Crossplane is a CNCF-graduated, Kubernetes-native framework that turns any cluster into a universal control plane for provisioning and managing cloud infrastructure — on AWS, Azure, GCP, and beyond — using pure Kubernetes APIs and GitOps workflows. Unlike traditional IaC tools that run imperatively, Crossplane continuously reconciles declared state with real cloud resources, detecting and correcting drift automatically. The key mental model is that Crossplane doesn't just create resources once; it owns them, meaning any out-of-band change is reverted — a powerful guarantee for production environments but one that demands deliberate use of managementPolicies and deletionPolicy to avoid surprises.
What This Cheat Sheet Covers
This topic spans 17 focused tables and 121 indexed concepts, 107 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
A jump-to index of every table row in this cheat sheet.
An interactive map of every table and concept in this topic.
Table 1: Core Concepts and Architecture
Crossplane's architecture builds on Kubernetes controllers and CRDs; every cloud resource maps to a custom Kubernetes object. Understanding these seven foundational object types — and how they compose into a layered API — is the prerequisite for all practical work.
| Concept | Example | Description | |
|---|---|---|---|
apiVersion: s3.aws.m.upbound.io/v1beta1kind: Bucketspec: forProvider: region: us-east-2 | • Kubernetes object representing one external cloud resource • the Provider reconciles it against the real infrastructure | ||
apiVersion: pkg.crossplane.io/v1kind: Providerspec: package: xpkg.crossplane.io/crossplane-contrib/provider-aws-s3:v2.0.0 | OCI package that installs CRDs and runs a controller pod to manage external resources for one cloud or service. | ||
apiVersion: aws.m.upbound.io/v1beta1kind: ProviderConfigspec: credentials: source: Secret secretRef: {name: aws-creds} | • Stores authentication credentials for a Provider • ProviderConfig is namespace-scoped, ClusterProviderConfig is cluster-wide | ||
apiVersion: apiextensions.crossplane.io/v2kind: CompositeResourceDefinitionmetadata: name: mydatabases.example.orgspec: scope: Namespaced | Registers a new custom API in the cluster (like a CRD) that defines the schema for a Composite Resource. | ||
apiVersion: example.org/v1alpha1kind: MyDatabasespec: region: us-east-1 | • A single Kubernetes object that represents a set of composed resources • created when a user calls the custom API | ||
apiVersion: apiextensions.crossplane.io/v1kind: Compositionspec: compositeTypeRef: kind: MyDatabase mode: Pipeline | • Template that specifies what resources to create when an XR is requested • operates as a pipeline of composition functions | ||
apiVersion: pkg.crossplane.io/v1kind: Functionspec: package: xpkg.crossplane.io/crossplane-contrib/function-patch-and-transform:v0.8.2 | • A gRPC server pod called by Crossplane to compute desired composed resources • the building block of the pipeline composition model |