How does Crossplane manage cloud infrastructure (RDS, S3) using Kubernetes CRDs?
❓ Interview Prompt: Explain Crossplane as a universal control plane — Providers, CompositeResources, Compositions, and GitOps-driven cloud infrastructure provisioning.
Crossplane transforms a Kubernetes cluster into a universal control plane that can provision and manage cloud infrastructure resources (AWS RDS, S3, GCP Cloud SQL, Azure AKS) using the same Kubernetes API and GitOps workflow.
Core Crossplane Concepts:
RDSInstance, S3Bucket, GKECluster). Crossplane reconciles their actual state with the declared spec.PostgresDatabase XR that packages an RDS instance + security groups + parameter group + backup policy.GitOps + Crossplane = Infrastructure as Code:
Store Crossplane manifests in Git. ArgoCD syncs them to the cluster. Crossplane provisions the cloud resources. All infrastructure changes are tracked in Git — perfect auditability and rollback.
Benefits:
kubectl apply — no Terraform, no AWS console.Code Implementation Example
# Step 1: Install AWS Provider
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
name: provider-aws
spec:
package: xpkg.upbound.io/upbound/provider-aws:v1.0.0
---
# Step 2: Developer requests a PostgreSQL database
# (Crossplane provisions AWS RDS automatically)
apiVersion: example.platformteam.io/v1alpha1
kind: PostgresDatabase
metadata:
name: my-app-db
namespace: dev-team-namespace
spec:
parameters:
size: medium # small, medium, large (team's simple API)
version: "15"
multiAZ: false # single AZ for dev environments
# Where to write the connection credentials
writeConnectionSecretsToRef:
name: my-app-db-credentials
# What the platform team's Composition does under the hood:
# → provisions RDSInstance (db.t3.medium, 20GB gp3)
# → creates DB SecurityGroup (only allows port 5432 from VPC)
# → creates RDS ParameterGroup (max_connections=200)
# → creates DB SubnetGroup (private subnets only)
# → writes connection details to Secret: my-app-db-credentialsCrossplane turns K8s into a universal cloud control plane — platform teams define Compositions, devs request infrastructure via kubectl. All cloud resources tracked as K8s objects, enabling GitOps.