-container-reuse; no --show-* or artifact export. | API | primary | direct | Not stated by selected sources; flags, options |
| tools/xprin-update-goldens | Test cases without diff or dyff assertions are skipped. | behavior | primary | corroborated | Not stated by selected sources; runner, docs |
| tools/xprin-update-goldens | Render runs; validation, assertions and post-test hooks do not. | behavior | primary | corroborated | Not stated by selected sources; stop, docs |
| tools/xprin-update-goldens | Render output is written to each expected path, full or per resource; a missing resource fails. | behavior | primary | direct | Not stated by selected sources; writes, tests |
| tools/xprin-update-goldens | Commit regenerated goldens as the test baseline. | documented-guidance | project-documentation | direct | Not stated by selected sources; guide |
| tools/xprin-update-goldens | Review regenerated files before committing because writes are unconditional. | guidance | primary | inferred | Not stated by selected sources; writes |
Crossplane CLI v2.5.0 resource validate Kubernetes built-ins
Selected update candidate [email protected]:F06. Advanced the
crossplane-cli lock from v2.4.0 to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b); the shared
crossplane-docs-cli-v2.5 lock entry is carried for the CLI v2.5.0 candidate
set. PR #197 merge commit cf03c1d2c1db3f8a67fc4785373e50c71a9038c4 and its commits 687fbe5 and b4e956e are
ancestors of v2.5.0 and not of v2.4.0 (git ancestry; GitHub API, issue #195
state and release notes unavailable at research time, 2026-10-16). The CLI v2.5
command reference and help do not mention built-in validation, so source and
tests are the evidence. Existing v2.4.0 statements were version-scoped rather
than removed. The PR #148 image-default change in v2.5.0 is a separate,
unselected change and was left untouched. No legacy content applies.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/local-composition-rendering | In CLI v2.4.0 any GVK without a supplied definition reports a missing schema. | release-history | primary | direct | Beta command group; v2.4.0 |
| cli/local-composition-rendering | From v2.5.0, GVKs without a supplied definition fall back to built-in strict decoding; supplied definitions take precedence; only unrecognized GVKs report missing. | behavior | primary | direct | Beta command group; fallback |
| cli/local-composition-rendering | Built-ins are client-go's scheme plus apiextensions.k8s.io/v1 and apiregistration.k8s.io/v1. | behavior | primary | direct | Beta command group; scheme |
| cli/local-composition-rendering | Strict decoding rejects unknown fields and mistyped values, reports them as schema errors, and is not admission or semantic validation. | behavior | primary | corroborated | Beta command group; decode, tests |
| cli/local-composition-rendering | Invalid resources make the command fail; missing schemas fail only with --error-on-missing-schemas. | behavior | primary | direct | Beta command group; exit |
| cli/local-composition-rendering | PR #197 adds built-in decoding and is contained in v2.5.0, not v2.4.0. | release-history | project-history | direct | merge commit |
| cli/local-composition-rendering | Use server-side dry-run or admission for semantic checks of built-ins. | guidance | primary | inferred | Follows from the stated non-admission scope; decode |
Crossplane CLI v2.5.0 Go model runtime objects
Selected update candidate [email protected]:F05. Advanced the
crossplane-cli lock from v2.4.0 to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b) and added the
crossplane-docs-cli-v2.5 lock at d1c9eb7fd1548d0d61ab3901781919a5b4aaf69d. Introducing commit 0990a75
is an ancestor of v2.5.0 and not of v2.4.0 (git ancestry; GitHub API
unavailable at research time, 2026-10-16). The flag carries no maturity label;
consuming commands are Beta, Alpha (operation render), or
unlabelled (composition render), and the Project metadata API is Alpha. A generator
comment mentioning claimRef only explains the root-struct rule; no legacy
behaviour is described. Nothing was copied beyond documented command lines.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/generated-go-runtime-objects | features.generateGoRuntimeObjects adds runtime.Object methods and per-package AddToScheme helpers; off by default. | API | primary and official-documentation | corroborated | Not stated by selected sources; config, default-off test, docs |
| cli/generated-go-runtime-objects | Every generated non-alias struct gets DeepCopyInto and DeepCopy; Time, MicroTime, FieldsV1 and RawExtension are copied by value. | behavior | primary | direct | Not stated by selected sources; loop, deepcopy, by-value |
| cli/generated-go-runtime-objects | Root structs (APIVersion, Kind, Metadata) get DeepCopyObject, GetObjectKind, GroupVersionKind, SetGroupVersionKind and scheme registration. The addRuntimeObjects doc comment still says APIVersion and Kind suffice; the code also requires Metadata. | behavior | primary | direct | Not stated by selected sources; loop, root, methods |
| cli/generated-go-runtime-objects | Registering packages get groupversion_info.go with GroupVersion, SchemeBuilder and AddToScheme; built-in packages use real API groups. | behavior | primary | direct | Not stated by selected sources; writer, tests |
| cli/generated-go-runtime-objects | composition generate, project build, dependency add, composition render and operation render pass the option; filtering commands honour spec.schemas.languages, the render commands do not. | behavior | primary | direct | Beta, Alpha (operation) or unlabelled (composition render); composition, build, dependency add, composition render, operation render, composition group |
| cli/generated-go-runtime-objects | runtime.Object generation runs before accessors. | behavior | primary | direct | Not stated by selected sources; order |
| cli/generated-go-runtime-objects | The models go.mod always declares go 1.24.0 and requires k8s.io/apimachinery v0.33.0; v2.4.0 declared go 1.23 with only oapi-codegen/runtime as a direct requirement. | release-history | primary | direct | Not stated by selected sources; v2.5.0, v2.4.0 |
| cli/generated-go-runtime-objects | Compile-and-scheme behaviour tests run only with the compilegate build tag. | test-coverage | primary | direct | Not stated by selected sources; compilegate |
| cli/generated-go-runtime-objects | An end-to-end workflow inherits Alpha from the Project metadata API that every consuming command reads. | inference | primary | inferred | Alpha (least stable required surface); languages, maturity |
Crossplane CLI v2.5.0 Go model accessors
Selected update candidate [email protected]:F04. Advanced the
crossplane-cli lock from v2.4.0 to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b) and added the
crossplane-docs-cli-v2.5 lock at d1c9eb7fd1548d0d61ab3901781919a5b4aaf69d. Introducing commits
e38b155, 07a44e7, 474c701 and 992a1b3 are ancestors of v2.5.0; v2.4.0 config
features are only enableAlpha and disableBeta (git ancestry and source;
GitHub API unavailable at research time, 2026-10-16). The flag carries no
maturity label; consuming commands are Beta, Alpha (operation render) or
unlabelled (composition render), and all read the Alpha Project metadata API. The config.Load comment claims unknown fields are errors, but the code
uses non-strict YAML unmarshalling, so that claim was not recorded. No legacy
content applies; nothing was copied beyond documented command lines.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/generated-go-model-accessors | features.generateGoModelAccessors adds GetX/SetX methods to generated Go models; off by default. | API | primary and official-documentation | corroborated | Not stated by selected sources; config, docs |
| cli/generated-go-model-accessors | CLI v2.4.0 config had only enableAlpha and disableBeta. | release-history | primary | direct | Not stated by selected sources; v2.4.0 config |
| cli/generated-go-model-accessors | The config file is found via --config, CROSSPLANE_CONFIG, then the XDG or ~/.config default; it must declare version: 1; a missing file disables all features. | behavior | primary and official-documentation | corroborated | Not stated by selected sources; path, load, docs |
| cli/generated-go-model-accessors | crossplane config set accepts only known keys and parses booleans. | behavior | primary | direct | Not stated by selected sources; set |
| cli/generated-go-model-accessors | Only the Go generator receives the option; commands that filter by spec.schemas.languages generate no Go models without go, while composition render and operation render pass unfiltered generators. | behavior | primary | direct | Alpha (Project API); options, filter, composition render, operation render |
| cli/generated-go-model-accessors | composition generate, project build, project run, function generate, dependency add, dependency update-cache, composition render and operation render pass the option. | behavior | primary | direct | Beta, Alpha (operation) or unlabelled (composition render); composition, build, run, function, dependency add, update-cache, composition render, operation render, maturity, composition group |
| cli/generated-go-model-accessors | Accessors use pointer receivers and the field type; getters are nil-safe, setters are not; aliases, embedded, unexported and existing method names are skipped. | behavior | primary | direct | Not stated by selected sources; generator, method set, nil guard |
| cli/generated-go-model-accessors | Accessors run after runtime.Object generation and skip colliding names. | behavior | primary | direct | Not stated by selected sources; order |
| cli/generated-go-model-accessors | With the setting off no accessors are generated. | behavior | primary | direct | Not stated by selected sources; test |
| cli/generated-go-model-accessors | An end-to-end workflow inherits Alpha from the Project metadata API that every consuming command reads. | inference | primary | inferred | Alpha (least stable required surface); languages, composition render, maturity |
Crossplane CLI v2.5.0 xrd generate --replace
Selected update candidate [email protected]:F03. Advanced the
crossplane-cli lock to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b) and added the CLI v2.5 docs lock
(d1c9eb7fd1548d0d61ab3901781919a5b4aaf69d). Commit b1c20a42a03f74bb0437eccb56d7ba999e8298f6 (PR #243) is an
ancestor of v2.5.0 and not of v2.4.0 (git ancestry; GitHub API unavailable at
research time, 2026-10-16). Loss of hand edits is an inference from the
full-file write. No legacy material; nothing copied.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/control-plane-projects | xrd generate writes <plural>/definition.yaml or --path in the APIs directory and refuses to overwrite without --replace. | behavior | primary | corroborated | Beta; handling, tests, docs |
| cli/control-plane-projects | CLI v2.4.0 had no --replace and told users to delete the file or use --path. | release-history | primary | direct | Beta; v2.4.0 flags without Replace, v2.4.0 error |
| cli/control-plane-projects | Replacing loses hand edits. | behavior | primary | inferred | Beta; full write |
Crossplane CLI v2.5.0 SimpleSchema customTypes
Selected update candidate [email protected]:F02. Advanced the
crossplane-cli lock to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b). Commit
410f1d8c3aa250a719676f851cf819ff05592d83 (PR #238) is an ancestor of v2.5.0
and not of v2.4.0, where both conversions passed no custom types (git ancestry;
GitHub API unavailable at research time, 2026-10-16). The SimpleSchema parser is
kro v0.9.2 (22f5645777c86ebd40b6143f248549f1dbe2923f, selected by the CLI
go.mod) and is used only as supporting evidence; its documentation names the
section types, which conflicts with the CLI key customTypes and is
recorded as a note. The CLI v2.5 docs (d1c9eb7fd1548d0d61ab3901781919a5b4aaf69d) do not document the key. No legacy
material; nothing copied.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/control-plane-projects | xrd generate --from simpleschema reads a top-level customTypes map used by spec and status conversion. | API | primary | direct | Beta (xrd group); input, conversion, label |
| cli/control-plane-projects | Custom types are expanded inline as object schemas in the generated XRD. | behavior | primary | corroborated | Beta; test, kro docs |
| cli/control-plane-projects | The example-XR route rejects customTypes. | behavior | primary | direct | Beta; allowed keys |
| cli/control-plane-projects | kro documents the section as types and supports types referencing types. | documented-guidance | supporting | direct | Not stated by selected sources; kro docs |
Crossplane CLI v2.5.0 xrd convert JSON Schema output
Selected update candidate [email protected]:F01. Advanced the
crossplane-cli lock from v2.4.0 to v2.5.0 (1acb525095a4e43c9a765954efa66a47667a432b) and added the
crossplane-docs-cli-v2.5 lock at d1c9eb7fd1548d0d61ab3901781919a5b4aaf69d, whose content/cli/v2.5/** matches
the last v2.5 docs commit 9c144a9144e97f3c77fdd50adc8aa515b8032504. Commit
a92acf938afe05be77bc10551ff5f4bea901df89 (PR #142, renamed to --format
before release) is an ancestor of v2.5.0 and not of v2.4.0 (git ancestry; the
GitHub API was unavailable at research time, 2026-10-16). Existing CLI pages stay
on v2.4. Legacy XRD and Claim CRD output, the -o help clause about Claim CRDs,
and the LegacyCluster multi-schema test were excluded. Nothing was copied beyond
two documented command lines.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/xrd-convert | xrd convert derives the CRD Crossplane generates from an XRD; Namespaced or Cluster XRDs yield one XR CRD. | documented-guidance | official-documentation | direct | Beta; reference |
| cli/xrd-convert | --format accepts crd (default) or jsonschema. | API | primary | direct | Beta; docs flag table shows only the default (partial); flags, docs |
| cli/xrd-convert | Each CRD version with a schema becomes one JSON Schema with $id and GVK metadata; files are <group>_<version>_<kind>.json. | behavior | primary | direct | Beta; per version, $id, routing |
| cli/xrd-convert | More than one schema requires --output-dir. | behavior | primary | direct | Beta; writing |
| cli/xrd-convert | Objects without additionalProperties get additionalProperties: false. | behavior | primary | direct | Beta; mutation |
function-go-templating v0.13.0 default template options and receive size
Selected update candidate [email protected]:F03. Advanced the
function-go-templating lock from v0.12.4 to v0.13.0 (9b7ea49394a7cef38fe517d2b60f55d64c4c8511). Commit
ee0dd5d8bd99b9e341ed2ccdeec655e44e4fb33d (PR #563, --default-options),
cd51c130161746d5ed7a6dd7c67b3b71ffbd8e32 (PR #592) and merge commit
8495fe5735358bf6e76816b35d1c9c36596f0b0d (PR #593, final name
MAX_RECV_MESSAGE_SIZE) are ancestors of v0.13.0 and not of v0.12.6. The
--max-recv-message-size flag itself predates v0.12.2. Containment was
established with git ancestry because the GitHub API was unavailable at research
time (2026-10-16); the dated project-history note is labelled accordingly.
Nothing was copied. No legacy material was involved.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions/function-go-templating/runtime-options | --default-options / FUNCTION_GO_TEMPLATING_DEFAULT_OPTIONS supply comma-separated options used only when input options is unset. | behavior | primary | corroborated | Not stated by selected sources; flags, selection, tests |
| functions/function-go-templating/runtime-options | The value is split on commas without trimming; invalid options produce a fatal result. | behavior | primary | direct | Not stated by selected sources; selection, recovery |
| functions/function-go-templating/runtime-options | The README describes missingkey=default as the effective default; missingkey=error makes missing keys fatal. | documented-guidance | supporting | corroborated | Not stated by selected sources; README, tests |
| functions/function-go-templating/runtime-options | MAX_RECV_MESSAGE_SIZE sets the existing --max-recv-message-size flag (MB, default 4) from v0.13.0. | behavior | primary | direct | Not stated by selected sources; flags, v0.12.2 flag |
| functions/function-go-templating/project-history | PR #593's merge commit is contained in v0.13.0. | release-history | project-history | direct | git ancestry; merge commit |
function-go-templating v0.13.0 response TTL
Selected update candidate [email protected]:F02. Advanced the
function-go-templating lock from v0.12.4 to v0.13.0 (9b7ea49394a7cef38fe517d2b60f55d64c4c8511). Commit
2171d4a597835dea79639e55daa3017395696303 (PR #426) is an ancestor of v0.13.0
and not of v0.12.6; v0.12.4 hard-coded response.DefaultTTL. Containment was
established with git ancestry because the GitHub API was unavailable at research
time (2026-10-16). Supporting sources: function-sdk-go v0.7.1
(176ccd5428a608f823c8c7562ffb090ca2c166d5, selected by go.mod) for the default
and the TTL semantics, and Crossplane v2.4.2 (bf8ffd4048a0bb1b408b8b745e31960c717009cb)
for pipeline TTL selection. No README or example documents the feature; nothing
was copied. No legacy material was involved.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions/function-go-templating/response-ttl | --ttl defaults to the SDK DefaultTTL of one minute and an invalid value stops startup. | behavior | primary | corroborated | Not stated by selected sources; flag, parsing, SDK default |
| functions/function-go-templating/response-ttl | A parseable non-empty input ttl replaces the flag value; an unparseable one is ignored. | behavior | primary | direct | Beta (v1beta1 input field); precedence, CRD |
| functions/function-go-templating/response-ttl | The observed-XR annotation gotemplating.fn.crossplane.io/ttl overrides flag and input; the desired XR keeps the annotation. | behavior | primary | corroborated | Not stated by selected sources; override, tests |
| functions/function-go-templating/response-ttl | An unparseable annotation sets TTL zero despite the "Ignoring" debug log. | behavior | primary | inferred | Not stated by selected sources; override |
| functions/function-go-templating/response-ttl | v0.12.4 returned the fixed SDK default TTL and had no TTL flag. | release-history | primary | direct | v0.12.4 fn.go |
| functions/function-go-templating/response-ttl | A response TTL tells Crossplane when to call the function again and how long it may cache the response. | API | supporting | direct | ResponseMeta |
| functions/function-go-templating/response-ttl | Crossplane v2.4.2 uses the smallest non-zero step TTL. | behavior | supporting | direct | Core implementation; pipeline TTL |
function-go-templating v0.13.0 Unknown ready-annotation alias
Selected update candidate [email protected]:F04. Advanced the
function-go-templating lock from v0.12.4 to v0.13.0 (9b7ea49394a7cef38fe517d2b60f55d64c4c8511). Commit
599edc93f52ba112a61c8449bdaa03a40da1e07a is an ancestor of v0.13.0 and not of
v0.12.6 (git ancestry; the GitHub API was unavailable at research time,
2026-10-16). The README readiness section lists no values, so the code and test
are the evidence. Only the composite path has an Unknown test; the composed
path shares the same parsing code. The Claim-conditions branch was excluded as
legacy.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions/function-go-templating/patterns/manual-readiness | From v0.13.0 the ready annotation accepts exact Unknown, treated as Unspecified; the error text still lists three values. | behavior | primary | corroborated | Beta pattern ceiling unchanged; alias, test |
| functions/function-go-templating/rendered-output | The alias applies to composed and composite resources. | behavior | primary | direct | Not stated by selected sources; alias, composite apply, composed apply |
function-go-templating v0.13.0 getComposedConnectionDetails helper
Selected update candidate [email protected]:F01. Advanced the
function-go-templating lock from v0.12.4 (fe17e68927afd64046232f39a2376e87b45e2f58)
to the highest stable tag v0.13.0 (9b7ea49394a7cef38fe517d2b60f55d64c4c8511). Commit
162e6052d98e71ce8b7d3d9bc55f740c33f49b66 (PR #566) is an ancestor of v0.13.0
and is not contained in v0.12.6; containment was established with git ancestry
because the GitHub API was unavailable at research time (2026-10-16). The
template-functions reference was re-pinned to v0.13.0 after confirming that the
other helpers are unchanged apart from moved line ranges and the condition type
moving from crossplane-runtime xpv1 to crossplane apis/v2 core/v2. The
upstream example's functions.yaml pins package v0.12.5, which does not contain
the helper, and contains a stray cluster-scoped XR; it was summarized, not
copied. The README section v1 Composite Resources (Legacy) was excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions/function-go-templating/template-functions | getComposedConnectionDetails request name reads observed.resources[<name>].connectionDetails and returns the map or nil when the resource or details are absent; dotted names work. | behavior | primary | direct | Not stated by selected sources; lookup, tests |
| functions/function-go-templating/template-functions | Returned values are base64-encoded strings. | behavior | primary | inferred | Not stated by selected sources; protojson request conversion, test fixture |
| functions/function-go-templating/template-functions | Connection details exist only in real observed state; crossplane render cannot simulate them. | documented-guidance | supporting | direct | Not stated by selected sources; example notes |
| functions/function-go-templating/template-functions | Indexing a nil result renders <no value> under default options. | behavior | primary | inferred | Not stated by selected sources; Go text/template semantics, labelled as inference |
| functions/function-go-templating/connection-details | A top-level observed-resources nil check covers only the first reconciliation; a source resource can be observed before its connection details exist. | behavior | primary | inferred | Labelled inference from the observed-state flow; no selected source states it |
| functions/function-go-templating/connection-details | From v0.13.0 the helper returns the same observed connectionDetails map; the Crossplane v2.3 guide predates it. | behavior | primary | direct | Beta input API unchanged; lookup |
Optional Crossplane control plane projects for new Compositions
Reused the existing crossplane-docs-v2.4 lock at
f51137d2f8e92a167bb580be528c78b879ed406d and the existing
crossplane-cli v2.4.0 lock at
ef9b974770a45e085aacee3b2cdda6284ab6cf51; neither source identity was
advanced. The official CLI documentation is the authority for the documented
workflow and explicit Beta state. CLI source is used only to establish the
project metadata boundary. Claims, deprecated XRD v1, legacy v1 XR semantics,
historical design, and project history were excluded. No source text or
examples were copied or adapted. Revalidated 2026-09-05: the Beta state applies
to the command workflow, while the separate dev.crossplane.io/v1alpha1
Project metadata API is Alpha.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| cli/control-plane-projects | The crossplane project command group is explicitly Beta and may change in a future release. | documented-guidance | official-documentation | direct | Beta; project command lifecycle |
| cli/control-plane-projects | A control plane project groups API definitions, Compositions, embedded Functions, examples, and crossplane-project.yaml; project init creates the standard directories. | documented-guidance | official-documentation | direct | Beta project workflow; project contents, initialization |
| cli/control-plane-projects | The documented route can generate an XRD from an example XR or SimpleSchema, generate a Composition, add dependencies, and scaffold an embedded Function. | documented-guidance | official-documentation | direct | Beta because the route uses the Beta project capability; XRD generation, Composition and Function workflow |
| cli/control-plane-projects | In a project directory, local Composition rendering discovers and builds embedded Functions without the standalone Functions manifest argument. | documented-guidance | official-documentation | direct | Beta project workflow; project-mode rendering |
| cli/control-plane-projects | crossplane project run creates a KIND development control plane and local registry, builds and pushes embedded Function and Configuration packages, installs the Configuration, and selects that cluster in kubectl. | documented-guidance | official-documentation | direct | Beta project workflow; local project run |
| cli/control-plane-projects | Project build and push provide the documented route to package a project for an existing Crossplane cluster. | documented-guidance | official-documentation | direct | Beta project workflow; build and push |
| cli/control-plane-projects | The Project metadata type is not a Kubernetes resource; it describes a buildable Configuration and its repository, dependencies, Functions, paths, architectures, and schema generation. | API | primary | direct | Alpha for the Project metadata API because the project file uses dev.crossplane.io/v1alpha1; Project API, project paths, documented API version |
The instruction to ask before wrapping a new Composition is a user-requested catalog authoring policy. It is intentionally labelled as such and is not attributed to Crossplane documentation. Project mode remains opt-in; the standalone manifest route remains available.
Provider development SDK from provider-template
Selected the user-requested crossplane/provider-template main snapshot at
a74b386da0ec848036e16ff0a207c5a16bc9827f. This workflow pins that immutable
snapshot rather than assigning it a semantic-version release identity. Its
go.mod selects Crossplane and crossplane-runtime v2.3.3; the
runtime tag resolves to fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827.
Version-matched supporting sources are crossplane/build at
b964dbe0ff0856a762f1a06fe554c647d22af7f0 and crossplane-tools at
60e57f817ad1f80dcf052a940cf923fde56fab1f. Current orientation uses
Crossplane v2.4.0 and docs series v2.4 at
f51137d2f8e92a167bb580be528c78b879ed406d. Researched 2026-08-21.
Claims, deprecated XRD v1, legacy v1 XR semantics, Core design documents, and
project history were excluded. No source text or examples were copied or
adapted.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| sdk/provider-development/start-here | Official v2.4 documentation assigns providers authentication, external API calls, Kubernetes APIs, and controller logic; provider-template is an official minimal hand-written-provider starting point. | documented-guidance | official-documentation and primary | corroborated | Not stated by selected sources; provider responsibilities, template purpose |
| sdk/provider-development/start-here | The selected template snapshot selects Crossplane APIs and crossplane-runtime v2.3.3; a stable dependency tag does not establish template maturity. | API | primary | direct | Not stated by selected sources; selected dependencies |
| sdk/provider-development/start-here | The template workflow initializes the build submodule, renames the provider, adds an API type, replaces sample implementations, registers controllers, then runs reviewable and build targets. | documented-guidance | primary | direct | Not stated by selected sources; workflow |
| sdk/provider-development/managed-resource-apis | The sample MyType is a namespaced modern managed resource with ManagedResourceSpec, forProvider, ManagedResourceStatus, and atProvider. | API | primary | direct | Alpha because the owning sample API is sample.template.crossplane.io/v1alpha1; type, version |
| sdk/provider-development/managed-resource-apis | Runtime ModernManaged adds a local connection-secret target and typed ProviderConfig reference to the base managed contract; LegacyManaged is explicitly deprecated for new namespace-scoped MRs. | API | primary | direct | Go SDK maturity is Not stated; the legacy sub-surface is explicitly Deprecated. interfaces |
| sdk/provider-development/managed-resource-apis | Authored API types and generator directives are source inputs; deepcopy/methodset files and packaged CRDs are generated outputs. | behavior | primary and supporting | corroborated | Not stated by selected sources; generation directives, angryjet methodsets |
| sdk/provider-development/provider-configuration | The Alpha template API defines namespaced ProviderConfig, cluster-scoped ClusterProviderConfig, and namespaced ProviderConfigUsage with typed references. | API | primary | direct | Alpha from template.crossplane.io/v1alpha1; types |
| sdk/provider-development/provider-configuration | The template declares None, Secret, InjectedIdentity, Environment, and Filesystem sources, but runtime's common extractor has no generic InjectedIdentity handler. | API and limitation | primary | corroborated | Alpha for the template credential API; helper maturity Not stated. template credentials, runtime extractor |
| sdk/provider-development/provider-configuration | The connector tracks typed ProviderConfig usage before fetching the selected namespaced or cluster-scoped config, then extracts credentials and constructs the external service client. | behavior | primary | corroborated | Template API Alpha; runtime behavior maturity Not stated. template connector, usage tracker contract |
| sdk/provider-development/managed-reconciler | Typed external clients must be non-blocking and idempotent; Observe must not mutate the external resource, and Create, Update, Delete, and Disconnect have explicit lifecycle roles. | API | primary | direct | Not stated by selected sources; these are unlabelled Go SDK contracts. external client |
| sdk/provider-development/managed-reconciler | The reconciler initializes and resolves references before connecting and observing; reference resolution is skipped during deletion, and connection/observation failures produce events and conditions. | behavior | primary | direct | Not stated by selected sources; ordering |
| sdk/provider-development/managed-reconciler | The template wires a typed connector, usage tracker, safe-start gate, management-policy option, desired-state filter, metrics, poll interval, and rate limiter, but its external service behavior is explicitly simulated and must be replaced. | behavior and illustrative-pattern | primary | direct | Runtime/template workflow maturity Not stated; sample API Alpha. setup, simulated client |
| sdk/provider-development/managed-reconciler | Runtime supplies fake modern/legacy managed resources, ProviderConfigs, typed usages, and a configurable controller-runtime mock client; the template's TestObserve table has no cases. | API and limitation | primary | direct | Not stated by selected sources; runtime fakes, mock client, empty template test table |
| sdk/provider-development/generate-test-package | The template gitlink pins crossplane/build at b964dbe0; that build machinery defines reviewable as generation, lint, and test, while generation runs go generate and go mod tidy, tests use go test with coverage, and build compiles configured static packages. | behavior | primary and supporting | corroborated | Not stated by selected sources; immutable template tree and build gitlink, reviewable, Go targets |
| sdk/provider-development/generate-test-package | The template builds a Provider runtime image and an xpkg whose metadata declares a Provider and safe-start capability; the selected xpkg machinery embeds the runtime image. | behavior and API | primary and supporting | corroborated | Workflow/package maturity Not stated; template targets, xpkg build, metadata |
| sdk/provider-development/generate-test-package | Official v2.4 docs install provider packages from an OCI registry through a Provider object and support digest references for deterministic installs; the page explicitly excludes provider-building instructions. | documented-guidance | official-documentation | direct | Not stated by selected sources; installation, digest |
Limitations and source boundaries
provider-templateis an official primary source, while itsMyType, credentials examples, and simulated external service are illustrative scaffolding that the repository directs authors to replace.The selected template snapshot uses Crossplane/runtime v2.3.3 while current stable Crossplane orientation is v2.4.0.
The older contributing provider-development guide states a runtime v0.9.0 target and cluster-scoped-only assumptions. Those statements were excluded from current SDK guidance; current template and version-matched runtime implementation establish the selected behavior.
The template README calls ProviderConfig Secret-only, while its types and CRD admit five credential sources. The API/schema are used for shape and the disagreement is preserved.
The integration script discovers a chart version dynamically, so it is not evidence for an immutable Crossplane integration-test version.
provider-template, crossplane-runtime, crossplane/build, and crossplane-tools are Apache-2.0 licensed. This catalog summarizes and cites without copying or adapting source material.
function-kro v0.3.0 preview
The user explicitly selected function-kro v0.3.0, a GitHub prerelease, at
a0b4c088bd950cb407901d01ee29263e6d54d639. Its go.mod selects
github.com/kubernetes-sigs/kro v0.9.2; the annotated KRO tag resolves to
22f5645777c86ebd40b6143f248549f1dbe2923f, whose website/docs provide the
version-matched supporting documentation. Researched 2026-08-21. Claims,
claim references, deprecated XRD v1, and legacy v1 XR semantics were excluded.
No source text or examples were copied or adapted.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions/function-kro/package | Package metadata declares a Crossplane Function named function-kro; the README places it in a Composition pipeline with a ResourceGraph input. | API and documented-guidance | primary | direct | Package maturity is Not stated by selected sources; explicit preview selection is source scope, not a maturity label. metadata, pipeline |
| functions/function-kro/package | The selected preview directly depends on KRO v0.9.2; KRO semantics are sourced only from that tag's peeled commit. | API | primary and supporting | direct | Not stated by selected sources; function dependency, version-matched KRO docs |
| functions/function-kro/input | ResourceGraph is a non-installed KRM-like Function input at kro.fn.crossplane.io/v1alpha1; its optional fields are status and resources. | API | primary | direct | Alpha, from the served v1alpha1 input API. type |
| functions/function-kro/input | Each resource has an ID and exactly one of template or externalRef; the schema also exposes forEach, includeWhen, and readyWhen. | API | primary | direct | Alpha input API. packaged schema |
| functions/function-kro/input | ${...} expressions are CEL; whole-field expressions preserve their result type while embedded string expressions require strings. | documented-guidance | supporting | direct | Pattern is Alpha because it requires the function's Alpha input API. KRO v0.9.2 CEL syntax |
| functions/function-kro/graph-evaluation | The function requests schemas for the XR and graph GVKs, uses required_schemas when advertised, otherwise requests CRDs, and waits without a fatal result while schemas are unavailable. | behavior | primary | direct | Alpha, inherited from the required ResourceGraph input. request path, schema paths |
| functions/function-kro/graph-evaluation | CEL references infer graph dependencies; the function evaluates runtime nodes topologically and defers resources whose expression data is pending. | behavior and documented-guidance | primary and supporting | corroborated | Alpha, inherited from the required ResourceGraph input. KRO dependency semantics, desired evaluation |
| functions/function-kro/graph-evaluation | External references are read-only and excluded from desired output; name and selector modes are mutually exclusive. | behavior and API | primary and supporting | corroborated | Alpha, inherited from the required ResourceGraph input. function behavior, KRO v0.9.2 guidance |
| functions/function-kro/graph-evaluation | Single desired resources use their node ID; collection members use {id}-{metadata.name}. readyWhen sets explicit readiness; absent readyWhen, readiness remains unspecified for later functions. | behavior | primary | direct | Alpha, inherited from the required ResourceGraph input. desired identity and readiness |
| functions/function-kro/graph-evaluation | Desired XR output contains only resolved status paths declared by the ResourceGraph, limiting SSA ownership. | behavior | primary | direct | Alpha, inherited from the required ResourceGraph input. status projection |
Limitations and source boundaries
The selected sources do not provide an immutable package image reference or a package-installation command.
KRO controller installation, generated CRDs, GraphRevisions, permissions, and controller lifecycle are not transferred to function-kro.
The KRO upstream
kro.run/v1alpha1API is Alpha, but that state is not used to label the function package. The function's ownkro.fn.crossplane.io/v1alpha1input independently establishes the Alpha ceiling for input-dependent patterns.Both repositories are Apache-2.0 licensed; this catalog summarizes and cites without copying source text or examples.
Custom-resource gate CRD cache schema stripping
Selected crossplane-runtime v2.4.0 at
71f319796d597c2c6cf004cc4bf5f44011a5aeaa; comparison baseline v2.3.3
at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827. The release histories
diverge but retain common merge base
1ed37b54bfd85825ea7a739d6295c60369e31533; availability was established
from the exact base and head states. Researched 2026-08-19. Primary
implementation evidence only; Claims, deprecated XRD v1, and legacy v1 XR
semantics were excluded. No source text was copied or adapted.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| sdk/crd-cache-schema-stripping | TransformStripCRDSchema is an exported controller-runtime cache transform, and its source shows it configured in cache.Options.ByObject for CustomResourceDefinition objects. | API | primary | direct | Not stated by selected sources; this is an unlabelled non-API Go helper. API and cache configuration |
| sdk/crd-cache-schema-stripping | For CRDs, the transform nils every version schema and managed fields, deletes only the last-applied annotation, mutates and returns the same pointer, and preserves other annotations; non-CRDs pass through unchanged. | behavior | primary | corroborated | Not stated by selected sources; implementation and tests |
| sdk/crd-cache-schema-stripping | The transform retains the CRD group, kind, version names, served flags, and Established status condition used by the custom-resources gate reconciler. | behavior | primary | corroborated | Not stated by selected sources; reconciler reads and transform tests |
| sdk/crd-cache-schema-stripping | The helper is opt-in: customresourcesgate.Setup registers the controller but does not configure the manager cache. | behavior | primary | direct | Not stated by selected sources; cache configuration example and setup |
| sdk/crd-cache-schema-stripping | A shared cache using the transform cannot supply schemas, managed fields, or the removed annotation to another reader; use immutable provider CRD artifacts rather than transformed cache objects for schema inspection. | authoring guidance | primary | inferred from direct transformation behavior | Not stated by selected sources; removed fields |
| sdk/crd-cache-schema-stripping | The helper is absent at the bounded v2.3.3 baseline and present at v2.4.0; a stable tag establishes release availability, not feature maturity. | release history | primary | direct | Not stated by selected sources; immutable release comparison |
Limitations and unresolved evidence
The selected source does not quantify memory savings or recommend the transform for every controller.
No selected source documents or tests typed-nil CRD input behavior.
No third-party or historical-design evidence was used. The repository is Apache-2.0 licensed, and the catalog summarizes and cites without copying or adapting source material.
Composed-resource identity and replacement
Selected Core release: v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation series v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91; selected crossplane-runtime v2.3.3 at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827; supporting Kubernetes v1.35.0 at 66452049f3d692768c39c797b21b793dce80314e. Researched 2026-07-16. Claims, deprecated XRD v1, legacy v1 XR semantics, CLI material, design documents, and project history were excluded. No source text was copied or adapted.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| composed-resource-identity-and-replacement | A ResourceName is the logical Composition/Function resource-map key, not the composed object's Kubernetes metadata.name; Core persists the logical key as the composition-resource-name annotation. | behavior | primary | direct | Maturity not stated by selected sources; identity definition, annotation rendering, annotation key and accessors, association |
| composed-resource-identity-and-replacement | When desired and observed states contain the same logical key, v2.3.3 overwrites desired name, namespace, and generateName with observed values before SSA. A changed desired metadata.name is discarded, no replacement object is declared, and no name-change-specific error is emitted. | behavior | primary | corroborated from complete released code path | Maturity not stated by selected sources; identity restoration, SSA |
| composed-resource-identity-and-replacement | Kubernetes ObjectMeta.name cannot be updated, but the same-key Composition path does not submit that invalid update because it restores the observed name first. | behavior | supporting and primary | corroborated | Kubernetes metadata, Core overwrite |
| composed-resource-identity-and-replacement | After a referenced Kubernetes object is fully absent, the observer skips the stale reference; without an observed match, an explicit desired name survives or normal generation runs, and Crossplane records the ref before applying the absent object. | behavior | primary | corroborated by code and tests | NotFound path, naming and refs, test |
| composed-resource-identity-and-replacement | Changing the logical key makes the old key undesired and the new key unmatched. Core garbage collects the old object before recording refs and applying the new object; a one-step key swap is not create-before-delete. | behavior | primary | direct | ordering, key-based GC |
| composed-resource-identity-and-replacement | For controlled replacement, first render old and new resources under distinct keys, wait for readiness and cut over consumers, then omit the old key in a later revision. | authoring guidance | primary and official-documentation | inferred | Mechanisms are direct but the staged procedure is inferred; desired-state deletion, controller ordering |
| composed-resource-identity-and-replacement | Core does not use an immutable desired-field change as a delete-and-create trigger. For external resources, absence selects Create while an existing outdated resource selects Update; an update error has no Core replacement fallback. | behavior and documented-guidance | primary, primary implementation dependency, and official-documentation | corroborated | immutable fields, create, update |
| composed-resource-identity-and-replacement | “Recreation happens only after explicit Kubernetes deletion” is too broad: Composition desired-state omission deletes a composed object, and a Provider with Create permission can recreate an externally deleted resource while the Kubernetes MR remains. | behavior boundary | primary and official-documentation | corroborated | Composition GC, management policies |
Limitations and unresolved evidence
No v2.3.3 unit test directly supplies an existing observed resource and a different explicit desired
metadata.nameunder the same logical key; the released overwrite path is explicit and unconditional.The staged replacement procedure is implementation-backed authoring inference, not a procedure stated end to end in official documentation.
Provider-specific replacement, adoption, external-name, finalizer, and data-retention behavior remains unresolved without a selected Provider release.
Crossplane Core cannot establish whether a Provider or external service internally replaces a resource during
Update.
function-sequencer Input and deletion-scope safety
Selected function-sequencer v0.6.0 at 8ee29b46b7b9491fb307cf6caf339541a8d93422; preceding stable v0.5.0 at 33505d3c6fb203b1f5f7a0257c28a8de3001ebf9; supporting Core v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d. Researched 2026-07-16. User commit e277a4070f65fc50dfb08b03d2acdcbdbfe1350b is post-release context only.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| function-sequencer/input | The v0.6.0 Input is a KRM-like sequencer.fn.crossplane.io/v1beta1 object; its generated definition is not installed, rules is required, and runtime constraints include regex and CEL evaluation. | API and behavior | primary | direct | Beta; input type, definition |
| function-sequencer/input | cacheTTL parses non-empty Go durations and invalid values are fatal; the generated 1m marker is not a runtime default. replayDeletion is copied to Usage resources and remains false at runtime unless explicitly set, despite its source default marker. | behavior | primary | direct | Beta; runtime, generation |
| function-sequencer/input | usageVersion selects v1 only for exact v1; empty or unknown values select v2. V2 selects namespaced Usage when the predecessor has a namespace and ClusterUsage otherwise; v1 emits the legacy cluster-scoped Usage kind. | behavior and safety guidance | primary | direct | Beta; discriminator and generators |
| function-sequencer/input | enableDeletionSequencing defaults false and generates Usage objects only for already-observed dependency pairs. resetCompositeReadiness defaults false and marks the XR not ready only when an unobserved successor is removed. | behavior | primary | direct | Beta; deletion and readiness, gating |
| function-sequencer/input | A false rule condition skips creation gating but does not prevent Usage generation; deleteOnly skips creation blocking but still permits Usage generation. Sequences are strict regexes by default and invalid patterns are fatal. | behavior | primary | direct | Beta; rule processing, regex |
| function-sequencer/input | Do not enable v2 deletion sequencing for a cluster-scoped predecessor and namespaced successor: generated ClusterUsage has no namespace fields and Core resolves endpoints in the empty namespace, so the relationship cannot resolve safely. | safety guidance | primary corroborated with project history | direct | Beta; function generation, ClusterUsage, Core lookup |
| function-sequencer/input | Issue #114 is an open report by human author @jkroepke (opened 2026-03-09, updated 2026-03-10) of a v0.5.0 ClusterUsage without namespace remaining unready for a namespaced resource; it is not proof that every deployment becomes undeletable or that a fix shipped. | reported-limitation | project-history corroborated by primary | corroborated | Researched 2026-07-16; issue #114 |
| function-sequencer/input | Post-v0.6.0 commit e277a407... adds rules[].createOnly and mutual exclusion with deleteOnly; it is not selected stable behavior. | release-history | primary | direct | Post-release; input type |
function-sequencer behavior
Selected function-sequencer release: v0.6.0 at 8ee29b46b7b9491fb307cf6caf339541a8d93422; preceding stable release: v0.5.0 at 33505d3c6fb203b1f5f7a0257c28a8de3001ebf9. Supporting Core release: v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; function-go-templating: v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830. Research completed 2026-07-16. Claims, deprecated XRD v1, and legacy v1 XR semantics were excluded. No source text was copied.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| function-sequencer/sequencing | Sequencer filters unobserved successors until every matched predecessor is Ready=True in accumulated desired state, while preserving an observed successor during a predecessor readiness regression. Auto-ready can derive that desired readiness from observation, while manual readiness can set it explicitly. | behavior | primary | direct | Beta from served Input v1beta1; sequencer implementation, auto-ready, manual readiness |
| function-sequencer/sequencing | Blocked or false-condition paths return Normal Function results; Core converts them to Kubernetes Events on the composite resource. | behavior | primary function and Core | corroborated | Beta Input; sequencer results, Core Event conversion |
| function-sequencer/input | Input v1beta1 requires rules and provides sequence, CEL condition, deleteOnly, cacheTTL, deletion-sequencing, Usage-version, and composite-readiness controls. | API | primary | direct | Beta from Input types and generated CRD |
YAML document boundaries in conditional Go templates
Selected function-go-templating release: v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830; preceding stable release: v0.12.1 at 548ae34fd9c843f0747981894fb7fa0ff1ba47fa. Supporting Go text/template source is go1.25.3 at 28622c19591d95c9a83f706f2ed1b303d58da85f. Research completed 2026-07-16. Claims, deprecated XRD v1, and legacy v1 XR semantics were excluded. No source text was copied; the small template snippets are adapted, provider-neutral patterns.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| yaml-document-boundaries | An Inline template can emit multiple YAML manifests through inline.templates or --- separators in inline.template. | documented-guidance | primary | direct | Beta from served v1beta1; README, CRD |
| yaml-document-boundaries | Go-template trim markers remove immediately adjacent whitespace. Therefore, retaining untrimmed control actions at syntactically significant YAML boundaries is an inferred authoring pattern that prevents a separator or field boundary from being joined to adjacent YAML text. | behavior and illustrative-pattern | supporting, applied to primary function behavior | corroborated and inferred | Beta from served v1beta1; Go whitespace rules, function README |
| yaml-document-boundaries | A suffix-aware truncation budget preserves the literal suffix within a chosen 63-character DNS-label limit, but cannot establish global uniqueness or a limit for an annotation key whose consumer does not require it. | illustrative-pattern | user-supplied example and supporting | inferred and direct | No function feature-state claim; Kubernetes defines a 63-character DNS label limit in validation; the supplied suffix lengths produce budgets of 56, 53, 49, and 59 characters. |
| yaml-document-boundaries | default true cannot distinguish an absent boolean from explicit false. For map fields, hasKey must select the fallback before get renders the supplied boolean. | API and behavior | supporting, availability gated by primary | corroborated | Beta from served v1beta1; Sprig dictionary lookup, defaults, function map |
| yaml-document-boundaries | kindIs "invalid" can guard a genuinely nil template value without comparing it to nil. It does not detect a missing Sprig get map key, because get returns an empty string. | API and behavior | supporting | corroborated | Sprig reflection helpers, get implementation; eq/ne comparisons require comparable types in Go templates. |
| yaml-document-boundaries | Human contributor @jkroepke recorded kindIs "invalid" $value as a nil workaround in Sprig issue #53. This is historical project evidence, not release behavior. | project history | project-history | direct as historical report | comment, authored 2019-04-15; researched 2026-07-16. |
| yaml-document-boundaries | A pinned yq pretty-print pass can parse and reserialize multiple YAML documents as a structural formatting gate; it does not prove the intended resource set. | illustrative-pattern | supporting | direct and inferred | yq multi-document support, eval command, and pretty-print flag |
| yaml-document-boundaries | crossplane composition render renders a Composition; crossplane resource validate is the validation command. crossplane composition validate is not a documented CLI command. | API and documented-guidance | primary | direct | CLI render-to-validation help |
Safe database status and connection publication
Selected Core release: v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation series v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91; function-go-templating v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830; and Crossplane runtime v2.3.3 at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827. Research completed 2026-07-16. Claims, deprecated XRD v1, and legacy v1 XR semantics were excluded. No source text was copied; the small template fragment is an adapted provider-neutral pattern.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| safe-status-and-connection-publication | A normally rendered composed resource needs a stable composition-resource-name, which becomes its desired/observed resource key. | behavior | primary | direct | Beta: the selected GoTemplate input serves v1beta1; function output handling |
| safe-status-and-connection-publication | Publishing a connection-secret reference and application-ready status only after all required observed resources are Ready and their required details exist is a strict, inferred authoring pattern. | documented-guidance and inference | official-documentation | corroborated | function mutation/readiness scope, initial observed-state guard |
| safe-status-and-connection-publication | Ready=True/Available identifies provider-reported usability, while Synced=True/ReconcileSuccess identifies successful reconciliation; Synced=True alone is insufficient for a strict consumer-ready contract. | documented-guidance and inference | official-documentation | direct and inferred | condition meanings |
| safe-status-and-connection-publication | A same-type rendered object without a composition-resource-name updates composite status; Kubernetes creates objects with metadata.name or a generated name; a managed resource may use external-name for its provider identity while retaining a Kubernetes-compatible metadata.name. Provider support and identifier format remain provider-specific. | behavior, API, and documented-guidance | primary and official-documentation | corroborated | status behavior, Kubernetes metadata, external name docs, runtime definition |
| safe-status-and-connection-publication | Defer a dependent desired resource only until the observed prerequisite value it requires exists; once a long-lived desired resource is introduced, continue rendering it and use explicit readiness for transient availability. Crossplane deletes a resource intentionally omitted from the next desired state. Exact inter-resource reference and retry behavior are provider-specific. | behavior and documented-guidance | primary and official-documentation | corroborated | desired-state deletion behavior, provider-defined settings boundary |
| safe-status-and-connection-publication | Observed connection-detail values are base64-encoded and may be copied to Secret.data; a derived URI must decode required components and encode the finished value once. Status should expose only the Secret reference after readiness and required data checks. | documented-guidance and inference | official-documentation | corroborated | v2 connection-details guide, condition meanings |
provider-kubernetes Object readiness and secret boundaries
Selected provider-kubernetes release: v1.2.1 at 0ea671a4dab090ff3b14877d35086f1950fa35e3; supporting function-auto-ready v0.7.0 at ed7886de159af73b9d6976f04f9171ec7a4cb411; supporting Sprig v3.3.0 at e708470d529a10ac1a3f02ab6fdd339b65958372. Research completed 2026-07-16. The wrapped Object API is Alpha because it serves v1alpha1. No provider-specific application CRD schema, image, service-discovery convention, or password format is claimed.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| provider-kubernetes-object-readiness | Object wraps a desired Kubernetes manifest and records the observed target in wrapper status; the Object API is Alpha. | API and behavior | primary | direct | Alpha from served v1alpha1; types |
| provider-kubernetes-object-readiness | SuccessfulCreate means target creation or up-to-date state; DeriveFromObject requires a standard Ready=True condition and is not a generic arbitrary-CR readiness detector. | behavior | primary | direct | Alpha; policy and evaluator, condition evaluator |
| provider-kubernetes-object-readiness | Wrapper status is not a generic durable Secret store because Secret sanitization can redact data before persistence. Random template values are non-hermetic, so fallback generation without a durable persistence contract can churn. | behavior and inference | primary and supporting | corroborated | Alpha wrapper; sanitization, Sprig maps |
| provider-kubernetes-object-readiness | function-auto-ready evaluates matching desired/observed resource keys and preserves prior explicit readiness, so it must follow rendering and cannot correct an unconditional earlier ready assertion. | behavior | primary | direct | Supporting function maturity not stated by selected sources; matching, explicit-readiness preservation |
Unresolved: concrete provider resource shapes, condition semantics, connection-detail key names, ProviderConfig behavior, and Terraform/HCL authoring requirements are not established without selecting and pinning the relevant provider releases.
External Secrets Operator PushSecret pattern
Selected supporting source: External Secrets Operator v2.7.0 at
e215053f3e68504de7483f9542b49f19f98293a1. This is a community
Kubernetes-secret publication pattern, not a Crossplane API or recommendation.
No Crossplane Core release or documentation series is used. The served
external-secrets.io/v1alpha1 PushSecret API makes the pattern Alpha. Claims,
deprecated XRD v1, legacy v1 XR semantics, and copied source material are
excluded. The source license is Apache-2.0; the catalog example is authored
from the API shape and is not copied or adapted.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| core/pushsecret-external-store-pattern | ESO's namespaced PushSecret selects a Kubernetes Secret and pushes mapped or bulk-selected data to external secret providers through SecretStore or ClusterSecretStore references. | API and documented-guidance | supporting | corroborated | Alpha from served external-secrets.io/v1alpha1; CRD, API guide, types |
| core/pushsecret-external-store-pattern | A Secret selected by name must be in the same namespace as PushSecret; PushSecret can reference SecretStore or ClusterSecretStore targets. | API | supporting | direct | Alpha from served v1alpha1; source-Secret rule, store reference type |
| core/pushsecret-external-store-pattern | data maps source keys to remote keys, while dataTo bulk-selects keys; a dataTo target must name or label-select a store, and its key conversion defaults to None. | API | supporting | direct | Alpha from served v1alpha1; data mapping, dataTo validation and conversion |
| core/pushsecret-external-store-pattern | Replace is the default update policy; IfNotExists avoids overwrite but may leave the cluster and provider values different. Provider secrets are retained on PushSecret deletion unless deletionPolicy is Delete. | documented-guidance | supporting | direct | Alpha from served v1alpha1; policy guide |
| core/pushsecret-external-store-pattern | Official v2.7.0 snippets demonstrate a Vault SecretStore with remote-key mappings and AWS Secrets Manager-oriented per-entry metadata. | illustrative-pattern | supporting | direct | Alpha from served v1alpha1; Vault snippet, AWS snippet |
Historical design: controlled rollout of Composition Functions
Selected Core release and requested design snapshot v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d. Its status is Accepted; it contains no prominent accuracy or implementation-completeness warning. That status establishes only that the proposal was accepted, not that it was released or remains current. Claims, deprecated XRD v1, legacy v1 XR semantics, and CLI material are excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| controlled-rollout-of-composition-functions-design | The design proposes (rather than establishes) multiple active Function revisions and pipeline-level revision reference or selection. | historical-context | historical-design | direct | No feature state is derived from the Accepted design status; design proposal, proposed Function field, proposed pipeline fields |
| controlled-rollout-of-composition-functions-design | In v2.3.3, Function exposes revisionActivationPolicy and revisionHistoryLimit, while a Composition pipeline step exposes functionRef.name; the controller invokes that name. Selected-release schema and controller evidence do not expose the design's activeRevisionLimit, functionRevisionRef, or functionRevisionSelector, so controlled Function-revision rollout is not recorded as current behavior. | API and behavior | primary | corroborated | Function package API has a Beta ceiling; the Composition pipeline API is Stable by repository default; controller invocation behavior has no separate maturity label. Function schema, pipeline schema, controller invocation |
Unresolved: this bounded review does not determine whether the accepted proposal is intended for a future release, has been replaced by another design, or exists outside the selected v2.3.3 release. It makes no roadmap claim.
Provider connection-detail source retrieval
Selected Core documentation series: v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. Selected provider sources: provider-upjet-aws v2.6.0 at 857b535dd0eb9b8242ad9d7c4e54aaa3e4616d60 and provider-upjet-azure v2.6.0 at e0398bae1693e229c9060631e048b93177df6fa4. Runtime key constants are pinned at 504c43e478d7364d73a1834ba277e3a9f94b8e0a. Claims, deprecated XRD v1, and legacy v1 XR semantics are excluded. No source text is copied.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| providers/provider-connection-details-source-retrieval | writeConnectionSecretToRef selects the connection Secret destination; resource-specific key availability remains provider-defined. | API and documented-guidance | primary and official-documentation | corroborated | Not stated by selected sources for the provider behavior; v2.3 guidance, Azure CRD |
| providers/provider-connection-details-source-retrieval | The selected AWS EFS FileSystem configurator returns id only when Terraform attribute id is a string. | behavior | primary | direct | Not stated by selected sources; EFS configurator |
| providers/provider-connection-details-source-retrieval | The selected Azure MSSQLServer configurator returns username and endpoint after required attribute extraction, and returns password only when the password attribute is available. | behavior | primary | corroborated | Not stated by selected sources; Azure function, runtime keys |
| providers/provider-connection-details-source-retrieval | The selected provider-sql MSSQL User path returns a typed managed.ConnectionDetails map with username, password, endpoint, and port, and passes it to the runtime publisher on create and password update. | behavior | primary | corroborated | The v1alpha1 User API is Alpha; the provider implementation pattern is Not stated by selected sources. Client, reconciler, runtime publisher |
Provider-domain foundation
Selected Core release: v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation series v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. Selected provider sources: provider-upjet-aws v2.6.0 at 857b535dd0eb9b8242ad9d7c4e54aaa3e4616d60, provider-aws v0.58.0 at 405d4d48d20c332ee427beb4187f80cc4b0af4ea, provider-opentofu v1.1.4 at 6a1a4f3a3c174b4f6d91c84e74c4a5b6781b0609, and supporting Upjet v2.3.0 at b02902e67b336b94e6bd119b86d14077ed0a0a32. The user-supplied Upbound provider-family documentation is pinned at 889d144d40620e05129a935824c592aece77657a. Claims, deprecated XRD v1, and legacy v1 XR semantics are excluded. No source text is copied.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| providers/provider-landscape | Upjet generates Crossplane CRDs, controllers, examples, and runtime support from Terraform provider schemas; provider-upjet-aws is explicitly built with Upjet. | behavior | supporting and primary | corroborated | Upjet, provider-upjet-aws |
| providers/provider-landscape | The selected legacy/community AWS provider uses a distinct AWS Go code-generation pipeline with required Crossplane-specific and controller work; provider-opentofu exposes a bespoke OpenTofu Workspace API. | behavior and API | primary | corroborated | provider-aws generation guide, provider-opentofu Workspace type |
| providers/provider-landscape | The two selected AWS providers have different Bucket CRD group/scope identities, so they are not manifest-compatible replacements. Upjet documents migration support but also reasons to consider native providers; no universal Upjet-preference rule is established. | API and documented-guidance | primary and supporting | corroborated | Upjet Bucket CRD, community Bucket CRD, Upjet guidance |
| providers/provider-package-revisions | Provider and ProviderRevision are cluster-scoped. A Provider update creates a ProviderRevision; exactly one revision of each Provider is Active, and active revisions establish package APIs and run provider deployments. | API, behavior, documented-guidance | primary and official-documentation | corroborated | Provider CRD, revision activation docs, runtime deployment lifecycle |
| providers/provider-package-revisions | Multiple Kubernetes clusters are an operational isolation choice for simultaneously active provider API/controller surfaces; Crossplane sources do not make them mandatory for provider staging because Manual activation and inactive-revision retention provide a single-cluster upgrade path. | documented-guidance and inference | official-documentation and primary | inferred | Manual activation behavior, activation policy, provider upgrade docs |
| providers/upjet-terraform-provenance | A selected Upjet Makefile pins the Terraform schema baseline and upstream docs snapshot, but conversion requires resource config and generated CRD. AWS's forked schema binary may differ from upstream docs. | behavior and illustrative-pattern | primary and supporting | corroborated | Makefile, S3 config, Terraform docs |
| providers/upjet-terraform-provenance | Repository naming is not evidence of Upjet implementation; use a release README declaration corroborated by Makefile, dependencies, and resource configuration before treating Terraform documentation as supporting example evidence. | behavior | primary | corroborated | README, go.mod |
| providers/upjet-terraform-provenance | Hand-maintained examples are CI-checked resource coverage and generated examples are pipeline output; neither alone proves an end-to-end use case. | behavior and illustrative-pattern | primary | corroborated | CI/checker, generator |
| providers/crd-schema-discovery | Version-addressed Upbound API package-resource routes provide a rapid CRD inventory and group/kind lookup; latest is mutable discovery input, not reproducible source evidence. | API and documented-guidance | official-registry | direct and inferred | inventory, Bucket lookup |
| providers/crd-schema-discovery | upbound/provider-aws-s3 identifies provider-upjet-aws as its source; it is neither a nonexistent crossplane-contrib/provider-aws-s3 repository nor the distinct community provider-aws family. Published backport capabilities do not prove byte-for-byte equivalence or a paywalled fix. | API and documented-guidance | official-registry | direct and inferred | Upbound S3 package, community AWS provider, support capabilities |
| providers/provider-families | AWS v2.6.0 family resource packages carry a provider-family label and dependency; its monolithic package is deprecated. The historical blog provides rationale only. | API and historical-context | primary and historical-context | corroborated | AWS package template, historical blog |
| providers/provider-families | In v2.3 documentation .m. denotes modern namespaced managed resources. It supports a v2 namespaced-model preference, not a universal family or package-selection rule. | documented-guidance | official-documentation | direct and inferred | v2.3 guide, AWS modern and non-modern CRDs |
| providers/provider-families | For Upbound official provider families, services are installed as individual Provider packages; the first family service also installs a shared provider-family Provider that manages ProviderConfig for the family. | documented-guidance | official-documentation | direct | Upbound provider-family installation, family Provider behavior |
| providers/provider-families | Upbound documents that an existing matching monolithic provider remains the endpoint owner until removed; the family does not take effect before that migration boundary. | documented-guidance | official-documentation | direct | Upbound migration warning |
| providers/provider-families | A family service declares a dependency on the latest available corresponding family package. The package manager resolves it automatically; an older service package can therefore use a newer shared family package, which the documentation describes as expected. | documented-guidance | official-documentation | direct | Upbound dependency-resolution guidance |
XRD-backed CRD authoring
Selected Core release: v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching Crossplane documentation series v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. Kubernetes CRD semantics are supporting documentation from kubernetes/website release-1.35 at be897babb9149b808e2ab8ed5367e5d0651b3dca. Claims, deprecated XRD v1, and legacy v1 XR semantics are excluded. No source text is copied.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| xrd-openapi-schema | An XRD version accepts an OpenAPI v3 schema; Crossplane injects common XR fields and supplied fields of the same names do not win. | API | primary | direct | XRD CRD |
| xrd-openapi-schema | Keep provider region platform-selected by default; if an XR product intentionally exposes a location, model a service-level string constrained to approved values with OpenAPI enum. This is an inferred platform API design recommendation, not a Crossplane restriction. | documented-guidance and inference | supporting documentation | direct and inferred | Kubernetes CRD schema enum example |
| xrd-cel-validation | The renderer selected by v2.3.3 propagates schema-root CEL and a released unit test retains a rule using metadata.name; Core uses the renderer, but a v2-specific API-server admission test is not established. Runtime metadata shaping retains only name, so labels are not established as CEL-accessible. | behavior and unresolved limitation | primary | corroborated | renderer and metadata shaping, unit test, Core wiring |
| xrd-unknown-data | Kubernetes structural-schema, preservation, list, map, and CEL visibility semantics constrain the schema carried by an XRD. | documented-guidance | supporting | direct | Kubernetes CRD docs |
| xrd-api-version-evolution | XRD served and unique referenceable map to generated-CRD serving and storage; an XRD v1alpha1 marked referenceable: true renders as a CRD v1alpha1 with storage: true; Kubernetes conversion webhooks are a CRD mechanism for incompatible served schemas. | API and documented-guidance | primary and supporting | corroborated | XRD type, runtime renderer, Kubernetes versioning |
| xrd-subresources-and-display | XRD versions configure generated-CRD scale and printer columns; a Composition must implement the scaling data flow. | API and documented-guidance | primary and official-documentation | corroborated | XRD CRD, scale guide |
| tenant-xr-api-security | A shared fictional XR group is an organization convention that simplifies RBAC rule/binding administration; it is not a Kubernetes security boundary. | documented-guidance | primary and supporting | corroborated | RBAC scope |
| tenant-xr-api-security | VAP and Kyverno can derive dynamic validation data from namespace labels; controller identity exclusions skip policy evaluation but must be scoped to actual identities. | documented-guidance | primary and official-documentation | corroborated | VAP API, Kyverno docs |
Project-history snapshots, researched 2026-07-15: human-authored PR #7018 by jonasz-lasut was merged on 2026-02-06 at 7e8d6e108b846555abdd09f60188b7adcf451495; it is post-v2.3.3 and therefore establishes only post-release development. Human-authored PR #5908 by vibe was merged on 2024-08-22 at dbc64645fc4843d1dfd37008222356bc8edbe9aa; it is historical release context only here. Issue #5070 by ra-grover was a human-authored report, not proof of current behavior. Bot and app activity was excluded.
Selected release v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830; supporting Sprig v3.3.0 at e708470d529a10ac1a3f02ab6fdd339b65958372. Maturity of the project-specific helpers is not stated by selected sources; the stable semantic-version tag pins released evidence rather than establishing maturity. The ExtraResources rendering directive is Alpha because it uses meta.gotemplating.fn.crossplane.io/v1alpha1. Claims, deprecated XRD v1, legacy v1 XR semantics, and the README section explicitly labelled v1 Composite Resources (Legacy) were excluded.
The readiness-pattern update additionally uses Sveltos addon-controller and
libsveltos v1.12.0, pinned at
b528b72dedf369566470709796d23d93fa1827b1 and
82cc79ba33929ffd061ee75f106a3bd8b70addcd. Sveltos is third-party example
evidence for this Crossplane catalog and primary implementation evidence only
for its own API and controller behavior. The integration example is adapted,
not copied; both Sveltos repositories and both Crossplane functions are
Apache-2.0 licensed.
EnvironmentConfig lifecycle and three-function pipeline
Selected Core releases: v1.17.3 at 481d3ca7193c89708b9a40375381862d25d64006, v1.18.0 at e663a43ece850e93fe5cdebb2e478e2fb9762ad1, and current v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d. Current documentation is v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91; historical v1.18 documentation is pinned at ad7f75a96dc902b1cdfee213255d87612fccbdbe. Selected function releases are environment-configs v0.7.2 at 5589092483aea1d65b9988f5116106585c4b516b, go-templating v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830, and auto-ready v0.7.0 at ed7886de159af73b9d6976f04f9171ec7a4cb411. Claims, deprecated XRD v1, legacy XR semantics, and old Resource-mode examples were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| environment-config | EnvironmentConfig remains a cluster-scoped schemaless data API in v2.3.3 and serves only v1beta1. | API | primary and official-documentation | corroborated | Beta; CRD |
| native-composition-environment-removal | v1.18 removed native Alpha Composition selection/loading/environment patches, not the EnvironmentConfig resource. | API and release-history | primary and official-documentation | corroborated | Removed capability; old Alpha field, migration docs |
| environment-configs-package | function-environment-configs v0.7.2 requires Crossplane 2.x and writes merged data to the standard environment context key. Package maturity is not stated; its separate Input API is Beta. | API and behavior | primary | direct | Package maturity not stated; metadata |
| environment-configs-input | Input supports default data, ordered references or selectors, Single/Multiple cardinality, label matchers, sorting, and Required/Optional resolution. | API | primary | direct | Beta; types |
| environment-configs-input | Runtime types and tests support toFieldPath but the packaged schema omits it, so safe packaged use is unresolved. | API conflict | primary | corroborated | Beta context; type, schema |
| selection-and-merge | Later selected data overrides earlier data, selected data overrides defaults, and defaults override incoming environment context; maps merge recursively. | behavior | primary | corroborated | Beta; runtime |
| go-templating-environment-source | Environment source requires a string at the named key beneath the reserved environment context; missing or wrong-typed values are fatal before template parsing. | API and behavior | primary | direct | Beta input ceiling; loader |
| auto-ready-environment-context | Alpha CEL rules may load from a bracket-and-dot environment context path; inline rules override context rules and parser/type misses are silently ignored. | API and behavior | primary | corroborated | Explicit Alpha; merge, parser |
| environment-config-pipeline | Function ordering follows data dependencies: environment-configs precedes a context-consuming template; auto-ready follows resource-producing steps and optional context producers. | illustrative-pattern and behavior | primary function repositories and official-documentation | corroborated | Alpha when CEL customizations or Alpha Context mutation are used; example |
Unresolved: the packaged toFieldPath schema conflict; stale v1alpha1 auto-ready README snippets versus the served v1beta1 input; old go-templating environment example pins and legacy XRD companion material. No project-history or design evidence was used for this batch.
Claims
All claims have function scope v0.12.2 unless a narrower version is stated.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| manual-readiness | The readiness annotation accepts True, False, or Unspecified, writes desired-resource readiness, and is removed from the emitted object. | API and behavior | primary | corroborated | implementation, named-resource handling |
| manual-readiness | getResourceCondition returns Unknown for missing state and getComposedResource returns the unwrapped observed object or nil. | behavior | primary | direct | condition helper, resource helper |
| non-composed-resource-readiness | An ExtraResources result can be translated by an earlier template into explicit readiness on a complete desired composed resource. | illustrative-pattern | primary | inferred from direct APIs | lookup, readiness handling |
| sveltos-clustersummary-readiness | Exact-name ExtraResources selection copies namespace, while label selection in v0.12.2 returns without it. | API and behavior | primary | direct | selector conversion |
| sveltos-clustersummary-readiness | A Sveltos Profile ClusterSummary is namespaced with the target cluster and deterministically named p--profile-capi-or-sveltos-cluster. | illustrative-pattern and behavior | third-party example; primary for Sveltos | direct | creation, naming |
| sveltos-clustersummary-readiness | Sveltos records feature status per configured feature class and regards Provisioned as success; its per-summary complete check requires all expected feature classes, while a separate check compares the copied summary configuration with the Profile. | illustrative-pattern and behavior | third-party example; primary for Sveltos | corroborated | status schema, complete check, sync check |
| package | A pipeline references the installed Function name and supplies a v1beta1 GoTemplate input. | API | primary | direct | README L9-L44 |
| package | This catalog selected v0.12.2 and pinned its commit. | release-history | primary | direct | commit 0a1e6d3 and source lock |
| input | The generated CRD serves/stores v1beta1, requires source, and defines the six input fields. | API | primary | direct | CRD L8-L94 |
| input | Inline requires exactly one of template and templates. | API | primary | direct | CRD L56-L69 |
| input | Default delimiters are {{ and }}; options is top-level. | API | primary | direct | CRD L31-L42, L80-L85 |
| input | Inline, FileSystem, and Environment load templates as documented. | documented-guidance | primary | direct | README L46-L59 |
| request-data | Templates receive observed/desired state, context, and extra resources. | behavior | primary | direct | README L60-L73 |
| request-data | Context and ExtraResources special resources update pipeline context. | behavior | primary | direct | README L159-L277 |
| context | The Alpha Context instruction accepts map-shaped data, deeply merges it over incoming request context, and writes merged top-level values to response context. | API/behavior | primary | corroborated | fn.go L290-L310, context.go L10-L20 |
| context | Multiple Context documents each merge against original request context; a later document updating the same top-level key can supersede earlier same-invocation nested updates. | behavior | primary | inferred from direct implementation flow | fn.go L198-L310, context.go L10-L20 |
| context-meta-kinds | Context and ExtraResources are v2-safe; ClaimConditions remains usable for v2 when targeting Composite, while CompositeAndClaim is Claim-dependent and excluded. | behavior/documented-guidance | primary | corroborated | runtime switch, condition targets |
| request-data | getCredentialData returns named request credential bytes. | behavior | primary | direct | function_maps.go L166-L177 |
| rendered-output | Resource-name and readiness annotations control composed-resource identity and readiness reporting. | behavior | primary | direct | function_maps.go L101-L103, README L124-L147 |
| rendered-output | v2 connection details use an explicitly composed Secret. | documented-guidance | primary | direct | README L101-L122 |
| connection-details | Crossplane v2 Compositions aggregate connection details by explicitly composing a Kubernetes Secret from observed composed-resource values. | documented-guidance | official-documentation and primary | corroborated | v2.3 guide L227-L315, README L101-L122 |
| connection-details | Stable composition resource-name annotations identify source resources under $.observed.resources and track the aggregate Secret as a composed resource. | behavior and illustrative-pattern | official-documentation and primary | corroborated | guide manifest L20-L66, helper L101-L103 |
| connection-details | Templates must tolerate initial reconciliation before observed resources exist; observed connection-detail values are already base64-encoded for direct placement in Secret.data. | documented-guidance | official-documentation | direct | v2.3 guide L307-L315 |
| connection-details | The connection-details concept is Beta because it uses the served GoTemplate v1beta1 input API. | API | primary | direct | generated CRD L8-L22 |
| rendered-output | Same-type output can update status or create a composed resource; recursion must terminate through another composition. | behavior/guidance | primary | direct | README L279-L350 |
| template-functions | The selected function map adds eleven named helpers; include has a recursion bound. | API/behavior | primary | direct | function_maps.go L24-L55, L105-L121 |
| template-functions | randomChoice is time-seeded and non-cryptographic; YAML helpers return execution errors; condition and lookup helpers return Unknown or nil on absent paths. | behavior | primary | direct | function_maps.go L67-L99, L124-L164 |
| template-functions | setResourceNameAnnotation returns a YAML mapping line and getCredentialData returns byte data only for a named CredentialData source. | behavior | primary | direct | function_maps.go L101-L103, L166-L190 |
| extra-resources | The Alpha ExtraResources directive supports cluster-scoped label matching, including an empty label map, but v0.12.2 returns from the label path before copying namespace; only the exact-name path preserves namespace. Crossplane therefore receives an empty namespace and performs an all-namespace label list, subject to RBAC. Runtime behavior also gives non-empty matchName precedence, conflicting with the field comment about label precedence. | API/behavior | primary | corroborated | selector conversion, released tests, Crossplane fetcher |
| extra-resources | A getExtraResources range guarded by the observed composite namespace is a template-side consumption filter: it can prevent an already-returned cross-namespace item from influencing rendered output, but cannot scope the earlier label-list request, reduce its RBAC requirement, or avoid its lookup cost. | illustrative-pattern and behavior | primary | corroborated | helper lookup, selector conversion, Crossplane list |
| extra-resources | No exposed Sprig v3.3.0 helper selects an arbitrary list item by a nested namespace predicate. A Go-template variable can retain the first in-namespace item and break stops the template scan; this does not change the earlier fetched list. | illustrative-pattern and behavior | supporting and primary | corroborated | Sprig list helpers, Sprig dictionaries, function map, Go-template control syntax |
| extra-resources | Requirement keys must be unique; all selectors populate required_resources and cluster-scoped selectors also populate the deprecated-compatible extra_resources field. | behavior | primary | direct | fn.go L311-L330, L366-L368 |
| extra-resources | Within each protocol map, fetched groups overwrite same-key incoming-context groups and retain unrelated incoming groups; when both maps are present, current required_resources are written second from the original context and supersede the legacy merge. | behavior | primary | direct | extraresources.go L64-L117, fn.go L370-L384 |
| extra-resources | A zero-match selector is non-fatal: Crossplane records the requirement key, calls the function again with no items, and completes when returned requirements stabilize; required does not impose a minimum match count. | behavior | primary (Crossplane Core and function implementation) | corroborated | protocol L70-L92, runner L67-L149, function completion L353-L388 |
| extra-resources | Exact-name NotFound is represented internally as a nil group without error, while an empty label List yields a group with zero items; helpers tolerate absent and empty paths, and bundled examples normalize them with default (list). | behavior and illustrative-pattern | primary | corroborated | fetcher L171-L227, helper tests L572-L593, example L18-L52 |
| extra-resources | Zero matches differ from failures: template execution errors can return fatal, non-NotFound Kubernetes fetch errors abort the pipeline step, and changing requirements are bounded by the stabilization loop. | behavior | primary | direct | function fatal path L90-L118, fetch errors L116-L136, pipeline propagation L401-L409 |
| template-functions | Sprig v3.3.0 is required; env and expandenv are removed. | API/behavior | primary | direct | go.mod L5-L10, function_maps.go L56-L62 |
| sprig | Exposed Sprig groups cover data shaping, collections, encoding, paths, dates, SemVer, crypto, randomness, and network. | documented-guidance | supporting, availability gated by primary | corroborated | Sprig index L3-L25, function map L56-L62 |
| sprig | Current-time, random, and DNS helpers are non-hermetic. | behavior | supporting | direct | functions.go L67-L94 |
| project-history | PR #580 is the sole commit from v0.12.1 to v0.12.2 and is contained in the selected release. | release-history | project-history corroborated by released source | corroborated | comparison, released go.mod |
| project-history | Human-authored PR #498 introduced the ExtraResources namespace field and is contained in v0.12.2; released code proves that its namespace assignment is reached only on the exact-name path. | release-history and behavior | project-history corroborated by released source | corroborated | PR #498, release containment, released conversion; researched 2026-07-14 |
| project-history | Issue #579 reports missing initial-reconciliation fields under .observed.composite.resource.spec against function v0.11.0 and Crossplane v1.19.x; the reporter said reading .desired resolved the reproduction and proposed an observed fallback or split pipeline steps. | reported-limitation and reported workarounds | project-history; selected-release primary and supporting sources establish only workaround availability and semantics | direct as a report; corroborated only for .desired availability and Sprig default semantics | issue #579, human follow-up, selected-release request data, Sprig defaults; researched 2026-07-14 |
| project-history | Issues #536, #535, #501, #61, and #40 are older-version or unverified reports, not v0.12.2 facts. | reported-limitation | project-history | direct as reports | Direct issue URLs in project-history.md; researched 2026-07-12 |
| project-history | PR #592 is post-release main-branch development and open PR #593 is a proposal, neither part of v0.12.2. | proposal | project-history | direct | Direct PR URLs in project-history.md; researched 2026-07-12 |
Unresolved
Runtime source-to-field validation is outside the selected generated schema scope.
The only bundled FileSystem example is legacy-only, so no runnable v2 FileSystem example is retained.
No open report was shown to reproduce on v0.12.2.
Issue #579 has no linked fix or current-release reproduction; its root-cause explanation and split-step workaround remain reporter hypotheses.
README nests
optionsunderinline, conflicting with the generated CRD; catalog follows the generated schema.Bundled installation examples pin v0.11.5 and use varying Function object names; catalog uses selected v0.12.2 and requires name matching.
function-auto-ready v0.7.0
Selected stable release v0.7.0 at ed7886de159af73b9d6976f04f9171ec7a4cb411; previous stable release v0.6.6 at 046fe9eca400dfdb835911d8b22da9b0e27a5547. Claims, claim references, deprecated XRD v1, and legacy v1 XR semantics were excluded. No project-history, historical-design, official-documentation, supporting, or third-party-example evidence was used.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| package | The package declares Composition capability and is used after a pipeline step produces desired resources. | API and documented-guidance | primary | direct | Package maturity not stated by selected sources; metadata, README |
| readiness | Desired resources require a same-key observed resource, and explicit readiness from an earlier function is preserved. | behavior | primary | direct | Maturity not stated by selected sources; implementation |
| readiness | Evaluation order is CEL, registered Kubernetes health check, then generic observed Ready=True condition. | behavior | primary | direct | Built-in behavior maturity not stated; CEL explicitly Alpha; implementation |
| readiness | A false built-in check leaves readiness unspecified, allowing the generic condition fallback. | behavior | primary | direct | Maturity not stated by selected sources; implementation |
| built-in-health-checks | Fifteen Kubernetes kinds have registered resource-specific checks; exact rules are established by their implementations. | behavior | primary | corroborated | Maturity not stated by selected sources; registry, README inventory |
| input | Input is a non-installed KRM-like v1beta1 object with TTL and two CEL customization fields. | API | primary | direct | Beta ceiling from served v1beta1 schema; source, schema |
| input | Input TTL overrides the runtime default; an invalid duration produces a fatal response. | behavior | primary | direct | Beta input; implementation |
| cel-health-checks | CELHealthcheckCustomizations is explicitly Alpha and disabled by default. | API | primary | direct | Explicit Alpha; feature registration |
| cel-health-checks | Rules are keyed by normalized GVK, evaluate observed object, return Boolean readiness, and inline entries override context entries. | API and behavior | primary | direct | Explicit Alpha; resolver, merge |
| cel-health-checks | The selected example centralizes a CEL rule map in EnvironmentConfig-backed function context and addresses it with celHealthCheckCustomizationFrom. | illustrative-pattern | primary example | direct | Explicit Alpha; pipeline wiring, rule map |
| cel-health-checks | A CEL evaluation error warns and falls through, conflicting with README language that it is treated as not ready. | behavior and documented-guidance | primary | direct conflict | Explicit Alpha; runtime, README |
function-auto-ready limitations and conflicts
README CEL snippets use
v1alpha1, but selected source, generated schema, and runnable example usev1beta1; catalog follows the schema-backed v1beta1 API.README links old Crossplane v1.14 documentation; it was not used as current official-documentation evidence.
Bundled basic-example package references are timestamp builds, not the selected v0.7.0 release; the catalog summarizes behavior without copying those references.
The selected sources do not state a minimum supported Crossplane version.
No legacy material was found in the bounded selected-release sources; current
/v1Composition and Configuration APIs were not excluded merely for using v1.
Crossplane Core v2.3.3
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching official documentation series v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| composite-resource-model | An XR represents a set of Kubernetes resources; an XRD defines its API and a Composition defines composed resources. | documented-guidance | official-documentation | direct | docs |
| composite-resource-definition | XRD v2 is cluster-scoped; each version requires name, served, and referenceable. The API contract says exactly one version is referenceable and must be served; the renderer maps it to generated-CRD storage. The selected schema has no list-level CEL proof of admission enforcement for uniqueness. | API, behavior, and limitation | primary | corroborated | XRD API Stable by repository default; renderer behavior maturity not separately stated; CRD, renderer |
| composite-resource-definition | Namespaced scope is the v2 default and is recommended for most XRDs. | documented-guidance | official-documentation | direct | docs |
| composite-resource-definition | defaultCompositionRef requires a Composition name and fills selection only when an XR specifies neither a reference nor a selector. | API and behavior | primary | corroborated | XRD API Stable by repository default; controller behavior maturity not separately stated; CRD, controller |
| composite-resource-definition | defaultCompositionUpdatePolicy defaults to Automatic, allows Automatic or Manual, and falls back when an XR has no policy. | API and behavior | primary | corroborated | XRD API Stable by repository default; controller behavior maturity not separately stated; CRD, revision behavior |
| composite-resource-definition | enforcedCompositionRef requires a Composition name, is immutable, and replaces a differing XR reference. | API and behavior | primary | corroborated | XRD API Stable by repository default; controller behavior maturity not separately stated; CRD, controller |
| composition | Current Composition is a non-deprecated cluster-scoped v1 API with Pipeline mode and bounded, uniquely named Function steps. Its GVK is Stable by repository default; /v1 alone is not the evidence. | API | primary | direct | CRD |
| managed-resources | A Provider defines and manages concrete MR APIs and their external resources. | documented-guidance | official-documentation | direct | docs |
| managed-resource-definition | MRD is Alpha; its schema defines API identity, scope, versions, activation state, and status. | API and documented-guidance | primary and official-documentation | corroborated | maturity, CRD |
Core limitations and exclusions
The XR model, XRD, Composition, and managed resources generally are Stable by repository default: selected current sources have no explicit non-stable label and no relevant served alpha or beta API version. Alpha applies only to MRD; Beta applies only to
managementPolicies.Claims, claim references, deprecated XRD v1 schema, legacy v1 XR semantics,
LegacyCluster, migration guidance, and legacy connection-secret workflows are excluded.Some v2.3 XRD documentation examples use the deprecated
/v1XRD API; the catalog records the conflict and uses the released v2 CRD for API shape.Concrete managed-resource schemas and controller behavior require separately pinned provider sources.
The selected runtime generator and Go helpers establish the XRD version-to-storage and Composition type-reference mappings updated here; this does not make them source proof for every generated Core CRD field.
Managed Resources deep dive
Selected Crossplane v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d, docs v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91, and the pinned runtime dependency v2.3.3 at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| managed-resources | Core provides a reusable MR contract but Providers define concrete APIs and external behavior. | API and documented-guidance | primary and official-documentation | corroborated | Common MR API contract Stable by repository default; unlabelled runtime behavior maturity not separately stated; runtime interface |
| anatomy | Common specs provide management policies, typed ProviderConfig references, connection Secret references, conditions, and observed status; provider schemas supply concrete desired/observed fields. | API | primary | direct | Stable by repository default, with Beta fields separated; Core types |
| anatomy | initProvider is create-time-only and explicitly Beta; late initialization persists only when provider-reported and policy-allowed. | behavior | official-documentation and primary | corroborated | Beta for initProvider/policy control; docs |
| lifecycle | The modern reconciler observes first, then policy-gates deletion, creation, late initialization, or update and requeues for polling. | behavior | primary | direct | Maturity not stated by selected sources; reconciler |
| management-policies | Observe, Create, Update, LateInitialize, Delete, and wildcard actions are validated and independently gate lifecycle operations. | API and behavior | primary and official-documentation | corroborated | Explicit Beta; policies |
| management-policies-project-history | Issue #4952 remains an open GA proposal whose unchecked criteria include an API-version update and linked limitation reports; it does not override the selected v2.3 Beta label. | proposal and reported limitations | project-history, bounded by official documentation | direct as project history | Researched 2026-07-14; GA tracker #4952, explicit Beta documentation |
| management-policies-project-history | Runtime PR #788 added two late-initialization policy combinations and is contained in runtime v2.3.3, which selected Crossplane v2.3.3 requires; this bounded implementation does not complete GA. | release-history | project-history corroborated by selected-release dependency evidence | corroborated | PR #788, runtime containment, Crossplane go.mod |
| external-identity | External name carries provider identity; after an indeterminate create, timestamps stop controllers without deterministic external names while deterministic-name controllers may continue safely. | behavior | primary | direct | Maturity not stated by selected sources; creation guard and exception |
| references-providerconfig | Generated reference resolution applies resolved fields before external reconciliation; typed ProviderConfig usage is tracked before config use. | behavior | primary | direct | Maturity not stated by selected sources; references, usage |
| references-providerconfig | Explicit providerConfigRef avoids the namespaced common-type default of ClusterProviderConfig/default; tenant-local versus shared central-account configuration is a provider-specific, least-privilege platform decision. | API and documented-guidance | primary | corroborated | typed reference, namespaced default |
| references-providerconfig | By default, keep raw ProviderConfig selection out of the human-orderable XRD/XR API and set it in the Composition's managed-resource template. This is a platform API design recommendation, not a Crossplane prohibition; an intentionally exposed selector must be constrained and authorized. | documented-guidance and inference | official-documentation | corroborated and inferred | XR and Composition roles, managed-resource base with providerConfigRef |
| references-providerconfig | A Provider defines an MR's available settings. *Ref and *Selector therefore are provider- and field-specific, and the selected Provider CRD and implementation must establish their availability and semantics. | documented-guidance and API boundary | official-documentation and primary | direct and inferred | Provider-defined settings, runtime provider-method gate |
| references-providerconfig | For an MR that implements runtime generated resolution, changed fields are force-applied by the dedicated reference-resolver field manager. The generic resolver caches a non-empty literal by default; clearing it triggers re-resolution unless a Provider implementation or policy differs. | behavior | primary | direct | SSA field owner, literal cache and re-resolution |
| references-providerconfig | A Composition may use a prerequisite resource's observed status.atProvider identifier as explicit desired input for a dependent resource where a generated reference is unavailable, after provider-specific readiness and field verification. | illustrative-pattern and documented-guidance | official-documentation | direct example and inferred guidance | Observed composed state, status-to-environment example |
| controls-conditions | Pause, poll interval, and reconcile-request annotations control scheduling; conditions expose reconcile state. | behavior | primary and official-documentation | corroborated | Maturity not stated by selected sources; docs |
| managed-resource-definition | MRD is an Alpha schema carrier whose activation irreversibly applies the derived CRD and reports establishment. | API and behavior | primary | direct | Alpha from served v1alpha1; types |
| managed-resource-activation-policy | MRAP is an Alpha API that activates MRDs matched by filepath-style globs and never deactivates them. | API and behavior | primary | direct | Alpha from served v1alpha1; types |
| managed-resource-activation-policy | Once an MRD is Active, deleting an MRAP or removing/changing its matching pattern does not return the MRD to Inactive or remove its derived CRD. | API, behavior, and documented-guidance | primary and official-documentation | corroborated | irreversible state, deletion path, activation-only reconciliation, v2.3 docs |
| minimal-managed-resource-activation | Helm's default MRAP activates all MRDs; disabling it before activation and using exact modern namespaced MRD names is a documented-compatible but stricter platform policy. | documented-guidance and inferred policy | official-documentation | direct and inferred | default override, exact/wildcard guidance |
| minimal-managed-resource-activation | Configuration-scoped MRAPs can overlap, but MRAP activation is one-way; a later narrowed policy cannot reduce already activated MRDs. | behavior and documented-guidance | primary and official-documentation | corroborated | configuration dependency guidance, overlap E2E |
| managed-resource-activation-policy | Open issue #6984 reports the one-way consequence on v2.0.6; maintainer context says deactivation was excluded from the Alpha implementation and remains a safety and controller-lifecycle design problem. | reported-limitation | project-history | direct as report, not behavior proof | Open issue #6984, researched 2026-07-14T17:23:20Z; no released fix or deactivation path established; bot/app activity excluded |
Managed Resource limitations and exclusions
Concrete
forProvider,initProvider,atProvider, reference, selector, ProviderConfig, credential, connection-detail, identifier, import, async-operation, and late-initializable schemas or guarantees require a separately pinned Provider.The docs conflict on omitted ProviderConfig defaults; released namespaced Core types establish
ClusterProviderConfig/default.The modern runtime excludes deletion policy from its required MR interface and gates deletion through management policies; deprecated compatibility resolvers were excluded.
Claims, legacy managed-resource interfaces, deprecated reconcilers, legacy v1 XR semantics, CLI content, Upjet-only asynchronous conditions, and legacy MR activation examples were excluded.
No third-party evidence was used; licensing is Apache-2.0 and no source material was copied or adapted.
Management Policies project history uses human-authored issue and PR summaries only; bot stale activity was excluded. Open Upjet/Core/runtime limitations remain reports or proposals, and Upjet PR #315 was not treated as universally shipped in Crossplane v2.3.3.
Crossplane Configurations v2.3.3
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| configuration-package | A Configuration is a portable OCI package containing XRDs and Compositions and declaring package dependencies. | documented-guidance | official-documentation | direct | contents, dependency metadata |
| configuration | Configuration is a cluster-scoped, served/stored pkg.crossplane.io/v1 API requiring a qualified package reference and exposing package controls and status. | API | primary | direct | Stable by repository default after inspecting the only served version and absence of non-stable or deprecation metadata; CRD |
| configuration | Installation is registry-based; revision activation defaults automatic; constraints and dependency resolution are enforced by default. | documented-guidance | official-documentation | direct | docs |
| configuration-revision | ConfigurationRevision is a controller-managed, cluster-scoped v1 API with desired state, image, revision number, dependency counts, owned objects, and conditions. | API and behavior | primary | direct | API Stable by repository default after inspecting the only served version and absence of non-stable or deprecation metadata; controller behavior maturity not separately stated; CRD |
| dependencies-and-authoring | Configuration metadata declares Configuration, Function, and Provider dependencies; dependency resolution is enabled by default. | documented-guidance | official-documentation | direct | docs, metadata |
| dependencies-and-authoring | Automatic dependency upgrades and downgrades are Alpha, flag-gated features with documented downgrade risks. | documented-guidance | official-documentation | direct | maturity |
Crossplane Functions taxonomy and specification
Provider-backed external query pattern
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91; function-go-templating v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830; provider-opentofu v1.1.4 at 6a1a4f3a3c174b4f6d91c84e74c4a5b6781b0609. Project history was researched on 2026-07-14. Claims, deprecated XRD v1, legacy v1 XR semantics, and bot/app activity were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| provider-backed-external-query | Issue #4141 reports that observe-only MRs require unique identity and do not provide general property queries; proposed alternatives are not released query semantics. | reported-limitation and proposal | project-history | direct as report | Open human-authored issue #4141, researched 2026-07-14 |
| provider-backed-external-query | Composition step credentials use literal Secret names and namespaces; issue #7343 reports the resulting dynamic per-XR credential-selection gap. | API, behavior, and reported-limitation | primary and project-history | corroborated | Composition API Stable by repository default; controller behavior maturity not separately stated; API, controller, open issue #7343 |
| provider-backed-external-query | A namespaced provider-opentofu Workspace accepts inline module text, selects ProviderConfig, and publishes non-sensitive outputs at status.atProvider.outputs. | API and documented-guidance | primary | corroborated | Beta from served v1beta1; types, README |
| provider-backed-external-query | A namespaced Workspace resolves a namespaced ProviderConfig and its credential Secret references in the Workspace namespace. | behavior | primary | direct | Beta from served v1beta1; resolution, Secret namespace |
| provider-backed-external-query | function-go-templating can name the Workspace as a composed resource and retrieve it from observed state on a later reconciliation; absent paths require a guard. | behavior and illustrative-pattern | primary and user-supplied example | corroborated | Beta from GoTemplate v1beta1 CRD; resource name, observed lookup |
Limitations and unresolved points
The user-supplied AWS SSO data-source pattern is illustrative and was not independently executed against the pinned releases.
The user reports one namespace per tenant and a namespaced ProviderConfig containing only tenant-level credentials. Released code corroborates same-namespace configuration and Secret lookup; tenant authorization still depends on Workspace placement, RBAC, and preventing unintended ClusterProviderConfig or cross-tenant object control.
The downstream schema determines whether omitting
principalArnbefore the output exists is valid.Neither open issue has a linked released resolution in Crossplane v2.3.3.
provider-opentofu is Apache-2.0 licensed. Its upstream example is summarized and cited; the rendered Workspace snippet is adapted from user-supplied material with no identified external provenance.
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. The Composition Functions specification is sourced directly from the selected v2.3.3 release. Claims, deprecated XRD v1, legacy v1 XR semantics, and CLI material were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| functions-overview | Crossplane defines known composition and operation function capabilities; a package may declare either or both. | API and documented-guidance | primary and official-documentation | corroborated | Role-specific; capability types, docs |
| functions-overview | Both roles use the shared RunFunction RPC, while type-specific state semantics differ. | API | primary | direct | Role-specific; protocol |
| function-package | Function is cluster-scoped; v1 is storage and v1beta1 remains served. | API | primary | direct | Beta ceiling from served v1beta1; CRD |
| function-package | Package lifecycle controls and defaults cover pulling, revisions, dependencies, constraints, and runtime configuration. | API | primary | direct | Beta ceiling; CRD |
| composition-functions | Composition functions continuously reconcile XR state through ordered steps and must preserve desired state from prior steps. | behavior | official-documentation, corroborated by primary protocol/runtime | corroborated | Behavior maturity not separately stated; the owning Composition API is Stable by repository default; docs |
| composition-functions | Composition pipeline has 1–99 unique steps with function references and optional input, credentials, and requirements. | API | primary | direct | Stable by repository default; CRD |
| operation-functions | Operation runs once to completion, begins without observed XR state, and requires operation capability on referenced functions. | behavior | primary and official-documentation | corroborated | Alpha from v1alpha1 and explicit docs; runtime |
| operation-functions | Operation output resources are applied without owner references; retry and status are represented by the Operation API. | behavior and API | primary and official-documentation | corroborated | Alpha; apply, CRD |
| scheduled-and-watched-operations | CronOperation schedules Operation templates; WatchOperation creates them after selected resource changes. | API and behavior | primary and official-documentation | corroborated | Alpha from served v1alpha1; Cron CRD, Watch CRD |
| composition-function-specification | The specification normatively defines composition-function RPC serving, tag/TTL handling, desired-state constraints, results, configuration, packaging, and runtime assumptions. | API and documented-guidance | primary specification | direct | Composition role Stable by repository default; specification |
Function limitations and conflicts
The general v2.3 Functions page and Function CRD description use composition-only framing; released capability metadata, protocol, Operations docs, and APIs establish the two-role model.
The Composition Functions specification is explicitly composition-scoped. Potentially shared clauses are not asserted as normative operation-function requirements without separate evidence.
Its
v1beta1service-version example is stale relative to the current v1 protocol and v1-first runner fallback; the protocol source is authoritative.Whether an individual package supports composition, operation, or both requires its immutable package metadata; no current ecosystem inventory is claimed.
No project-history or third-party-example evidence was used in this batch.
Configuration limitations and exclusions
Configuration and ConfigurationRevision API surfaces are Stable by repository default after complete served-version inspection. Base dependency-resolution, authoring, and manual-promotion workflow maturity is
Not stated by selected sources; Alpha applies only to automatic dependency upgrade and downgrade features.Configuration and revision pull/state values are defined by Go constants but are not all encoded as CRD OpenAPI enums.
No rollback-specific field or status was found, so rollback procedure and reconciliation are not claimed.
CLI command syntax is excluded from Core. Claims, deprecated XRD v1, and legacy v1 XR semantics were outside this source batch.
The documentation's initial package-content summary omits some dependency kinds listed later; the catalog preserves the explicit Configuration, Function, and Provider dependency list.
The v2.3 Configuration page and installation page name different automatic-downgrade enablement settings; the catalog records the conflict and does not prescribe one mechanism.
Usage and ClusterUsage deletion protection
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. Both APIs are Beta because their only served API is protection.crossplane.io/v1beta1 and official documentation labels the feature Beta. Project history was researched on 2026-07-14. Bot- and app-authored activity was excluded. Claims, deprecated apiextensions.crossplane.io Usage, deprecated XRD v1, and legacy v1 XR semantics were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| usages-clusterusages | Usage and ClusterUsage block deletion of an of resource for protection or deletion ordering; they do not establish creation ordering. | behavior and documented-guidance | official-documentation and primary | corroborated | Beta; docs, webhook |
| usages-clusterusages | Usage is namespaced and ClusterUsage is cluster-scoped; both serve and store v1beta1. | API | primary | direct | Beta from served v1beta1; Usage CRD, ClusterUsage CRD |
| usages-clusterusages | of is required; at least one of by or reason is required; endpoints resolve references or selectors and references take precedence. | API and behavior | primary | direct | Beta; types |
| usages-clusterusages | Selector resolution persists the selected name into the reference and does not continuously retarget the Usage. | behavior | official-documentation | direct | Beta; docs |
| usages-clusterusages | Reconciliation applies the in-use label and makes by the Usage owner; deletion is denied with Conflict while a matching Usage remains. | behavior | primary | corroborated | Beta; reconciler, webhook |
| usages-clusterusages | Namespaced Usage supports by in its namespace and of in the same or an explicit different namespace; cross-namespace of requires by. | API, behavior, and documented-guidance | primary and official-documentation | corroborated | Beta; docs, validation |
| usages-clusterusages | ClusterUsage endpoints have no namespace fields and its finder index matches empty-namespace, cluster-scoped deletion requests. | API and behavior | primary | direct | Beta; types, finder |
| usages-clusterusages | Issue #7123 reports a gap for mixed namespaced and cluster-scoped endpoints and proposes API or consent-model changes; it remains an open report/proposal rather than released behavior. | reported-limitation and proposal | project-history | direct as report | Researched 2026-07-14; issue #7123 |
| usages-clusterusages | Issue #7249 reports silently ineffective namespaced Usage protection of a cluster-scoped resource; the v2.3.3 finder corroborates the namespace-key mismatch. | reported-limitation and behavior | project-history corroborated by primary | corroborated | Beta; researched 2026-07-14; issue #7249, finder |
| usages-clusterusages | Issue #6336 tracks a proposal to promote the protection.crossplane.io Usage APIs to GA; it does not establish released GA maturity or a committed release. | proposal | project-history | direct as proposal | Researched 2026-07-14; human-authored open issue #6336; selected v2.3.3 APIs remain Beta |
| usages-clusterusages | function-sequencer issue #114 reports that v0.5.0 emits a ClusterUsage without a namespace for a namespaced sequenced resource, leaving the Usage unready indefinitely. | reported-limitation | project-history | direct as report | Researched 2026-07-14; human-authored open issue #114; downstream report only, not Core behavior evidence |
| usages-clusterusages | Human-authored PR #6345 gives historical rationale for the v2 Usage APIs and unresolved mixed-scope cases; its merge commit is not an ancestor of v2.3.3. | historical project context | project-history | direct | Researched 2026-07-14; PR #6345, diverged commit comparison; current claims use selected-release source |
Usage limitations and exclusions
Official documentation does not establish mixed namespace/cluster endpoint relationships as supported workflows.
A visible in-use label does not establish effective protection for a namespaced Usage whose
ofresource is cluster-scoped in v2.3.3.Cluster-scoped
bywith namespacedofis representable in API comments but lacks official guidance and released E2E corroboration; it is not promoted as a reliable workflow.No source material was copied or adapted. Crossplane implementation is Apache-2.0; Crossplane documentation is CC BY 4.0.
Namespaced composition boundaries and cross-namespace synchronization patterns
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; PR #6588 is contained in v2.0.0 at b639502e2f93680ff83417a0f517ec459ce079cc; provider-kubernetes v1.2.1 at 0ea671a4dab090ff3b14877d35086f1950fa35e3; Reflector v10.0.59 at d5b9b2f83269cdb94647088a1fcf83b1b0081ff6; and kubernetes-replicator v2.12.4 at 44dc6db78c584771832a84a41cd06a1701a39fc0. Project history was researched at 2026-07-16T00:00:00Z; Claims, deprecated XRD v1, and legacy v1 XR semantics were excluded from current guidance.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| namespaced-composition-boundaries | A namespaced XR cannot compose a cluster-scoped resource, and Crossplane overrides a desired namespaced resource's namespace with the XR namespace. | behavior | primary | corroborated | Maturity not stated by selected sources; enforcement, rendering |
| namespaced-composition-boundaries | PR #6588's merge commit is contained in v2.0.0; released v2.3.3 code and unit/E2E tests retain the rejection. | release-history corroborated by behavior | project-history and primary | corroborated | PR, containment, unit test |
| namespaced-composition-boundaries | Issue #6759 openly reports centralized-namespace, multi-tenancy, security-boundary, and cross-namespace-read limitations and contains proposed workarounds, not accepted guidance. | reported-limitation and proposal | project-history | direct as report | Researched 2026-07-14; human-authored open issue #6759 |
| cross-namespace-synchronization-patterns | provider-kubernetes Object wraps desired target state in spec.forProvider.manifest and records the complete observed target under status.atProvider.manifest. | API and behavior | primary | corroborated | Alpha from served v1alpha APIs; types, observation |
| cross-namespace-synchronization-patterns | The namespaced Object controller reads a target by the embedded manifest's namespace and name without substituting the wrapper namespace; with an in-cluster ProviderConfig this permits a different target namespace when RBAC allows it. | behavior and illustrative-pattern | primary | direct for target lookup, inferred for the same-cluster pattern | Alpha; namespaced controller, in-cluster configuration |
| cross-namespace-synchronization-patterns | Object references can patch selected fields from an explicitly namespaced control-plane resource into a wrapped target; this is not transparent whole-object replication. | API and illustrative-pattern | primary | direct for API, inferred for cross-namespace pattern | Alpha; reference API, resolution |
| cross-namespace-synchronization-patterns | Reflector copies typed Secret or ConfigMap data through annotation-selected namespaces; it does not support arbitrary objects or status feedback. | illustrative-pattern and behavior | third-party-example | corroborated | Not a Crossplane feature; configuration, typed copy |
| cross-namespace-synchronization-patterns | kubernetes-replicator supports typed push/pull replication for Secrets, ConfigMaps, Roles, RoleBindings, and ServiceAccounts; it is not an arbitrary-object or status bridge. | illustrative-pattern and behavior | third-party-example | corroborated | Not a Crossplane feature; README, controller registration |
| cross-namespace-synchronization-patterns | Both third-party controllers receive cluster-wide access to their enabled resource types by default, which expands the security impact of compromise or misconfiguration. | API and limitation | third-party-example | direct for RBAC, inferred for risk characterization | Reflector RBAC, replicator RBAC |
Cross-namespace synchronization limitations and exclusions
The precise v2.3.3 fetch boundary is now established: exact-name selectors use
Get, label selectors useList, and an empty namespace lists across namespaces. Issue #6759 remains a report for its broader platform concerns.“Status replicated back” is narrowed to observed target state in the provider-kubernetes wrapper; it is not written into the source object.
The community tools are illustrative, fixed-kind synchronization controllers and are not Crossplane recommendations.
No source or configuration was copied. Crossplane and provider-kubernetes are Apache-2.0, Reflector is MIT, and kubernetes-replicator is Apache-2.0.
Composition health assessment in GitOps tools
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. Argo CD v3.1.16 is pinned at 5d001b80990d14c0fc9b2cbee1eac25fc288da15; supporting kstatus source is pinned at 45a0b5b7e6b292c0a59c899aa50a3662a0c1cf7d; the user-requested Flux v2-9 documentation track is pinned at 32b8fe6417a23265c1d8eb2851ce8f0f7ef85317. Project history was researched on 2026-07-14. Claims, deprecated XRD v1, legacy v1 XR semantics, and bot/app activity were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| composition-gitops-health | Crossplane v2.3.3 Composition has no status field, status subresource, or conditions from which a GitOps tool can derive controller-reported health. | API and behavior | primary | corroborated | Composition API/status shape Stable by repository default; the GitOps assessment consequence and guidance have no independent maturity assignment; type, CRD |
| composition-gitops-health | The kstatus revision referenced in issue #2672 falls back to Current for an otherwise unknown resource without recognized conditions, so categorical kstatus incompatibility is not established; the limitation is absence of meaningful native health. | behavior | supporting, qualified by primary | corroborated | kstatus fallback |
| composition-gitops-health | Issue #2672 openly reports Flux health-assessment problems for Crossplane resources and includes a maintainer observation that Composition has no readiness concept or conditions. | reported-limitation | project-history | direct as report | Researched 2026-07-14; human-authored open issue #2672, maintainer comment |
| composition-gitops-health | Crossplane v2.3 documentation recommends wildcard Argo CD Lua health customizations and gives Composition special no-status handling that reports it healthy. | documented-guidance | official-documentation | direct | wildcard guidance, no-status rule |
| composition-gitops-health | Argo CD 3.1 ships a bundled wildcard Lua health check for kinds in *.crossplane.io; PR #22919's merge commit is contained in v3.1.0 and selected v3.1.16, whose fixtures mark a status-less Composition healthy. | release-history and behavior | supporting implementation and project-history | corroborated | released check, fixture, containment |
| composition-gitops-health | Flux v2.9 documents CEL health checks for Crossplane Provider and AWS Role only; it provides no Composition, XR, or generic Crossplane example and states no minimum controller version. | documented-guidance and illustrative-pattern | supporting | direct | mechanism, examples |
Composition health limitations and exclusions
Issue #2672's initial concrete example is a Provider, not a Composition; it is not generalized into proof about all Crossplane resources.
Argo CD's Lua policy treats absent Composition status as healthy but does not add native API readiness. Its wildcard eligibility and two happy-path fixtures do not establish semantic coverage for every Crossplane kind.
Flux's condition-based examples cannot be transferred unchanged to a status-less Composition; a Composition-specific CEL workaround remains unestablished.
No selected-release test directly executes kstatus against a v2.3.3 Composition.
Crossplane and cli-utils sources are Apache-2.0, Crossplane documentation is CC BY 4.0, and Flux website content is Apache-2.0. No configuration or source material was copied or adapted.
Real-time composition reconciliation
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91; selected crossplane-runtime v2.3.3 at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827. The capability is explicitly Beta and enabled by default. Project history was researched on 2026-07-14; bot/app activity, Claims, deprecated XRD v1, and legacy v1 XR semantics were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| realtime-composition-reconciliation | Beta real-time mode indexes XR composed-resource references, disables the normal poll interval, and maps composed-resource events back to referencing XRs. | behavior | primary and official-documentation | corroborated | Explicit Beta; setup, docs |
| realtime-composition-reconciliation | A positive shortest function TTL schedules a jittered requeue even in real-time mode. | behavior | primary | direct | Beta context; result, TTL fold |
| realtime-composition-reconciliation | Required resources are fetched during a run but do not independently enter the XR resource-reference watch index. | reported-limitation and behavior | primary | corroborated by negative-path inspection | Beta context; fetch, index |
| realtime-composition-project-history | Issues #6898, #6824, #7024, and provider-kubernetes #421 report distinct forms of reconciliation or watch-event churn; none proves a selected-release Core fix. | reported-limitation | project-history | direct as reports | Researched 2026-07-14; direct issue URLs in concept |
| realtime-composition-project-history | Runtime #902's defensive condition-equality fix is contained in selected crossplane-runtime v2.3.3 and is distinct from provider-kubernetes #421. | release-history and behavior | project-history corroborated by primary | corroborated | issue, released Crossplane source, runtime containment |
| realtime-composition-project-history | Issue #6453 proposes promotion from Beta to GA; it does not establish GA maturity. | proposal | project-history | direct | Researched 2026-07-14; issue |
Real-time composition limitations and exclusions
Required-resource non-watch behavior is scoped to the selected v2.3.3 implementation.
The six issues are not flattened into a single root cause; only runtime #902 has a released fix proven in the selected source.
Two GitHub Actions comments on #6898, two on #6824, and one on #6453 were excluded. Stale automation did not establish resolution.
No source material was copied or adapted. Crossplane implementation is Apache-2.0 and Crossplane documentation is CC BY 4.0.
Composed-resource RBAC
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d; matching documentation v2.3 at f1315464e35d40d25a28e4c15b6725b0e21adf91. The workflow's maturity is not stated by selected sources; a released procedure is not itself a lifecycle label. Claims, deprecated XRD v1, legacy v1 XR semantics, and CLI material were excluded.
| Concept | Exact claim | Class | Source role | Confidence | Feature state / evidence |
|---|---|---|---|---|---|
| composed-resource-rbac | Crossplane uses its service account to create function-produced composed resources, but it does not have unrestricted access to every Kubernetes resource kind by default. | documented-guidance | official-documentation | direct | Maturity not stated by selected sources; controller identity, default scope |
| composed-resource-rbac | Default access covers resources installed by Providers (managed resources), resources defined by XRDs (composite resources), and some Kubernetes kinds required by Crossplane, such as Deployments. | documented-guidance | official-documentation | direct | Maturity not stated by selected sources; default scope |
| composed-resource-rbac | Operators grant another kind by creating a ClusterRole with the required rules and the rbac.crossplane.io/aggregate-to-crossplane: "true" label. | documented-guidance | official-documentation | direct | Maturity not stated by selected sources; grant procedure |
| composed-resource-rbac | The documented CloudNativePG example grants all verbs on postgresql.cnpg.io clusters; the docs do not claim this is a least-privilege rule. | documented-guidance | official-documentation | direct | Maturity not stated by selected sources; example |
| composed-resource-rbac | The RBAC manager is installed and enabled by default, automatically grants Crossplane access to managed and composite resources, and separately manages Provider service-account roles. | behavior and documented-guidance | official-documentation | direct | Maturity not stated by selected sources; default deployment, responsibilities |
| composed-resource-rbac | With the RBAC manager disabled, operators must manually grant access to every composed kind, including managed and composite resources. | documented-guidance | official-documentation | direct | Maturity not stated by selected sources; disabled-manager consequence |
Composed-resource RBAC limitations and exclusions
The selected documentation does not enumerate the complete default Kubernetes-kind allowlist or least-privilege verbs for arbitrary composed kinds.
Current v2.3 guidance uses an aggregated ClusterRole, not ControllerConfig, for the access grant.
No source manifest was copied or adapted. Crossplane documentation is CC BY 4.0.
Local Composition rendering and xprin assertion suites
Selected CLI release: v2.4.0 at ef9b974770a45e085aacee3b2cdda6284ab6cf51.
Selected xprin release: v0.2.0 at b5a100aa3e7118c1acdd2096b7993929939624b2.
Maturity of both unlabelled non-API tools is Not stated by selected sources;
their stable semantic-version tags select released evidence rather than a
lifecycle state.
Claims, deprecated XRD v1, legacy v1 XR semantics, and xprin Claim examples
are excluded. No source material is copied or adapted; both repositories are
Apache-2.0.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| cli/local-composition-rendering | crossplane composition render takes an XR, a Pipeline-mode Composition, and a Functions input; it validates the Composition's compositeTypeRef against the XR GVK. | API | primary | direct | arguments, validation |
| cli/local-composition-rendering | The default render engine and Function runtime use Docker; documented alternatives include a development Function runtime and --crossplane-binary. | documented-guidance | primary | direct | render runtime guidance |
| cli/local-composition-rendering | The Functions input accepts only Function objects, so non-Function project manifests must remain outside it. | behavior | primary | direct | Function GVK validation |
| cli/local-composition-rendering | A pkg.crossplane.io/v1 Provider is not a valid Functions input: the loader requires the Function kind, not merely the shared API group, so it fails before pipeline execution. | behavior | primary | direct | Function GVK validation |
| cli/local-composition-rendering | --observed-resources injects unvalidated YAML as observed cluster resources, allowing a fixture to supply managed-resource status. | documented-guidance | primary | direct | observed resource guidance |
| cli/local-composition-rendering | A full render-to-validation round trip passes the --include-full-xr output to resource validate, which accepts comma-separated schema extensions and stdin resources; --error-on-missing-schemas makes absent schemas fail. | API and documented-guidance | primary | corroborated | pipeline help, input and error handling |
| cli/local-composition-rendering | resource validate builds offline validators only from CRD/XRD extensions or package CRDs. Core Kubernetes resources such as v1 Secret have no CRD and therefore report MissingSchema; the report is expected coverage behavior, not a CRD defect. | API and behavior | primary | direct | schema inputs, validator map |
| cli/local-composition-rendering | For a missing non-Crossplane custom GVK, CustomResourceDefinition/catalog main is a mutable discovery source for a CRD definition YAML. Resolve and record a commit before using a matching definition locally as a reproducible resource validate extension; a hit does not prove installed-CRD compatibility, a miss does not prove absence, and the selected CLI does not document direct catalog-URL integration. | supporting-source discovery guidance | supporting and primary | direct and inferred | catalog definition files, CLI extension inputs |
| cli/local-composition-rendering | Issue #195 is an open v2.4.0 report by human author @jkroepke of v1/Secret MissingSchema; it is a report, not a released fix or supported workaround. | reported-limitation | project-history | direct as report | issue #195, opened by human @jkroepke on 2026-07-16; researched 2026-07-16. |
| cli/local-composition-rendering | CLI v2.4.0 defaults an omitted validation image to a tag matching the CLI version; an explicit Core-image override is required when that matching image is unavailable. | behavior and documented-guidance | primary | direct | default image selection |
| cli/local-composition-rendering | PR #148 merged after v2.4.0 and changes the default to :stable, but no stable v2.4.1 release/tag existed at research time; it is post-release merged work, not selected-release v2.4.0 behavior. | release-history | project-history corroborated by tag inspection | direct | PR #148, merge d0fecffda3afb297a39929f11184bfe5391794da; researched 2026-07-16; v2.4.1 tag lookup returned no remote ref |
| core/composition-project-layout | The current Composition API is apiextensions.crossplane.io/v1; when spec is present its required type reference and Pipeline mode support a separate composition.yaml that targets the project's XR API. The root schema does not itself require spec. | API | primary | direct | Composition CRD |
| core/composition-project-layout | The listed files are an authoring recommendation, not a required Crossplane layout. Its Functions-only boundary is directly supported by CLI validation, and MRAP remains conditional on the selected activation policy. | documented-guidance | primary, official-documentation, plus explicit recommendation | corroborated | Function GVK validation, MRAP activation guidance |
| tools/xprin-test-suites | xprin orchestrates local Crossplane CLI render and validation commands, has declarative assertions, and requires Docker for Composition Functions without requiring a Kubernetes cluster. | behavior | primary third-party tool | direct | README |
| tools/xprin-test-suites | A suite configures XR, Composition, Functions, optional observed resources and CRDs, then may validate and assert over render output. | API and behavior | primary third-party tool | corroborated | suite specification, execution sequence |
Limitations
xprin establishes only its own framework behavior; it is not authority for general Crossplane behavior.
The reference layout does not claim that Provider, ProviderConfig, or MRAP manifests are universal CLI inputs or required in every project.
Whole-bundle composition-authoring review
Selected Core release v2.3.3 at 09ffaea39ccaea0f80817e35b5bbd3632b4e7e0d,
matching documentation series v2.3 at
f1315464e35d40d25a28e4c15b6725b0e21adf91, Crossplane CLI v2.4.0 at
ef9b974770a45e085aacee3b2cdda6284ab6cf51, function-go-templating
v0.12.2 at 0a1e6d386f4363fae257ddbfb5b497416370e830, function-auto-ready
v0.7.0 at ed7886de159af73b9d6976f04f9171ec7a4cb411, function-sequencer
v0.6.0 at 8ee29b46b7b9491fb307cf6caf339541a8d93422, and crossplane-runtime
v2.3.3 at fcf6aaa11ef4b56b9a8b1b91a446e0f6b8fc2827 were reused from the
source lock. Research completed 2026-07-16. Claims, deprecated XRD v1, and
legacy v1 XR semantics were excluded. The starter guide is an authored route,
not a copied runnable example.
| Concept | Exact claim | Class | Source role | Confidence | Evidence |
|---|---|---|---|---|---|
| composition-developer-starter | Composition compositeTypeRef.apiVersion is XRD group plus referenceable version name, while kind is the XRD kind; values match the reconciled XR GVK exactly. | API and behavior | primary | corroborated | type constructor, XRD GVK, compatibility filter |
| composed-resource-rbac | Core performs required-resource exact-name Get or label List operations with its configured Kubernetes client; the Function pod does not perform those reads. | behavior and security boundary | primary | corroborated | fetcher, Core wiring, Function gRPC path |
| namespaced-composition-boundaries | Required-resource fetch is separate from composed-resource same-namespace enforcement. In function-go-templating v0.12.2, label conversion omits namespace, so Core performs an all-namespace List subject to Core RBAC. | behavior and limitation | primary | corroborated | selector conversion, Core list |
| xrd-cel-validation | The selected renderer forwards schema-root CEL rules and retains generated metadata.name; the current code path is corroborated, but v2-specific API-server admission enforcement and metadata.labels support are not proven. | behavior and unresolved limitation | primary | direct and inferred | renderer, unit test, Core wiring |
| connection-publication | An aggregate Secret may validly exist with empty data during convergence, while auto-ready's built-in Secret check treats existence as ready. Required-key completeness therefore needs an explicit gate when it is part of the XR contract. | behavior and authoring guidance | primary and official-documentation | corroborated and inferred | empty initial Secret manifest, Secret registration, alwaysReady, explicit readiness preservation |
| environment-config-pipeline | environment-configs and go-templating Context can both update the reserved environment key; their merge precedence means pipeline order changes the winner at conflicting paths. | behavior and authoring guidance | primary | corroborated | environment merge, Context merge |
| package-revision-guidance | Current v2.3 docs establish that Manual prevents automatic revision activation, but the selected documentation does not establish the exact supported promotion mutation or command. | documented-guidance and unresolved limitation | official-documentation | direct | Configuration revisions, Provider revisions |
Review conclusions and unresolved evidence
A Composition developer starter route is necessary because the individual concepts are evidence-rich but the prior root graph did not connect the complete authoring journey.
Adding more ad hoc tags is not the primary fix. Every concept already had tags, while the vocabulary contained singular/plural and function-category variants. This change adds only
composition-authoringto the starter and relies on explicit links. A controlled taxonomy should precede broad tag migration.No complete runnable provider-specific Composition, universal live apply order, package registry promotion command, provider credential schema, or multi-tenant EnvironmentConfig policy is claimed without separately selected project evidence.
242 files
- .agents/agents/okf-crossplane-cli-update-researcher/AGENT.md
- .agents/agents/okf-crossplane-core-code-researcher/AGENT.md
- .agents/agents/okf-crossplane-core-design-researcher/AGENT.md
- .agents/agents/okf-crossplane-core-docs-researcher/AGENT.md
- .agents/agents/okf-crossplane-core-update-researcher/AGENT.md
- .agents/agents/okf-crossplane-docs-update-researcher/AGENT.md
- .agents/agents/okf-crossplane-researcher/AGENT.md
- .agents/agents/okf-crossplane-runtime-update-researcher/AGENT.md
- .agents/agents/okf-function-auto-ready-researcher/AGENT.md
- .agents/agents/okf-function-environment-configs-researcher/AGENT.md
- .agents/agents/okf-function-go-templating-project-history-researcher/AGENT.md
- .agents/agents/okf-function-go-templating-researcher/AGENT.md
- .agents/agents/okf-function-go-templating-sprig-researcher/AGENT.md
- .agents/agents/okf-function-go-templating-update-researcher/AGENT.md
- .agents/agents/okf-function-kro-kro-researcher/AGENT.md
- .agents/agents/okf-function-kro-researcher/AGENT.md
- .agents/agents/okf-function-sdk-go-researcher/AGENT.md
- .agents/agents/okf-function-sequencer-researcher/AGENT.md
- .agents/agents/okf-function-sequencer-update-researcher/AGENT.md
- .agents/agents/okf-function-tag-manager-researcher/AGENT.md
- .agents/agents/okf-reviewer/AGENT.md
- .agents/agents/okf-source-scout/AGENT.md
- .agents/agents/okf-upjet-researcher/AGENT.md
- .agents/agents/okf-xprin-update-researcher/AGENT.md
- .agents/skills/okf-open-knowledge-format/SKILL.md
- .agents/skills/okf-open-knowledge-format/references/conversion.md
- .agents/skills/okf-open-knowledge-format/references/examples.md
- .agents/skills/okf-open-knowledge-format/references/spec-v02.md
- .agents/skills/okf-open-knowledge-format/scripts/validate.sh
- .agents/skills/okf-updates/SKILL.md
- .agents/skills/okf-updates/agents/openai.yaml
- .agents/skills/okf/SKILL.md
- .agents/skills/okf/agents/openai.yaml
- .agents/skills/okf/references/evidence-contract.md
- .agents/skills/okf/references/okf-profile.md
- .agents/skills/okf/references/okf-spec.md
- .agents/skills/okf/references/sources.yaml
- .codespellrc
- .codex-plugin/plugin.json
- .codex/agents/okf-crossplane-cli-update-researcher.toml
- .codex/agents/okf-crossplane-core-code-researcher.toml
- .codex/agents/okf-crossplane-core-design-researcher.toml
- .codex/agents/okf-crossplane-core-docs-researcher.toml
- .codex/agents/okf-crossplane-core-update-researcher.toml
- .codex/agents/okf-crossplane-docs-update-researcher.toml
- .codex/agents/okf-crossplane-researcher.toml
- .codex/agents/okf-crossplane-runtime-update-researcher.toml
- .codex/agents/okf-function-auto-ready-researcher.toml
- .codex/agents/okf-function-environment-configs-researcher.toml
- .codex/agents/okf-function-go-templating-project-history-researcher.toml
- .codex/agents/okf-function-go-templating-researcher.toml
- .codex/agents/okf-function-go-templating-sprig-researcher.toml
- .codex/agents/okf-function-go-templating-update-researcher.toml
- .codex/agents/okf-function-kro-kro-researcher.toml
- .codex/agents/okf-function-kro-researcher.toml
- .codex/agents/okf-function-sdk-go-researcher.toml
- .codex/agents/okf-function-sequencer-researcher.toml
- .codex/agents/okf-function-sequencer-update-researcher.toml
- .codex/agents/okf-function-tag-manager-researcher.toml
- .codex/agents/okf-reviewer.toml
- .codex/agents/okf-source-scout.toml
- .codex/agents/okf-upjet-researcher.toml
- .codex/agents/okf-xprin-update-researcher.toml
- .codex/config.toml
- .dockerignore
- .editorconfig
- .github/workflows/ci.yaml
- .github/zizmor.yml
- .gitignore
- .mcp.json
- .okf/claim-ledger.md
- .okf/sources.lock.yaml
- .pi/agents/okf-crossplane-cli-update-researcher.md
- .pi/agents/okf-crossplane-core-code-researcher.md
- .pi/agents/okf-crossplane-core-design-researcher.md
- .pi/agents/okf-crossplane-core-docs-researcher.md
- .pi/agents/okf-crossplane-core-update-researcher.md
- .pi/agents/okf-crossplane-docs-update-researcher.md
- .pi/agents/okf-crossplane-researcher.md
- .pi/agents/okf-crossplane-runtime-update-researcher.md
- .pi/agents/okf-function-auto-ready-researcher.md
- .pi/agents/okf-function-environment-configs-researcher.md
- .pi/agents/okf-function-go-templating-project-history-researcher.md
- .pi/agents/okf-function-go-templating-researcher.md
- .pi/agents/okf-function-go-templating-sprig-researcher.md
- .pi/agents/okf-function-go-templating-update-researcher.md
- .pi/agents/okf-function-kro-kro-researcher.md
- .pi/agents/okf-function-kro-researcher.md
- .pi/agents/okf-function-sdk-go-researcher.md
- .pi/agents/okf-function-sequencer-researcher.md
- .pi/agents/okf-function-sequencer-update-researcher.md
- .pi/agents/okf-function-tag-manager-researcher.md
- .pi/agents/okf-reviewer.md
- .pi/agents/okf-source-scout.md
- .pi/agents/okf-upjet-researcher.md
- .pi/agents/okf-xprin-update-researcher.md
- .pi/prompts/okf-updates.md
- .pi/prompts/okf.md
- .pi/settings.json
- .plugin/plugin.json
- AGENTS.md
- ATTRIBUTION.md
- Dockerfile
- LICENSE
- README.md
- catalog/cli/control-plane-projects.md
- catalog/cli/generated-go-model-accessors.md
- catalog/cli/generated-go-runtime-objects.md
- catalog/cli/index.md
- catalog/cli/local-composition-rendering.md
- catalog/cli/xrd-convert.md
- catalog/composition-api-and-provider-contracts.md
- catalog/composition-developer-starter.md
- catalog/composition-pipeline-and-security.md
- catalog/composition-testing-and-packaging.md
- catalog/core/composed-resource-identity-and-replacement.md
- catalog/core/composed-resource-rbac.md
- catalog/core/composite-resource-definition.md
- catalog/core/composite-resource-model.md
- catalog/core/composition-gitops-health.md
- catalog/core/composition-project-layout.md
- catalog/core/composition.md
- catalog/core/configurations/configuration.md
- catalog/core/configurations/dependencies-and-authoring.md
- catalog/core/configurations/index.md
- catalog/core/configurations/package.md
- catalog/core/configurations/revision.md
- catalog/core/controlled-rollout-of-composition-functions-design.md
- catalog/core/cross-namespace-synchronization-patterns.md
- catalog/core/environment-config.md
- catalog/core/index.md
- catalog/core/managed-resource-activation-policy.md
- catalog/core/managed-resource-anatomy.md
- catalog/core/managed-resource-controls-and-conditions.md
- catalog/core/managed-resource-definition.md
- catalog/core/managed-resource-external-identity.md
- catalog/core/managed-resource-lifecycle.md
- catalog/core/managed-resource-management-policies-project-history.md
- catalog/core/managed-resource-management-policies.md
- catalog/core/managed-resource-references-and-provider-config.md
- catalog/core/managed-resources.md
- catalog/core/minimal-managed-resource-activation.md
- catalog/core/namespaced-composition-boundaries.md
- catalog/core/native-composition-environment-removal.md
- catalog/core/pushsecret-external-store-pattern.md
- catalog/core/realtime-composition-project-history.md
- catalog/core/realtime-composition-reconciliation.md
- catalog/core/tenant-xr-api-security.md
- catalog/core/usages-and-clusterusages.md
- catalog/core/xrd-api-version-evolution.md
- catalog/core/xrd-cel-validation.md
- catalog/core/xrd-openapi-schema.md
- catalog/core/xrd-subresources-and-display.md
- catalog/core/xrd-unknown-data.md
- catalog/functions/composition-function-specification.md
- catalog/functions/composition-functions.md
- catalog/functions/environment-config-pipeline.md
- catalog/functions/function-auto-ready/built-in-health-checks.md
- catalog/functions/function-auto-ready/cel-health-checks.md
- catalog/functions/function-auto-ready/index.md
- catalog/functions/function-auto-ready/input.md
- catalog/functions/function-auto-ready/package.md
- catalog/functions/function-auto-ready/readiness.md
- catalog/functions/function-environment-configs/index.md
- catalog/functions/function-environment-configs/input.md
- catalog/functions/function-environment-configs/package.md
- catalog/functions/function-environment-configs/selection-and-merge.md
- catalog/functions/function-go-templating/connection-details.md
- catalog/functions/function-go-templating/context.md
- catalog/functions/function-go-templating/environment-source.md
- catalog/functions/function-go-templating/extra-resources.md
- catalog/functions/function-go-templating/index.md
- catalog/functions/function-go-templating/input.md
- catalog/functions/function-go-templating/package.md
- catalog/functions/function-go-templating/patterns/index.md
- catalog/functions/function-go-templating/patterns/manual-readiness.md
- catalog/functions/function-go-templating/patterns/non-composed-resource-readiness.md
- catalog/functions/function-go-templating/patterns/provider-backed-external-query.md
- catalog/functions/function-go-templating/patterns/provider-kubernetes-object-readiness.md
- catalog/functions/function-go-templating/patterns/safe-status-and-connection-publication.md
- catalog/functions/function-go-templating/patterns/sveltos-clustersummary-readiness.md
- catalog/functions/function-go-templating/patterns/yaml-document-boundaries.md
- catalog/functions/function-go-templating/project-history.md
- catalog/functions/function-go-templating/rendered-output.md
- catalog/functions/function-go-templating/request-data.md
- catalog/functions/function-go-templating/response-ttl.md
- catalog/functions/function-go-templating/runtime-options.md
- catalog/functions/function-go-templating/sprig.md
- catalog/functions/function-go-templating/template-functions.md
- catalog/functions/function-kro/graph-evaluation.md
- catalog/functions/function-kro/index.md
- catalog/functions/function-kro/input.md
- catalog/functions/function-kro/package.md
- catalog/functions/function-sequencer/index.md
- catalog/functions/function-sequencer/input.md
- catalog/functions/function-sequencer/sequencing.md
- catalog/functions/index.md
- catalog/functions/operation-functions.md
- catalog/functions/overview.md
- catalog/functions/package.md
- catalog/functions/scheduled-and-watched-operations.md
- catalog/index.md
- catalog/log.md
- catalog/providers/crd-schema-discovery.md
- catalog/providers/index.md
- catalog/providers/provider-connection-details-source-retrieval.md
- catalog/providers/provider-families.md
- catalog/providers/provider-landscape.md
- catalog/providers/provider-package-revisions.md
- catalog/providers/upjet-terraform-provenance.md
- catalog/sdk/crd-cache-schema-stripping.md
- catalog/sdk/index.md
- catalog/sdk/provider-development/generate-test-package.md
- catalog/sdk/provider-development/index.md
- catalog/sdk/provider-development/managed-reconciler.md
- catalog/sdk/provider-development/managed-resource-apis.md
- catalog/sdk/provider-development/provider-configuration.md
- catalog/sdk/provider-development/start-here.md
- catalog/tools/index.md
- catalog/tools/xprin-crossplane-cli-tiers.md
- catalog/tools/xprin-crossplane-version.md
- catalog/tools/xprin-function-container-reuse.md
- catalog/tools/xprin-test-artifacts-export.md
- catalog/tools/xprin-test-suites.md
- catalog/tools/xprin-update-goldens.md
- compose.yaml
- mcp/README.md
- mcp/entrypoint.sh
- mcp/fetch_cache.py
- mcp/git_source.py
- mcp/github_source.py
- mcp/provider_crd_tools.py
- mcp/pyproject.toml
- mcp/server.py
- mcp/tests/test_git_source.py
- mcp/tests/test_github_source.py
- mcp/tests/test_provider_crd_tools.py
- mcp/uv.lock
- mise.toml
- renovate.json
- skills-lock.json
- skills/crossplane-v2-okf/SKILL.md
Advantages
- Provides version-aware knowledge by linking facts to specific repository revisions. evidence: README.md
- Connects distributed sources like Go APIs, CRDs, and documentation into a single navigable catalog. evidence: README.md
Limitations
- The public MCP server is provided as an early-access service and is not intended for production use without self-hosting. evidence: README.md
- Requires explicit provider versions for CRD tools, as it does not guess or infer versions automatically. evidence: README.md
Security
Risk level: Low risk
This brain runs
Agent instructions that run or fetch something (26)
.agents/agents/okf-function-go-templating-researcher/AGENT.md:Write for Crossplane users who want to install and use `function-go-templating` in Compositions..agents/agents/okf-reviewer/AGENT.md:`mise run lint` succeeds after the final fixes and before the root or parent agent creates a commit..agents/agents/okf-reviewer/AGENT.md:Run `mise run lint` as the final validation command..agents/skills/okf-open-knowledge-format/SKILL.md:If the user agrees to install:.agents/skills/okf-open-knowledge-format/SKILL.md:uv tool install okflint.agents/skills/okf-open-knowledge-format/SKILL.md:pip install okflint.agents/skills/okf-open-knowledge-format/SKILL.md:kcmd push --dry-run.agents/skills/okf-updates/SKILL.md:Run this workflow only after the user explicitly invokes `$okf-updates`, `/skill:okf-updates`, or `/okf-updates`..agents/skills/okf-updates/SKILL.md:Run at most three direct researchers at once..agents/skills/okf-updates/SKILL.md:A requester reply that selects one or more candidate IDs from this explicitly invoked workflow is explicit permission to run the normal OKF update logic for those candidates..agents/skills/okf-updates/SKILL.md:Run deterministic validation, `okf-reviewer`, and `mise run lint`..agents/skills/okf/SKILL.md:Run this workflow only after the user explicitly invokes `$okf`, `/skill:okf`, or `/okf`..agents/skills/okf/SKILL.md:After all review fixes, run `mise run lint`..agents/skills/okf/SKILL.md:Commit every intended file only after reviewer approval and a successful lint run..agents/skills/okf/SKILL.md:Run the Core docs and Core code researchers together when a concept needs both user-facing guidance and exact served API shape..agents/skills/okf/SKILL.md:Run independent read-heavy research in parallel, with at most three direct agents..agents/skills/okf/SKILL.md:After all fixes, run `mise run lint` and fix every reported issue..agents/skills/okf/SKILL.md:The reviewer may return `APPROVED` only after the final lint run succeeds..agents/skills/okf/SKILL.md:Non-thinking coding models such as Qwen3-Coder-Next can run every project agent without incompatible reasoning controls..agents/skills/okf/SKILL.md:deterministic validation and `mise run lint` resultsAGENTS.md:Run the normal workflow only when the user explicitly invokes `$okf`, `/skill:okf`, or `/okf`, or selects a feature candidate returned by an explicitly invoked `$okf-updates`, `/skill:okf-updates`, or `/okf-updates` workflow.AGENTS.md:Run update discovery only when the user explicitly invokes `$okf-updates`, `/skill:okf-updates`, or `/okf-updates`.AGENTS.md:Run deterministic validation and the `okf-reviewer` before committing the changes.AGENTS.md:After the final review fixes, run `mise run lint` before creating any commit.AGENTS.md:After reviewer approval and a successful lint run, commit every intended change.AGENTS.md:Create commits with a Developer Certificate of Origin sign-off by default by using `git commit --signoff` (or `git commit -s`).
MCP servers (1)
.mcp.json(crossplane-v2-okf):https://crossplane.mcp.jkroepke.de/mcp· uses the network
- Low risk: network-instructions (.agents/skills/okf-open-knowledge-format/SKILL.md:214)
Attribution and licence
- First committed by
jkroepke
- Publisher
- Jan-Otto Kröpke (Community)
- Source
- jkroepke/okf-crossplane-v2 · commit df24ac2
- Licence
- Apache License 2.0 (files served here)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Contributors
- jkroepke
AutoGineer is not affiliated with or endorsed by jkroepke.
Download
The ZIP holds the files AutoGineer serves, with ATTRIBUTION.md and the licence. Download okf-crossplane-v2.zip