fix(ansible-run): bump kcl-tekton-pr to 0.9.0 (Observe+Create on PipelineRun)

[patrick-hermann-sva]

Consumes stuttgart-things/stage-time#60 (merged, kcl-tekton-pr:0.9.0 published to ghcr and public).

Why

kcl-tekton-pr ≤0.8.0 set no managementPolicies on the PipelineRun Object, so it defaulted to ["*"] — claiming Update on a resource Tekton makes immutable once it completes. provider-kubernetes' observe dry-run SSA is then denied by Tekton's webhook:

observe failed: cannot get desired state: cannot dry run SSA: admission webhook
"validation.webhook.pipeline.tekton.dev" denied the request:
Once the PipelineRun is complete, no updates are allowed: spec

Observe errors → the finalizer is never released → deleting an AnsibleRun XR after a successful run strands the Object forever. Three of them sat stuck for 22h+ on kind1 and needed a manual finalizer patch. It hits every AnsibleRun deleted after a completed run, so they accumulate.

0.9.0 sets managementPolicies: ["Observe", "Create"] — create it, watch it, never touch it again.

Verification

All three examples render against the published 0.9.0, each emitting the Object with managementPolicies: ['Observe', 'Create'] and the PipelineRun manifest intact.

The rendered output diff, 0.8.0 → 0.9.0, is exactly:

 124a125,127
 >   managementPolicies:
 >   - Observe
 >   - Create

Nothing else about the PipelineRun changes — a clean additive change. crossplane xpkg build passes.

Behaviour probed directly on kind1 (not inferred), against an already-completed PipelineRun:

	["*"] (0.8.0)	["Observe","Create"] (0.9.0)
Observe a completed PipelineRun	webhook denied, Synced=False	Synced=True
Delete the Object	stuck 22h+	0.34 s
PipelineRun	—	preserved

Version drift, fixed in passing

The three version references had drifted apart and are realigned to v0.1.8:

Where	Was	Now
crossplane.yaml meta.crossplane.io/version	v0.1.7	v0.1.8
examples/configuration.yaml package tag	v0.1.2	v0.1.8
root README.md table row	v0.1.2	v0.1.8

Worth flagging: neither v0.1.6 nor v0.1.7 was ever published — ghcr stops at v0.1.5. So the SOPS-decrypt work (#93, #94) is in git and in the version annotation but has never shipped as a package. v0.1.8 will be the first published tag carrying it.

Note

The PipelineRun is now left behind when the XR is deleted (no Delete policy). Completed runs are history and Tekton pruning owns their lifecycle. If they should die with the XR instead, that needs ["Observe","Create","Delete"] in the module — untested against the dry-run problem, see stage-time#60.

🤖 Generated with Claude Code

[github-actions]

📦 ttl.sh preview packages

Preview OCI packages for the Configurations changed in this PR, pushed to the public, ephemeral ttl.sh registry. No auth required — install on any Crossplane v2 cluster:

📦 cicd/ansible-run → ttl.sh/stuttgart-things/crossplane-configurations-pr101-167ea99/ansible-run:24h

apiVersion: pkg.crossplane.io/v1
kind: Configuration
metadata:
  name: ansible-run-preview
spec:
  package: ttl.sh/stuttgart-things/crossplane-configurations-pr101-167ea99/ansible-run:24h

Note

Images expire 24h after the last push (ttl.sh's maximum TTL); push a new commit to refresh them. The Configuration name is suffixed -preview so it won't clash with a canonical install.