Crossplane XRD Generator

Both tools provision cloud infrastructure, but their control model differs fundamentally. Terraform uses a push-based model: you run terraform apply and it makes API calls, then stores state in a file or backend. Crossplane runs inside Kubernetes as a controller that continuously reconciles desired state with actual cloud state — it's pull-based and self-healing. Crossplane models infrastructure as Kubernetes custom resources (CRs), enabling GitOps workflows with kubectl and Argo/Flux. Terraform is better for standalone pipelines; Crossplane is better when you want platform engineering inside a Kubernetes control plane where app teams consume infrastructure via CRs without needing cloud credentials.

A CRD (CustomResourceDefinition) is a standard Kubernetes primitive that registers a new API type in your cluster. An XRD (CompositeResourceDefinition) is a Crossplane-specific higher-level abstraction built on top of CRDs. When you apply an XRD, Crossplane automatically generates and manages the underlying CRD for you. XRDs also define Claim types, connection secret keys, and link to Compositions — none of which are CRD concepts. Think of XRDs as CRDs with built-in platform engineering features: they enforce schema, enable namespace-scoped Claims, and declare what outputs (connection secrets) composite resources produce.

A Composition is the implementation blueprint for a composite resource defined by an XRD. The XRD defines the API shape (what fields users can set), while the Composition defines what managed resources get created and how XRD fields map to those resources using patch-and-transform rules. One XRD can have multiple Compositions — for example, an XDatabase XRD might have an AWS Composition (creates RDS), a GCP Composition (creates Cloud SQL), and an Azure Composition (creates Azure SQL). Platform teams write Compositions; app developers consume the XRD without needing to know which cloud resource is behind it.

A Claim is a namespace-scoped request for a composite resource. Composite resources (XRs) are cluster-scoped, which means only cluster admins can create them. Claims let namespace-level users (application teams) request composite resources without cluster-admin access. Crossplane maps each Claim to exactly one XR. Use Claims when you want to give application teams self-service infrastructure provisioning within their own namespace, with the platform team controlling what they can provision via RBAC on the Claim type. If all your users are cluster admins or you don't need namespace isolation, you can skip Claims and use XRs directly.

Crossplane providers are Kubernetes controllers packaged as OCI images that know how to manage a specific set of external resources. For example, provider-aws can manage EC2 instances, RDS databases, S3 buckets, and hundreds of other AWS resources — each as a Kubernetes custom resource. Providers authenticate to cloud APIs using a ProviderConfig resource that references a Kubernetes secret containing credentials (IAM keys, service account JSON, etc.). Once a provider is installed and configured, you can create managed resources like aws.RDS or gcp.CloudSQL, and the provider's controller continuously reconciles them with the real cloud state. The Upbound Marketplace hosts official and community providers for AWS, GCP, Azure, Helm, Terraform, and more.

A Crossplane control plane is a Kubernetes cluster (or a managed Upbound Space) running Crossplane with providers installed, acting as the single source of truth for your infrastructure. Instead of multiple teams running separate Terraform pipelines, a control plane centralizes cloud resource management with Kubernetes-native RBAC, audit logging via kube-apiserver, and continuous reconciliation. You build one when you want to offer a self-service developer platform: app teams submit Claim resources to request databases, queues, or caches, and the control plane provisions and manages them automatically. Upbound's hosted Spaces product lets you run managed Crossplane control planes without operating your own cluster.