Default managed resource activation policy

important

This feature is in preview and is off by default. It requires Spaces v1.19.0 or later.

Crossplane 2.x represents each managed resource a provider ships as a ManagedResourceDefinition. A ManagedResourceActivationPolicy decides which managed resource definitions become active, and Crossplane installs CRDs only for active ones. Upbound Crossplane (UXP) installs a policy named default that activates *, so every provider in a control plane serves every managed resource it ships.

The spec.crossplane.defaultManagedResourceActivationPolicy.mode field on a ControlPlane lets each control plane keep that behavior (All) or start with nothing activated (None). With None, you activate only the managed resources you use, with policies of your own. The control plane then holds fewer CRDs, and on UXP v2.4.2-up.1 and later, providers stay scaled to zero until you activate one of their managed resources.

Without this feature, the only setting is the controlPlanes.uxp.disableDefaultManagedResourceActivationPolicy Helm parameter, which applies to every control plane in the Space.

How activation works

Activation policies only apply to providers that declare the safe-start capability. Crossplane activates every managed resource definition of other providers whatever the policies say, so None changes nothing for them.

Crossplane v2.4 scales the runtime of a safe-start provider to zero until the first of its managed resource definitions becomes active. UXP does this from v2.4.2-up.1. On earlier versions, provider pods keep running even with nothing activated.

warning

Activation is one-way. An active managed resource definition never becomes inactive again, and a provider that scaled up never scales back to zero. Switching a control plane to None stops further activation through the default policy, but it doesn't undo what's already active. To get the full benefit for every provider, set None when you create the control plane.

Prerequisites

To use this feature, you need:

• A self-hosted Space running Spaces v1.19.0 or later
• Control planes running UXP v2.x. Control planes on UXP v1.x ignore the setting until you upgrade them.
• UXP v2.4.2-up.1 or later, if you want unused providers to scale to zero
• Helm and kubectl

Before you enable the feature

When you enable the feature, Spaces takes over the default policy in every UXP v2.x control plane in the Space. Each control plane picks up the change on its next reconcile, and the change can't be undone where it activates managed resources.

Where the mode resolves to All, Spaces sets default to activate *. If you narrowed or deleted default in a control plane, this activates every managed resource there for good.

Where the mode resolves to None, Spaces deletes default. This includes every control plane without its own mode in a Space that sets disableDefaultManagedResourceActivationPolicy, where the Helm parameter alone never deleted an existing default. Those control planes stop activating managed resources for providers you install later.

You can't set a mode on a control plane before the feature is on, so check each control plane for a customized or missing default policy first:

kubectl get managedresourceactivationpolicy default -o yaml

Enabling or disabling the feature also restarts Crossplane once in each running UXP v2.x control plane, unless the Space already sets disableDefaultManagedResourceActivationPolicy. The restarts don't happen during the Helm upgrade. Each control plane picks up the change on its next reconcile, so they don't all happen at once. A paused control plane picks it up when it resumes.

Enable the feature

Set features.alpha.managedResourceActivationPolicy.enabled=true when you install or upgrade Spaces:

helm upgrade spaces oci://xpkg.upbound.io/spaces-artifacts/spaces \
  --version ${SPACES_VERSION} \
  --namespace upbound-system \
  --reuse-values \
  --set "features.alpha.managedResourceActivationPolicy.enabled=true" \
  --wait

Start a control plane with nothing activated

1. Set mode to None in the ControlPlane manifest:

   apiVersion: spaces.upbound.io/v1beta1
   kind: ControlPlane
   metadata:
     name: my-control-plane
     namespace: default
   spec:
     crossplane:
       defaultManagedResourceActivationPolicy:
         mode: None

   When you set defaultManagedResourceActivationPolicy, you must set mode to All or None.

2. Apply the manifest:

   kubectl apply -f my-control-plane.yaml

3. Connect to the control plane and confirm that it has no default policy:

   kubectl get managedresourceactivationpolicy default

   The command returns a NotFound error.

4. Activate the managed resources you use with a policy of your own:

   apiVersion: apiextensions.crossplane.io/v1alpha1
   kind: ManagedResourceActivationPolicy
   metadata:
     name: my-activations
   spec:
     activate:
     - buckets.s3.aws.m.upbound.io
     - "*.ec2.aws.m.upbound.io"

   Don't name it default. While the feature is on, Spaces overwrites or deletes the default policy, depending on the mode.

5. Check which managed resource definitions are active:

   kubectl get managedresourcedefinitions

   The STATE column shows Active for the managed resources your policy matches and Inactive for the rest.

See the Crossplane documentation on managed resource activation policies for the pattern syntax.

Set a default for the whole Space

Control planes that don't set mode use the Space-wide default. Spaces resolves the mode of each control plane in this order:

1. The mode set on the ControlPlane
2. None, if the Space sets controlPlanes.uxp.disableDefaultManagedResourceActivationPolicy=true
3. All, which matches Crossplane's own behavior

warning

Changing the Space-wide default while the feature is on changes the mode of every control plane that doesn't set its own. Going from None to All activates every managed resource in those control planes and can't be undone. Going from All to None deletes the default policy in each of them.

Change the mode of a running control plane

Edit mode on the ControlPlane. The change takes effect without a restart. Switching to None doesn't deactivate anything that's already active.

Spaces also reverts edits to, or the deletion of, the default policy inside the control plane. It does this on the control plane's next reconcile, which any change to the ControlPlane triggers and which otherwise runs periodically.

If you set a mode while you have paused Crossplane in the control plane, the mode holds from the moment Crossplane starts again.

Disable the feature

When you disable the feature, Spaces stops managing the default policy. Unless the Space sets disableDefaultManagedResourceActivationPolicy, Crossplane recreates default with * when it restarts. This activates every managed resource in control planes that ran with None, and it can't be undone.

While the feature is off, Spaces rejects ControlPlane objects that set spec.crossplane.defaultManagedResourceActivationPolicy. A ControlPlane that already has the field keeps it, but Spaces ignores it. You can remove the field, but you can't set or change it until you enable the feature again.

Troubleshooting

Provider pods keep running with nothing activated

Check that:

• The provider declares the safe-start capability
• The control plane runs UXP v2.4.2-up.1 or later
• None of the provider's managed resource definitions are active, in the output of kubectl get managedresourcedefinitions

A provider scaled to zero reports the RuntimeActive condition as False with the reason AwaitingActivation on its ProviderRevision.

The default policy comes back or changes

While the feature is on, Spaces owns the default policy and reverts any change to it. Keep your activations in policies with other names.

The control plane isn't ready

A new control plane isn't ready until Spaces has reconciled its default policy. Crossplane installs the ManagedResourceActivationPolicy CRD after it starts, so for a short time the Ready condition of the ControlPlane reports Waiting for control plane API: Waiting for the ManagedResourceActivationPolicy CRD. If Spaces can't reconcile the policy, the condition reports the error instead. To see the condition, run:

kubectl get controlplane <control-plane-name> -o yaml