Crossplane — Cloud Control Plane

Kubernetes-native cloud infrastructure management — Crossplane turns your Kubernetes cluster into a universal control plane that provisions cloud resources via CRDs and continuous reconciliation.

Overview

Cloud infrastructure as Kubernetes objects

Crossplane is an open-source CNCF project that extends Kubernetes to manage cloud infrastructure (AWS, GCP, Azure) with native Kubernetes primitives: CRDs, controllers and RBAC. Instead of running the Terraform CLI or CloudFormation stacks, you declare cloud resources as Kubernetes manifests, and Crossplane controllers reconcile actual cloud state to match.

The building blocks

Provider — A package that installs CRDs and a controller for one cloud (provider-aws, provider-gcp, provider-azure); each managed resource type becomes a CRD
Managed Resource (MR) — A Kubernetes object that maps directly to a cloud resource: an RDSInstance object creates an actual AWS RDS instance, and the controller calls AWS APIs to create, update or delete it to match the spec
CompositeResourceDefinition (XRD) — Defines a new abstract resource type (PostgreSQLDatabase) that hides cloud-specific details
Composition — Maps an XRD to one or more managed resources
Claim — A namespace-scoped object developers create to request infrastructure; hides cloud complexity and can be quota-controlled per namespace

> [!IMPORTANT] Platform teams define Compositions; developers consume the abstract XRDs through Claims.

Crossplane vs Terraform

Operation — plan/apply CLI runs — Continuous reconciliation, like a Kubernetes controller
State — External state files — The Kubernetes API
Manual cloud change — Found on the next plan — Corrected automatically: no drift
Access control — Separate — Kubernetes RBAC
GitOps — Needs a pipeline around it — Manifests sync like any other workload

Key concepts

Managed Resource (MR): Kubernetes CRD representing a single cloud resource (e.g., RDSInstance, S3Bucket). Crossplane controllers watch MRs and call cloud APIs to make actual resources match the spec. Deletion of an MR deletes the cloud resource by default.
CompositeResourceDefinition (XRD): Defines a new abstract API type (e.g., XPostgreSQLServer). Platform teams create XRDs so developers work with cloud-agnostic APIs instead of raw managed resources.
Composition: Defines how an XR maps to one or more Managed Resources. A single XPostgreSQLServer Composition might create an RDSInstance plus a SecurityGroup plus a SubnetGroup on AWS.
Claim: Namespace-scoped proxy for a Composite Resource. Developers create Claims in their namespace; Crossplane creates a cluster-scoped XR and binds the Claim to it. Claims enforce namespace isolation and quota control.
Provider: Crossplane package (OCI image plus CRDs plus controller) for a specific cloud. provider-aws installs CRDs for every AWS service. Providers authenticate via ProviderConfig (IAM role, IRSA).
Continuous Reconciliation: Unlike Terraform (one-shot apply), Crossplane controllers continuously compare actual cloud state with desired state. If a resource is modified outside Crossplane, the controller reverts it on the next reconcile cycle.

When to use it

Building a self-service platform where developers request infrastructure via Kubernetes manifests
Implementing GitOps for cloud infrastructure provisioning
Interview questions about Kubernetes-native IaC and platform engineering
Replacing Terraform for teams that are already Kubernetes-native
Enabling multi-cloud resource management from a single Kubernetes cluster