bug: namespaced ProviderConfig reconciles in a hot loop since v1beta2 storage #462

What happened

On master (since #408), every namespaced ProviderConfig that uses source: Secret with a secretRef is reconciled in a hot loop:

• metadata.generation rises by ~75–100 per second without any spec change (observed 73k → 236k during one test run).
• Every iteration logs gitlab.m.crossplane.io/v1beta1 ProviderConfig is deprecated; use gitlab.m.crossplane.io/v1beta2 ... (~2k log lines/minute per namespace).
• source: None (no secretRef) stays stable.

v0.21.2 is not affected.

Cause

#408 made v1beta2 the storage version, but the usage-accounting controller in pkg/namespaced/controller/config/config.go still reads and writes the ProviderConfig as typed v1beta1.

The crossplane-runtime providerconfig reconciler calls Update on every reconcile (finalizer). The v1beta1 SecretKeySelector.Namespace has no omitempty, so the write sends secretRef.namespace: "", a field the stored v1beta2 object does not have. The API server treats this as a spec change and bumps generation; the field is pruned again at v1beta2 storage; the resulting watch event triggers the next reconcile.

Expected

The ProviderConfig controller reconciles the storage version, and generation stays stable once the finalizer is set.

Environment

master 486cc11, Crossplane 2.4.2, kind.