Project Lightning Talk: What Can Crossplane Actually Do? A Real World Fiel... Jonasz Łasut-Balcerzak

This talk introduces Crossplane, a tool that integrates with Kubernetes to streamline platform API management. The speaker discusses the advantages of using Crossplane, highlighting its ability to provide a unified control plane for both application and infrastructure deployments. Crossplane allows developers to leverage existing policies and access control mechanisms from Kubernetes, aiding in self-service within complex, multi-tenant environments while maintaining compliance with evolving security requirements. The speaker shares practical examples from their work at Baloas, illustrating how Crossplane simplifies management, including extending functionalities of cloud provider products like DNS and API gateways. Overall, Crossplane is positioned as a solution to reduce platform complexity and enhance developer agility while ensuring safety and compliance.

So let's talk about what can crossplain do for you. Uh my name is Yonwas Baleshak. I work at Balawas which is Swiss insurance company. And let's just jump straight on the topic. Why should you choose crossplane? Sorry. Why should you choose crossplane for your platform APIs? So one of the biggest benefits that you get with crossplane is of course that you get Kubernetes control plane and ecosystem

together with it. You all know and love Kubernetes. I mean we are at CubeCon. So what you can which parts of Kubernetes ecosystem you can use with crossplane to enhance it is for example policies Kybero opa gatekeeper admission policies you can also reuse the same arbback that you use for your application deployments and then use it for your infrastructure deployments that way and that brings me to

the point that you get a single pane of glass for both your application and infra deployments which can be pretty useful. You can reuse the same GitHubs flows and promotion flows for both your apps and infra. What you also get is implementation flexibility. Um you can start really simple with YAML templating using pattern transform. You can also use Go templates which you know if you've used Helm

uh but you can also use general purpose programming languages with functions. So you can use Go, TypeScript, Python. uh if you want to do something more complex than just templating and you get vast array of providers so for example provider Azure that I've mentioned and any other big cloud provider so what's the real world problem uh self-service in highly regulated multi-tenant environment is tricky uh you have

a lot of resources that have shared usage but no shared responsibility for example w or DNS it's really hard to bring self-service to the developers for those um you also get a compliance which is ever evolving and you have security requirements that may change from day to day and crossplane actually allows you to create new composition revisions to just release updates to all cloud resources to be

compliant with all those security requirements. You can also extend the cloud provider product if you are missing something for compliance and you can build abstraction of a really complex configuration that's span across multiple providers or multiple tenant boundaries. um and I will show you three examples of what we did at Baloas um and what crossplane allowed us to do in such examples. So first example would be

shared usage without shared responsibility in that case DNS. What you don't get with most DNS cloud provider DNS is you don't really get a validation or ownership built into the platform. So you can't easily ask DNS is this tenant allowed to create that DNS record or change that DNS record. What crossplane gives you is you can build that capability really easily into your platform and expose uh

composite resource that limits the resource capabilities to a safe subset that is allowed to that particular tenant. Some examples uh below. What you can also do is you can extend cloud provider products. for example, API gateways. You can add some capabilities that are missing from the cloud provider product by using those Go or TypeScript For example, you can add caching to policies or you can fetch some

resources that are normally not available from the cloud provider for the cloud provider. You can also extend the capabilities for your domain specific requirements. So it's it allows you to build on a platform on top of cloud providers and one of my favorite examples if you have developers that are not really that heavy into infrastructure. Um you can easily build abstractions over really complex configurations that span

across multiple providers. For example, you can create a simple abstraction that allows you to deploy application to Kubernetes and then with a simple flag SSO enabled would create everything that is required for of to uh authentication create all resources from the gateway API of your choice for example uh in the cluster and that brings two providers. So, Kubernetes, gateway API and cloud provider or identity provider and

that way developer can just do one really simple resource without any knowledge about the internals and get a safe safely deployed application. Um, just to summarize what can crossplane do for you. Uh crossplane is really good at abstracting the platform complexity for the developers and it allows you to build guard rails to just enable developers to move way quicker and way safer at the same time. Uh

thank you. That was crossplane uh real or guide.