Crossplane: The Kubernetes Control Plane for Infrastructure

Why it exists

Teams want to manage infrastructure with the same declarative, version-controlled GitOps workflows they use for applications. Traditional Infrastructure as Code (IaC) tools operate separately from the Kubernetes scheduler, creating a divide between application and infrastructure management that Crossplane aims to close.

The mental model

Think of Crossplane as extending the Kubernetes control plane beyond containers to manage your entire cloud. Instead of defining Pods and Services, you define RDSInstance or S3Bucket resources directly in Kubernetes YAML. Kubernetes becomes the single source of truth for both your applications and the infrastructure they depend on.

How it works

You install Crossplane into a Kubernetes cluster. Then, you install "Providers" for your cloud (e.g., provider-aws, provider-gcp), which act like drivers. These Providers add new resource types (CRDs) to Kubernetes, like Bucket for S3. You can then kubectl apply a manifest for a Bucket, and Crossplane's controllers will create and manage the real bucket in AWS. Its core feature is "Composition," where a platform team can define a high-level resource like StandardDatabase that bundles a database instance, networking rules, and secrets into a single, simple API for developers.

When to use it

Use Crossplane when building an Internal Developer Platform (IDP) on Kubernetes. It excels at creating a self-service catalog of infrastructure resources that developers can consume without leaving the Kubernetes ecosystem. It's ideal for platform teams standardizing how infrastructure is provisioned and managed across an organization.

When not to use it

Avoid Crossplane for small projects or if your team isn't heavily invested in Kubernetes as its central operating model. The overhead of managing Crossplane and its providers can be substantial. If a simpler workflow with a tool like Terraform or Pulumi meets your needs, Crossplane is likely overkill.

One canonical example

A platform team defines a CompositeResourceDefinition (XRD) for a ProductionPostgres database. A developer simply creates a ProductionPostgres custom resource in their application's namespace. Crossplane's composition engine sees this request and automatically provisions a high-availability RDS instance, a subnet group, and firewall rules in AWS. It then writes the connection string and credentials into a Kubernetes Secret in the developer's namespace, ready for their application to use.