docs(scaleway): validate the Crossplane bet and the IaC coverage

[UlysseCarpentier]

Summary

Closes the fourth and last Scaleway research ticket: [Scaleway] Validation du pari Crossplane & couverture IaC. Feeds #4.

Adds docs/scaleway/crossplane-iac.md and its rows in the decision index.

Stacked on #17. Base is docs/scaleway-kapsule-state-of-the-art, so this PR's diff shows only the new document. GitHub retargets it to main when #17 merges. Review #17 first.

Verdict: the bet holds — but not for the reason expected

Coverage is excellent. 144 managed resources against 157 in the Terraform provider. Everything a client claim needs is generated: RDB with its databases, users, privileges, ACLs and read replicas; Redis; MongoDB; Object; the whole MNQ range (SQS, SNS, NATS); Secrets; Key Manager; Block. The narrow gaps — lb ACLs, serverless triggers, job definitions — sit on no claim path.

Worth noting: iam.applications, iam.apikeys and iam.policies are all generated, so the static-credential problem from managed-scope.md becomes expressible as a Composition rather than a script.

Cadence is not.

• No release since v0.6.0, 6 February 2026 — seven months.
• No functional commit since 27 April 2026 — everything after is Dependabot.
• That April fix (Redis LateInitializer) is in no release.
• Two priority:highest bugs open since August 2024: PublicGatewayIP not created, RDB Instance matchLabels broken.
• The Terraform provider it is generated from ships roughly monthly (v2.82.0, 1 September 2026), so the generated provider drifts behind its own source by default.

What saves the bet is that the provider is generated, not written. A hand-written provider that stalls means waiting or writing Go. An upjet-generated one that stalls is a build you can run yourself — and the repository carries its generator config.

Decisions

• Pin v0.6.0. Never a floating tag on a component that reconciles client infrastructure.
• The factory owns a fork it can regenerate — a standing capability, ~3–5 days to stand up, ~0.5 day per refresh.
• provider-terraform is the per-resource fallback, because it patches inside the Composition: claims, XRs and the GitOps path are untouched, and the patch is removed when the generated provider catches up.
• tofu-controller is refused — a second reconciler and a second state model beside Flux, for a problem the first resort already solves.
• Verify before promising. Two of the three oldest bugs touch RDB and public gateway IPs, which the catalog will use. They are old enough to be fixed and unclosed; the first cluster tests them.

The OpenTofu provider needs no such argument

157 resources, v2.82.0 released 1 September 2026. Every foundations resource exists, including the ones the sprint's decisions depend on: k8s_acl (the allowed-IP list), cockpit_token, object_bucket_lock_configuration, the whole VPC and public gateway set, and iam_application / iam_policy / iam_api_key. No gaps, nothing to work around.

Cost

€0 recurring. ~3–5 days of engineering, once, amortised across every client.

Test plan

• docs/scaleway/crossplane-iac.md renders correctly on GitHub.
• Repository facts re-checked (release dates, commit history, issue state read from the GitHub API, 14 September 2026).
• The ~3–5 day fork-and-regenerate estimate is the right order of magnitude.
• Agreement that owning a regeneratable fork is the right answer to a stalled upstream, rather than waiting on Scaleway.

One thing this document does not do

It does not verify the two 2024 bugs are still real. That needs a cluster, and the ticket is explicit that no POC is in scope.

🤖 Generated with Claude Code