This document discusses application-driven infrastructure using Crossplane. It introduces Crossplane as a Kubernetes-native framework that allows platform teams to assemble infrastructure from multiple vendors and expose higher-level APIs. This enables development teams to consume infrastructure services without having to write custom code. Crossplane uses the concepts of providers, managed resources, and composite resources to map external services to Kubernetes and provide opinionated APIs through self-service resources. It aims to simplify infrastructure provisioning and management for both platform and application teams.

1. APPLICATION-DRIVEN
INFRASTRUCTURE
WITH CROSSPLANE

2. Daniele Monti
➔ GitHub: https://github.com/Monska85
➔ Twitter: @danielemonti
➔ Linkedin: danielemonti1985
Platform Engineer @ SparkFabrik

3. DEVOPS AND SHIFT LEFT PRINCIPLES

4. “DevOps is a set of practices that combines
software development (Dev) and IT operations (Ops).
It aims to shorten the systems development life cycle and to provide
continuous delivery with high software quality.”
https://www.dynatrace.com/news/blog/what-is-shift-left-and-what-is-shift-right/

5. “The shift left approach consists in pushing the beginning of the quality related
tasks at earlier stages of the software lifecycle.
Shift left as a principle was created thinking about testing, but now it involves
also other disciplines such as security and deployment.”

6. SHIFT LEFT
LIFECYCLE
Quality related tasks
➔ This approach reduces risk since many issues are
addressed long before the release
➔ Releases can be made more quickly and with better
quality
➔ Earlier tests ensure most problems are caught much
earlier, when they are easier to debug and fix (less
problem detection, more problem prevention)
➔ More reliable estimations of effort and resources
Software lifecycle

7. Security concepts must be introduced in the early stages,
so the entire application development workflow will follow
defined security standards.
This prevents code rewritings close to the deployment and
leaves only minor security fixes for the production checks.
SHIFT LEFT
SECURITY
DevSecOps

8. The supply chain attack is the current challenge in the
security industry. Introducing checks about the third party
software in early stages prevents wrong assumptions on
what our software can include or not.
We can also automate the signing of our artifacts, the
production of signed SBOMs and the execution of SAST
checks to improve our security posture.
SHIFT LEFT
SECURITY
Supply chain

9. SHIFT LEFT
COSTS
This graph is based on the data taken from The Economic Impacts of
Inadequate Infrastructure for Software Testing, National Institute of
Standards and Technology (NIST) report.
Read the entire document here.

10. SHIFT RIGHT
COMPLEMENTS
TO SHIFT LEFT
Shift right is not the opposite of shift left!
It takes place in the production environment. The
unexpected behaviour and the performance analysis will
produce more value in the production environment.
The continuous deployment of small changes and the
monitoring of the system are the best practices used
in this stage.
The chaos engineering is the discipline of testing resilience
of the system in the production environment.

11. ➔ Shift left spreads the QA tests during the entire
process
➔ Shift left is not only related to software testing:
security aspects, for example, must be one of
the pillars of your development
➔ The automation of these tasks is mandatory
➔ Having less problem detection and more problem
prevention has an high impact on the costs
➔ Shift right complements the shift left
TO SUM UP:

12. YOU BUILD IT, YOU RUN IT.
2006 - Werner Vogels, CTO and vice president of Amazon Web Services

13. Cloud native
model
“Giving developers operational responsibilities has greatly
enhanced the quality of the services, both from a customer
and a technology point of view.” - A conversation with
Werner Vogels
The old model of throwing the artifact over the wall of
confusion1
and then forgetting about it is no more suitable
in the cloud native model.
1. The “Wall of Confusion” is a DevOps term popularized by Andrew Clay Schafer (AgileRoots 2009 ~17:00
mark) and Lee Thompson (Dev2Ops Interview). It refers to the phenomena where one group in a value
stream approaches their job as complete when they’ve passed it onto the next group.
Ops for Dev

14. INFRASTRUCTURE AS CODE & PLATFORM ENGINEERING

15. INFRASTRUCTURE
AS CODE
● Easier to read, maintain and distribute
● Consistent over time: each deployment has the same
configuration
● Reusable code (modules)
and cost efficient
● Automation (no human errors)
● Self documented
● Versioned

16. GCP
Deployment Manager
AWS
CloudFormation
AZURE
Resource Manager
...
INFRASTRUCTURE
AS CODE

17. Foundations guarantee
the highest value to
open source projects

18. INFRASTRUCTURE
AS CODE

19. IAC
TERRAFORM
EXAMPLES

20. IaC & PLATFORM ENGINEERING
IAC
TERRAFORM
EXAMPLES

21. PLATFORM
ENGINEERING
Cloud Services
Organization
Best
practices
Policies
Security
models
Platform
Dev team Dev team
Dev team

22. THE
PLATFORM The scope of The Platform is to expose a simply way (API) to
obtain a piece of infrastructure or a service encapsulating all
the organization rules.
The Platform offers a simple access to
a complex set of resources.

23. THE
PLATFORM
INTERACTION MODES
There are only three ways in which teams should
interact:
➔ Collaboration: working together for a defined
period of time to discover new things (APIs,
practices, technologies, etc.)
➔ X-as-a-Service: one team provides and one team
consumes something “as a Service”
➔ Facilitation: one team helps and mentors
another team
https://teamtopologies.com/key-concepts

24. THE
PLATFORM
API
Development team needs:
“Our new microservice needs a Postgresql
database and an S3-like object storage bucket.
The microservice will be deployed on K8S”
K8S Deployment Bucket
DB Instance Database

25. THE
PLATFORM
API
K8S + TERRAFORM
Bucket
DB Instance
Database
K8S Deployment

26. THE
PLATFORM
API
K8S + TERRAFORM
Bucket
DB Instance
Database
🚨 COGNITIVE LOAD ALERT 🚨
A new tool to learn for the
development team.
Hard to integrate with a K8S
CI/CD pipeline.

27. THE CLOUD NATIVE CONTROL PLANE FRAMEWORK

29. THE
PLATFORM
API
THE KUBERNETES WAY
Bucket
DB Instance
Database
K8S Deployment

30. Crossplane is an incubating project in the CNCF landscape.
Crossplane enables platform teams to assemble
infrastructure from multiple vendors, and exposes higher
level self-service APIs for application teams to consume,
without having to write any code.
Crossplane extends the Kubernetes cluster to support
orchestrating any infrastructure or managed service.
CROSSPLANE
CNCF PROJECT

31. Providers are the core concept of Crossplane.
Providers are Crossplane Packages that bundle a set of
Managed Resources and their respective controllers to allow
Crossplane to provision the respective infrastructure
resources.
Each Provider package has its own configuration type, the so
colled ProviderConfig. This resource, for example, is used by
the provider controller to get the API credentials.
CROSSPLANE
PROVIDERS

32. Managed Resources are the mapping between K8S and the
external services.
A Managed Resource is the Crossplane representation of a
resource in an external system.
Managed Resources are the building blocks of Crossplane.
They are designed to be composed of higher level,
opinionated Custom Resources that Crossplane calls
Composite Resources or XRs.
CROSSPLANE
MANAGED RESOURCES

33. Crossplane is extensible, thanks to its provider model.
Anything with an API could be connected to a Kubernetes
cluster where Crossplane is running, giving you a CRD
representing each resource.
This model allows Crossplane to manage infrastructure
pieces or services (or whatever) using a specific provider for
those resources.
https://blog.crossplane.io/providers-101-ordering-pizza-wit
h-kubernetes-and-crossplane/ is an awesome example on
how Crossplane could manage any API driven service.
CROSSPLANE
PROVIDER MODEL

34. THE
PLATFORM
API
THE KUBERNETES WAY
Bucket
DB Instance
Database
K8S Deployment

35. THE
PLATFORM
API
THE KUBERNETES WAY
DB Instance
Database
K8S Deployment
Bucket
🚨 COGNITIVE LOAD ALERT 🚨
There are a lot of moving parts and many
things to configure, including some
properties that should be opinionated by
the platform.

36. Composite Resources are designed to build the platform with
the opinionated concepts.
The Composite Resources are the way to create the high level
API and to leverage Crossplane to create your opinionated
platform.
With a single YAML manifest, with a small amount of
configuration, Crossplane will be able to create all the
needed managed resources.
CROSSPLANE
COMPOSITE RESOURCES

37. THE
PLATFORM
API
COMPOSITE RESOURCE
K8S Deployment
External resources

38. Crossplane uses X as shorthand for Crossplane and
Composite.
This choice was made to avoid the confusion
between the kubernetes resources and the
crossplane ones.
CROSSPLANE
TERMINOLOGY
Custom Resource Definition
(CRD)
Custom Resource
(CR)
Composite Resource Definition
(XRD)
Composite Resource
(XR)

39. Composite Resource Definition
(XRD)
Composite Resource
(XR)
Define
Composition
Use
Managed Resource
Managed Resource
Managed Resource
Application
Application team
Platform team

40. CROSSPLANE
K8S CLOSED BOX
Crossplane can write all the connection
reference as secrets inside the cluster.
This is really useful to keep all the data
inside the cluster which could be used
as a kubernetes secret in the workloads.

41. ➔ Consistency across resources
➔ Application and infrastructure are
deployed at the same time
➔ Simple text file human and machine
readable
➔ Versioned
CROSSPLANE
YAML FOR THE WIN

42. CROSSPLANE
DEPLOYMENT STRATEGY

43. CROSSPLANE
DRAWBACKS
➔ The providers are still in development
version (0.x.y in semver)
➔ Another tool to maintain
➔ Another set of modules (XRD and
Composition) to maintain
➔ Balance between complexity and
advantages
➔ Static YAML

44. CROSSPLANE
ALTERNATIVES
➔ Pulumi
➔ Serverless Framework
➔ Terraform
➔ Rancher terraform controller

45. ➔ Offer the dev teams simple APIs to create
opinionated services
➔ Platform Engineers should package the
organization model into the Platform
➔ Crossplane is a framework to develop a custom
platform in the kubernetes way
TO SUM UP:

46. THANK YOU!