What Crossplane is & the control-plane model

Kubernetes as a universal control plane.

Intermediate12 min · lesson 1 of 12

Crossplane turns a Kubernetes cluster into a control plane for infrastructure. Instead of running a CLI that applies a plan and exits, you install Crossplane into a cluster, and it extends the Kubernetes API with new resource types for cloud things — an RDS database, an S3 bucket, a GCP network. You then create those with kubectl apply like any other Kubernetes object, and a controller continuously reconciles them against the real cloud, creating, updating, and healing them.

The shift is from imperative runs to a always-on control loop. Terraform or CloudFormation provision when you run them; Crossplane provisions and keeps provisioning, because the same reconciliation engine that makes Kubernetes self-heal pods now heals your cloud infrastructure. Delete a bucket out from under it and Crossplane recreates it, exactly as Kubernetes recreates a deleted pod — the declared spec is enforced forever, not just at apply time.

CLI tool vs control plane

CLI IaC (Terraform, CFN)

run to apply

provisions, then exits

state file

external record

drift

found only on next run

Crossplane

always reconciling

a controller, never exits

state in the API

the cluster is the record

self-healing

drift corrected continuously

Same desired-state idea; Crossplane runs it as a live control loop instead of a one-shot command.

Why teams reach for it

Two big draws. First, it unifies app and infra under one API and one toolchain — the same kubectl, RBAC, GitOps, and admission control that governs workloads now governs databases and networks. Second, it is a platform-building tool: a platform team can define its own high-level APIs (a “PostgresInstance” that means something specific to your org) and let developers self-serve, which the later lessons build up to.

The control plane holds cloud-admin power

Crossplane runs continuously with credentials that can create and destroy real cloud infrastructure — so the cluster it lives in is now a top-tier security asset. A compromise of that cluster, or over-broad RBAC within it, is a compromise of your cloud account. The security lessons treat this seriously; keep it in mind from the start.

Installing Crossplane & a provider