Provisioning: Default to folder sync only and block new instance sync repositories (#115569)

* Default to folder sync only and block new instance sync repositories

- Change default allowed_targets to folder-only in backend configuration
- Modify validation to only enforce allowedTargets on CREATE operations
- Add deprecation warning for existing instance sync repositories
- Update frontend defaults and tests to reflect new behavior

Fixes #619

* Update warning message: change 'deprecated' to 'not fully supported'

* Fix health check: don't validate allowedTargets for existing repositories

Health checks for existing repositories should treat them as UPDATE operations,
not CREATE operations, so they don't fail validation for instance sync target.

* Fix tests and update i18n translations

- Update BootstrapStep tests to reflect folder-only default behavior
- Run i18n-extract to update translation file structure

* Fix integration tests

* Fix tests

* Fix provisioning test wizard

* Fix fronted test

apps/provisioning/pkg/repository/tester.go

@@ -23,7 +23,13 @@ func NewSimpleRepositoryTester(validator RepositoryValidator) SimpleRepositoryTe
 
 // TestRepository validates the repository and then runs a health check
 func (t *SimpleRepositoryTester) TestRepository(ctx context.Context, repo Repository) (*provisioning.TestResults, error) {
-	errors := t.validator.ValidateRepository(repo)
+	// Determine if this is a CREATE or UPDATE operation
+	// If the repository has been observed by the controller (ObservedGeneration > 0),
+	// it's an existing repository and we should treat it as UPDATE
+	cfg := repo.Config()
+	isCreate := cfg.Status.ObservedGeneration == 0
+
+	errors := t.validator.ValidateRepository(repo, isCreate)
 	if len(errors) > 0 {
 		rsp := &provisioning.TestResults{
 			Code:    http.StatusUnprocessableEntity, // Invalid

apps/provisioning/pkg/repository/validator.go

@@ -32,7 +32,9 @@ func NewValidator(minSyncInterval time.Duration, allowedTargets []provisioning.S
 }
 
 // ValidateRepository solely does configuration checks on the repository object. It does not run a health check or compare against existing repositories.
-func (v *RepositoryValidator) ValidateRepository(repo Repository) field.ErrorList {
+// isCreate indicates whether this is a CREATE operation (true) or UPDATE operation (false).
+// When isCreate is false, allowedTargets validation is skipped to allow existing repositories to continue working.
+func (v *RepositoryValidator) ValidateRepository(repo Repository, isCreate bool) field.ErrorList {
 	list := repo.Validate()
 	cfg := repo.Config()
 
@@ -44,7 +46,7 @@ func (v *RepositoryValidator) ValidateRepository(repo Repository) field.ErrorLis
 		if cfg.Spec.Sync.Target == "" {
 			list = append(list, field.Required(field.NewPath("spec", "sync", "target"),
 				"The target type is required when sync is enabled"))
-		} else if !slices.Contains(v.allowedTargets, cfg.Spec.Sync.Target) {
+		} else if isCreate && !slices.Contains(v.allowedTargets, cfg.Spec.Sync.Target) {
 			list = append(list,
 				field.Invalid(
 					field.NewPath("spec", "target"),

apps/provisioning/pkg/repository/validator_test.go

@@ -303,7 +303,8 @@ func TestValidateRepository(t *testing.T) {
 	validator := NewValidator(10*time.Second, []provisioning.SyncTargetType{provisioning.SyncTargetTypeFolder}, false)
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			errors := validator.ValidateRepository(tt.repository)
+			// Tests validate new configurations, so always pass isCreate=true
+			errors := validator.ValidateRepository(tt.repository, true)
 			require.Len(t, errors, tt.expectedErrs)
 			if tt.validateError != nil {
 				tt.validateError(t, errors)