Add safe-start capability

[chlunde]

Description of your changes

This allows cluster operators to disable namespaced or clusterwide
resources, and disable database types that they do not require.

• Providers create ManagedResourceDefinitions but CRDs only when activated
• Users activate only needed resources through ManagedResourceActivationPolicies
• Significant reduction in cluster resource overhead

https://docs.crossplane.io/latest/guides/implementing-safe-start/

I have:

• Read and followed Crossplane's contribution process.
• Run make reviewable to ensure this PR is ready for review.

How has this code been tested

[chlunde]

Hmm, is it flaky?

>>>>>>> verifying cluster-wide MSSQL CRDs are NOT installed
NAME                                CREATED AT
databases.mssql.sql.crossplane.io   2025-11-28T10:47:31Z

cluster-wide MSSQL Database CRD should not be installed

[chlunde]

Locally, sometimes I get

2025-11-28T10:50:13Z    INFO    provider-sql    SafeStart disabled: insufficient CRD watch permissions, using immediate controller setup

...

2025-11-28T10:50:13Z    ERROR   controller-runtime.cache.UnhandledError Failed to watch {"reflector": "k8s.io/client-go@v0.34.0/tools/cache/reflector.go:290", "type": "*v1alpha1.ProviderConfigUsage", "error": "failed to list *v1alpha1.ProviderConfigUsage: providerconfigusages.mssql.sql.crossplane.io is forbidden: User \"system:serviceaccount:crossplane-system:provider-sql-xpkg-crosspl\" cannot list resource \"providerconfigusages\" in API group \"mssql.sql.crossplane.io\" at the cluster scope: RBAC: clusterrole.rbac.authorization.k8s.io \"crossplane:provider:provider-sql-xpkg-crosspl:system\" not found"}
  k8s.io/apimachinery/pkg/util/runtime.logError                                                                                                                                                                                k8s.io/apimachinery@v0.34.0/pkg/util/runtime/runtime.go:221
  k8s.io/apimachinery/pkg/util/runtime.handleError                                                                                                                                                                             k8s.io/apimachinery@v0.34.0/pkg/util/runtime/runtime.go:212
  k8s.io/apimachinery/pkg/util/runtime.HandleErrorWithContext                                                                                                                                                                  k8s.io/apimachinery@v0.34.0/pkg/util/runtime/runtime.go:198
  k8s.io/client-go/tools/cache.DefaultWatchErrorHandler                                                                                                                                                                        k8s.io/client-go@v0.34.0/tools/cache/reflector.go:205
  k8s.io/client-go/tools/cache.(*Reflector).RunWithContext.func1                                                                                                                                                               k8s.io/client-go@v0.34.0/tools/cache/reflector.go:361
  k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1                                                                                                                                                                         k8s.io/apimachinery@v0.34.0/pkg/util/wait/backoff.go:233
  k8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext.func1                                                                                                                                                              k8s.io/apimachinery@v0.34.0/pkg/util/wait/backoff.go:255
  k8s.io/apimachinery/pkg/util/wait.BackoffUntilWithContext                                                                                                                                                                    k8s.io/apimachinery@v0.34.0/pkg/util/wait/backoff.go:256
  k8s.io/apimachinery/pkg/util/wait.BackoffUntil                                                                                                                                                                               k8s.io/apimachinery@v0.34.0/pkg/util/wait/backoff.go:233
  k8s.io/client-go/tools/cache.(*Reflector).RunWithContext                                                                                                                                                                     k8s.io/client-go@v0.34.0/tools/cache/reflector.go:359
  k8s.io/client-go/tools/cache.(*controller).RunWithContext.(*Group).StartWithContext.func3                                                                                                                                    k8s.io/apimachinery@v0.34.0/pkg/util/wait/wait.go:63
  k8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1                                                                                                                                                                       k8s.io/apimachinery@v0.34.0/pkg/util/wait/wait.go:72
2025-11-28T10:50:13Z    INFO    Starting EventSource    {"controller": "managed/role.postgresql.sql.m.crossplane.io", "controllerGroup": "postgresql.sql.m.crossplane.io", "controllerKind": "Role", "source": "kind source: *v1alpha1.Role"}
2025-11-28T10:50:13Z    ERROR   controller-runtime.source.Kind  if kind is a CRD, it should be installed before calling Start   {"kind": "Database.mssql.sql.crossplane.io", "error": "no matches for kind \"Database\" in version \"mssql.sql.crossplane.io/v1alpha1\""}
  sigs.k8s.io/controller-runtime/pkg/internal/source.(*Kind[...]).Start.func1.1                                                                                                                                                sigs.k8s.io/controller-runtime@v0.22.0/pkg/internal/source/kind.go:75
  k8s.io/apimachinery/pkg/util/wait.loopConditionUntilContext.func1                                                                                                                                                            k8s.io/apimachinery@v0.34.0/pkg/util/wait/loop.go:53
  k8s.io/apimachinery/pkg/util/wait.loopConditionUntilContext                                                                                                                                                                  k8s.io/apimachinery@v0.34.0/pkg/util/wait/loop.go:54
  k8s.io/apimachinery/pkg/util/wait.PollUntilContextCancel                                                                                                                                                                     k8s.io/apimachinery@v0.34.0/pkg/util/wait/poll.go:33
  sigs.k8s.io/controller-runtime/pkg/internal/source.(*Kind[...]).Start.func1                                                                                                                                                  sigs.k8s.io/controller-runtime@v0.22.0/pkg/internal/source/kind.go:68

[terwey]

Any news on this? Would love this feature.

[sgpbyrne]

Any update on this @chlunde ?

Hi @fernandezcuesta - I noticed that you are actively working on this repo - do you know if this change will proceed or it has been abandoned?

[fernandezcuesta]

I worked in the same goal on a separate PR before noticing this one, but need to steal some ideas from this one, so eventually I guess we'll work on a blend of both. Can't promise anything short term.