Crossplane in 2026: Why Kubernetes Teams Are Ditching Terraform

1# This is a Kubernetes manifest, not a Terraform file
2apiVersion: s3.aws.upbound.io/v1beta1
3kind: Bucket
4metadata:
5  name: my-application-data
6  namespace: team-backend
7spec:
8  forProvider:
9    region: ap-southeast-2
10    versioning:
11      enabled: true
12    serverSideEncryptionConfiguration:
13      - rule:
14          applyServerSideEncryptionByDefault:
15            sseAlgorithm: AES256

1# One composite resource provisions everything
2apiVersion: platform.buun.io/v1alpha1
3kind: Application
4metadata:
5  name: customer-api
6  namespace: production
7spec:
8  database:
9    engine: postgresql
10    size: large
11  replicas: 3
12  monitoring: enabled

1# Team-scoped database - only team-backend can see/modify
2apiVersion: rds.aws.upbound.io/v1beta1
3kind: Instance
4metadata:
5  name: orders-db
6  namespace: team-backend  # Scoped to team
7spec:
8  forProvider:
9    instanceClass: db.t3.medium
10    engine: postgres

1apiVersion: apiextensions.crossplane.io/v1
2kind: Composition
3metadata:
4  name: application-with-logic
5spec:
6  compositeTypeRef:
7    apiVersion: platform.buun.io/v1alpha1
8    kind: Application
9  mode: Pipeline
10  pipeline:
11    - step: compute-resources
12      functionRef:
13        name: function-go-templating
14      input:
15        apiVersion: gotemplating.fn.crossplane.io/v1beta1
16        kind: GoTemplate
17        source: Inline
18        inline:
19          template: |
20            {{- $replicas := .observed.composite.resource.spec.replicas }}
21            {{- $size := .observed.composite.resource.spec.database.size }}
22            {{- $cpu := "500m" }}
23            {{- $memory := "1Gi" }}
24            {{- if eq $size "large" }}
25              {{- $cpu = "2000m" }}
26              {{- $memory = "4Gi" }}
27            {{- end }}
28            # Dynamic resource computation based on inputs

1# You must configure and manage state
2terraform {
3  backend "s3" {
4    bucket         = "my-terraform-state"
5    key            = "prod/terraform.tfstate"
6    region         = "ap-southeast-2"
7    encrypt        = true
8    dynamodb_table = "terraform-locks"  # Locking required!
9  }
10}

1# State is just Kubernetes resources - no configuration needed
2# Kubernetes etcd handles everything:
3# - Storage
4# - Locking (via resource versions)
5# - Backup (your cluster backup strategy)
6# - High availability

1# argocd-application.yaml
2apiVersion: argoproj.io/v1alpha1
3kind: Application
4metadata:
5  name: aws-infrastructure
6  namespace: argocd
7spec:
8  project: default
9  source:
10    repoURL: https://github.com/buun-group/infrastructure
11    path: crossplane/production
12    targetRevision: main
13  destination:
14    server: https://kubernetes.default.svc
15  syncPolicy:
16    automated:
17      prune: true
18      selfHeal: true

1# Developer applies this - no cloud console access needed
2apiVersion: database.platform.io/v1alpha1
3kind: PostgreSQL
4metadata:
5  name: orders-db
6  namespace: team-payments
7spec:
8  size: medium      # Abstracts away instance types
9  version: "15"
10  backup: daily
11  # Platform team's composition handles:
12  # - Actual RDS configuration
13  # - Security groups
14  # - Parameter groups
15  # - Monitoring
16  # - Backup schedules

1# XRD defines what developers can configure
2apiVersion: apiextensions.crossplane.io/v1
3kind: CompositeResourceDefinition
4metadata:
5  name: xdatabases.platform.buun.io
6spec:
7  group: platform.buun.io
8  names:
9    kind: XDatabase
10    plural: xdatabases
11  versions:
12    - name: v1alpha1
13      schema:
14        openAPIV3Schema:
15          type: object
16          properties:
17            spec:
18              type: object
19              required: ["size", "engine"]
20              properties:
21                size:
22                  type: string
23                  enum: ["small", "medium", "large"]  # Limited options
24                engine:
25                  type: string
26                  enum: ["postgresql", "mysql"]  # Approved engines only
27                # Note: No direct instance type selection
28                # No VPC configuration
29                # No security group access
30                # Platform team controls these in Composition

1# Developer API is cloud-agnostic
2apiVersion: storage.platform.io/v1alpha1
3kind: ObjectStorage
4metadata:
5  name: app-assets
6spec:
7  region: australia
8  versioning: true
9
10# Platform team maintains multiple compositions:
11# - composition-objectstorage-aws.yaml  → S3
12# - composition-objectstorage-azure.yaml → Blob Storage
13# - composition-objectstorage-gcp.yaml  → Cloud Storage

1# Install Crossplane
2helm repo add crossplane-stable https://charts.crossplane.io/stable
3helm install crossplane crossplane-stable/crossplane \
4  --namespace crossplane-system \
5  --create-namespace
6
7# Install AWS Provider
8cat <<EOF | kubectl apply -f -
9apiVersion: pkg.crossplane.io/v1
10kind: Provider
11metadata:
12  name: provider-aws-s3
13spec:
14  package: xpkg.upbound.io/upbound/provider-aws-s3:v1.0.0
15EOF

1# Use IRSA (IAM Roles for Service Accounts) - no long-lived creds
2apiVersion: aws.upbound.io/v1beta1
3kind: ProviderConfig
4metadata:
5  name: default
6spec:
7  credentials:
8    source: IRSA

1# Create an S3 bucket
2apiVersion: s3.aws.upbound.io/v1beta1
3kind: Bucket
4metadata:
5  name: my-crossplane-bucket
6spec:
7  forProvider:
8    region: ap-southeast-2
9    tags:
10      ManagedBy: Crossplane
11      Environment: development

1# Check resource status
2kubectl get bucket my-crossplane-bucket
3
4# NAME                    READY   SYNCED   AGE
5# my-crossplane-bucket    True    True     2m
6
7# Describe for details
8kubectl describe bucket my-crossplane-bucket

1# Import existing AWS resources
2crossplane beta import \
3  --provider provider-aws-s3 \
4  --resource Bucket \
5  --name existing-bucket-name
6
7# Generates Crossplane manifests for existing infrastructure