New Workspace stuck: Observe fails with 'No state file was found' before Create can run

[Robsta86]

Description

When creating a new Workspace resource with no prior state, the reconciliation gets stuck. The Workspace never reaches SYNCED: True or READY: True.

The error is:

observe failed: cannot list tofu resources: OpenTofu encountered an error. Summary: .

Decoding the full error:

No state file was found!

State management commands require a state file. Run this command
in a directory where OpenTofu has been run or use the -state flag
to point the command to a specific state location.

Reproduction

Tested with both local and Kubernetes secret backends — same result.

Minimal reproduction (local backend):

apiVersion: opentofu.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: local
spec: {}
---
apiVersion: opentofu.upbound.io/v1beta1
kind: Workspace
metadata:
  name: repro-local-backend
spec:
  providerConfigRef:
    name: local
  forProvider:
    source: Inline
    module: |
      output "result" {
        value = "hello from crossplane"
      }

With Kubernetes backend:

apiVersion: opentofu.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: k8s-backend
spec:
  backendFile: |
    terraform {
      backend "kubernetes" {
        secret_suffix     = "repro"
        namespace         = "crossplane-system"
        in_cluster_config = true
      }
    }
---
apiVersion: opentofu.upbound.io/v1beta1
kind: Workspace
metadata:
  name: repro-k8s-backend
spec:
  providerConfigRef:
    name: k8s-backend
  forProvider:
    source: Inline
    module: |
      output "result" {
        value = "hello from crossplane"
      }

Result (same for both):

$ kubectl get workspace.opentofu.upbound.io
NAME                  SYNCED   READY   AGE
repro-local-backend   False            30s
repro-k8s-backend     False            30s

Events show:

Warning  CannotObserveExternalResource  managed/workspace.opentofu.upbound.io  cannot list tofu resources: OpenTofu encountered an error.

Observations

• With enableTofuCLILogging: true, provider logs confirm that tofu plan succeeds — the module is valid and changes are detected.
• Inspecting the provider pod filesystem shows that tofu init ran successfully (.terraform/ directory exists, workspace directory created under terraform.tfstate.d/).
• The workspace state directory is empty — no terraform.tfstate exists because no apply has ever run.
• tofu state list on a workspace with no prior apply returns exit code 1 with "No state file was found" — this is standard OpenTofu behavior (verified locally with OpenTofu v1.11.5).

Environment

• provider-opentofu: v1.1.1
• Crossplane: v2.2.0
• Kubernetes: v1.31.5 (k3d)
• OpenTofu (local verification): v1.11.5

[Robsta86]

Closing — the issue only occurs with local backend. When a backend block (e.g. backend "kubernetes" {}) is declared in the module, tofu init properly initializes it and tofu state list returns empty (exit 0) on a fresh workspace. The backendFile in ProviderConfig uses -backend-config which requires an existing backend block in the HCL to work — without it, the local backend is used and fails on first run.