Run OCI provider in-process without Terraform CLI

[kousalya-kethavath]

Description of your changes

This PR introduces the OCI provider no-fork architecture: OCI Terraform SDKv2 resources run in-process through Upjet/
Crossplane instead of invoking the Terraform CLI at runtime.

The upstream terraform-provider-oci source is not permanently forked. A versioned patch is applied only in an
isolated build/generation/test workspace, keeping the dependency upgrade path explicit and reviewable.

1. Add no-fork build and patch workflow

• Adds a versioned patch for upstream terraform-provider-oci.
• Adds the noforkpatcher tool and validation tests.
• Updates Make targets so generate, build, test, and lint:
  • create an isolated upstream-provider workspace,
  • apply and validate the no-fork patch,
  • materialize generated no-fork templates,
  • temporarily replace the Terraform provider module,
  • clean up afterward.
• Keeps generated APIs, controllers, CRDs, and examples as generated artifacts rather than handwritten no-fork source.

2. Route OCI resources through no-fork clients

• Routes OCI SDKv2 resources through in-process provider configuration and clients.
• Adds generated/template-backed provider setup for the patched Terraform provider.
• Adds ProviderConfig-scoped client metadata caching, keyed by ProviderConfig identity and configuration hash, with
  bounded LRU eviction.
• Avoids cross-ProviderConfig client/configuration leakage.
• Adds no-fork configuration and client coverage.
• Adds management dashboard and OpenSearch scope configuration required by the generated resource set.
• Preserves server-side apply ownership semantics for ZPR tag maps:
  • defined_tags
  • freeform_tags
    remain granular maps in both cluster-scoped and namespaced generator configuration.

3. Configure no-fork provider runtime and metrics

• Reworks the provider runtime template to use the in-process no-fork setup and operation tracking.
• Exposes managed-resource state metrics with configurable bind address and polling interval.
• Retains compatibility for existing Terraform-related flags by keeping them hidden/deprecated where applicable.
• Adds an optional provider-version value used for Crossplane ChangeLog metadata.
• Injects the Terraform provider version at build time rather than hardcoding a runtime dependency.

4. Regenerate provider artifacts for no-fork

• Regenerates APIs, controllers, CRDs, generated examples, and provider command output using the no-fork generation
  workflow.

5. Remove Terraform CLI from provider image

• Removes Terraform CLI installation and Terraform CLI configuration from the provider image.
• Reduces runtime image dependencies now that resource operations are performed in-process.

6. Optimize no-fork package publishing

• Updates package publishing workflow to support batched family/service package publishing.
• Adds cache handling and reuse for no-fork build artifacts.
• Reduces repeated upstream patch/build work during package publishing.
• Adds workflow controls for concurrency, batching, and cleanup.

7. Reuse no-fork patch across family build

• Refines the build and publishing flow so a family build applies the upstream patch once.
• Reuses the resulting no-fork workspace/cache for service package builds.
• Removes redundant patch application from downstream service build steps.

Behavior and compatibility notes

• The provider image no longer contains the Terraform CLI.
• Terraform remains a build/generation-time dependency only.
• OCI SDKv2 resources use in-process configuration and clients.
• The current Terraform Plugin Framework resource list remains empty; SDKv2 resources are the active no-fork path.
• Provider version metadata is optional and used for ChangeLog reporting; it is not required for normal provider
  runtime behavior.
• Existing Terraform-related runtime flags are retained only for compatibility where needed and are deprecated/hidden.

Validation performed

• Ran make generate successfully using the no-fork patch workflow.

• Verified regenerated ZPR API markers and CRD schemas preserve granular map ownership for definedTags and
  freeformTags.

• Ran focused tests:

  go test ./config/cluster/zpr ./config/namespaced/zpr
  

• Ran the package publishing workflow for all subpackages and both target platforms from the equivalent no-fork patch-
  reuse commit:

  • workflow run: https://github.com/kousalya-kethavath/crossplane-provider-oci/actions/runs/29981237458
  • result: successful
  • duration: approximately 1h 21m
  • the family build started cold for the no-fork cache; subsequent service builds reused the cache produced within
    the same workflow run.

Reviewer focus

• Review the upstream patch in build/nofork/patches/terraform-provider-oci.patch, especially client configuration
  isolation and removal of unsafe global behavior.
• Review ProviderConfig cache keys, eviction behavior, and credentials/configuration isolation.
• Review CI cache boundaries and publish workflow reuse to ensure builds remain reproducible.
• Review image changes to confirm no runtime path still requires Terraform CLI.

Risks and follow-up considerations

• Future terraform-provider-oci upgrades require rebasing and validating the versioned patch.

• The first family build remains more expensive because it builds the patched upstream dependency; subsequent service
  builds reuse that work.

• Generated artifact volume is intentionally large and should be reviewed primarily through generator inputs and
  representative generated output.

• Rollback is primarily an image/version rollback; CRD changes should be reviewed for compatibility before deployment.

Fixes #

I have:

• Read and followed Crossplane's contribution process.
• Run make generate and committed the results (ideally in a separate commit).
• Not made any manual changes to generated files, and verified this with make check-diff.

How has this code been tested

In-cluster no-fork smoke test

• Deployed family, identity, networking, and compute no-fork provider images to OKE using workload identity.
• Verified all Provider objects became Installed=True and Healthy=True.
• Successfully created, observed, and deleted:
  • a compartment-scoped TagNamespace,
  • a VCN,
  • a subnet.

Evidence that reconciliation uses the in-process path

• Confirmed Terraform CLI was absent from the live provider containers.

• Inspected running processes and found no Terraform CLI or external provider-plugin process.

• Searched provider logs and found no Terraform execution patterns (terraform init, plan, apply, destroy, or fork/exec
  terraform).

• Successful resource operations reported OCI Terraform provider version 8.22.0, consistent with the embedded in-
  process SDKv2 provider.

Upgrade and rollback compatibility

• Validated upgrade from Terraform CLI-backed providers to no-fork providers for networking and identity resources.

• Existing VCN, subnet, and TagNamespace external names remained unchanged and resources stayed Ready=True /
  Synced=True after upgrade.

• Validated rollback/downgrade to Terraform CLI-backed v1.2.0 provider images:

  • tested provider packages became healthy,
  • existing resources retained their external names,
  • no delete/recreate occurred,
  • post-rollback tag updates reconciled successfully.