fix(crossplane): stop NATGateway late-initializing vpcId (zonal create failure) (#718)

* fix(crossplane): stop NATGateway late-initializing vpcId

The PlatformCluster Composition never sets spec.forProvider.vpcId on the
NATGateway, but the Upbound AWS EC2 provider late-initializes it from the
observed resource. availabilityMode defaults to "zonal", for which the EC2
API rejects VpcId on create:

  MissingParameter: VpcId is not supported for a NAT gateway with
  availability mode zonal

This stays dormant while the NAT exists (observe-only), but any (re)create
- e.g. after an out-of-band NAT deletion - fails, which breaks the private
subnet default route, blocks provider image pulls, and cascades into ArgoCD
cluster-cache sync errors.

Excluding LateInitialize from managementPolicies prevents the provider from
copying vpcId into the spec, so (re)create uses subnetId only and succeeds.

* fix(bootstrap): replace {{- if }} blocks with dig (directory-mode compatible) + open addon enablement via GitLab overlay

CRITICAL: the PR #628 cherry-pick added Go-template {{- if }} control
blocks to addons.yaml. gitops/bootstrap is applied in ArgoCD directory
mode (raw YAML), so {{- if }} broke YAML parsing — bootstrap app errored:
'Failed to unmarshal addons.yaml: line 28 could not find expected':''.

Fix: use sprig 'dig' (missingkey-safe) for optional overlay_repo_* annotations
instead of {{- if }} structural control flow. Overlay source is now always
present, defaulting to the addons/fleet repo when overlay_repo_url is absent
(idempotent no-op). Valid YAML, backward-compatible, missingkey-safe.

Also opens addon enablement to tenants: fleet-secret appsets (hub + spokes)
now merge $overlay enabled-addons.yaml/addon-overrides.yaml from GitLab
fleet-config on top of the GitHub defaults.

---------

Co-authored-by: Workshop User <workshopuser@example.com>

Author: allamand

gitops/abstractions/crossplane/platform-cluster/templates/composition.yaml

@@ -274,6 +274,16 @@ spec:
               apiVersion: ec2.aws.upbound.io/v1beta1
               kind: NATGateway
               spec:
+                # Exclude LateInitialize so the provider does not copy the observed
+                # vpcId back into spec.forProvider. availabilityMode defaults to
+                # "zonal", and a late-initialized vpcId makes (re)create fail with:
+                # "VpcId is not supported for a NAT gateway with availability mode zonal".
+                # The Composition intentionally never sets vpcId here; subnetId is enough.
+                managementPolicies:
+                  - Observe
+                  - Create
+                  - Update
+                  - Delete
                 forProvider:
                   allocationIdSelector:
                     matchControllerRef: true

gitops/bootstrap/addons.yaml

@@ -24,11 +24,9 @@ spec:
         - repoURL: '{{ .metadata.annotations.addonsRepoURL }}'
           targetRevision: '{{ .metadata.annotations.addonsRepoRevision }}'
           ref: defaults
-        {{- if .metadata.annotations.overlay_repo_url }}
-        - repoURL: '{{ .metadata.annotations.overlay_repo_url }}'
-          targetRevision: '{{ .metadata.annotations.overlay_repo_revision }}'
+        - repoURL: '{{ dig "overlay_repo_url" .metadata.annotations.addonsRepoURL .metadata.annotations }}'
+          targetRevision: '{{ dig "overlay_repo_revision" .metadata.annotations.addonsRepoRevision .metadata.annotations }}'
           ref: overlay
-        {{- end }}
         - repoURL: '{{ .metadata.annotations.addonsRepoURL }}'
           path: 'platform-charts/appset-chart'
           targetRevision: '{{ .metadata.annotations.addonsRepoRevision }}'
@@ -46,14 +44,12 @@ spec:
               - $defaults/{{ .metadata.annotations.addonsRepoBasepath }}addons/registry/ml.yaml
               - $defaults/{{ .metadata.annotations.addonsRepoBasepath }}overlays/environments/{{ .metadata.labels.environment }}/overrides.yaml
               - $defaults/{{ .metadata.annotations.addonsRepoBasepath }}overlays/clusters/{{ .nameNormalized }}/overrides.yaml
-              {{- if .metadata.annotations.overlay_repo_url }}
-              - $overlay/{{ .metadata.annotations.overlay_repo_basepath }}overlays/environments/{{ .metadata.labels.environment }}/overrides.yaml
-              - $overlay/{{ .metadata.annotations.overlay_repo_basepath }}overlays/clusters/{{ .nameNormalized }}/overrides.yaml
-              {{- end }}
+              - $overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.addonsRepoBasepath .metadata.annotations }}overlays/environments/{{ .metadata.labels.environment }}/overrides.yaml
+              - $overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.addonsRepoBasepath .metadata.annotations }}overlays/clusters/{{ .nameNormalized }}/overrides.yaml
             valuesObject:
-              overlayRepoURLGit: '{{ default "" .metadata.annotations.overlay_repo_url }}'
-              overlayRepoURLGitRevision: '{{ default "main" .metadata.annotations.overlay_repo_revision }}'
-              overlayRepoURLGitBasePath: '{{ default "" .metadata.annotations.overlay_repo_basepath }}'
+              overlayRepoURLGit: '{{ dig "overlay_repo_url" "" .metadata.annotations }}'
+              overlayRepoURLGitRevision: '{{ dig "overlay_repo_revision" "main" .metadata.annotations }}'
+              overlayRepoURLGitBasePath: '{{ dig "overlay_repo_basepath" "" .metadata.annotations }}'
       destination:
         namespace: argocd
         name: '{{ .name }}'

gitops/bootstrap/fleet-secrets.yaml

@@ -33,6 +33,9 @@ spec:
         - repoURL: '{{ .metadata.annotations.fleetRepoURL }}'
           targetRevision: '{{ .metadata.annotations.fleetRepoRevision }}'
           ref: values
+        - repoURL: '{{ dig "overlay_repo_url" .metadata.annotations.fleetRepoURL .metadata.annotations }}'
+          targetRevision: '{{ dig "overlay_repo_revision" .metadata.annotations.fleetRepoRevision .metadata.annotations }}'
+          ref: overlay
         - repoURL: '{{ .metadata.annotations.addonsRepoURL }}'
           targetRevision: '{{ .metadata.annotations.addonsRepoRevision }}'
           path: 'platform-charts/fleet-secret'
@@ -59,6 +62,8 @@ spec:
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}fleet/members/{{ .clusterName }}/values.yaml'
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}overlays/environments/{{ .labels.environment }}/enabled-addons.yaml'
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}overlays/clusters/{{ .clusterName }}/addon-overrides.yaml'
+              - '$overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.fleetRepoBasepath .metadata.annotations }}overlays/environments/{{ .labels.environment }}/enabled-addons.yaml'
+              - '$overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.fleetRepoBasepath .metadata.annotations }}overlays/clusters/{{ .clusterName }}/addon-overrides.yaml'
       destination:
         name: '{{ .name }}'
         namespace: argocd

gitops/bootstrap/hub-fleet-secret.yaml

@@ -26,6 +26,9 @@ spec:
         - repoURL: '{{ .metadata.annotations.fleetRepoURL }}'
           targetRevision: '{{ .metadata.annotations.fleetRepoRevision }}'
           ref: values
+        - repoURL: '{{ dig "overlay_repo_url" .metadata.annotations.fleetRepoURL .metadata.annotations }}'
+          targetRevision: '{{ dig "overlay_repo_revision" .metadata.annotations.fleetRepoRevision .metadata.annotations }}'
+          ref: overlay
         - repoURL: '{{ .metadata.annotations.addonsRepoURL }}'
           targetRevision: '{{ .metadata.annotations.addonsRepoRevision }}'
           path: 'platform-charts/fleet-secret'
@@ -42,6 +45,8 @@ spec:
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}fleet/hub/values.yaml'
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}overlays/environments/control-plane/enabled-addons.yaml'
               - '$values/{{ .metadata.annotations.fleetRepoBasepath }}overlays/clusters/{{ .metadata.annotations.aws_cluster_name }}/addon-overrides.yaml'
+              - '$overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.fleetRepoBasepath .metadata.annotations }}overlays/environments/control-plane/enabled-addons.yaml'
+              - '$overlay/{{ dig "overlay_repo_basepath" .metadata.annotations.fleetRepoBasepath .metadata.annotations }}overlays/clusters/{{ .metadata.annotations.aws_cluster_name }}/addon-overrides.yaml'
       destination:
         name: '{{ .name }}'
         namespace: argocd