Old revision not demoted for SA
Author: fernandezcuestaCreated Sep 16, 2026Updated Sep 18, 2026
Labelsbug
What happened?
When trying to upgrade from v2.3.3 to v2.4.1, the functions and provider pods didn't start up. In all function/provider resources there are events messages like:
Message: Package runtime health is "False" with message: post establish runtime hook failed for package: cannot apply function package service account: ServiceAccount "function-sequencer" is invalid: metadata.ownerReferences: Invalid value: [{"apiVersion":"pkg.crossplane.io/v1","kind":"FunctionRevision","name":"function-sequencer-77518d1ebbf7","uid":"f866d50b-cddc-4fe6-90c2-462c76ac7cb9","controller":true,"blockOwnerDeletion":true},{"apiVersion":"pkg.crossplane.io/v1","kind":"FunctionRevision","name":"function-sequencer-bdbbc83b7f94","uid":"ca0276a5-0400-482e-972b-8333f8f093a7","controller":true,"blockOwnerDeletion":true}]: Only one reference can have Controller set to true. Found "true" in references for FunctionRevision/function-sequencer-77518d1ebbf7 and FunctionRevision/function-sequencer-bdbbc83b7f94SA already had old revision's controller: true ownerRef.
New revision added another controller: true, which Kubernetes rejects.
How can we reproduce it?
Any 2.3.x to 2.4.x upgrade with running functions/providers should raise it.
What environment did it happen in?
Crossplane version: v2.4.1
Source: crossplane/crossplane