Crossplane: Cloud Resources as Kubernetes Objects

1. 1

   Install Crossplane

   Chart crossplane from https://charts.crossplane.io/stable, into crossplane-system, through Argo CD like every add-on.

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
     name: crossplane
     namespace: argocd
     annotations: { argocd.argoproj.io/sync-wave: "-5" }
   spec:
     project: default
     source:
       repoURL: https://charts.crossplane.io/stable
       chart: crossplane
       targetRevision: 2.0.2
     destination:
       server: https://kubernetes.default.svc
       namespace: crossplane-system
     syncPolicy:
       automated: { prune: true, selfHeal: true }
       syncOptions: [CreateNamespace=true]

2. 2

   Install the AWS providers

   Providers are split per service family (provider-aws-s3, provider-aws-rds, provider-aws-ec2) so you only install the CRDs you need; each has hundreds. A DeploymentRuntimeConfig attaches the service account that EKS Pod Identity maps to an IAM role.

   apiVersion: pkg.crossplane.io/v1beta1
   kind: DeploymentRuntimeConfig
   metadata: { name: aws-irsa }
   spec:
     serviceAccountTemplate:
       metadata: { name: crossplane-provider-aws }
   ---
   apiVersion: pkg.crossplane.io/v1
   kind: Provider
   metadata: { name: provider-aws-s3 }
   spec:
     package: xpkg.crossplane.io/crossplane-contrib/provider-aws-s3:v2.1.0
     runtimeConfigRef: { name: aws-irsa }
   ---
   apiVersion: pkg.crossplane.io/v1
   kind: Provider
   metadata: { name: provider-aws-rds }
   spec:
     package: xpkg.crossplane.io/crossplane-contrib/provider-aws-rds:v2.1.0
     runtimeConfigRef: { name: aws-irsa }

3. 3

   Tell providers how to authenticate

   source: PodIdentity uses the pod's AWS identity, with no access keys stored anywhere.

   apiVersion: aws.upbound.io/v1beta1        # for cluster-scoped managed resources
   kind: ProviderConfig
   metadata: { name: default }
   spec:
     credentials:
       source: PodIdentity
   ---
   apiVersion: aws.m.upbound.io/v1beta1      # for namespaced managed resources (Mission 2.2)
   kind: ClusterProviderConfig
   metadata: { name: default }
   spec:
     credentials:
       source: PodIdentity

   terminalcopy cmd

   $ kubectl get providers

   ── expected output ──

   NAME INSTALLED HEALTHY PACKAGE AGE

   provider-aws-rds True True xpkg.crossplane.io/crossplane-contrib/provider-aws-rds:v2.1.0 3m

   provider-aws-s3 True True xpkg.crossplane.io/crossplane-contrib/provider-aws-s3:v2.1.0 3m

4. 4

   Create a bucket as YAML

   A managed resource maps one-to-one onto the AWS API. READY and SYNCED conditions show its state; kubectl describe shows API errors.

   apiVersion: s3.aws.upbound.io/v1beta1
   kind: Bucket
   metadata:
     name: shoplite-crossplane-demo-7f3a
   spec:
     forProvider:
       region: ap-south-1
       tags: { owner: team-platform, managed-by: crossplane }
     providerConfigRef: { name: default }

   terminalcopy cmd

   $ kubectl apply -f examples/bucket.yaml && kubectl get bucket -w

   ── expected output ──

   NAME SYNCED READY EXTERNAL-NAME AGE

   shoplite-crossplane-demo-7f3a True False shoplite-crossplane-demo-7f3a 4s

   shoplite-crossplane-demo-7f3a True True shoplite-crossplane-demo-7f3a 21s

5. 5

   Watch drift correction

   Change the bucket's tags in the console or CLI. Within the poll interval (default ~10 minutes, configurable), Crossplane restores them from the spec.

   terminalcopy cmd

   $ aws s3api put-bucket-tagging --bucket shoplite-crossplane-demo-7f3a --tagging 'TagSet=[{Key=owner,Value=someone-else}]'

   # ...after the next reconcile:

   aws s3api get-bucket-tagging --bucket shoplite-crossplane-demo-7f3a --query 'TagSet[?Key==`owner`].Value' --output text

   ── expected output ──

   team-platform

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.