From a5f7da88817bcac86436f421f4d444c04a968f62 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 19 Jun 2026 01:03:51 +0200 Subject: [PATCH 1/2] feat(github-config): activate team CRDs for maintainers team management --- .../crossplane/managed-resource-activation-policy.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml index 9cab20670..9700f4eb1 100644 --- a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml +++ b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml @@ -25,3 +25,9 @@ spec: # adopted Observe-first in devantler-tech/.github deploy/. The tenant Role # already covers the enterprise.github.m.upbound.io group. - organizationrulesets.enterprise.github.m.upbound.io + # Team management — the maintainers team + its membership and team->repo + # access (declared in devantler-tech/.github deploy/teams/). Lets a team be + # the canonical CODEOWNERS owner across the suite. + - teams.team.github.m.upbound.io + - teammemberships.team.github.m.upbound.io + - teamrepositories.team.github.m.upbound.io From e573bc72a5d1fb694158def22690cc45c5681d48 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 19 Jun 2026 01:03:52 +0200 Subject: [PATCH 2/2] feat(github-config): grant tenant SA RBAC on team.github.m.upbound.io --- k8s/bases/apps/github-config/rbac.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/k8s/bases/apps/github-config/rbac.yaml b/k8s/bases/apps/github-config/rbac.yaml index 25a4e194d..678d133e9 100644 --- a/k8s/bases/apps/github-config/rbac.yaml +++ b/k8s/bases/apps/github-config/rbac.yaml @@ -26,6 +26,7 @@ metadata: rules: - apiGroups: - repo.github.m.upbound.io + - team.github.m.upbound.io - actions.github.m.upbound.io - enterprise.github.m.upbound.io - github.m.upbound.io