feat(crossplane): add provider-aws-s3 with ExternalSecret credentials

[h0lybyte]

Summary

• Install provider-aws-s3 v2.4.0 (Upbound family provider) — auto-pulls provider-family-aws for shared auth CRDs
• Pull AWS credentials from existing kilobase-s3-secret via ExternalSecret cross-namespace access (same pattern as n8n)
• Reformat credentials into INI format required by Crossplane ClusterProviderConfig
• Sync-wave ordering ensures provider CRDs register before ClusterProviderConfig is applied

Architecture

providers-application.yaml (ArgoCD)
└── providers/
    ├── provider-aws-s3.yaml          [wave 0] Provider CRD
    ├── aws-externalsecret.yaml       [wave 1-2] SA + SecretStore + ExternalSecret
    ├── rbac.yaml                     [wave 1] Cross-namespace Role/RoleBinding
    └── cluster-provider-config.yaml  [wave 5] ClusterProviderConfig (needs provider CRDs)

• SkipDryRunOnMissingResource=true handles the CRD timing gap
• Retry policy (5 attempts, 10s backoff) covers provider startup time
• Credentials flow: kilobase-s3-secret → ExternalSecret → aws-secret (INI format) → ClusterProviderConfig

What's Next (follow-up PRs)

• S3 Bucket managed resource for CNPG backup bucket
• BucketVersioning, BucketServerSideEncryptionConfiguration, etc.
• Additional AWS providers as needed (EC2, IAM, etc.)

Test plan

• All resources except ClusterProviderConfig pass kubectl apply --dry-run=client
• ClusterProviderConfig uses SkipDryRunOnMissingResource=true (CRD doesn't exist until provider installs)
• ArgoCD syncs provider → provider pod starts → CRDs register
• ExternalSecret syncs aws-secret with INI-formatted credentials
• ClusterProviderConfig applies successfully on retry
• kubectl get provider shows upbound-provider-aws-s3 as HEALTHY

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None