Skip to content

Conversation

@bobh66
Copy link
Contributor

@bobh66 bobh66 commented Sep 12, 2025

Description of your changes

Added a MustCreate management policy that requires the external resource to NOT exist before the MR can create it.

Fixes #872

Tested using provider-kubernetes running a private branch of crossplane-runtime. Created a Secret and also an Object containing a Secret with the same name but different data, and managementPolicies: ['MustCreate', 'Observe', 'Update', 'LateInitialize', 'Delete'] and verified that when the Object was created the Secret remained unchanged and the Object reported an error that the Secret it was trying to create was already in existence.

Docs PR is crossplane/docs#993

I have:

Need help with this checklist? See the cheat sheet.

@bobh66 bobh66 requested a review from a team as a code owner September 12, 2025 19:08
@bobh66 bobh66 requested a review from negz September 12, 2025 19:08
Copy link
Member

@jbw976 jbw976 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks reasonable as well @bobh66, thank you!

// All actions explicitly set, the same as default.
sets.New[xpv1.ManagementAction](xpv1.ManagementActionObserve, xpv1.ManagementActionCreate, xpv1.ManagementActionUpdate, xpv1.ManagementActionLateInitialize, xpv1.ManagementActionDelete),
// All actions explicitly set with MustCreate instead of Create.
sets.New[xpv1.ManagementAction](xpv1.ManagementActionObserve, xpv1.ManagementActionMustCreate, xpv1.ManagementActionUpdate, xpv1.ManagementActionLateInitialize, xpv1.ManagementActionDelete),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the combinatorics are starting to get cumbersome here - are we already tracking loosening up our requirement to define every possible allowed combination of policies? i couldn't find a tracking issue for that just looking now...

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was to ensure folks dont shoot themselves in the foot by adding unsupported/untested combinations, or combinations that dont make sense. Most of the sensible ones are here already.

Adding more policies will make this worse and if we do we should rethink this.

never := time.Time{}
// If the resource already exists, the MustCreate policy is set, and there are no create annotations then
// this MR did not create the resource and an error is raised.
if observation.ResourceExists && policy.MustCreate() && meta.GetExternalCreatePending(managed).Equal(never) && meta.GetExternalCreateSucceeded(managed).Equal(never) && meta.GetExternalCreateFailed(managed).Equal(never) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should these checks for all the external create annotations be made into a helper function? e.g. similar to ExternalCreateIncomplete and ExternalCreateSucceededDuring

@lsviben
Copy link
Contributor

lsviben commented Oct 28, 2025

Similarly to the comment on adding the Orphan management policy, I am vary of adding new policies to the management policies except for the primitives we have.

Adding MustCreate would be adding a flavour of Create, so I worry that if we go in this direction we would add more such flavours in the future and it could become unmanagable. Or imagine if we would later want to combine the Orphan policy ["Observe", "Create", "Update", "LateInitialize"] from the other PR, with MustCreate. Would we need to add OrphanMustCreate that translates to ["Observe", "MustCreate", "Update", "LateInitialize"]. Furthermore * would lose its meaning as it would not anymore map to ALL.

In general I think the basic policies should follow the methods of the external managed client.

However, I do understand where the issue is coming from and what we are trying to achive here, I just don't think adding a new management policy is the right way. I wonder should we introduce some management options field? We could add mustCreate there, and maybe move lateInitialize there at one point, or anything else that pops out?

@bobh66
Copy link
Contributor Author

bobh66 commented Nov 4, 2025

@lsviben I don't disagree that managementPolicies is already too complicated - related comment here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support MustCreate management policy to trigger failure when a resource already exists

3 participants