feat(gcp): pin crossplane-configuration-gcp v0.2.0

[Smana]

Wires the GCP Crossplane API released today as crossplane-configuration v0.2.0. #1824 deliberately omitted this because the tag did not exist yet.

Completes workstream 5 of the GCP support design.

The AWS pin bump is not incidental

The schema catalog is derived from one pin. gen-catalog.sh reads XPKG_SOURCE — the AWS configuration-packages.yaml — and fetches that release's xrd-crds.yaml asset.

Left at v0.1.0, the catalog carries 5 XRDs and no GCPWorkloadIdentity, so the first GCP claim added to this repo would hard-fail validation under skipMissingSchemas: false. Loud rather than silent, but it makes the new API unusable here — a half-wired pin.

The alternative was worse. Teaching gen-catalog.sh to merge assets from several pins means handling CRDs that appear in both, and that script carries an explicit warning against growing conditional logic in the fetch, because a second seam is how the catalog drifts from what is actually installed. One version across both clouds keeps it a single seam.

Safe because the AWS package did not change. The package.yaml inside crossplane-configuration-aws v0.1.0 and v0.2.0 is byte-identical — 189403 bytes, same 6 kinds — verified by pulling both from ghcr.io rather than assuming it from the diff. The bump deploys the same content under a new revision.

It is also not the #1774 adopt-vs-prune case: the AWS XRDs are already package-owned, so there is nothing for Flux to delete in between.

Per CLAUDE.md, the App Wizard's fetch-crossplane-configuration clone tag moves in the same change — otherwise the form and render preview describe a different API version than the cluster serves.

No prune: disabled cutover for the GCP pin

That procedure exists because a package adopts XRDs that Flux still holds in its inventory, and prune deletes them in the gap, taking every claim with them.

No GCPWorkloadIdentity XRD or claim has ever existed on any cluster — nothing to adopt, nothing to destroy. The exemption is specific to a first install and is recorded in the kustomization so it is not mistaken for the general rule. It applies again the moment this package reaches a second cluster.

Documentation

Five website pages cited v0.1.0 and none are covered by .doc-claims.yaml, so they would have gone stale silently. Updated. The crossplane README's per-cloud table now shows both pins and states the cutover rule once.

Evidence

Check	Result
./scripts/validate-manifests.sh	exit 0 — Valid: 1216, Invalid: 0, Skipped: 0
Schema catalog	now builds 6 XRD schemas incl. gcpworkloadidentity_v1alpha1.json (was 5)
Published schema matches shipped API	serviceAccount carries name only, root required: [spec], roles pattern includes the numeric-project form
AWS package unchanged across releases	byte-identical package.yaml, pulled from ghcr.io
./scripts/validate-links.sh	exit 0
./scripts/validate-doc-claims.sh	exit 0

The schema check is the meaningful one: it proves source → release → registry → catalog all line up, including the namespace-confinement fix made during review.

Still not verified

Nothing here has run against a live GCP project. The provider has never authenticated and the composition has never created an IAM binding — design criteria 18–21 need a rebuild. A healthy ClusterProviderConfig proves nothing on its own; the first ProjectIAMMember is the real test of the Workload Identity binding.

[github-actions]

🔍 Rendered manifest diff — this PR vs main (desired state)

2 changed · 1 added · 0 removed

Rendered with kustomize build + helm template (source of truth = git), so Helm-expanded workloads are included. Shows what Flux will apply — not a diff against live cluster state (drift is alerted on separately), and not CRD-defaulted / webhook-mutated output. Secret values are redacted; per-render noise (webhook caBundles, checksum/* annotations, render timestamps) is normalized out.

🟡 changed — cloud.ogenki.io/v1alpha1/App/apps/app-wizard

--- a/cloud.ogenki.io/v1alpha1/App/apps/app-wizard
+++ b/cloud.ogenki.io/v1alpha1/App/apps/app-wizard
@@ -77,7 +77,7 @@
     - clone
     - --depth=1
     - --single-branch
-    - --branch=v0.1.0
+    - --branch=v0.2.0
     - https://github.com/Smana/crossplane-configuration.git
     - /repo/crossplane-configuration
     image: cgr.dev/chainguard/git:latest

🟡 changed — pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-aws

--- a/pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-aws
+++ b/pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-aws
@@ -4,4 +4,4 @@
   name: crossplane-configuration-aws
   namespace: crossplane-system
 spec:
-  package: ghcr.io/smana/crossplane-configuration-aws:v0.1.0
+  package: ghcr.io/smana/crossplane-configuration-aws:v0.2.0

🟢 added — pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-gcp

--- a/pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-gcp
+++ b/pkg.crossplane.io/v1/Configuration/crossplane-system/crossplane-configuration-gcp
@@ -0,0 +1,7 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Configuration
+metadata:
+  name: crossplane-configuration-gcp
+  namespace: crossplane-system
+spec:
+  package: ghcr.io/smana/crossplane-configuration-gcp:v0.2.0