cmd/crossplane/core/core.go (1)

343-349: Optionally ignore canceled/timeouts to reduce noise.

Consider treating context cancellation/timeouts as benign as well.

Apply this diff after fixing the Is order:

        DefaultWatchErrorHandler: func(_ context.Context, _ *kcache.Reflector, err error) {
-           if errors.Is(err, io.EOF) {
+           if errors.Is(err, io.EOF) ||
+               errors.Is(err, context.Canceled) ||
+               errors.Is(err, context.DeadlineExceeded) {
                // Watch ended normally or context done.
                return
            }
            log.Debug("Watch error - probably due to CRD being uninstalled", "error", err)
        },

internal/controller/pkg/revision/reconciler.go (1)

122-128: Naming nit: option sets only the client, not the applicator.

WithClientApplicator(ca) now assigns only ca.Client. That matches current usage (this reconciler never calls Apply), but the name can mislead tests/callers expecting Applicator injection.

Would you like a follow-up to add a new WithClient option and deprecate WithClientApplicator here for clarity?

internal/controller/pkg/runtime/runtime_function.go (3)

93-95: Add MustBeControllableBy to avoid adopting foreign Services

Defensive guard to ensure we only mutate Services we control; aligns with other controllers.

- if err := h.client.Applicator.Apply(ctx, svc); err != nil {
+ if err := h.client.Applicator.Apply(ctx, svc, resource.MustBeControllableBy(pr.GetUID())); err != nil {

Quick check: does build.Service already set OwnerReferences? If yes, this is belt-and-braces. Thanks!

---

106-108: Likewise guard Secret apply with MustBeControllableBy

Consistent ownership check on the TLS Secret.

- if err := h.client.Applicator.Apply(ctx, secServer); err != nil {
+ if err := h.client.Applicator.Apply(ctx, secServer, resource.MustBeControllableBy(pr.GetUID())); err != nil {

---

145-147: Guard Deployment apply with MustBeControllableBy

Prevents updating Deployments not controlled by this revision.

- if err := h.client.Applicator.Apply(ctx, d); err != nil {
+ if err := h.client.Applicator.Apply(ctx, d, resource.MustBeControllableBy(pr.GetUID())); err != nil {

internal/engine/engine.go (1)

304-306: Small doc nit: clarify ignored mgr param in wrapper

Future readers may wonder why mgr is unused here after the API change.

- co := &ControllerOptions{nc: func(name string, mgr manager.Manager, options kcontroller.Options) (kcontroller.Controller, error) {
+ // controller-runtime >= v0.22: NewUnmanaged no longer requires a manager; mgr is intentionally ignored.
+ co := &ControllerOptions{nc: func(name string, mgr manager.Manager, options kcontroller.Options) (kcontroller.Controller, error) {

internal/controller/pkg/runtime/runtime_provider.go (5)

89-91: Add MustBeControllableBy for Service apply

Avoids mutating Services not owned by the ProviderRevision.

- if err := h.client.Applicator.Apply(ctx, svc); err != nil {
+ if err := h.client.Applicator.Apply(ctx, svc, resource.MustBeControllableBy(pr.GetUID())); err != nil {

---

102-105: Guard TLS client Secret apply with MustBeControllableBy

- if err := h.client.Applicator.Apply(ctx, secClient); err != nil {
+ if err := h.client.Applicator.Apply(ctx, secClient, resource.MustBeControllableBy(pr.GetUID())); err != nil {

---

106-108: Guard TLS server Secret apply with MustBeControllableBy

- if err := h.client.Applicator.Apply(ctx, secServer); err != nil {
+ if err := h.client.Applicator.Apply(ctx, secServer, resource.MustBeControllableBy(pr.GetUID())); err != nil {

---

146-148: Add MustBeControllableBy for Deployment apply

Consistency with CRD/other apply sites and safer ownership semantics.

- if err := h.client.Applicator.Apply(ctx, d); err != nil {
+ if err := h.client.Applicator.Apply(ctx, d, resource.MustBeControllableBy(pr.GetUID())); err != nil {

---

288-289: Consider guarding ServiceAccount apply with MustBeControllableBy

If SA is internally managed, add an ownership guard to avoid updates to external SAs. This would require threading the owner UID into applySA.

Would you like a small follow-up that refactors applySA to accept the owner UID and applies:

- func applySA(ctx context.Context, cl resource.ClientApplicator, sa *corev1.ServiceAccount) error {
+ func applySA(ctx context.Context, cl resource.ClientApplicator, ownerUID types.UID, sa *corev1.ServiceAccount) error {
    ...
-   return cl.Applicator.Apply(ctx, sa)
+   return cl.Applicator.Apply(ctx, sa, resource.MustBeControllableBy(ownerUID))
}

and call with:

- if err := applySA(ctx, h.client, sa); err != nil {
+ if err := applySA(ctx, h.client, pr.GetUID(), sa); err != nil {

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro