[BUG] using a role with compositeRolesSelector fails if no roles are found anymore

[TomBillietKlarrio]

I have this usecase:

---
apiVersion: role.keycloak.crossplane.io/v1alpha1
kind: Role
metadata:
  labels:
    use: v1
  name: role2
spec:
  providerConfigRef:
    name: keycloak-provider-config
  forProvider:
    name: role2
    description: "rol"
    realmId: master
---
apiVersion: role.keycloak.crossplane.io/v1alpha1
kind: Role
metadata:
  name: role4
spec:
  providerConfigRef:
    name: keycloak-provider-config
  forProvider:
    name: role4
    compositeRolesSelector:
      matchLabels:
        use: v1
      policy:
        resolution: Optional
        resolve: Always
    description: "composite role"
    realmId: master

role4 has a compositeRolesSelector, which matched for role2.
This all works fine when installed on the cluster.

However, if role2 gets deleted, the compositeRolesSelector no longer matches any role. If should then update the role4 to remove those references, but that fails. Note it only fails if there was a match before. If the compositeRolesSelector never had a match, all is fine.
The error I get

2025-11-05T11:19:25Z	DEBUG	provider-keycloak	Cannot resolve managed resource references	{"controller": "managed/role.keycloak.crossplane.io/v1alpha1, kind=role", "request": {"name":"role4"}, "uid": "b1731ea2-3928-4c1f-8abd-4e1c82a2c9c1", "version": "681132", "external-name": "3c695e26-226b-450d-abc1-38ccc69eb393", "error": "cannot patch the managed resource via server-side apply: Role.role.keycloak.crossplane.io \"role4\" is invalid: [spec.forProvider.compositeRolesRefs: Invalid value: \"null\": spec.forProvider.compositeRolesRefs in body must be of type array: \"null\", spec.forProvider.compositeRoles: Invalid value: \"null\": spec.forProvider.compositeRoles in body must be of type array: \"null\", <nil>: Invalid value: \"null\": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation]"}
2025-11-05T11:19:25Z	DEBUG	events	cannot patch the managed resource via server-side apply: Role.role.keycloak.crossplane.io "role4" is invalid: [spec.forProvider.compositeRolesRefs: Invalid value: "null": spec.forProvider.compositeRolesRefs in body must be of type array: "null", spec.forProvider.compositeRoles: Invalid value: "null": spec.forProvider.compositeRoles in body must be of type array: "null", <nil>: Invalid value: "null": some validation rules were not checked because the object was invalid; correct the existing errors to complete validation]	{"type": "Warning", "object": {"kind":"Role","name":"role4","uid":"b1731ea2-3928-4c1f-8abd-4e1c82a2c9c1","apiVersion":"role.keycloak.crossplane.io/v1alpha1","resourceVersion":"681132"}, "reason": "CannotResolveResourceReferences"}

I've been digging into it, and came so far:

provider-keycloak/apis/cluster/role/v1alpha1/zz_generated.resolvers.go

Line 67 in 67ac2ea

mg.Spec.ForProvider.CompositeRolesRefs = mrsp.ResolvedReferences

seems to do the resolving, and that nicely resolves to an empty array

Going further, I think this may be caused because the omitEmpty flag here

provider-keycloak/apis/cluster/role/v1alpha1/zz_role_types.go

Line 38 in 67ac2ea

CompositeRoles []*string `json:"compositeRoles,omitempty" tf:"composite_roles,omitempty"`

I tried removing that flag on line 38 and 42 and running a debug version. That does not give this error anymore, but gets the provider seemingly into and endless loop reconciling the role the whole time.

I'm a bit stuck here, any advice would be appreciated

[TomBillietKlarrio]

Looks like I needed to remove the omitempty on a few more places, now it seems to work, I opened a PR.
It's a bit unclear to me however how I can add a test for this. All tests seems to be a crossplane object that should just work? In this case I need some logic:

• create 2 roles
• delete a role again
• make sure the crossplane sync runs (which can take minutes)

[denniskniep]

Hi,
behind the scenes chainsaw is used see here Hope that helps: https://blog.upbound.io/crossplane-testing-deep-dive

Maybe you can apply different states in different phases ?!

[Breee]

So this is in fact an upjet limitation and needs to be fixed in upjet itself. I'll soon fork upjet I think and then we can fix all sorts of Bugs hopefully.