In Episode 4, we built an API (XRD) but it didn’t actually create any AWS infrastructure. In this final fundamental episode, we write a Composition. This is the ’translation engine’ that instructs Crossplane exactly which physical Managed Resources to create when a developer requests our custom API.
Managed Resources (MRs) are too low-level for application developers. In this episode, we learn how to define a Composite Resource Definition (XRD). This allows Platform Engineers to design a brand new, highly abstracted Custom Kubernetes API tailored exactly to their company’s needs.
A Managed Resource (MR) is the foundational building block of Crossplane. It is a 1-to-1 representation of a physical cloud object (like an S3 Bucket or an RDS Instance) stored as a Custom Resource in Kubernetes. In this episode, we provision our first AWS resource directly via kubectl.
Crossplane is useless on its own. To orchestrate AWS, Azure, or GCP, we must install Providers. In this episode, we install the official Upbound AWS Provider, configure Kubernetes Secrets to store our IAM credentials, and bind them to a ProviderConfig.
To understand Crossplane, you must first understand the Kubernetes Control Loop. In this episode, we explore the theoretical difference between CLI-driven IaC (Terraform) and Control Plane IaC (Crossplane). We will then install Crossplane into a local cluster using Helm.
In Episode 7, we built a reusable TypeScript ComponentResource. But what if the Data Science team wants to use your component in their Python IaC? Historically, they couldn’t. Pulumi Multi-Language Components (MLC) solves this by using gRPC to project your TypeScript code across all supported languages.
In Terraform, enforcing security rules requires external tools like OPA (Open Policy Agent) and Rego. Pulumi provides a native Policy-as-Code engine called CrossGuard. In this episode, we will write TypeScript policies that act as a strict firewall, preventing developers from provisioning insecure infrastructure.
Testing infrastructure usually means deploying it to a sandbox, waiting 15 minutes, running a bash script to ping an IP, and tearing it down. Because Pulumi is TypeScript, we can use the industry-standard Jest testing framework to write offline, millisecond unit tests to validate our infrastructure logic before we ever touch the cloud.
What happens when you need to provision a resource in a system that doesn’t have an official Pulumi plugin? In Terraform, you must write complex Go code, compile a binary, and distribute it. In Pulumi, you can author a Dynamic Provider directly in your index.ts file using pure TypeScript.
Running pulumi up from a CLI is great for Platform Engineers, but what if you want to build a self-service Internal Developer Portal (IDP) where developers click a button on a web page to provision a database? The Pulumi Automation API allows you to embed the entire Pulumi Engine inside your own Node.js, Python, or Go applications.
