feat(crossplane): enable dependency version upgrades

[patrick-hermann-sva]

Adds --enable-dependency-version-upgrades to the Crossplane args in cicd/values/crossplane.values.yaml.gotmpl.

Problem

crossplane-config and crossplane-providers install functions and providers under short names (function-auto-ready, provider-opentofu, …), and Configurations depend on them. When one of them is upgraded in place, Crossplane 2.3.3 installs a second copy under the derived name (crossplane-contrib-function-auto-ready) during the revision swap. That copy is the latest version the constraint allows. The package is then in the Lock twice, and every package stays Unhealthy (node … already exists) until the copy is deleted by hand.

Seen on u26-kind3 on 2026-09-18/19:

• provider-opentofu, during a play run;
• function-auto-ready, environment-configs and go-templating, during a planned in-place upgrade.

Lab results (throwaway kind cluster, Crossplane 2.3.3, real stuttgart-things Configurations)

Test	Result
Baseline: short-named function, in-place upgrade	copy after 2 s, every package Unhealthy, does not heal
revisionActivationPolicy: Manual	no copy, but old and new revision both in the Lock, deadlock until the old revision is deleted
revisionHistoryLimit: 0	copy after 2 s, same as baseline
--enable-dependency-version-upgrades	clean within 6–8 s, no copy, no Lock duplicate (3 functions)
Provider (provider-kubernetes 1.2.0 → 1.2.1), no flag	copy plus Lock duplicate, the opentofu pattern
Provider, with flag	clean within 8 s
Flag turned on for an existing cluster, then an upgrade	no package change from the switch itself, then a clean upgrade within 6 s

Why not long names

Every Composition calls its functions by object name (pipeline[].functionRef.name). On kind3 that's function-kcl 31×, auto-ready 27×, environment-configs 16×, go-templating 8× and patch-and-transform 4×. Without the short-named object, rendering fails with cannot get gRPC client connection for Function "function-auto-ready", even though every package shows Healthy. The short names have to stay.

Side effect (alpha flag)

When a Configuration is updated and needs a higher version of a dependency, Crossplane now upgrades the installed dependency in place instead of failing. A helmfile-pinned function or provider can then end up ahead of its pin until the pin is raised. The downgrade flag stays off.

Rollout

helmfile diff against u26-kind3 changes only this one arg in the crossplane Deployment, which restarts once. The kind plays pin this repo via helm_repo_ref (ansible#1216), so the flag only takes effect after that ref is raised.

🤖 Generated with Claude Code