Managed Reconciler calls the Update method for managed resources that don't exist

[bobh66]

What happened?

This issue was found in provider-kubernetes but the fix appears to belong in the managed reconciler.

The problem occurs when a Managed Resource has managementPolicies: ['Observe', 'Update'] and the external resource does not exist.

The managed reconciler does not gate the Update() call on observation.ResourceExists here so the reconciler will call Observe() for a resource that doesn't exist and get back observation.ResourceExists == false and observation.ResourceUpToDate == false. It will skip the Create() step as intended, but will call Update() because the resource is not up to date. This is normally not a problem beyond causing an invalid Update request to the external system, but in the case of provider-kubernetes the missing resource is created by the Update() call because it uses SSA and is unaware that the resource did not already exist.

How can we reproduce it?

See crossplane-contrib/provider-kubernetes#542 for more details and a sample manifest that causes the problem.

What environment did it happen in?

Crossplane version: 2.3.4

• Cloud provider or hardware configuration: kind
• Kubernetes version: 1.36
• Kubernetes distribution: kind

Suggested Solution

Update the Managed Reconciler to not call Update() when the resource is not found.