chore: bump github.com/crossplane/upjet/v2 from 2.2.0 to 2.3.0

[dependabot]

Bumps github.com/crossplane/upjet/v2 from 2.2.0 to 2.3.0.

Release notes

Sourced from github.com/crossplane/upjet/v2's releases.

v2.3.0

New Features

Conversion Webhook Decoupled from Leader Election (#678)

⚠️ Action required for providers using conversion webhooks and safe-start feature (gated setup). The webhook registration path has moved out of the controller Setup function. Providers that set StartWebhooks: true need to update their entry point. Providers that do not use conversion webhooks are unaffected.

Conversion webhook registration was gated behind leader election through the SetupGated/gate mechanism. SetupGated stores a closure that only fires on the elected leader, so follower pods never called ctrl.NewWebhookManagedBy and their webhook servers returned 404 for every conversion request. With two replicas and --leader-election, some conversion webhook calls fail.

The fix separates webhook registration from reconciler setup:

• controller.go.tmpl: adds SetupWebhookWithManager — a standalone function that registers the conversion webhook for a single resource kind. Removes the if o.StartWebhooks { ... } block from Setup; webhook registration is no longer the reconciler's responsibility.

• setup.go.tmpl: adds the SetupWebhookWithManager{{ .Group }} aggregator, following the same pattern as Setup{{ .Group }} and SetupGated{{ .Group }}, so providers can register all webhooks for a group in a single call.

Providers call SetupWebhookWithManager_ once before mgr.Start() on every pod, independent of the gate and leader election. Reconciler setup remains behind the gate and runs only on the leader.

// OLD generated code (v2.2.0 and earlier) — inside Setup()
if o.StartWebhooks {
    if err := ctrl.NewWebhookManagedBy(mgr, &v1beta1.MyResource{}).
        Complete(); err != nil {
        return errors.Wrap(err, "cannot register webhook for the kind v1beta1.MyResource")
    }
}

What changed

The if o.StartWebhooks { ... } block has been removed from the generated Setup() function entirely. In its place, each generated resource controller file now exposes a standalone function:

// NEW generated code (v2.3.0) — standalone function, not inside Setup()
func SetupWebhookWithManager(mgr ctrl.Manager) error {
    if err := ctrl.NewWebhookManagedBy(mgr, &v1beta1.MyResource{}).
        Complete(); err != nil {
        return errors.Wrap(err, "cannot register webhook for the kind v1beta1.MyResource")
    }
    return nil
}

The group-level zz_setup.go file also gains a corresponding aggregator:

func SetupWebhookWithManagerMyGroup(mgr ctrl.Manager) error {
    for _, setup := range []func(ctrl.Manager) error{
        myresourceSetupWebhookWithManager,
        // ... all resources in this group
    } {
        if err := setup(mgr); err != nil {
</tr></table> 

... (truncated)

Commits

• b02902e Merge pull request #678 from sergenyalcin/register-webhooks-seperately
• 391acbd Decouple conversion webhook registration from leader election
• eff8498 Merge pull request #672 from fernandezcuesta/fix/671--customizable-injectedke...
• 28ac43b chore: coderabbitai review
• 1fc5dc3 feat: add Description field to SSA InjectedKey
• 59c4552 Merge pull request #670 from ulucinar/fix-472
• 6c7a192 Add missing comments on async SDKv2 client's request re-queueing behavior
• 9a25f0c Async plugin SDKv2 & framework external clients now use deep-copies for Creat...
• a98ffed Run make test.race as a parallel workflow job
• be60f3a Add async plugin framework external client tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)