Infrastructure Provisioning with Kubernetes

​

Crossplane — Kubernetes-native infrastructure control

• Cloud resources become first-class Kubernetes objects with continuous reconciliation.
• Compositions let you package complex infrastructure patterns as templates.
• GitOps-friendly and integrates with Kubernetes RBAC, admission controllers, and observability.

1. Define a CompositeResourceDefinition (XRD) that models what developers can request.
2. Create a Composition template that maps the XRD to concrete cloud resources (e.g., RDS instance, network, secrets).
3. Developers submit a claim (instance of the XRD) and Crossplane reconciles the Composition to provision resources.

# Provider: Connects to cloud APIs
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: provider-aws
spec:
  package: xpkg.upbound.io/crossplane-contrib/provider-aws:v0.44.0

# XRD: Define what developers can request
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xpostgresqlinstances.database.spr.com
spec:
  group: database.spr.com
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          properties:
            spec:
              properties:
                storageGB:
                  type: integer
                  minimum: 20
                engineVersion:
                  type: string
                  enum: ["13.7", "14.6", "15.1"]

​

Terraform / OpenTofu — mature IaC with operator integrations

• Mature ecosystem and provider coverage.
• HCL language and state management (remote state backends).
• Often used outside the cluster (CI/CD pipelines) or integrated into-cluster via operators.

# Terraform Operator in Kubernetes
apiVersion: tf.isaaguilar.com/v1alpha1
kind: Terraform
metadata:
  name: pony-database-infrastructure
spec:
  terraformModule:
    source: "git::https://github.com/spr/terraform-modules//rds-postgres"
  outputsToSecret:
    name: pony-db-connection

• Terraform/OpenTofu have broad provider coverage and module ecosystems.
• They are not inherently Kubernetes-native; you integrate them into GitOps workflows or run them from CI/CD.
• Crossplane provides tighter Kubernetes-native reconciliation, but Terraform has a lower initial learning curve for many teams and more mature provider modules.

​

Cluster API — declarative cluster lifecycle management

• Cluster lifecycle: creating, upgrading, and scaling Kubernetes clusters.
• Multi-cloud/hybrid/edge consistent cluster management.
• Use-cases where you want cluster standardization and automation of node and control-plane lifecycle.

# Cluster API Cluster resource
apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  name: pony-production-cluster
spec:
  clusterNetwork:
    pods:
      cidrBlocks: ["192.168.0.0/16"]
  infrastructureRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
    kind: AWSCluster
    name: pony-production-cluster

​

Comparing the three approaches

• Crossplane: Kubernetes-native, manages a wide range of cloud resources via CRDs and Compositions; excellent for GitOps-driven, self-service platforms. Requires deeper Kubernetes expertise to design compositions effectively.
• Terraform/OpenTofu: Mature IaC, extensive provider ecosystem and modules, generally managed outside the cluster (or integrated via operators). Familiar, approachable HCL workflow and broad community adoption.
• Cluster API: Specialized for Kubernetes cluster lifecycle management. Narrow scope but deep capability for cluster provisioning, scaling, and upgrades.

• Crossplane: deep Kubernetes skills, composition design, and provider wiring.
• Terraform/OpenTofu: HCL proficiency, state and module management; easier ramp for many teams.
• Cluster API: Kubernetes and cluster operations experience — focused but narrower in scope.

​

Patterns and best practices (2025)

1. Start experimenting with Cluster API to standardize and manage cluster lifecycles.
2. Add Crossplane to model application infrastructure as Kubernetes resources and provide self-service compositions.
3. Keep Terraform/OpenTofu for complex foundational networking, or for teams that already rely on a large Terraform module ecosystem.
4. Expose multiple abstraction levels (platform operators, SREs, and developers) according to persona.

​

Key takeaways

• Crossplane (CNCF): represents Kubernetes-native infrastructure control using CRDs and composition patterns; ideal when you want infrastructure as Kubernetes objects and tight GitOps integration.
• Terraform / OpenTofu: mature IaC ecosystem using HCL and modules; often the quickest way to adopt IaC at scale and has the largest provider coverage.
• Cluster API (CNCF): specialized for Kubernetes cluster lifecycle management — provisioning, upgrading, scaling — and not a general cloud resource orchestrator.
• Design your platform with layered abstractions, GitOps, policy-as-code, and observability to enable self-service while preserving security and compliance.