Adds the data plane for the Sovereign IAM access plane (epic #320):
- platform/crossplane-claims/chart/templates/xrds/useraccess.yaml
XUserAccess XRD (access.openova.io/v1alpha1) — cluster-scoped Claim
carrying user identity (Keycloak subject + groups), Sovereign ref, and
one or more (application, role, namespaces) grants.
- platform/crossplane-claims/chart/templates/compositions/useraccess.yaml
Default Composition useraccess.compose.openova.io — materialises one
RoleBinding per Claim via provider-kubernetes Object against the
per-Sovereign sovereign-<sovereignRef> ProviderConfig. Multi-grant
shapes are expanded api-side into N single-grant Claims (avoids the
Composition-iteration trap; no composition-functions introduced).
- platform/crossplane-claims/chart/templates/clusterroles.yaml
Three canonical ClusterRoles — openova:application-{admin,editor,viewer}.
Editor + viewer explicitly omit secrets; admin can manage namespace-
scoped roles/rolebindings (NOT cluster-scoped).
- userAccess.enabled values toggle (default true), version bumps to 1.1.0
on chart + blueprint, sample fixture, validation script extended to
expect 7 XRDs / 7 Compositions / 3 ClusterRoles.
Canonical seam: extends the existing platform/crossplane-claims/chart/
XRD+Composition pattern (compose.openova.io/v1alpha1 family). New API
group access.openova.io is intentional — IAM is a separate concern from
the cloud-resource compose.* family. No catalyst-api or UI code touched
(those are #323's territory; this PR ships the data model #323 consumes).
Co-authored-by: hatiyildiz <hatiyildiz@noreply.github.com>
Resolves install ordering on fresh clusters where the apiserver rejects
CompositeResourceDefinition CRs because the apiextensions.crossplane.io
CRDs registered by the crossplane subchart aren't live yet at apply time.
- bp-crossplane bumped 1.1.2 -> 1.1.3 (controller-only payload)
- NEW bp-crossplane-claims@1.0.0 carries XRDs + Compositions
- Flux HelmRelease for crossplane-claims uses dependsOn: [bp-crossplane]
- composition-validate.sh + fixtures relocate to the new chart
- blueprint-release CI: opt-out annotation
catalyst.openova.io/no-upstream=true permits zero-deps charts that
legitimately ship only Catalyst-authored CRs (the original hollow-chart
rule remains in force for every other umbrella chart)
Live error this fixes (from otech.omani.works):
no matches for kind "CompositeResourceDefinition" in version
"apiextensions.crossplane.io/v1" -- ensure CRDs are installed first
Pattern: intra-chart CRD-ordering breaks -> split charts + Flux dependsOn.
Apply universally to similar cases going forward.
Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
