crossplane/upjet v2.4.0

on GitHub

This is a minor release that ships several new configuration and runtime capabilities for upjet-based providers, together with a set of bug fixes and security-relevant dependency updates.

New Features

• Runtime Terraform conversions in the CLI-based external client (#683): The Terraform CLI external client now applies the runtime schema conversions (for example, singleton-list-to-embedded-object) that were previously handled only by the no-fork clients. This unblocks CLI-based providers whose reconciliations failed when converting singleton lists to embedded objects.

• Separate Terraform import ID via GetImportIDFn (#677): Added an optional ExternalName.GetImportIDFn field. When set, upjet uses it to produce the ID passed to terraform import, while GetIDFn continues to produce the ID for the refreshed state. This supports providers that store resource IDs in a different format than their import function expects; existing behavior is preserved when it is unset. Fixes #676.

• Customizable controller setup aggregator & terraformed templates (#693): Added the config.WithSetupAggregatorTemplate and config.WithTerraformedTemplate ProviderOptions, allowing providers to override the controller setup aggregator and the resource.Terraformed templates used during code generation. The change is backward-compatible and mirrors the existing config.WithMainTemplate option. A new Terraform.ResourceSchema template variable is also introduced, superseding Terraform.SchemaVersion for terraformed template rendering.

• Storage version migration support (#588, #711): Added support for automatically migrating stored CRD resources to the current storage version when a CRD's storage version changes, avoiding stale versions lingering in etcd across upgrades. #711 switches this to a dynamic approach that discovers the versions to migrate at runtime instead of relying on static configuration.

Bug Fixes

• Fix namespaced conversions resolved from the wrong provider in RoundTrip (#695): registry.GetConversions selected between the cluster- and namespaced-scoped providers using the destination object's namespace, which was still empty at the first conversion stage during RoundTrip, so namespaced resources fell through to the cluster-scoped provider. The namespace is now copied from the source before conversions are resolved, so all conversion stages operate against the correct provider.

• Fix "unexpected identity change" errors at Observe (Plugin Framework) (#698): Incomplete or invalid resource identities (for example, cached after a failed Create) could be sent as CurrentIdentity to Terraform's ReadResource RPC, causing subsequent Observe calls to fail with an "unexpected identity change" diagnostic once the original failure was resolved. Such identities are no longer fed back to the provider, eliminating the spurious errors.

• Prevent Terraform provider panics when the external resource is not found (#685): InstanceState's RawConfig and RawPlan are now populated when a previously cached state had zero-valued RawConfig/RawPlan but the external resource is (no longer) found. This prevents the underlying Terraform provider from panicking when it reads those attributes (for example, the Terraform AWS provider's tagging interceptor).

• Omit XValidation for required fields that have references (#684): When a field is marked required but also has a reference configured, it is satisfiable via its *Ref/*Selector fields, so no CEL XValidation required-parameter rule is emitted for it anymore. This avoids validation errors for fields resolved through references.

• Do not emit SSA markers on observation (status) fields (#660): Removed the listType: map markers and injected map-key defaults from generated status.atProvider fields, where server-side apply merge markers do not apply. Fixes #659.

Dependency & Security Updates

• Bumped golang.org/x/net to v0.55.0 (#699) and google.golang.org/grpc to v1.82.1 (#710) to pick up security fixes.
• Updated Go to 1.25.12 (#701) and refreshed CI GitHub Actions and build tooling (#661, #700, #703, #705, #706, #707, #709).

What's Changed

• Add support for Terraform runtime conversions in CLI-based external client by @ulucinar in #683
• Set InstanceState's RawConfig & RawPlan if Resource is not found by @ulucinar in #685
• fix(types): omit XValidation for required fields with references by @jonasz-lasut in #684
• Allow Custom Controller Setup Aggregator & Terraformed Templates via config.Provider by @ulucinar in #693
• fix: comment status without SSA options by @fernandezcuesta in #660
• Update all non-major github action by @renovate[bot] in #661
• feat: add getImportIDFn by @fernandezcuesta in #677
• Fix resolving namespaced conversions to wrong provider in RoundTrip by @sergenyalcin in #695
• [feat]: Surface deletionTimestamp as a printcolumn by @tchinmai7 in #514
• chore: update renovate configuration by @erhancagirici in #649
• Update module golang.org/x/net to v0.55.0 [SECURITY] by @renovate[bot] in #699
• Update dependency go to v1.25.12 - autoclosed by @renovate[bot] in #701
• Update all non-major github action by @renovate[bot] in #700
• Update dependency docker/buildx to v0.35.0 by @renovate[bot] in #703
• Update actions/checkout action to v7 by @renovate[bot] in #706
• Update actions/cache action to v6 by @renovate[bot] in #705
• Revert "[feat]: Surface deletionTimestamp as a printcolumn" by @jonasz-lasut in #708
• Add storage version migration support by @sergenyalcin in #588
• fw-external-client: fix TF unexpected identity change errors at Observe by @erhancagirici in #698
• Update module google.golang.org/grpc to v1.82.1 [SECURITY] by @renovate[bot] in #710
• Update all non-major github action by @renovate[bot] in #709
• Update actions/setup-go action to v7 by @renovate[bot] in #707
• Switch to dynamic storage version migration by @sergenyalcin in #711

Full Changelog: v2.3.0...v2.4.0