Problem
Running multiple independent instances of provider-terraform in the same cluster is currently blocked by Crossplane's CRD ownership model:
cannot establish control of object: workspaces.tf.upbound.io is already controlled
by ProviderRevision terraform-caed3a7b79bd
CRDs are cluster-scoped Kubernetes resources and can only carry a single ownerReference, preventing a second ProviderRevision from claiming the same CRD.
Motivation
A single provider instance creates operational challenges:
-
Priority — No way to ensure critical Workspace resources are reconciled ahead of less important ones. A dedicated instance per priority tier would solve this.
-
Security — A single pod accumulates credentials for all connected systems, violating least-privilege. Independent instances allow scoped credential access.
-
Conflicting runtime requirements — Different workloads require different identity mechanisms (IRSA, Azure Workload Identity), private Terraform binaries, and environment variables that may collide. A single image cannot cleanly satisfy all of these.
-
Team autonomy — Multiple teams want to own and deploy their automation independently into a shared cluster, without being forced to co-maintain a single provider image and deployment.
Feature Request
We'd like to discuss how provider-terraform could support this use case — whether via changes in this repo, upstream in crossplane/crossplane, or both.
Problem
Running multiple independent instances of provider-terraform in the same cluster is currently blocked by Crossplane's CRD ownership model:
CRDs are cluster-scoped Kubernetes resources and can only carry a single ownerReference, preventing a second ProviderRevision from claiming the same CRD.
Motivation
A single provider instance creates operational challenges:
Priority — No way to ensure critical Workspace resources are reconciled ahead of less important ones. A dedicated instance per priority tier would solve this.
Security — A single pod accumulates credentials for all connected systems, violating least-privilege. Independent instances allow scoped credential access.
Conflicting runtime requirements — Different workloads require different identity mechanisms (IRSA, Azure Workload Identity), private Terraform binaries, and environment variables that may collide. A single image cannot cleanly satisfy all of these.
Team autonomy — Multiple teams want to own and deploy their automation independently into a shared cluster, without being forced to co-maintain a single provider image and deployment.
Feature Request
We'd like to discuss how provider-terraform could support this use case — whether via changes in this repo, upstream in crossplane/crossplane, or both.