

Shadow IT is not just an organizational annoyance — it introduces real security, compliance, and cost risks. Preventing it requires replacing slow manual processes with fast, trustworthy self-service APIs.


- Ticket-driven: Developer files a ticket or emails platform; a human acts as a middleman and performs manual provisioning.
- Platform-as-product: Developer calls a platform API that declares intent; automated systems provision resources without human intervention.

- Developers are your customers: treat the developer experience as a product. If a developer must wait three days for a namespace, your product is broken.
- APIs are contracts: a clear contract sets expectations — developers know what they can request and what they will receive; platform teams know what they must support and guarantee.
- Automation needs interfaces: humans do not scale; APIs do. You can’t effectively automate a ticket queue, but you can automate an API endpoint.

- Consumer layer: Developers request resources via platform APIs and only declare intent — they don’t need to know implementation details.
- Contract layer: The platform API itself. CRDs define schema; validation enforces guardrails; defaults fill unspecified values. This layer separates intent (what to create) from execution (how to create it).
- Platform logic layer: Reconciliation implemented by controllers/operators and workflow engines. These components translate the declared desired state into real infrastructure.
- Consumer-centric: design from the developer’s perspective.
- Declarative: users declare what they want, not how to implement it.
- Guardrails: enforce validation and policy at the API layer.
- Self-documenting: schema should double as documentation.

- Infrastructure-centric API: Forces developers to specify cloud-specific settings (instance class, storage class, AZs). This raises the risk of improper configuration, increases cognitive load, and leaks implementation details.
- Consumer-centric API: Exposes intent (e.g., “medium Postgres”), hides cloud specifics, and maps intent to platform-defined defaults (instance class, backups, networking, security). This reduces mistakes and simplifies the developer experience.
- Custom Resource Definitions (CRDs): define your API schema and extend Kubernetes with domain-specific types (Database, Application, Team).
- Operators and Controllers: watch custom resources and reconcile actual state to desired state; when a Database CR is created, the controller provisions the database.
- Workflow Engines: orchestrate multi-step provisioning flows requiring retries, parallelism, and dependencies (e.g., create VPC → create DB → create Secret → notify team).

- Developer creates a Custom Resource (CR) via the platform API.
- The CRD validates input against the schema and policies (guardrails).
- A controller/operator reconciles the CR and triggers provisioning tasks.
- Infrastructure and related artifacts are created; the CR’s status is updated and notifications are sent to the developer.
Design platform APIs with the developer experience in mind: provide concise intent-driven fields, sensible defaults, and clear validation errors. Think of the CRD schema as both the contract and the documentation.
- Treat your platform as a product: measure developer experience and iterate.
- APIs enable self-service at scale: they prevent bottlenecks and reduce shadow IT.
- Design consumer-centric contracts that hide infrastructure complexity and enforce guardrails.
- Kubernetes gives you the building blocks: CRDs, controllers/operators, and workflow engines to implement self-service.

- Learn By Doing: Crossplane — https://learn.kodekloud.com/user/courses/learn-by-doing-crossplane
- Kubernetes CRD documentation — https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/
- Operator pattern — https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
- Consider workflow engines such as Argo Workflows or Temporal for orchestrating multi-step provisioning flows.