Export Crossplane managed-resource conditions as metrics (first increment of #2820)

[devantler]

🤖 Generated by the Agentic Engineer

First increment of #2820. The alerting rule cannot be written before the series
exists, so this child delivers only the metric source.

Evidence

Measured on the live cluster 2026-08-06, over repositories.repo.github.m.upbound.io:

• 20 managed resources; Synced=False on 3, Synced=True on 17.
• 3 resources report Ready=True while Synced=False — the exact silent state
  Alert when a Crossplane managed resource stops reconciling (Ready=True hides Synced=False) #2820 describes, present right now and non-zero.
• 60 condition entries in total (Synced, Ready, LastAsyncOperation), every one
  carrying a non-null reason, and the value domain is exactly True/False.

That gives the increment a live positive fixture (3) and a live negative one (17)
without constructing anything.

Scope

Repository only, deliberately. CustomResourceStateMetrics matches an exact
groupVersionKind — there is no wildcard and no categories: managed selector — so
each of the 16 managed-resource kinds must be listed individually. Starting with the
one kind that carries the observed failure proves the pipeline end to end before
committing to a list that will drift. Extending coverage is a separate child, and
until it lands the exporter's coverage is explicitly partial.

Acceptance criteria

• crossplane_managed_resource_condition is queryable in coroot-prometheus,
  one series per (resource, condition), value 1 for True and 0 for False.
• Ready is exported alongside Synced, so the Ready-True-while-Synced-False
  pair is expressible as a single query.
• Ships default-off (unreferenced component), so activation is a separate,
  independently reversible change.
• Read-only RBAC scoped to the exported kind, not apiGroups: ["*"].
• Verified after activation by comparing the metric against a live
  kubectl read: 3 Synced=False, 17 Synced=True.

Rough size: one Kustomize component, off-the-shelf images, no bespoke code.

[coderabbitai]

🔗 Related PRs

#2445 - feat(kubescape): route runtime-detection alerts to Headlamp, Slack, and Coroot [merged]
#2459 - feat: deploy Kyverno Policy Reporter (UI + kyverno plugin) [merged]
#2635 - fix(deploy): reboot stale nodes so containerd adopts refreshed GHCR auth [merged]
#2794 - fix(opencost): restore usage metrics [merged]
#2830 - feat(ci): publish Kubescape posture findings to Code Scanning [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

Duplicate of #2986, which was filed ~7 hours earlier and covers the same increment. I filed
this after checking #2820 for claims and branches but not for existing children — the
sub-issue list was the signal I skipped.

Consolidating on #2986: it is the canonical child, it is already linked under #2820 alongside
#2987 (the alert half), and its evidence is broader (109 managed resources across 7 API groups,
plus the finding that Coroot's cluster-agent exposes only image under
clusterAgent.kubeStateMetrics — no CustomResourceState hook, which is exactly why a
separate kube-state-metrics is needed).

#2994 is re-pointed at #2986. Closing this as the duplicate; nothing is lost.