adress reviews

Author: mjudeikis

docs/proposals/v2-extended.md

@@ -3,7 +3,7 @@
 * Status: **DRAFT — for iteration**
 * Authors: @mjudeikis
 * Date: 2026-06-10
-* Builds on: [v2-slim-core.md](v2-slim-core.md) (Proposed))
+* Builds on: [v2-slim-core.md](v2-slim-core.md) (Proposed)
 
 ## Summary
 

v2/konnector/deploy/charts/konnector/files/crds/core.kube-bind.io_connections.yaml

@@ -238,17 +238,17 @@ spec:
                   connect and immutable thereafter.
                 type: string
                 x-kubernetes-validations:
-                - message: localClusterUID is immutable
-                  rule: self == oldSelf
+                - message: localClusterUID is immutable once set
+                  rule: oldSelf == '' || self == oldSelf
               remoteClusterUID:
                 description: |-
                   remoteClusterUID is the identity of the provider cluster, pinned on first
                   connect and immutable thereafter. A Secret later pointing at a different
                   cluster is rejected rather than silently re-homing synced objects.
                 type: string
                 x-kubernetes-validations:
-                - message: remoteClusterUID is immutable
-                  rule: self == oldSelf
+                - message: remoteClusterUID is immutable once set
+                  rule: oldSelf == '' || self == oldSelf
             type: object
         required:
         - spec

v2/konnector/engine/binding/reconciler.go

@@ -98,8 +98,9 @@ func (b *base) reconcileAccessor(ctx context.Context, obj corev1alpha1.BindingAc
 	}
 
 	var (
-		boundAPIs   []corev1alpha1.BoundAPI
-		notExported []string
+		boundAPIs     []corev1alpha1.BoundAPI
+		notExported   []string
+		pendingSchema []string
 	)
 	for _, api := range spec.APIs {
 		exported, ok := conn.Status.ExportsAPI(api.Name)
@@ -114,7 +115,9 @@ func (b *base) reconcileAccessor(ctx context.Context, obj corev1alpha1.BindingAc
 			crd := &apiextensionsv1.CustomResourceDefinition{}
 			if err := b.client.Get(ctx, client.ObjectKey{Name: api.Name}, crd); err != nil {
 				if apierrors.IsNotFound(err) {
-					notExported = append(notExported, api.Name)
+					// The API is exported, but the Connection has not installed the
+					// synthesized CRD yet — a transient wait, not "not exported".
+					pendingSchema = append(pendingSchema, api.Name)
 					continue
 				}
 				return fmt.Errorf("getting synthesized CRD %q: %w", api.Name, err)
@@ -151,6 +154,11 @@ func (b *base) reconcileAccessor(ctx context.Context, obj corev1alpha1.BindingAc
 			fmt.Sprintf("APIs not exported by the provider yet: %s", strings.Join(notExported, ", ")))
 		return nil
 	}
+	if len(pendingSchema) > 0 {
+		setReady(status, obj, metav1.ConditionFalse, corev1alpha1.ReasonPending,
+			fmt.Sprintf("waiting for the Connection to install the synthesized CRD(s): %s", strings.Join(pendingSchema, ", ")))
+		return nil
+	}
 
 	// Sync related Secrets/ConfigMaps in the declared direction, scoped like the
 	// binding.

v2/sdk/apis/core/v1alpha1/connection_types.go

@@ -134,14 +134,14 @@ type ConnectionStatus struct {
 	// cluster is rejected rather than silently re-homing synced objects.
 	//
 	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="remoteClusterUID is immutable"
+	// +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="remoteClusterUID is immutable once set"
 	RemoteClusterUID string `json:"remoteClusterUID,omitempty"`
 
 	// localClusterUID is the identity of the consumer cluster, pinned on first
 	// connect and immutable thereafter.
 	//
 	// +optional
-	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="localClusterUID is immutable"
+	// +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="localClusterUID is immutable once set"
 	LocalClusterUID string `json:"localClusterUID,omitempty"`
 
 	// activeSchemaSource is the schema source actually in effect after resolving

v2/sdk/config/crd/core.kube-bind.io_connections.yaml

@@ -238,17 +238,17 @@ spec:
                   connect and immutable thereafter.
                 type: string
                 x-kubernetes-validations:
-                - message: localClusterUID is immutable
-                  rule: self == oldSelf
+                - message: localClusterUID is immutable once set
+                  rule: oldSelf == '' || self == oldSelf
               remoteClusterUID:
                 description: |-
                   remoteClusterUID is the identity of the provider cluster, pinned on first
                   connect and immutable thereafter. A Secret later pointing at a different
                   cluster is rejected rather than silently re-homing synced objects.
                 type: string
                 x-kubernetes-validations:
-                - message: remoteClusterUID is immutable
-                  rule: self == oldSelf
+                - message: remoteClusterUID is immutable once set
+                  rule: oldSelf == '' || self == oldSelf
             type: object
         required:
         - spec