fix: preserve OIDC dependencies during deletion

[patrickleet]

Summary

• add readiness-gated Crossplane Usages for the OIDCClient deletion chain
• keep the Zitadel ProviderConfig and credentials alive while deleting the external OIDC application
• keep provider-kubernetes alive while deleting the credentials Object
• assert all three deletion edges in the focused OIDCClient composition test

Test output

• git diff --check — passed
• Dory full/focused renders — blocked before template evaluation because the Docker API returned EOF while creating dependency-schema containers; Colima was not used
• GitHub Actions — pending

Incident evidence

This prevents the teardown ordering observed for preview OIDCClients, where ProviderConfigs disappeared before their dependent managed resources could delete external state.

Summary by CodeRabbit

• New Features

  • Added safeguards that preserve required provider configurations and credentials until dependent resources are deleted.
  • Added deletion ordering for Kubernetes provider, credentials, OIDC provider, and OIDC application resources.
  • Enabled deletion replay to support reliable cleanup of dependent resources.

• Tests

  • Added coverage verifying resource protection and deletion ordering behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 82088f09-597a-4576-8795-f9980621ad7f

📥 Commits

Reviewing files that changed from the base of the PR and between fc7ebe1 and 4fc78a1.

📒 Files selected for processing (5)

• functions/oidcclient/010-state-status.yaml.gotmpl
• functions/oidcclient/050-kubernetes-provider-config.yaml.gotmpl
• functions/oidcclient/100-bootstrap-credentials.yaml.gotmpl
• functions/oidcclient/200-provider-config.yaml.gotmpl
• tests/test-oidcclient/main.k

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The OIDC client function now computes observed readiness and creates Crossplane Usage resources that enforce deletion order among Kubernetes and Zitadel ProviderConfigs, credentials, and the OIDC application. Tests assert all three deletion relationships.

Changes

OIDC deletion ordering

Layer / File(s)	Summary
Readiness state computation functions/oidcclient/010-state-status.yaml.gotmpl	The template computes readiness for ProviderConfigs, credentials, and the OIDC resource. It stores four readiness booleans in $state.observed.
Deletion dependency wiring functions/oidcclient/050-kubernetes-provider-config.yaml.gotmpl, functions/oidcclient/100-bootstrap-credentials.yaml.gotmpl, functions/oidcclient/200-provider-config.yaml.gotmpl	The templates conditionally create Usage resources with replayDeletion: true to enforce deletion order among the ProviderConfigs, credentials Object, and OIDC resource.
Deletion order assertions tests/test-oidcclient/main.k	Tests assert the three Usage relationships and deletion replay setting.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 4fc78

The PR adds readiness-gated deletion ordering for OIDC dependencies and corresponding assertions; no actionable merge-blocking risk remains at the current head.

Sequence Diagram(s)

sequenceDiagram
  participant StateStatusTemplate
  participant UsageTemplates
  participant Crossplane
  StateStatusTemplate->>UsageTemplates: expose resource readiness
  UsageTemplates->>Crossplane: create conditional Usage resources
  Crossplane->>Crossplane: replay deletion in dependency order

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preserving OIDC-related dependencies during deletion through Crossplane Usages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/oidcclient-deletion-order

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Published Crossplane Package

The following Crossplane package was published as part of this PR:

Package: ghcr.io/hops-ops/auth-stack:pr-28-9d8791bd2a7080985d87e078457b9ddca4a50cb0

View Package