Add --[no-]default-mrap flag to project run

[stevendborrelli]

Description of your changes

Adds a --[no-]default-mrap flag to crossplane project run, mirroring the flag of the same name in the up CLI.

Docs PR crossplane/docs#1147

Crossplane's Helm chart defaults provider.defaultActivations to ["*"], so the local dev control plane always gets a wildcard ManagedResourceActivationPolicy activating every managed resource CRD its providers offer. That's a convenient default, but it doesn't match a production control plane that manages activation explicitly — a project can pass project run locally while its own activation policies are incomplete, and only fail once deployed.

--no-default-mrap sets provider.defaultActivations to null in the chart values. The chart template is a bare range over that value (templates/deployment.yaml), so an explicit null both removes the chart default during value coalescing and, failing that, ranges over nothing — either way no --activation args reach Crossplane and no default MRAP is created. Verified against chart v2.4.0:

$ helm template cp crossplane --repo https://charts.crossplane.io/stable | grep -c activation
1
$ helm template cp crossplane --repo https://charts.crossplane.io/stable \
    --set-json 'provider.defaultActivations=null' | grep -c activation
0

The flag defaults to true, so existing behavior is unchanged.

Implementation follows the existing --cluster-admin pattern: a WithDefaultMRAP functional option on controlplane.EnsureLocalDevControlPlane, threaded into ensureCrossplane.

Reviewer note: ensureCrossplane returns early when Crossplane is already installed, so this flag — like --cluster-admin today — only takes effect when the control plane is created. Reusing an existing control plane keeps whatever it was built with. This is documented in help/run.md, but it's worth a look if you think the flag should instead force a reinstall or fail loudly on a mismatch.

I have:

• Read and followed Crossplane's contribution process.
• Run ./nix.sh flake check to ensure this PR is ready for review.
• Added or updated unit tests.
• Linked a PR or a docs tracking issue to document this change.
• Added backport release-x.y labels to auto-backport this PR.

Need help with this checklist? See the cheat sheet.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a80dd533-a926-4e3f-8f5c-57f5943b0096

📥 Commits

Reviewing files that changed from the base of the PR and between 3d72f93 and 06abed8.

📒 Files selected for processing (3)

• cmd/crossplane/project/help/run.md
• cmd/crossplane/project/run.go
• internal/project/controlplane/controlplane.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

crossplane project run adds an option to disable the default wildcard ManagedResourceActivationPolicy. The option flows through control plane configuration and removes Helm chart default activations when disabled. Documentation includes creation-time behavior and an example.

Changes

Default MRAP control

Layer / File(s)	Summary
CLI option and wiring cmd/crossplane/project/run.go, cmd/crossplane/project/help/run.md	The command adds the negatable DefaultMRAP option, forwards it to control plane setup, and documents --no-default-mrap.
Control plane MRAP configuration internal/project/controlplane/controlplane.go	Control plane setup enables the default MRAP by default and sets provider.defaultActivations to nil when the option is disabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 06abe

The new option narrows managed-resource activation for newly created local control planes, while existing control planes retain their previous activation state when reused. The change is mergeable with owner awareness that users must recreate an existing control plane for the setting to take effect.

Sequence Diagram(s)

sequenceDiagram
  participant ProjectRun
  participant EnsureLocalDevControlPlane
  participant HelmChart
  ProjectRun->>EnsureLocalDevControlPlane: pass WithDefaultMRAP
  EnsureLocalDevControlPlane->>HelmChart: set provider.defaultActivations to nil when disabled
  HelmChart-->>EnsureLocalDevControlPlane: install control plane without default wildcard MRAP

Loading

Suggested reviewers: adamwg

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Breaking Changes	✅ Passed	PASS. The pull request diff changes no files under apis/** and changes cmd/** only by adding the DefaultMRAP boolean flag and its help text. The flag is optional and defaults to true, so it do…
Feature Gate Requirement	✅ Passed	The check passes. The PR changes no files under apis/**. The behavior change is gated by the new DefaultMRAP bool CLI option with default:"true" and negatable:"", which exposes `--no-default-m…
Title check	✅ Passed	The title is 43 characters, stays under the 72-character limit, and clearly describes the addition of the --[no-]default-mrap flag to project run.
Description check	✅ Passed	The description directly explains the new flag, its default behavior, implementation, documentation, limitations, and validation steps. It is relevant to the changeset.

Full details: Breaking Changes

Explanation

PASS. The pull request diff changes no files under apis/** and changes cmd/** only by adding the DefaultMRAP boolean flag and its help text. The flag is optional and defaults to true, so it does not add a required public field or flag. No existing public field or flag is removed or renamed. The default Crossplane behavior remains unchanged; disabling the wildcard MRAP is an explicit new option. The behavior wiring is in internal/project/controlplane/controlplane.go, outside the check's scoped paths.

Full details: Feature Gate Requirement

Explanation

The check passes. The PR changes no files under apis/**. The behavior change is gated by the new DefaultMRAP bool CLI option with default:"true" and negatable:"", which exposes --no-default-mrap. The option is threaded through WithDefaultMRAP to ensureCrossplane, where the new behavior runs only when defaultMRAP is false. The default path preserves the existing behavior.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}