Migrate S3 Files from OpenTofu to Crossplane (provider-upjet-aws v2.6+)

[Smana]

Context

Phase 4b of the self-hosted LLM platform (PR #1434, ADR-0004) provisions Amazon S3 Files via OpenTofu (opentofu/llm-platform/) as an interim because Crossplane Upbound provider-upjet-aws v2.5.0 does NOT yet ship the s3files.aws.m.upbound.io CRDs (verified May 2026; Terraform AWS provider added the resources in v6.40.0 on April 8, 2026 — Crossplane lags by one upstream release cycle).

What this issue tracks

Replace the OpenTofu opentofu/llm-platform/ stack with a native Crossplane composition once Upbound publishes the s3files CRDs.

Trigger

Watch crossplane-contrib/provider-upjet-aws releases for v2.6.0 or later. When the release notes mention aws_s3files_* or s3files.aws.m.upbound.io, this issue can be acted on.

Migration plan (T020f from the original plan)

1. Bump provider in infrastructure/base/crossplane/providers/provider-s3.yaml (and add a new provider-s3files.yaml if it ships as a separate family package).
2. Add CRDs to ManagedResourceActivationPolicy in infrastructure/base/crossplane/providers/activation-policy.yaml:
   • filesystems.s3files.aws.m.upbound.io
   • mounttargets.s3files.aws.m.upbound.io
   • accesspoints.s3files.aws.m.upbound.io
   • filesystempolicies.s3files.aws.m.upbound.io
3. Re-render OpenTofu resources as Crossplane MRs under infrastructure/base/llm-models-fs/ (or as a new XLLMFileSystem composition if reuse is anticipated). One-to-one mapping:

   OpenTofu	Crossplane
   aws_s3files_file_system.models	FileSystem
   aws_s3files_mount_target.az[*]	MountTarget x N
   aws_s3files_access_point.shared	AccessPoint
   aws_s3files_file_system_policy.models	FileSystemPolicy
   aws_iam_role.{s3files_service,csi_driver}	Role (provider-aws-iam)
   aws_iam_role_policy*	RolePolicy / RolePolicyAttachment
   aws_eks_pod_identity_association.csi_driver	PodIdentityAssociation (already a Crossplane MR)

4. State surgery — tofu state rm for each resource, then tofu destroy deletes nothing in AWS but drops them from state. Crossplane then adopts the existing AWS resources by external-name.
5. Drop the opentofu/llm-platform/ stack + Terramate orchestration.
6. Keep EnvironmentConfig keys identical — InferenceService composition consumer side doesn't change.

Acceptance criteria

• kubectl get filesystems.s3files.aws.m.upbound.io returns the migrated resource Synced=True / Ready=True
• InferenceService preload Job + serving Deployment run unchanged after migration
• opentofu/llm-platform/ directory deleted
• CSI driver pod identity binding still works (PIA Crossplane MR)

References

• ADR-0004: docs/decisions/0004-amazon-s3-files-for-model-weights-storage.md
• Phase 4b plan: docs/plans/self-hosted-llm-platform/03-plan-draft.md (T020f)

[aqemia-smaine-kahlouch]

Status: still blocked on upstream — keep open.

provider-aws-s3 is now at v2.6.0 (infrastructure/base/crossplane/providers/provider-s3.yaml), but the s3files.aws.m.upbound.io CRDs are still not shipped, so the trigger condition isn't met. opentofu/llm-platform/ remains the active S3 Files stack. Keep watching provider-upjet-aws releases for the s3files family, then execute the documented migration.

(Status reviewed 2026-07-14.)