diff --git a/content/master/getting-started/install-crossplane-include.md b/content/master/getting-started/install-crossplane-include.md new file mode 100644 index 000000000..aa315962c --- /dev/null +++ b/content/master/getting-started/install-crossplane-include.md @@ -0,0 +1,1198 @@ +--- +tocHidden: true +--- + +## Install Crossplane + +Crossplane installs into an existing Kubernetes cluster. + +{{< hint type="tip" >}} +If you don't have a Kubernetes cluster create one locally with [Kind](https://kind.sigs.k8s.io/). +{{< /hint >}} + + +### Install the Crossplane Helm chart + +Helm enables Crossplane to install all its Kubernetes components through a _Helm Chart_. + +Enable the Crossplane Helm Chart repository: + +```shell +helm repo add \ +crossplane-stable https://charts.crossplane.io/stable +helm repo update +``` + +Run the Helm dry-run to see all the Crossplane components Helm installs. + +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--dry-run --debug \ +--namespace crossplane-system \ +--create-namespace +``` +{{}} +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--dry-run --debug \ +--namespace crossplane-system \ +--create-namespace +install.go:200: [debug] Original chart version: "" +install.go:217: [debug] CHART PATH: /home/vagrant/.cache/helm/repository/crossplane-1.13.0.tgz + +NAME: crossplane +LAST DEPLOYED: Fri Jul 28 13:57:41 2023 +NAMESPACE: crossplane-system +STATUS: pending-install +REVISION: 1 +TEST SUITE: None +USER-SUPPLIED VALUES: +{} + +COMPUTED VALUES: +affinity: {} +args: [] +configuration: + packages: [] +customAnnotations: {} +customLabels: {} +deploymentStrategy: RollingUpdate +extraEnvVarsCrossplane: {} +extraEnvVarsRBACManager: {} +extraVolumeMountsCrossplane: {} +extraVolumesCrossplane: {} +hostNetwork: false +image: + pullPolicy: IfNotPresent + repository: crossplane/crossplane + tag: "" +imagePullSecrets: {} +leaderElection: true +metrics: + enabled: false +nodeSelector: {} +packageCache: + configMap: "" + medium: "" + pvc: "" + sizeLimit: 20Mi +podSecurityContextCrossplane: {} +podSecurityContextRBACManager: {} +priorityClassName: "" +provider: + packages: [] +rbacManager: + affinity: {} + args: [] + deploy: true + leaderElection: true + managementPolicy: Basic + nodeSelector: {} + replicas: 1 + skipAggregatedClusterRoles: false + tolerations: [] +registryCaBundleConfig: + key: "" + name: "" +replicas: 1 +resourcesCrossplane: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi +resourcesRBACManager: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi +securityContextCrossplane: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 +securityContextRBACManager: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 +serviceAccount: + customAnnotations: {} +tolerations: [] +webhooks: + enabled: true +xfn: + args: [] + cache: + configMap: "" + medium: "" + pvc: "" + sizeLimit: 1Gi + enabled: false + extraEnvVars: {} + image: + pullPolicy: IfNotPresent + repository: crossplane/xfn + tag: "" + resources: + limits: + cpu: 2000m + memory: 2Gi + requests: + cpu: 1000m + memory: 1Gi + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - SETUID + - SETGID + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + seccompProfile: + type: Unconfined + +HOOKS: +MANIFEST: +--- +# Source: crossplane/templates/rbac-manager-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rbac-manager + namespace: crossplane-system + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +--- +# Source: crossplane/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: crossplane + namespace: crossplane-system + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +--- +# Source: crossplane/templates/secret.yaml +# The reason this is created empty and filled by the init container is that it's +# mounted by the actual container, so if it wasn't created by Helm, then the +# deployment wouldn't be deployed at all with secret to mount not found error. +# In addition, Helm would delete this secret after uninstallation so the new +# installation of Crossplane would use its own certificate. +apiVersion: v1 +kind: Secret +metadata: + name: webhook-tls-secret + namespace: crossplane-system +type: Opaque +--- +# Source: crossplane/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-crossplane: "true" +--- +# Source: crossplane/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:system:aggregate-to-crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + crossplane.io/scope: "system" + rbac.crossplane.io/aggregate-to-crossplane: "true" +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - "*" +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - serviceaccounts + - services + verbs: + - "*" +- apiGroups: + - apiextensions.crossplane.io + - pkg.crossplane.io + - secrets.crossplane.io + resources: + - "*" + verbs: + - "*" +- apiGroups: + - extensions + - apps + resources: + - deployments + verbs: + - get + - list + - create + - update + - patch + - delete + - watch +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +--- +# Source: crossplane/templates/rbac-manager-allowed-provider-permissions.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:allowed-provider-permissions + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" +--- +# Source: crossplane/templates/rbac-manager-clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-rbac-manager + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC roles for each namespace it sees. +# These RBAC roles are controlled (in the owner reference sense) by the namespace. +# The RBAC manager needs permission to set finalizers on Namespaces in order to +# create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - "" + resources: + - namespaces/finalizers + verbs: + - update +- apiGroups: + - apiextensions.crossplane.io + resources: + - compositeresourcedefinitions + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC cluster roles for each XRD it sees. +# These cluster roles are controlled (in the owner reference sense) by the XRD. +# The RBAC manager needs permission to set finalizers on XRDs in order to +# create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - apiextensions.crossplane.io + resources: + - compositeresourcedefinitions/finalizers + verbs: + - update +- apiGroups: + - pkg.crossplane.io + resources: + - providerrevisions + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC cluster roles for each ProviderRevision +# it sees. These cluster roles are controlled (in the owner reference sense) by the +# ProviderRevision. The RBAC manager needs permission to set finalizers on +# ProviderRevisions in order to create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - pkg.crossplane.io + resources: + - providerrevisions/finalizers + verbs: + - update +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - roles + verbs: + - get + - list + - watch + - create + - update + - patch + # The RBAC manager may grant access it does not have. + - escalate +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - "*" +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-admin + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-admin: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-edit + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-edit: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-view + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-view: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-browse + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-browse: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-admin + labels: + rbac.crossplane.io/aggregate-to-admin: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane administrators have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane administrators must create provider credential secrets, and may +# need to read or otherwise interact with connection secrets. They may also need +# to create or annotate namespaces. +- apiGroups: [""] + resources: [secrets, namespaces] + verbs: ["*"] +# Crossplane administrators have access to view the roles that they may be able +# to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterroles, roles] + verbs: [get, list, watch] +# Crossplane administrators have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterrolebindings, rolebindings] + verbs: ["*"] +# Crossplane administrators have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +# Crossplane administrators have access to view CRDs in order to debug XRDs. +- apiGroups: [apiextensions.k8s.io] + resources: [customresourcedefinitions] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-edit + labels: + rbac.crossplane.io/aggregate-to-edit: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane editors must create provider credential secrets, and may need to +# read or otherwise interact with connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane editors may see which namespaces exist, but not edit them. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane editors have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-view + labels: + rbac.crossplane.io/aggregate-to-view: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane viewers may see which namespaces exist. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane viewers have read-only access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-browse + labels: + rbac.crossplane.io/aggregate-to-browse: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane browsers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane browsers have read-only access to compositions and XRDs. This +# allows them to discover and select an appropriate composition when creating a +# resource claim. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +# The below ClusterRoles are aggregated to the namespaced RBAC roles created by +# the Crossplane RBAC manager when it is running in --manage=All mode. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-admin + labels: + rbac.crossplane.io/aggregate-to-ns-admin: "true" + rbac.crossplane.io/base-of-ns-admin: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace admins have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace admins may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane namespace admins have access to view the roles that they may be +# able to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [roles] + verbs: [get, list, watch] +# Crossplane namespace admins have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [rolebindings] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-edit + labels: + rbac.crossplane.io/aggregate-to-ns-edit: "true" + rbac.crossplane.io/base-of-ns-edit: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace editors may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-view + labels: + rbac.crossplane.io/aggregate-to-ns-view: "true" + rbac.crossplane.io/base-of-ns-view: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane +subjects: +- kind: ServiceAccount + name: crossplane + namespace: crossplane-system +--- +# Source: crossplane/templates/rbac-manager-clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane-rbac-manager + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-rbac-manager +subjects: +- kind: ServiceAccount + name: rbac-manager + namespace: crossplane-system +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane-admin + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: crossplane:masters +--- +# Source: crossplane/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: crossplane-webhooks + namespace: crossplane-system + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + selector: + app: crossplane + release: crossplane + ports: + - protocol: TCP + port: 9443 + targetPort: 9443 +--- +# Source: crossplane/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: crossplane + namespace: crossplane-system + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + replicas: 1 + selector: + matchLabels: + app: crossplane + release: crossplane + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + spec: + securityContext: + {} + serviceAccountName: crossplane + hostNetwork: false + initContainers: + - image: "crossplane/crossplane:v1.13.0" + args: + - core + - init + imagePullPolicy: IfNotPresent + name: crossplane-init + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.memory + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: "WEBHOOK_TLS_SECRET_NAME" + value: webhook-tls-secret + - name: "WEBHOOK_SERVICE_NAME" + value: crossplane-webhooks + - name: "WEBHOOK_SERVICE_NAMESPACE" + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: "WEBHOOK_SERVICE_PORT" + value: "9443" + containers: + - image: "crossplane/crossplane:v1.13.0" + args: + - core + - start + imagePullPolicy: IfNotPresent + name: crossplane + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + ports: + - name: webhooks + containerPort: 9443 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.memory + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: LEADER_ELECTION + value: "true" + - name: "WEBHOOK_TLS_SECRET_NAME" + value: webhook-tls-secret + - name: "WEBHOOK_TLS_CERT_DIR" + value: /webhook/tls + volumeMounts: + - mountPath: /cache + name: package-cache + - mountPath: /webhook/tls + name: webhook-tls-secret + volumes: + - name: package-cache + emptyDir: + medium: + sizeLimit: 20Mi + - name: webhook-tls-secret + secret: + # NOTE(muvaf): The tls.crt is used both by the server (requires it to + # be a single cert) and the caBundle fields of webhook configs and CRDs + # which can accept a whole bundle of certificates. In order to meet + # the requirements of both, we require a single certificate instead of + # a bundle. + # It's assumed that initializer generates this anyway, so it should be + # fine. + secretName: webhook-tls-secret +--- +# Source: crossplane/templates/rbac-manager-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: crossplane-rbac-manager + namespace: crossplane-system + labels: + app: crossplane-rbac-manager + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + replicas: 1 + selector: + matchLabels: + app: crossplane-rbac-manager + release: crossplane + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: crossplane-rbac-manager + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + spec: + securityContext: + {} + serviceAccountName: rbac-manager + initContainers: + - image: "crossplane/crossplane:v1.13.0" + args: + - rbac + - init + imagePullPolicy: IfNotPresent + name: crossplane-init + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.memory + containers: + - image: "crossplane/crossplane:v1.13.0" + args: + - rbac + - start + - --manage=Basic + - --provider-clusterrole=crossplane:allowed-provider-permissions + imagePullPolicy: IfNotPresent + name: crossplane + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.memory + - name: LEADER_ELECTION + value: "true" + +NOTES: +Release: crossplane + +Chart Name: crossplane +Chart Description: Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume. +Chart Version: 1.13.0 +Chart Application Version: 1.13.0 + +Kube Version: v1.27.4 +``` +{{< /expand >}} + +Install the Crossplane components using `helm install`. + +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--namespace crossplane-system \ +--create-namespace +``` + +Verify Crossplane installed with `kubectl get pods`. + +```shell {copy-lines="1"} +kubectl get pods -n crossplane-system +NAME READY STATUS RESTARTS AGE +crossplane-d4cd8d784-ldcgb 1/1 Running 0 54s +crossplane-rbac-manager-84769b574-6mw6f 1/1 Running 0 54s +``` + +Installing Crossplane creates new Kubernetes API end-points. +Look at the new API end-points with `kubectl api-resources | grep crossplane`. + +```shell {label="grep",copy-lines="1"} +kubectl api-resources | grep crossplane +compositeresourcedefinitions xrd,xrds apiextensions.crossplane.io/v1 false CompositeResourceDefinition +compositionrevisions comprev apiextensions.crossplane.io/v1 false CompositionRevision +compositions comp apiextensions.crossplane.io/v1 false Composition +environmentconfigs envcfg apiextensions.crossplane.io/v1alpha1 false EnvironmentConfig +configurationrevisions pkg.crossplane.io/v1 false ConfigurationRevision +configurations pkg.crossplane.io/v1 false Configuration +controllerconfigs pkg.crossplane.io/v1alpha1 false ControllerConfig +locks pkg.crossplane.io/v1beta1 false Lock +providerrevisions pkg.crossplane.io/v1 false ProviderRevision +providers pkg.crossplane.io/v1 false Provider +storeconfigs secrets.crossplane.io/v1alpha1 false StoreConfig +``` \ No newline at end of file diff --git a/content/master/getting-started/provider-aws-part-2.md b/content/master/getting-started/provider-aws-part-2.md index e604ba6da..3e069f37a 100644 --- a/content/master/getting-started/provider-aws-part-2.md +++ b/content/master/getting-started/provider-aws-part-2.md @@ -2,28 +2,25 @@ title: AWS Quickstart Part 2 weight: 120 tocHidden: true +aliases: + - /master/getting-started/provider-aws-part-3 --- {{< hint "important" >}} -This guide is part 2 of a series. Follow [**part 1**]({{}})** -to install Crossplane and connect your Kubernetes cluster to AWS. +This guide is part 2 of a series. + +[**Part 1**]({{}}) covers +to installing Crossplane and connect your Kubernetes cluster to AWS. -[**Part 3**]({{}})** covers patching _composite resources_ -and using Crossplane _packages_. {{< /hint >}} - -This section creates a _[Composition](#create-a-composition)_, -_[Composite Resource Definition](#define-a-composite-resource)_ and a -_[Claim](#create-a-claim)_ -to create a custom Kubernetes API to create AWS resources. - +This guide walks you through building and accessing a custom API with Crossplane. ## Prerequisites * Complete [quickstart part 1]({{}}) connecting Kubernetes to AWS. * an AWS account with permissions to create an AWS S3 storage bucket and a -DynamoDB instance + DynamoDB instance {{}} 1. Add the Crossplane Helm repository and install Crossplane @@ -45,9 +42,9 @@ cat <}} -## Create a composition -[Part 1]({{}}) created a single _managed resource_. -A _Composition_ is a template to create multiple _managed resources_ at the same time. - -This sample _composition_ creates an DynamoDB instance and associated S3 storage -bucket. - -{{< hint "note" >}} -This example comes from the AWS recommendation for -[storing large DynamoDB attributes in S3](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-use-s3-too.html#bp-use-s3-too-large-values). -{{< /hint >}} - -To create a _composition_, first define each individual managed resource. - -### Create an S3 bucket object -Define a `bucket` resource using the configuration from the previous section: - -```yaml -apiVersion: s3.aws.upbound.io/v1beta1 -kind: Bucket -metadata: - name: crossplane-quickstart-bucket -spec: - forProvider: - region: "us-east-2" - providerConfigRef: - name: default -``` - -### Create a DynamoDB table resource -Next, define a DynamoDB `table` resource. - -{{< hint "tip" >}} -The [Upbound Marketplace](https://marketplace.upbound.io/) provides -[schema documentation](https://marketplace.upbound.io/providers/upbound/provider-aws/v0.27.0/resources/dynamodb.aws.upbound.io/Table/v1beta1) for a `Table` resource. -{{< /hint >}} - -The _AWS Provider_ defines the -{{}}apiVersion{{}} -and -{{}}kind{{}}. - -DynamoDB instances require a -{{}}region{{}}, -{{}}writeCapacity{{}} -and -{{}}readCapacity{{}} -parameters. - -The {{}}attribute{{}} section creates -the database "Partition key" and "Hash key." - -This example creates a single key named -{{}}S3ID{{}} of type -{{}}S{{}} for "string" -```yaml {label="dynamoMR"} -apiVersion: dynamodb.aws.upbound.io/v1beta1 -kind: Table -metadata: - name: crossplane-quickstart-database -spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID -``` - -{{< hint "note" >}} -DynamoDB specifics are beyond the scope of this guide. Read the -[DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html) -for more information. -{{}} - -### Create the composition object -The _composition_ combines the two resource definitions. +## Create a custom API -A -{{}}Composition{{}} comes from the -{{}}Crossplane{{}} -API resources. + +Crossplane allows you to build your own custom APIs for your users, abstracting +away details about the cloud provider and their resources. You can make your API +as complex or simple as you wish. + -Create any {{}}name{{}} for this _composition_. +The custom API is a Kubernetes object. +Here is an example custom API. -```yaml {label="compName"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition +```yaml {label="exAPI"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL metadata: - name: dynamoDBWithS3 -``` - -Add the resources to the -{{}}spec.resources{{}} -section of the _composition_. - -Give each resource a -{{}}name{{}} -and put the resource definition under the -{{}}base{{}} -key. - -```yaml {label="specResources"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamoDBWithS3 -spec: - resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - forProvider: - region: "us-east-2" - providerConfigRef: - name: default - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID + name: my-nosql-database +spec: + location: "US" ``` -Put the entire resource definition including the -{{}}apiVersion{{}} and resource -settings under the -{{}}base{{}}. - -_Compositions_ are only a template for generating resources. A _composite -resource_ actually creates the resources. - -A _composition_ defines what _composite resources_ can use this -template. +Like any Kubernetes object the API has a +{{}}version{{}}, +{{}}kind{{}} and +{{}}spec{{}}. -_Compositions_ do this with the -{{}}spec.compositeTypeRef{{}} -definition. - -```yaml {label="compRef"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamodb-with-bucket -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database - resources: - # Removed for Brevity -``` +### Define a group and version +To create your own API start by defining an +[API group](https://kubernetes.io/docs/reference/using-api/#api-groups) and +[version](https://kubernetes.io/docs/reference/using-api/#api-versioning). -A _composite resource_ is actually a custom Kubernetes API type you define. The -platform team controls the kind, API endpoint and version. +The _group_ can be any value, but common convention is to map to a fully +qualified domain name. - -With this {{}}spec.compositeTypeRef{{}} -Crossplane only allows _composite resources_ from the API group -{{}}custom-api.example.org{{}} -that are of -{{}}kind: database{{}} -to use this template to create resources. +The version shows how mature or stable the API is and increments when changing, +adding or removing fields in the API. -### Apply the composition -Apply the full _Composition_ to your Kubernetes cluster. - -```yaml -cat <}}database.example.com{{}}. -A _composite resource_ is a custom API defined by the platform teams. -A _composite resource definition_ defines the schema for a _composite resource_. +Since this is the first version of the API, this guide uses the version +{{}}v1alpha1{{}}. - -A _composite resource definition_ installs the custom API type into Kubernetes -and defines what `spec` keys and values are valid when calling this new custom API. - -Before creating a _composite resource_ Crossplane requires a _composite resource definition_. - -{{< hint "tip" >}} -_Composite resource definitions_ are also called `XRDs` for short. -{{< /hint >}} - -Just like a _composition_ the -{{}}composite resource definition{{}} -is part of the -{{}}Crossplane{{}} -API group. - -The _XRD_ {{}}name{{}} is the new -API endpoint. - -```yaml {label="xrdName"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org +```yaml {label="version",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 ``` -The _XRD's_ -{{}}spec{{}} defines the new custom -API. +### Define a kind -### Define the API endpoint and kind -First, define the new API -{{}}group{{}}. -Next, create the API {{}}kind{{}} and -{{}}plural{{}}. +The API group is a logical collection of related APIs. Within a group are +individual kinds representing different resources. -```yaml {label="xrdGroup"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org -spec: - group: custom-api.example.org - names: - kind: database - plural: databases -``` +For example a `database` group may have a `Relational` and `NoSQL` kinds. -{{}} -The _XRD_ {{}}group{{}} matches the _composition_ {{}}apiVersion{{}} and the -_XRD_ {{}}kind{{}} matches the _composition_ -{{}}kind{{}} under the {{}}compositeTypeRef{{}}. +The `kind` can be anything, but it must be +[UpperCamelCased](https://kubernetes.io/docs/contribute/style/style-guide/#use-upper-camel-case-for-api-objects). -```yaml {label="noteComp"} -kind: Composition -# Removed for brevity -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database -``` -{{< /hint >}} - -### Set the API version -In Kubernetes, all API endpoints have a version to tell the stability of the API -and track revisions. - -Apply a version to the _XRD_ with a -{{}}versions.name{{}}. -This matches the {{}}apiVersion{{}} used in the _composition's_ -{{}}compositeTypeRef{{}}. +This API's kind is +{{}}NoSQL{{}} -_XRDs_ require both -{{}}versions.served{{}} -and -{{}}versions.referenceable{{}}. - -```yaml {label="xrdVersion"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: custom-api-definition -spec: - group: custom-api.example.org - names: - kind: database - plural: databases - versions: - - name: v1alpha1 - served: true - referenceable: true +```yaml {label="kind",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL ``` -{{}} -For more information on defining versions in Kubernetes read the -[API versioning](https://kubernetes.io/docs/reference/using-api/#api-versioning) section of the Kubernetes documentation. -{{< /hint >}} - -### Create the API schema -With an API endpoint named, now define the API schema, or what's allowed -inside the `spec` of the new Kubernetes object. +### Define a spec -{{< hint "note" >}} -_XRDs_ follow the Kubernetes -[_custom resource definition_ rules for schemas](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema). -{{}} +The most important part of an API is the schema. The schema defines the inputs +accepted from users. -Place the API -{{< hover label="xrdSchema" line="8" >}}schema{{}} -under the -{{< hover label="xrdSchema" line="7" >}}version.name{{}} +This API allows users to provide a +{{}}location{{}} of where to run their +cloud resources. -The _XRD_ type defines the next lines. They're always the same. +All other resource settings can't be configurable by the users. This allows +Crossplane to enforce any policies and standards without worrying about +user errors. - - -{{< hover label="xrdSchema" line="9" >}}openAPIV3Schema{{}} specifies -how the schema gets validated. - - -Next, the entire API is an -{{< hover label="xrdSchema" line="10" >}}object{{}} -with a -{{< hover label="xrdSchema" line="11" >}}property{{}} of -{{< hover label="xrdSchema" line="12" >}}spec{{}}. - -The -{{< hover label="xrdSchema" line="12" >}}spec{{}} is also an -{{< hover label="xrdSchema" line="13" >}}object{{}} with -{{< hover label="xrdSchema" line="14" >}}properties{{}}. - -```yaml {label="xrdSchema"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - # Removed for brevity - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - type: object - properties: - spec: - type: object - properties: +```yaml {label="spec",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL +spec: + location: "US" ``` -{{< hint "tip" >}} -An _XRD_ is a Kubernetes _custom resource definition_. -For more information on the values allowed in the _XRD_ view the _XRD_ object with -`kubectl describe crd compositeresourcedefinitions` -{{< /hint >}} +### Apply the API -Now, define the custom API. Your custom API continues under the last -{{}}properties{{}} definition in the -previous example. - -This custom API has only one setting: - -* {{}}region{{}} - where to deploy -the resources, a choice of "EU" or "US" - - -Users can't change any other settings of the S3 bucket or DynamoDB instance. - -The{{}}region{{}} -is a {{}}string{{}} -and can match the regular expression that's -{{}}oneOf{{}} -{{}}EU{{}} -or -{{}}US{{}}. - -This API requires the setting -{{}}region{{}}. - - -```yaml {label="customAPI"} -# Removed for brevity -# schema.openAPIV3Schema.type.properties.spec -properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' -required: - - region -``` +Crossplane uses +{{}}Composite Resource Definitions{{}} +(also called an `XRD`) to install your custom API in +Kubernetes. -### Enable claims to the API -Allow a _claim_ to use this _XRD_ by defining the _claim_ API endpoint under the _XRD_ -{{}}spec{{< /hover >}}. +The XRD {{}}spec{{}} contains all the +information about the API including the +{{}}group{{}}, +{{}}version{{}}, +{{}}kind{{}} and +{{}}schema{{}}. -```yaml {label="XRDclaim"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: -# Removed for brevity - claimNames: - kind: customDatabase - plural: customDatabases -``` +The XRD's {{}}name{{}} must be the +combination of the {{}}plural{{}} and +{{}}group{{}}. -{{}} -The [Claims](#create-a-claim) section later in this guide discusses _claims_. -{{< /hint >}} +The {{}}schema{{}} uses the +{{}}OpenAPIv3{{}} specification to define +the API {{}}spec{{}}. -### Apply the composite resource definition -Apply the complete _XRD_ to your Kubernetes cluster. +The API defines a {{}}location{{}} that +must be {{}}oneOf{{}} either +{{}}EU{{}} or +{{}}US{{}}. +Apply this XRD to create the custom API in your Kubernetes cluster. -```yaml +```yaml {label="xrd",copy-lines="all"} cat <}}claimNames{{}} allows users +to access this API either at the cluster level with the +{{}}nosql{{}} endpoint or in a namespace +with the +{{}}nosqlclaim{{}} endpoint. -```shell {copy-lines="1",label="getXRD"} -kubectl get xrd -NAME ESTABLISHED OFFERED AGE -databases.custom-api.example.org True True 9s -``` +The namespace scoped API is a Crossplane _Claim_. +{{}} +For more details on the fields and options of Composite Resource Definitions +read the +[XRD documentation]({{}}). +{{< /hint >}} -## Create a composite resource -Creating an _XRD_ allows the creation _composite resources_. - -_Composite resources_ are a convenient way to create multiple resources with a standard template. +View the installed XRD with `kubectl get xrd`. -A _composite resource_ uses the custom API created in the _XRD_. +```shell {copy-lines="1"} +kubectl get xrd +NAME ESTABLISHED OFFERED AGE +nosqls.database.example.com True True 2s +``` -Looking at part of the _XRD_: +View the new custom API endpoints with `kubectl api-resources | grep nosql` -```yaml {label="xrdSnip"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - group: custom-api.example.org - names: - kind: database -# Removed for brevity - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' +```shell {copy-lines="1",label="apiRes"} +kubectl api-resources | grep nosql +nosqlclaim database.example.com/v1alpha1 true NoSQLClaim +nosqls database.example.com/v1alpha1 false NoSQL ``` -The _XRD_ {{}}group{{}} -becomes the _composite resource_ -{{}}apiVersion{{}}. +## Create a deployment template -The _XRD_ {{}}kind{{}} -is the _composite resource_ -{{}}kind{{}} +When users access the custom API Crossplane takes their inputs and combines them +with a template describing what infrastructure to deploy. Crossplane calls this +template a _Composition_. -The _XRD_ API {{}}spec{{}} defines the -_composite resource_ {{}}spec{{}}. +The {{}}Composition{{}} defines all the +cloud resources to deploy. +Each entry in the template +is a full resource definitions, defining all the resource settings and metadata +like labels and annotations. -The _XRD_ {{}}properties{{}} section -defines the options for the _composite resource_ -{{}}spec{{}}. +This template creates an AWS +{{}}S3{{}} +{{}}Bucket{{}} and a +{{}}DynamoDB{{}} +{{}}Table{{}}. -The one option is {{}}region{{}} and it -can be either {{}}EU{{}} or -{{}}US{{}}. +Crossplane uses {{}}patches{{}} to apply +the user's input to the resource template. +This Composition takes the user's +{{}}location{{}} input and uses it as the +{{}}region{{}} used in the individual +resource. -This _composite resource_ uses -{{}}region: US{{}}. - -### Apply the composite resource +Apply this Composition to your cluster. -Apply the composite resource to the Kubernetes cluster. - -```yaml {label="xr"} +```yaml {label="comp",copy-lines="all"} cat <}}compositeTypeRef{{}} defines +which custom APIs can use this template to create resources. -```shell {copy-lines="1"} -kubectl get composite -NAME SYNCED READY COMPOSITION AGE -my-composite-resource True True dynamo-with-bucket 31s -``` +{{}} +Read the [Composition documentation]({{}}) for +more information on configuring Compositions and all the available options. -The output mentions the _composite_ template that the _composite resource_ used. +Read the +[Patch and Transform documentation]({{}}) +for more information on how Crossplane uses patches to map user inputs to +Composition resource templates. +{{< /hint >}} -Now look at the S3 `bucket` and DynmoDB `table` _managed resources_ with -`kubectl get bucket` and `kubectl get table`. +View the Composition with `kubectl get composition` ```shell {copy-lines="1"} -kubectl get bucket -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-8b6tx True True my-composite-resource-8b6tx 56s +kubectl get composition +NAME XR-KIND XR-APIVERSION AGE +dynamo-with-bucket NoSQL database.example.com/v1alpha1 3s ``` -```shell {copy-lines="1"} -kubectl get table -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-m6vk6 True True my-composite-resource-m6vk6 59s +## Install the DynamoDB Provider + +Part 1 only installed the AWS S3 Provider. Deploying a DynamoDB Table requires +the DynamoDB Provider as well. + +Add the new Provider to the cluster. + +```yaml +cat <}}NoSQL{{}} object to create the +cloud resources. + +```yaml {copy-lines="all",label="xr"} cat <}} -There may a delay in deleting the _managed resources_. Crossplane is making API -calls to AWS and waits for AWS to confirm they deleted the resources before -updating the state in Kubernetes. -{{}} - -Now only one bucket and table exist. +Delete the resources with `kubectl delete nosql`. ```shell {copy-lines="1"} -kubectl get bucket -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-8b6tx True True my-composite-resource-8b6tx 7m34s +kubectl delete nosql my-nosql-database +nosql.database.example.com "my-nosql-database" deleted ``` -```shell {copy-lines="1"} -kubectl get table -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-m6vk6 True True my-composite-resource-m6vk6 7m37s -``` +Verify Crossplane deleted the resources with `kubectl get managed` -Delete the second _composite resource_ to remove the last `bucket` and `table` -_managed resources_. +{{}} +It may take up to 5 minutes to delete the resources. +{{< /hint >}} -```shell -kubectl delete composite my-composite-resource +```shell {copy-lines="1"} +kubectl get managed +No resources found ``` -_Composite resources_ are great for creating multiple related resources against -a template, but all _composite resources_ exist at the Kubernetes "cluster -level." There's no isolation between _composite resources_. Crossplane uses -_claims_ to create resources with namespace isolation. +## Using the API with namespaces -## Create a claim +Accessing the API `nosql` happens at the cluster scope. +Most organizations +isolate their users into namespaces. -_Claims_, just like _composite resources_ use the custom API defined in the -_XRD_. Unlike a _composite resource_, Crossplane can create _claims_ in a -namespace. +A Crossplane _Claim_ is the custom API within a namespace. -### Create a new Kubernetes namespace -Create a new namespace with `kubectl create namespace`. - -```shell -kubectl create namespace test -``` +Creating a _Claim_ is just like accessing the custom API endpoint, but with the +{{}}kind{{}} +from the custom API's `claimNames`. -A _claim_ uses the same {{}}group{{}} -a _composite resource_ uses but a different -{{}}kind{{}}. +Create a new namespace to test create a Claim in. -```yaml {label="XRDclaim2"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: -# Removed for brevity - group: custom-api.example.org - claimNames: - kind: custom-database - plural: custom-databases +```shell +kubectl create namespace crossplane-test ``` -Like the _composite resource_, create a new object with the -{{}}custom-api.example.org{{}} API -endpoint. - -The _XRD_ -{{}}ClaimNames.kind{{}} defines the -{{}}kind{{}}. - -The {{}}spec{{}} uses the same -API options as the _composite resource_. +Then create a Claim in the `crossplane-test` namespace. -### Apply the claim -Apply the _claim_ to your Kubernetes cluster. - -```yaml {label="claim"} +```yaml {label="claim",copy-lines="all"} cat <}} +It may take up to 5 minutes to delete the resources. +{{< /hint >}} -### Delete the claims -Removing the _claims_ removes the _composite resources_ and the associated -_managed resources_. +Verify Crossplane deleted the composite resource with `kubectl get composite`. -```shell -kubectl delete claim claimed-database -n test -kubectl delete claim claimed-database -n test2 +```shell {copy-lines="1"} +kubectl get composite +No resources found ``` -Verify Crossplane removed all the _managed resources_. +Verify Crossplane deleted the managed resources with `kubectl get managed`. -```shell -kubectl get bucket -kubectl get table -``` - -Claims are powerful tools to give users resources in their own isolated -namespace. But these examples haven't shown how the custom API can change -the settings defined in the _composition_. This _composition patching_ applies -the API settings when creating resources. -[Part 3]({{< ref "provider-aws-part-3">}}) of this guide covers _composition -patches_ and making all this configuration portable in Crossplane _packages_. - -## Next steps -* [**Continue to part 3**]({{< ref "provider-aws-part-3">}}) to create a learn - about _patching_ resources and creating Crossplane _packages_. -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. \ No newline at end of file +```shell {copy-lines="1"} +kubectl get managed +No resources found +``` \ No newline at end of file diff --git a/content/master/getting-started/provider-aws-part-3.md b/content/master/getting-started/provider-aws-part-3.md deleted file mode 100644 index 47f14649b..000000000 --- a/content/master/getting-started/provider-aws-part-3.md +++ /dev/null @@ -1,652 +0,0 @@ ---- -title: AWS Quickstart Part 3 -weight: 120 -tocHidden: true ---- - -{{< hint "important" >}} -This guide is part 3 of a series. - -Follow [**part 1**]({{}}) -to install Crossplane and connect your Kubernetes cluster to AWS. - -Follow [**part 2**]({{}}) to create a _composition_, -_custom resource definition_ and a _claim_. -{{< /hint >}} - -[Part 2]({{}}) created a _composite resource -definition_ to define the schema of the custom API. Users create a _claim_ to -use the custom API and apply their options. Part 2 didn't show how the options -set in a _claim_ change or get applied the associated _composite resources_. - -## Prerequisites -* Complete quickstart [part 1]({{}}) and - [Part 2]({{}}) to install Crossplane and the quickstart - configurations. - -{{}} -1. Add the Crossplane Helm repository and install Crossplane -```shell -helm repo add \ -crossplane-stable https://charts.crossplane.io/stable -helm repo update - -helm install crossplane \ -crossplane-stable/crossplane \ ---namespace crossplane-system \ ---create-namespace -``` - -2. When the Crossplane pods finish installing and are ready, apply the AWS Provider - -```yaml {label="provider",copy-lines="all"} -cat < -aws_secret_access_key = -``` - -4. Create a Kubernetes secret from the AWS keys -```shell {label="kube-create-secret",copy-lines="all"} -kubectl create secret \ -generic aws-secret \ --n crossplane-system \ ---from-file=creds=./aws-credentials.txt -``` - -5. Create a _ProviderConfig_ -```yaml {label="providerconfig",copy-lines="all"} -cat <}} - -## Enable composition patches -In a _composition_ `patches` map fields in the custom API to fields inside the -_managed resources_. - -The _composition_ has two _managed resources_, a -{{}}bucket{{}} and a -{{}}table{{}}. - -```yaml {label="compResources"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -# Removed for Brevity -resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - forProvider: - region: "us-east-2" - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID -``` - -The custom API defined a single option, -{{}}region{{}}. A -{{}}region{{}} can be either -{{}}EU{{}} or -{{}}US{{}}. - - -```yaml {label="xrdSnip"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - group: custom-api.example.org - names: - kind: database -# Removed for brevity - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' -``` - -Creating a _composition_ `patch` allows Crossplane to update the settings of the -_composite resource_. Patches apply to the individual _managed resources_ -inside the _composition_. - -A {{}}patch{{}} has a -{{}}fromField{{}} and a -{{}}toField{{}} specifying which value -_from_ the custom API should apply _to_ the _managed resource_. -Patches can create a -{{}}transform{{}} to change the _from_ -field before it's applied. - -The transform -{{}}type{{}} is what kind of change to -make on the _from_ field. Types of changes could include appending a string, -preforming a math operation or mapping one value to another. - -Applying a {{}}patch{{}} to the -{{}}Bucket{{}} uses the custom API -{{}}region{{}} to use as the _managed resource_ -{{}}region{{}}. - - -The custom API value "EU" is -{{}}mapped{{}} to the value "eu-north-1" -and "US" is {{}}mapped{{}} to the value -"us-east-2." - - - -```yaml {label="patch"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -# Removed for Brevity -resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - spec: - forProvider: - region: "us-east-2" - patches: - - fromFieldPath: "region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-2" -``` - -Patching is a powerful tool enabling simpler or abstracted APIs. A developer -isn't required to know the specific AWS region identifier, only the abstracted -option of "EU" or "US." - - -### Apply the updated composition -Apply the same `patch` to the `Table` _managed resource_ and apply the updated -_composition_. - -```yaml -cat <}}region{{}} to "EU." - -```yaml {label="claim"} -cat < -Using {{}}region: "EU"{{}} patches the -_composite resource_, updating the AWS region from `us-east-2` to `eu-north-1`. -The developer creating the claim isn't required to know which specific AWS -region or the naming conventions. Using the abstract API options of "EU" or "US" -the developer places their resources in the desired location. - - -Deleting the claim removes the _managed resources_. - -{{}} -The _managed resources_ take up to 5 minutes to delete. -{{< /hint >}} - -```shell -kubectl delete claim claimed-eu-database -n test -``` - -## Create a Crossplane configuration package - -Crossplane _configuration packages_ allow users to combine their _custom -resource definition_ and _composition_ files into an OCI image. - -{{< hint "note" >}} -The [Open Container Initiative](https://opencontainers.org/faq/) -defines the OCI image standard. -An OCI images is a standard way to package data. -{{< /hint >}} - -You can host configuration packages in image registries like -[Docker Hub](https://hub.docker.com/) or the -[Upbound Marketplace](https://marketplace.upbound.io/). - -Crossplane can download and install configuration packages into a Kubernetes -cluster. - -Creating a configuration package makes your Crossplane custom APIs portable -and versioned. - -Building and installing configuration packages requires an OCI image compatible -tool. - -{{< hint "note" >}} -You can use any software that builds OCI images. This includes -[Docker](https://www.docker.com/) or -[Upbound's Up CLI)](https://github.com/upbound/up). -{{< /hint >}} - -A configuration package includes three files: -* `crossplane.yaml` defines the metadata of the package. -* `definition.yaml` is the _composite resource definition_ for the package. -* `composition.yaml` is the _composition_ template for the package. - - - -### Create a crossplane.yaml file - -Configuration packages describe their contents and requirements with a -`crossplane.yaml` file. - -The `crossplane.yaml` file lists the required Crossplane _providers_ and their -compatible versions as well as the required Crossplane version. - -The Crossplane -{{}}meta.pkg{{}} API defines the schema -for a -{{}}Configuration{{}}. - -Inside the {{}}spec{{}} define the -required Crossplane -{{}}version{{}}. - -The {{}}dependsOn{{}} section lists the -dependencies for a package. - -This package lists the Upbound -{{}}provider-aws{{}} -version {{}}0.27.0{{}} or later as a -dependency. - -{{}} -Crossplane automatically installs dependencies. Dependencies can include other -configuration packages. -{{< /hint >}} - -```yaml {label="xpyaml"} -apiVersion: meta.pkg.crossplane.io/v1 -kind: Configuration -metadata: - name: crossplane-aws-quickstart -spec: - crossplane: - version: ">=v1.11.0" - dependsOn: - - provider: xpkg.upbound.io/upbound/provider-aws - version: ">=v0.27.0" -``` - -Create a new directory and save the `crossplane.yaml` file. - -```yaml -mkdir crossplane-aws-quickstart -cat < crossplane-aws-quickstart/crossplane.yaml -apiVersion: meta.pkg.crossplane.io/v1 -kind: Configuration -metadata: - name: crossplane-aws-quickstart -spec: - crossplane: - version: ">=v1.11.0" - dependsOn: - - provider: xpkg.upbound.io/upbound/provider-aws - version: ">=v0.27.0" -EOF -``` - - - -### Create a definition.yaml file - - -A configuration package requires a _composite resource definition_ (XRD) to define the -custom API. - -Save the _XRD_ as `definition.yaml` in the same directory as the -`crossplane.yaml` file. - -```yaml -cat < crossplane-aws-quickstart/definition.yaml -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org -spec: - group: custom-api.example.org - names: - kind: database - plural: databases - versions: - - name: v1alpha1 - served: true - referenceable: true - schema: - openAPIV3Schema: - type: object - properties: - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' - required: - - region - claimNames: - kind: custom-database - plural: custom-databases -EOF -``` - - - -### Create a composition.yaml file - - -The _composition_ template creates the _managed resources_ and allows _patches_ -to customize the _managed resources_. - -Copy the _composition_ into the `composition.yaml` file in the same directory as -`crossplane.yaml`. - -```yaml -cat < crossplane-aws-quickstart/composition.yaml -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamo-with-bucket -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database - resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - providerConfigRef: - name: default - patches: - - fromFieldPath: "spec.region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-1" - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID - patches: - - fromFieldPath: "spec.region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-1" -EOF -``` - -### Install the Crossplane command-line -To build a configuration package install the Crossplane Kubernetes command-line -extension. - -```shell -curl "https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh" -./install.sh -sudo mv kubectl-crossplane /usr/bin -``` - -Verify the Crossplane command-line installed with `kubectl crossplane --help` - -```shell -kubectl crossplane --help -Usage: kubectl crossplane - -A command line tool for interacting with Crossplane. - -Flags: - -h, --help Show context-sensitive help. - -v, --version Print version and quit. - --verbose Print verbose logging statements. -# Ouptut removed for brevity -``` - -### Build a configuration package - -Use the `kubectl crossplane` command to create an `.xpkg` file containing the -custom APIs and Crossplane configuration. - -```shell -kubectl crossplane build configuration -f crossplane-aws-quickstart/ --name="crossplane-aws-quickstart" -``` - -Now an `.xpkg` OCI image is inside the `crossplane-aws-quickstart` directory. - -```shell -ls crossplane-aws-quickstart/ -composition.yaml crossplane-aws-quickstart.xpkg crossplane.yaml definition.yaml -``` - -## Next steps -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. -* Read more about [Crossplane concepts]({{}}) \ No newline at end of file diff --git a/content/master/getting-started/provider-aws.md b/content/master/getting-started/provider-aws.md index e5e47a415..4bf4b783f 100644 --- a/content/master/getting-started/provider-aws.md +++ b/content/master/getting-started/provider-aws.md @@ -3,1092 +3,97 @@ title: AWS Quickstart weight: 100 --- -Connect Crossplane to AWS to create and manage cloud resources from Kubernetes with the [Upbound AWS Provider](https://marketplace.upbound.io/providers/upbound/provider-aws). +Connect Crossplane to AWS to create and manage cloud resources from Kubernetes +with the +[Upbound AWS Provider](https://marketplace.upbound.io/providers/upbound/provider-family-aws/v0.37.0). -This guide is in three parts: +This guide is in two parts: * Part 1 walks through installing Crossplane, configuring the provider to authenticate to AWS and creating a _Managed Resource_ in AWS directly from your Kubernetes cluster. This shows Crossplane can communicate with AWS. -* [Part 2]({{< ref "provider-aws-part-2" >}}) creates a -_Composite Resource Definition_ (XRD), _Composite Resource_ (XR) and a _Claim_ -(XRC) to show how to create and use custom APIs. -* [Part 3]({{< ref "provider-aws-part-3" >}}) demonstrates how to patch -_Compositions_ with values used in a _Claim_ and how to build a Crossplane -_Package_. +* [Part 2]({{< ref "provider-aws-part-2" >}}) shows how to build and access a + custom API with Crossplane. + ## Prerequisites This quickstart requires: -* a Kubernetes cluster with at least 6 GB of RAM +* a Kubernetes cluster with at least 2 GB of RAM * permissions to create pods and secrets in the Kubernetes cluster * [Helm](https://helm.sh/) version v3.2.0 or later * an AWS account with permissions to create an S3 storage bucket * AWS [access keys](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) -## Install Crossplane - -Crossplane installs into an existing Kubernetes cluster. - -{{< hint type="tip" >}} -If you don't have a Kubernetes cluster create one locally with [Kind](https://kind.sigs.k8s.io/). -{{< /hint >}} - - -### Install the Crossplane Helm chart - -Helm enables Crossplane to install all its Kubernetes components through a _Helm Chart_. - -Enable the Crossplane Helm Chart repository: - -```shell -helm repo add \ -crossplane-stable https://charts.crossplane.io/stable -helm repo update -``` - -Run the Helm dry-run to see all the Crossplane components Helm installs. - -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---dry-run --debug \ ---namespace crossplane-system \ ---create-namespace -``` -{{}} -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---dry-run --debug \ ---namespace crossplane-system \ ---create-namespace -install.go:193: [debug] Original chart version: "" -install.go:210: [debug] CHART PATH: /home/vagrant/.cache/helm/repository/crossplane-1.10.1.tgz - -NAME: crossplane -LAST DEPLOYED: Thu Jan 19 15:52:08 2023 -NAMESPACE: crossplane-system -STATUS: pending-install -REVISION: 1 -TEST SUITE: None -USER-SUPPLIED VALUES: -{} - -COMPUTED VALUES: -affinity: {} -args: {} -configuration: - packages: [] -customAnnotations: {} -customLabels: {} -deploymentStrategy: RollingUpdate -extraEnvVarsCrossplane: {} -extraEnvVarsRBACManager: {} -image: - pullPolicy: IfNotPresent - repository: crossplane/crossplane - tag: v1.10.1 -imagePullSecrets: {} -leaderElection: true -metrics: - enabled: false -nodeSelector: {} -packageCache: - medium: "" - pvc: "" - sizeLimit: 5Mi -podSecurityContextCrossplane: {} -podSecurityContextRBACManager: {} -priorityClassName: "" -provider: - packages: [] -rbacManager: - affinity: {} - args: {} - deploy: true - leaderElection: true - managementPolicy: All - nodeSelector: {} - replicas: 1 - skipAggregatedClusterRoles: false - tolerations: {} -registryCaBundleConfig: {} -replicas: 1 -resourcesCrossplane: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi -resourcesRBACManager: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi -securityContextCrossplane: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 -securityContextRBACManager: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 -serviceAccount: - customAnnotations: {} -tolerations: {} -webhooks: - enabled: false - -HOOKS: -MANIFEST: ---- -# Source: crossplane/templates/rbac-manager-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" ---- -# Source: crossplane/templates/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" ---- -# Source: crossplane/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-crossplane: "true" ---- -# Source: crossplane/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:system:aggregate-to-crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - crossplane.io/scope: "system" - rbac.crossplane.io/aggregate-to-crossplane: "true" -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - "*" -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - serviceaccounts - - services - verbs: - - "*" -- apiGroups: - - apiextensions.crossplane.io - - pkg.crossplane.io - - secrets.crossplane.io - resources: - - "*" - verbs: - - "*" -- apiGroups: - - extensions - - apps - resources: - - deployments - verbs: - - get - - list - - create - - update - - patch - - delete - - watch -- apiGroups: - - "" - - coordination.k8s.io - resources: - - configmaps - - leases - verbs: - - get - - list - - create - - update - - patch - - watch - - delete -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - get - - list - - create - - update - - patch - - watch - - delete ---- -# Source: crossplane/templates/rbac-manager-allowed-provider-permissions.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:allowed-provider-permissions - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" ---- -# Source: crossplane/templates/rbac-manager-clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - namespaces - - serviceaccounts - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.crossplane.io - resources: - - compositeresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - pkg.crossplane.io - resources: - - providerrevisions - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - roles - verbs: - - get - - list - - watch - - create - - update - - patch - # The RBAC manager may grant access it does not have. - - escalate -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - verbs: - - bind -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterrolebindings - verbs: - - "*" -- apiGroups: - - "" - - coordination.k8s.io - resources: - - configmaps - - leases - verbs: - - get - - list - - create - - update - - patch - - watch - - delete ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-admin - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-admin: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-edit - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-edit: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-view - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-view: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-browse - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-browse: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-admin - labels: - rbac.crossplane.io/aggregate-to-admin: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane administrators have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane administrators must create provider credential secrets, and may -# need to read or otherwise interact with connection secrets. They may also need -# to create or annotate namespaces. -- apiGroups: [""] - resources: [secrets, namespaces] - verbs: ["*"] -# Crossplane administrators have access to view the roles that they may be able -# to grant to other subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [clusterroles, roles] - verbs: [get, list, watch] -# Crossplane administrators have access to grant the access they have to other -# subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [clusterrolebindings, rolebindings] - verbs: ["*"] -# Crossplane administrators have full access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: ["*"] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: ["*"] -# Crossplane administrators have access to view CRDs in order to debug XRDs. -- apiGroups: [apiextensions.k8s.io] - resources: [customresourcedefinitions] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-edit - labels: - rbac.crossplane.io/aggregate-to-edit: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane editors have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane editors must create provider credential secrets, and may need to -# read or otherwise interact with connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] -# Crossplane editors may see which namespaces exist, but not edit them. -- apiGroups: [""] - resources: [namespaces] - verbs: [get, list, watch] -# Crossplane editors have full access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: ["*"] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-view - labels: - rbac.crossplane.io/aggregate-to-view: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane viewers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane viewers may see which namespaces exist. -- apiGroups: [""] - resources: [namespaces] - verbs: [get, list, watch] -# Crossplane viewers have read-only access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: [get, list, watch] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-browse - labels: - rbac.crossplane.io/aggregate-to-browse: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane browsers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane browsers have read-only access to compositions and XRDs. This -# allows them to discover and select an appropriate composition when creating a -# resource claim. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -# The below ClusterRoles are aggregated to the namespaced RBAC roles created by -# the Crossplane RBAC manager when it is running in --manage=All mode. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-admin - labels: - rbac.crossplane.io/aggregate-to-ns-admin: "true" - rbac.crossplane.io/base-of-ns-admin: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace admins have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane namespace admins may need to read or otherwise interact with -# resource claim connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] -# Crossplane namespace admins have access to view the roles that they may be -# able to grant to other subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [roles] - verbs: [get, list, watch] -# Crossplane namespace admins have access to grant the access they have to other -# subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [rolebindings] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-edit - labels: - rbac.crossplane.io/aggregate-to-ns-edit: "true" - rbac.crossplane.io/base-of-ns-edit: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace editors have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane namespace editors may need to read or otherwise interact with -# resource claim connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-view - labels: - rbac.crossplane.io/aggregate-to-ns-view: "true" - rbac.crossplane.io/base-of-ns-view: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace viewers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane -subjects: -- kind: ServiceAccount - name: crossplane - namespace: crossplane-system ---- -# Source: crossplane/templates/rbac-manager-clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane-rbac-manager -subjects: -- kind: ServiceAccount - name: rbac-manager - namespace: crossplane-system ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane-admin - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane-admin -subjects: -- apiGroup: rbac.authorization.k8s.io - kind: Group - name: crossplane:masters ---- -# Source: crossplane/templates/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: crossplane - labels: - app: crossplane - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -spec: - replicas: 1 - selector: - matchLabels: - app: crossplane - release: crossplane - strategy: - type: RollingUpdate - template: - metadata: - labels: - app: crossplane - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - spec: - securityContext: - {} - serviceAccountName: crossplane - initContainers: - - image: crossplane/crossplane:v1.10.1 - args: - - core - - init - imagePullPolicy: IfNotPresent - name: crossplane-init - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_SERVICE_ACCOUNT - valueFrom: - fieldRef: - fieldPath: spec.serviceAccountName - containers: - - image: crossplane/crossplane:v1.10.1 - args: - - core - - start - imagePullPolicy: IfNotPresent - name: crossplane - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: LEADER_ELECTION - value: "true" - volumeMounts: - - mountPath: /cache - name: package-cache - volumes: - - name: package-cache - emptyDir: - medium: - sizeLimit: 5Mi ---- -# Source: crossplane/templates/rbac-manager-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane-rbac-manager - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -spec: - replicas: 1 - selector: - matchLabels: - app: crossplane-rbac-manager - release: crossplane - strategy: - type: RollingUpdate - template: - metadata: - labels: - app: crossplane-rbac-manager - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - spec: - securityContext: - {} - serviceAccountName: rbac-manager - initContainers: - - image: crossplane/crossplane:v1.10.1 - args: - - rbac - - init - imagePullPolicy: IfNotPresent - name: crossplane-init - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - containers: - - image: crossplane/crossplane:v1.10.1 - args: - - rbac - - start - - --manage=All - - --provider-clusterrole=crossplane:allowed-provider-permissions - imagePullPolicy: IfNotPresent - name: crossplane - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: LEADER_ELECTION - value: "true" - -NOTES: -Release: crossplane - -Chart Name: crossplane -Chart Description: Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume. -Chart Version: 1.10.1 -Chart Application Version: 1.10.1 - -Kube Version: v1.24.9 -``` -{{< /expand >}} - -Install the Crossplane components using `helm install`. - -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---namespace crossplane-system \ ---create-namespace -``` - -Verify Crossplane installed with `kubectl get pods`. - -```shell {copy-lines="1"} -kubectl get pods -n crossplane-system -NAME READY STATUS RESTARTS AGE -crossplane-d4cd8d784-ldcgb 1/1 Running 0 54s -crossplane-rbac-manager-84769b574-6mw6f 1/1 Running 0 54s -``` - -Installing Crossplane creates new Kubernetes API end-points. Look at the new API end-points with `kubectl api-resources | grep crossplane`. - -```shell {label="grep",copy-lines="1"} -kubectl api-resources | grep crossplane -compositeresourcedefinitions xrd,xrds apiextensions.crossplane.io/v1 false CompositeResourceDefinition -compositionrevisions apiextensions.crossplane.io/v1alpha1 false CompositionRevision -compositions apiextensions.crossplane.io/v1 false Composition -configurationrevisions pkg.crossplane.io/v1 false ConfigurationRevision -configurations pkg.crossplane.io/v1 false Configuration -controllerconfigs pkg.crossplane.io/v1alpha1 false ControllerConfig -locks pkg.crossplane.io/v1beta1 false Lock -providerrevisions pkg.crossplane.io/v1 false ProviderRevision -providers pkg.crossplane.io/v1 false Provider -storeconfigs secrets.crossplane.io/v1alpha1 false StoreConfig -``` +{{}} ## Install the AWS provider -Install the provider into the Kubernetes cluster with a Kubernetes configuration file. +Install the AWS S3 provider into the Kubernetes cluster with a Kubernetes +configuration file. ```yaml {label="provider",copy-lines="all"} cat <}}Provider{{}} Custom Resource Definition tells Kubernetes how to -connect to the provider. +The Crossplane {{< hover label="provider" line="3" >}}Provider{{}} +installs the Kubernetes _Custom Resource Definitions_ (CRDs) representing AWS S3 +services. These CRDs allow you to create AWS resources directly inside +Kubernetes. Verify the provider installed with `kubectl get providers`. -{{< hint type="note" >}} -It may take up to five minutes for the provider to list `HEALTHY` as `True`. -{{< /hint >}} -```shell {copy-lines="1"} +```shell {copy-lines="1",label="getProvider"} kubectl get providers -NAME INSTALLED HEALTHY PACKAGE AGE -upbound-provider-aws True True xpkg.upbound.io/upbound/provider-aws:v0.27.0 12m +NAME INSTALLED HEALTHY PACKAGE AGE +provider-aws-s3 True True xpkg.upbound.io/upbound/provider-aws-s3:v0.37.0 2m53s +upbound-provider-family-aws True True xpkg.upbound.io/upbound/provider-family-aws:v0.37.0 2m48s ``` -A provider installs their own Kubernetes _Custom Resource Definitions_ (CRDs). These CRDs allow you to create AWS resources directly inside Kubernetes. +The S3 Provider installs a second Provider, the +{{}}upbound-provider-family-aws{{}}. +The family provider manages authentication to AWS across all AWS family +Providers. -You can view the new CRDs with `kubectl get crds`. Every CRD maps to a unique AWS service Crossplane can provision and manage. +You can view the new CRDs with `kubectl get crds`. +Every CRD maps to a unique AWS service Crossplane can provision and manage. {{< hint type="tip" >}} -See details about all the supported CRDs in the [Upbound Marketplace](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). +See details about all the supported CRDs in the +[Upbound Marketplace](https://marketplace.upbound.io/providers/upbound/provider-aws-s3/v0.37.0). {{< /hint >}} ## Create a Kubernetes secret for AWS -The provider requires credentials to create and manage AWS resources. Providers use a Kubernetes _Secret_ to connect the credentials to the provider. +The provider requires credentials to create and manage AWS resources. +Providers use a Kubernetes _Secret_ to connect the credentials to the provider. -First generate a Kubernetes _Secret_ from your AWS key-pair and then configure the Provider to use it. - -{{< hint type="note" >}} -Other authentication methods exist and are beyond the scope of this guide. The [Provider documentation](https://marketplace.upbound.io/providers/upbound/provider-aws/latest/docs/configuration) contains information on alternative authentication methods. -{{< /hint >}} +Generate a Kubernetes _Secret_ from your AWS key-pair and +then configure the Provider to use it. ### Generate an AWS key-pair file For basic user authentication, use an AWS Access keys key-pair file. {{< hint type="tip" >}} -The [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) provides information on how to generate AWS Access keys. +The [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) +provides information on how to generate AWS Access keys. {{< /hint >}} Create a text file containing the AWS account `aws_access_key_id` and `aws_secret_access_key`. +{{< editCode >}} ```ini {copy-lines="all"} [default] -aws_access_key_id = -aws_secret_access_key = +aws_access_key_id = $@$@ +aws_secret_access_key = $@$@ ``` +{{< /editCode >}} Save this text file as `aws-credentials.txt`. @@ -1097,7 +102,13 @@ The [Configuration](https://marketplace.upbound.io/providers/upbound/provider-aw {{< /hint >}} ### Create a Kubernetes secret with the AWS credentials -A Kubernetes generic secret has a name and contents. Use {{< hover label="kube-create-secret" line="1">}}kubectl create secret{{< /hover >}} to generate the secret object named {{< hover label="kube-create-secret" line="2">}}aws-secret{{< /hover >}} in the {{< hover label="kube-create-secret" line="3">}}crossplane-system{{}} namespace. +A Kubernetes generic secret has a name and contents. +Use +{{< hover label="kube-create-secret" line="1">}}kubectl create secret{{}} +to generate the secret object named +{{< hover label="kube-create-secret" line="2">}}aws-secret{{< /hover >}} +in the {{< hover label="kube-create-secret" line="3">}}crossplane-system{{}} namespace. + Use the {{< hover label="kube-create-secret" line="4">}}--from-file={{}} argument to set the value to the contents of the {{< hover label="kube-create-secret" line="4">}}aws-credentials.txt{{< /hover >}} file. ```shell {label="kube-create-secret",copy-lines="all"} @@ -1128,9 +139,12 @@ creds: 114 bytes ``` ## Create a ProviderConfig -A `ProviderConfig` customizes the settings of the AWS Provider. +A {{< hover label="providerconfig" line="3">}}ProviderConfig{{}} +customizes the settings of the AWS Provider. -Apply the {{< hover label="providerconfig" line="2">}}ProviderConfig{{}} with the command: +Apply the +{{< hover label="providerconfig" line="3">}}ProviderConfig{{}} +with the this Kubernetes configuration file: ```yaml {label="providerconfig",copy-lines="all"} cat <}}secretRef{{}}. +This attaches the AWS credentials, saved as a Kubernetes secret, as a +{{< hover label="providerconfig" line="9">}}secretRef{{}}. -The {{< hover label="providerconfig" line="11">}}spec.credentials.secretRef.name{{< /hover >}} value is the name of the Kubernetes secret containing the AWS credentials in the {{< hover label="providerconfig" line="10">}}spec.credentials.secretRef.namespace{{< /hover >}}. +The +{{< hover label="providerconfig" line="11">}}spec.credentials.secretRef.name{{< /hover >}} +value is the name of the Kubernetes secret containing the AWS credentials in the +{{< hover label="providerconfig" line="10">}}spec.credentials.secretRef.namespace{{< /hover >}}. ## Create a managed resource -A _managed resource_ is anything Crossplane creates and manages outside of the Kubernetes cluster. This creates an AWS S3 bucket with Crossplane. The S3 bucket is a _managed resource_. +A _managed resource_ is anything Crossplane creates and manages outside of the +Kubernetes cluster. + +This guide creates an AWS S3 bucket with Crossplane. + +The S3 bucket is a _managed resource_. {{< hint type="note" >}} AWS S3 bucket names must be globally unique. To generate a unique name the example uses a random hash. @@ -1175,13 +198,20 @@ spec: EOF ``` -The {{< hover label="xr" line="3">}}apiVersion{{< /hover >}} and {{< hover label="xr" line="4">}}kind{{}} are from the provider's CRDs. +The {{< hover label="xr" line="3">}}apiVersion{{< /hover >}} and +{{< hover label="xr" line="4">}}kind{{}} are from the provider's CRDs. + +The {{< hover label="xr" line="6">}}metadata.name{{< /hover >}} value is the +name of the created S3 bucket in AWS. +This example uses the generated name `crossplane-bucket-` in the +{{< hover label="xr" line="6">}}$bucket{{}} variable. -The {{< hover label="xr" line="6">}}metadata.name{{< /hover >}} value is the name of the created S3 bucket in AWS. -This example uses the generated name `crossplane-bucket-` in the {{< hover label="xr" line="6">}}`$bucket`{{}} variable. +The {{< hover label="xr" line="9">}}spec.forProvider.region{{< /hover >}} tells +AWS which AWS region to use when deploying resources. -The {{< hover label="xr" line="9">}}spec.forProvider.region{{< /hover >}} tells AWS which AWS region to use when deploying resources. The region can be any [AWS Regional endpoint](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) code. +The region can be any +[AWS Regional endpoint](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) code. Use `kubectl get buckets` to verify Crossplane created the bucket. @@ -1207,6 +237,9 @@ bucket.s3.aws.upbound.io "crossplane-bucket-45eed4ae0" deleted ``` ## Next steps -* [**Continue to part 2**]({{< ref "provider-aws-part-2">}})** to create a Crossplane _Composite Resource_ and _Claim_. -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. \ No newline at end of file +* [**Continue to part 2**]({{< ref "provider-aws-part-2">}}) to create a + Crossplane _Composite Resource_ and _Claim_. +* Explore AWS resources that Crossplane can configure in the + [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). +* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with + Crossplane users and contributors. \ No newline at end of file diff --git a/content/v1.13/getting-started/install-crossplane-include.md b/content/v1.13/getting-started/install-crossplane-include.md new file mode 100644 index 000000000..aa315962c --- /dev/null +++ b/content/v1.13/getting-started/install-crossplane-include.md @@ -0,0 +1,1198 @@ +--- +tocHidden: true +--- + +## Install Crossplane + +Crossplane installs into an existing Kubernetes cluster. + +{{< hint type="tip" >}} +If you don't have a Kubernetes cluster create one locally with [Kind](https://kind.sigs.k8s.io/). +{{< /hint >}} + + +### Install the Crossplane Helm chart + +Helm enables Crossplane to install all its Kubernetes components through a _Helm Chart_. + +Enable the Crossplane Helm Chart repository: + +```shell +helm repo add \ +crossplane-stable https://charts.crossplane.io/stable +helm repo update +``` + +Run the Helm dry-run to see all the Crossplane components Helm installs. + +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--dry-run --debug \ +--namespace crossplane-system \ +--create-namespace +``` +{{}} +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--dry-run --debug \ +--namespace crossplane-system \ +--create-namespace +install.go:200: [debug] Original chart version: "" +install.go:217: [debug] CHART PATH: /home/vagrant/.cache/helm/repository/crossplane-1.13.0.tgz + +NAME: crossplane +LAST DEPLOYED: Fri Jul 28 13:57:41 2023 +NAMESPACE: crossplane-system +STATUS: pending-install +REVISION: 1 +TEST SUITE: None +USER-SUPPLIED VALUES: +{} + +COMPUTED VALUES: +affinity: {} +args: [] +configuration: + packages: [] +customAnnotations: {} +customLabels: {} +deploymentStrategy: RollingUpdate +extraEnvVarsCrossplane: {} +extraEnvVarsRBACManager: {} +extraVolumeMountsCrossplane: {} +extraVolumesCrossplane: {} +hostNetwork: false +image: + pullPolicy: IfNotPresent + repository: crossplane/crossplane + tag: "" +imagePullSecrets: {} +leaderElection: true +metrics: + enabled: false +nodeSelector: {} +packageCache: + configMap: "" + medium: "" + pvc: "" + sizeLimit: 20Mi +podSecurityContextCrossplane: {} +podSecurityContextRBACManager: {} +priorityClassName: "" +provider: + packages: [] +rbacManager: + affinity: {} + args: [] + deploy: true + leaderElection: true + managementPolicy: Basic + nodeSelector: {} + replicas: 1 + skipAggregatedClusterRoles: false + tolerations: [] +registryCaBundleConfig: + key: "" + name: "" +replicas: 1 +resourcesCrossplane: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi +resourcesRBACManager: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi +securityContextCrossplane: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 +securityContextRBACManager: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 +serviceAccount: + customAnnotations: {} +tolerations: [] +webhooks: + enabled: true +xfn: + args: [] + cache: + configMap: "" + medium: "" + pvc: "" + sizeLimit: 1Gi + enabled: false + extraEnvVars: {} + image: + pullPolicy: IfNotPresent + repository: crossplane/xfn + tag: "" + resources: + limits: + cpu: 2000m + memory: 2Gi + requests: + cpu: 1000m + memory: 1Gi + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - SETUID + - SETGID + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + seccompProfile: + type: Unconfined + +HOOKS: +MANIFEST: +--- +# Source: crossplane/templates/rbac-manager-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rbac-manager + namespace: crossplane-system + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +--- +# Source: crossplane/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: crossplane + namespace: crossplane-system + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +--- +# Source: crossplane/templates/secret.yaml +# The reason this is created empty and filled by the init container is that it's +# mounted by the actual container, so if it wasn't created by Helm, then the +# deployment wouldn't be deployed at all with secret to mount not found error. +# In addition, Helm would delete this secret after uninstallation so the new +# installation of Crossplane would use its own certificate. +apiVersion: v1 +kind: Secret +metadata: + name: webhook-tls-secret + namespace: crossplane-system +type: Opaque +--- +# Source: crossplane/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-crossplane: "true" +--- +# Source: crossplane/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:system:aggregate-to-crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + crossplane.io/scope: "system" + rbac.crossplane.io/aggregate-to-crossplane: "true" +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - "*" +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - serviceaccounts + - services + verbs: + - "*" +- apiGroups: + - apiextensions.crossplane.io + - pkg.crossplane.io + - secrets.crossplane.io + resources: + - "*" + verbs: + - "*" +- apiGroups: + - extensions + - apps + resources: + - deployments + verbs: + - get + - list + - create + - update + - patch + - delete + - watch +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +--- +# Source: crossplane/templates/rbac-manager-allowed-provider-permissions.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:allowed-provider-permissions + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" +--- +# Source: crossplane/templates/rbac-manager-clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-rbac-manager + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +- apiGroups: + - "" + resources: + - events + verbs: + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC roles for each namespace it sees. +# These RBAC roles are controlled (in the owner reference sense) by the namespace. +# The RBAC manager needs permission to set finalizers on Namespaces in order to +# create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - "" + resources: + - namespaces/finalizers + verbs: + - update +- apiGroups: + - apiextensions.crossplane.io + resources: + - compositeresourcedefinitions + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC cluster roles for each XRD it sees. +# These cluster roles are controlled (in the owner reference sense) by the XRD. +# The RBAC manager needs permission to set finalizers on XRDs in order to +# create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - apiextensions.crossplane.io + resources: + - compositeresourcedefinitions/finalizers + verbs: + - update +- apiGroups: + - pkg.crossplane.io + resources: + - providerrevisions + verbs: + - get + - list + - watch +# The RBAC manager creates a series of RBAC cluster roles for each ProviderRevision +# it sees. These cluster roles are controlled (in the owner reference sense) by the +# ProviderRevision. The RBAC manager needs permission to set finalizers on +# ProviderRevisions in order to create resources that block their deletion when the +# OwnerReferencesPermissionEnforcement admission controller is enabled. +# See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement +- apiGroups: + - pkg.crossplane.io + resources: + - providerrevisions/finalizers + verbs: + - update +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - roles + verbs: + - get + - list + - watch + - create + - update + - patch + # The RBAC manager may grant access it does not have. + - escalate +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + verbs: + - bind +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + verbs: + - "*" +- apiGroups: + - "" + - coordination.k8s.io + resources: + - configmaps + - leases + verbs: + - get + - list + - create + - update + - patch + - watch + - delete +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-admin + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-admin: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-edit + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-edit: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-view + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-view: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane-browse + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rbac.crossplane.io/aggregate-to-browse: "true" +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-admin + labels: + rbac.crossplane.io/aggregate-to-admin: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane administrators have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane administrators must create provider credential secrets, and may +# need to read or otherwise interact with connection secrets. They may also need +# to create or annotate namespaces. +- apiGroups: [""] + resources: [secrets, namespaces] + verbs: ["*"] +# Crossplane administrators have access to view the roles that they may be able +# to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterroles, roles] + verbs: [get, list, watch] +# Crossplane administrators have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [clusterrolebindings, rolebindings] + verbs: ["*"] +# Crossplane administrators have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +# Crossplane administrators have access to view CRDs in order to debug XRDs. +- apiGroups: [apiextensions.k8s.io] + resources: [customresourcedefinitions] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-edit + labels: + rbac.crossplane.io/aggregate-to-edit: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane editors must create provider credential secrets, and may need to +# read or otherwise interact with connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane editors may see which namespaces exist, but not edit them. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane editors have full access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: ["*"] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-view + labels: + rbac.crossplane.io/aggregate-to-view: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane viewers may see which namespaces exist. +- apiGroups: [""] + resources: [namespaces] + verbs: [get, list, watch] +# Crossplane viewers have read-only access to built in Crossplane types. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +- apiGroups: + - pkg.crossplane.io + resources: [locks, providers, configurations, providerrevisions, configurationrevisions] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-browse + labels: + rbac.crossplane.io/aggregate-to-browse: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane browsers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane browsers have read-only access to compositions and XRDs. This +# allows them to discover and select an appropriate composition when creating a +# resource claim. +- apiGroups: + - apiextensions.crossplane.io + resources: ["*"] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +# The below ClusterRoles are aggregated to the namespaced RBAC roles created by +# the Crossplane RBAC manager when it is running in --manage=All mode. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-admin + labels: + rbac.crossplane.io/aggregate-to-ns-admin: "true" + rbac.crossplane.io/base-of-ns-admin: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace admins have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace admins may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +# Crossplane namespace admins have access to view the roles that they may be +# able to grant to other subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [roles] + verbs: [get, list, watch] +# Crossplane namespace admins have access to grant the access they have to other +# subjects. +- apiGroups: [rbac.authorization.k8s.io] + resources: [rolebindings] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-edit + labels: + rbac.crossplane.io/aggregate-to-ns-edit: "true" + rbac.crossplane.io/base-of-ns-edit: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace editors have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +# Crossplane namespace editors may need to read or otherwise interact with +# resource claim connection secrets. +- apiGroups: [""] + resources: [secrets] + verbs: ["*"] +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crossplane:aggregate-to-ns-view + labels: + rbac.crossplane.io/aggregate-to-ns-view: "true" + rbac.crossplane.io/base-of-ns-view: "true" + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +rules: +# Crossplane namespace viewers have access to view events. +- apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +--- +# Source: crossplane/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane +subjects: +- kind: ServiceAccount + name: crossplane + namespace: crossplane-system +--- +# Source: crossplane/templates/rbac-manager-clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane-rbac-manager + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-rbac-manager +subjects: +- kind: ServiceAccount + name: rbac-manager + namespace: crossplane-system +--- +# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crossplane-admin + labels: + app: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crossplane-admin +subjects: +- apiGroup: rbac.authorization.k8s.io + kind: Group + name: crossplane:masters +--- +# Source: crossplane/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: crossplane-webhooks + namespace: crossplane-system + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + selector: + app: crossplane + release: crossplane + ports: + - protocol: TCP + port: 9443 + targetPort: 9443 +--- +# Source: crossplane/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: crossplane + namespace: crossplane-system + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + replicas: 1 + selector: + matchLabels: + app: crossplane + release: crossplane + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: crossplane + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + spec: + securityContext: + {} + serviceAccountName: crossplane + hostNetwork: false + initContainers: + - image: "crossplane/crossplane:v1.13.0" + args: + - core + - init + imagePullPolicy: IfNotPresent + name: crossplane-init + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.memory + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: "WEBHOOK_TLS_SECRET_NAME" + value: webhook-tls-secret + - name: "WEBHOOK_SERVICE_NAME" + value: crossplane-webhooks + - name: "WEBHOOK_SERVICE_NAMESPACE" + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: "WEBHOOK_SERVICE_PORT" + value: "9443" + containers: + - image: "crossplane/crossplane:v1.13.0" + args: + - core + - start + imagePullPolicy: IfNotPresent + name: crossplane + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + ports: + - name: webhooks + containerPort: 9443 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.memory + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: LEADER_ELECTION + value: "true" + - name: "WEBHOOK_TLS_SECRET_NAME" + value: webhook-tls-secret + - name: "WEBHOOK_TLS_CERT_DIR" + value: /webhook/tls + volumeMounts: + - mountPath: /cache + name: package-cache + - mountPath: /webhook/tls + name: webhook-tls-secret + volumes: + - name: package-cache + emptyDir: + medium: + sizeLimit: 20Mi + - name: webhook-tls-secret + secret: + # NOTE(muvaf): The tls.crt is used both by the server (requires it to + # be a single cert) and the caBundle fields of webhook configs and CRDs + # which can accept a whole bundle of certificates. In order to meet + # the requirements of both, we require a single certificate instead of + # a bundle. + # It's assumed that initializer generates this anyway, so it should be + # fine. + secretName: webhook-tls-secret +--- +# Source: crossplane/templates/rbac-manager-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: crossplane-rbac-manager + namespace: crossplane-system + labels: + app: crossplane-rbac-manager + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" +spec: + replicas: 1 + selector: + matchLabels: + app: crossplane-rbac-manager + release: crossplane + strategy: + type: RollingUpdate + template: + metadata: + labels: + app: crossplane-rbac-manager + release: crossplane + helm.sh/chart: crossplane-1.13.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: cloud-infrastructure-controller + app.kubernetes.io/part-of: crossplane + app.kubernetes.io/name: crossplane + app.kubernetes.io/instance: crossplane + app.kubernetes.io/version: "1.13.0" + spec: + securityContext: + {} + serviceAccountName: rbac-manager + initContainers: + - image: "crossplane/crossplane:v1.13.0" + args: + - rbac + - init + imagePullPolicy: IfNotPresent + name: crossplane-init + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane-init + resource: limits.memory + containers: + - image: "crossplane/crossplane:v1.13.0" + args: + - rbac + - start + - --manage=Basic + - --provider-clusterrole=crossplane:allowed-provider-permissions + imagePullPolicy: IfNotPresent + name: crossplane + resources: + limits: + cpu: 100m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsUser: 65532 + env: + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: crossplane + resource: limits.memory + - name: LEADER_ELECTION + value: "true" + +NOTES: +Release: crossplane + +Chart Name: crossplane +Chart Description: Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume. +Chart Version: 1.13.0 +Chart Application Version: 1.13.0 + +Kube Version: v1.27.4 +``` +{{< /expand >}} + +Install the Crossplane components using `helm install`. + +```shell +helm install crossplane \ +crossplane-stable/crossplane \ +--namespace crossplane-system \ +--create-namespace +``` + +Verify Crossplane installed with `kubectl get pods`. + +```shell {copy-lines="1"} +kubectl get pods -n crossplane-system +NAME READY STATUS RESTARTS AGE +crossplane-d4cd8d784-ldcgb 1/1 Running 0 54s +crossplane-rbac-manager-84769b574-6mw6f 1/1 Running 0 54s +``` + +Installing Crossplane creates new Kubernetes API end-points. +Look at the new API end-points with `kubectl api-resources | grep crossplane`. + +```shell {label="grep",copy-lines="1"} +kubectl api-resources | grep crossplane +compositeresourcedefinitions xrd,xrds apiextensions.crossplane.io/v1 false CompositeResourceDefinition +compositionrevisions comprev apiextensions.crossplane.io/v1 false CompositionRevision +compositions comp apiextensions.crossplane.io/v1 false Composition +environmentconfigs envcfg apiextensions.crossplane.io/v1alpha1 false EnvironmentConfig +configurationrevisions pkg.crossplane.io/v1 false ConfigurationRevision +configurations pkg.crossplane.io/v1 false Configuration +controllerconfigs pkg.crossplane.io/v1alpha1 false ControllerConfig +locks pkg.crossplane.io/v1beta1 false Lock +providerrevisions pkg.crossplane.io/v1 false ProviderRevision +providers pkg.crossplane.io/v1 false Provider +storeconfigs secrets.crossplane.io/v1alpha1 false StoreConfig +``` \ No newline at end of file diff --git a/content/v1.13/getting-started/provider-aws-part-2.md b/content/v1.13/getting-started/provider-aws-part-2.md index e604ba6da..e94f9ef7b 100644 --- a/content/v1.13/getting-started/provider-aws-part-2.md +++ b/content/v1.13/getting-started/provider-aws-part-2.md @@ -2,28 +2,25 @@ title: AWS Quickstart Part 2 weight: 120 tocHidden: true +aliases: + - /v1.13/getting-started/provider-aws-part-3 --- {{< hint "important" >}} -This guide is part 2 of a series. Follow [**part 1**]({{}})** -to install Crossplane and connect your Kubernetes cluster to AWS. +This guide is part 2 of a series. + +[**Part 1**]({{}}) covers +to installing Crossplane and connect your Kubernetes cluster to AWS. -[**Part 3**]({{}})** covers patching _composite resources_ -and using Crossplane _packages_. {{< /hint >}} - -This section creates a _[Composition](#create-a-composition)_, -_[Composite Resource Definition](#define-a-composite-resource)_ and a -_[Claim](#create-a-claim)_ -to create a custom Kubernetes API to create AWS resources. - +This guide walks you through building and accessing a custom API with Crossplane. ## Prerequisites * Complete [quickstart part 1]({{}}) connecting Kubernetes to AWS. * an AWS account with permissions to create an AWS S3 storage bucket and a -DynamoDB instance + DynamoDB instance {{}} 1. Add the Crossplane Helm repository and install Crossplane @@ -45,9 +42,9 @@ cat <}} -## Create a composition -[Part 1]({{}}) created a single _managed resource_. -A _Composition_ is a template to create multiple _managed resources_ at the same time. - -This sample _composition_ creates an DynamoDB instance and associated S3 storage -bucket. - -{{< hint "note" >}} -This example comes from the AWS recommendation for -[storing large DynamoDB attributes in S3](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-use-s3-too.html#bp-use-s3-too-large-values). -{{< /hint >}} - -To create a _composition_, first define each individual managed resource. - -### Create an S3 bucket object -Define a `bucket` resource using the configuration from the previous section: - -```yaml -apiVersion: s3.aws.upbound.io/v1beta1 -kind: Bucket -metadata: - name: crossplane-quickstart-bucket -spec: - forProvider: - region: "us-east-2" - providerConfigRef: - name: default -``` - -### Create a DynamoDB table resource -Next, define a DynamoDB `table` resource. - -{{< hint "tip" >}} -The [Upbound Marketplace](https://marketplace.upbound.io/) provides -[schema documentation](https://marketplace.upbound.io/providers/upbound/provider-aws/v0.27.0/resources/dynamodb.aws.upbound.io/Table/v1beta1) for a `Table` resource. -{{< /hint >}} - -The _AWS Provider_ defines the -{{}}apiVersion{{}} -and -{{}}kind{{}}. - -DynamoDB instances require a -{{}}region{{}}, -{{}}writeCapacity{{}} -and -{{}}readCapacity{{}} -parameters. - -The {{}}attribute{{}} section creates -the database "Partition key" and "Hash key." - -This example creates a single key named -{{}}S3ID{{}} of type -{{}}S{{}} for "string" -```yaml {label="dynamoMR"} -apiVersion: dynamodb.aws.upbound.io/v1beta1 -kind: Table -metadata: - name: crossplane-quickstart-database -spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID -``` - -{{< hint "note" >}} -DynamoDB specifics are beyond the scope of this guide. Read the -[DynamoDB Developer Guide](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html) -for more information. -{{}} - -### Create the composition object -The _composition_ combines the two resource definitions. +## Create a custom API -A -{{}}Composition{{}} comes from the -{{}}Crossplane{{}} -API resources. + +Crossplane allows you to build your own custom APIs for your users, abstracting +away details about the cloud provider and their resources. You can make your API +as complex or simple as you wish. + -Create any {{}}name{{}} for this _composition_. +The custom API is a Kubernetes object. +Here is an example custom API. -```yaml {label="compName"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition +```yaml {label="exAPI"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL metadata: - name: dynamoDBWithS3 -``` - -Add the resources to the -{{}}spec.resources{{}} -section of the _composition_. - -Give each resource a -{{}}name{{}} -and put the resource definition under the -{{}}base{{}} -key. - -```yaml {label="specResources"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamoDBWithS3 -spec: - resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - forProvider: - region: "us-east-2" - providerConfigRef: - name: default - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID + name: my-nosql-database +spec: + location: "US" ``` -Put the entire resource definition including the -{{}}apiVersion{{}} and resource -settings under the -{{}}base{{}}. - -_Compositions_ are only a template for generating resources. A _composite -resource_ actually creates the resources. - -A _composition_ defines what _composite resources_ can use this -template. +Like any Kubernetes object the API has a +{{}}version{{}}, +{{}}kind{{}} and +{{}}spec{{}}. -_Compositions_ do this with the -{{}}spec.compositeTypeRef{{}} -definition. - -```yaml {label="compRef"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamodb-with-bucket -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database - resources: - # Removed for Brevity -``` +### Define a group and version +To create your own API start by defining an +[API group](https://kubernetes.io/docs/reference/using-api/#api-groups) and +[version](https://kubernetes.io/docs/reference/using-api/#api-versioning). -A _composite resource_ is actually a custom Kubernetes API type you define. The -platform team controls the kind, API endpoint and version. +The _group_ can be any value, but common convention is to map to a fully +qualified domain name. - -With this {{}}spec.compositeTypeRef{{}} -Crossplane only allows _composite resources_ from the API group -{{}}custom-api.example.org{{}} -that are of -{{}}kind: database{{}} -to use this template to create resources. +The version shows how mature or stable the API is and increments when changing, +adding or removing fields in the API. -### Apply the composition -Apply the full _Composition_ to your Kubernetes cluster. - -```yaml -cat <}}database.example.com{{}}. -A _composite resource_ is a custom API defined by the platform teams. -A _composite resource definition_ defines the schema for a _composite resource_. +Since this is the first version of the API, this guide uses the version +{{}}v1alpha1{{}}. - -A _composite resource definition_ installs the custom API type into Kubernetes -and defines what `spec` keys and values are valid when calling this new custom API. - -Before creating a _composite resource_ Crossplane requires a _composite resource definition_. - -{{< hint "tip" >}} -_Composite resource definitions_ are also called `XRDs` for short. -{{< /hint >}} - -Just like a _composition_ the -{{}}composite resource definition{{}} -is part of the -{{}}Crossplane{{}} -API group. - -The _XRD_ {{}}name{{}} is the new -API endpoint. - -```yaml {label="xrdName"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org +```yaml {label="version",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 ``` -The _XRD's_ -{{}}spec{{}} defines the new custom -API. +### Define a kind -### Define the API endpoint and kind -First, define the new API -{{}}group{{}}. -Next, create the API {{}}kind{{}} and -{{}}plural{{}}. +The API group is a logical collection of related APIs. Within a group are +individual kinds representing different resources. -```yaml {label="xrdGroup"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org -spec: - group: custom-api.example.org - names: - kind: database - plural: databases -``` +For example a `database` group may have a `Relational` and `NoSQL` kinds. -{{}} -The _XRD_ {{}}group{{}} matches the _composition_ {{}}apiVersion{{}} and the -_XRD_ {{}}kind{{}} matches the _composition_ -{{}}kind{{}} under the {{}}compositeTypeRef{{}}. +The `kind` can be anything, but it must be +[UpperCamelCased](https://kubernetes.io/docs/contribute/style/style-guide/#use-upper-camel-case-for-api-objects). -```yaml {label="noteComp"} -kind: Composition -# Removed for brevity -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database -``` -{{< /hint >}} - -### Set the API version -In Kubernetes, all API endpoints have a version to tell the stability of the API -and track revisions. - -Apply a version to the _XRD_ with a -{{}}versions.name{{}}. -This matches the {{}}apiVersion{{}} used in the _composition's_ -{{}}compositeTypeRef{{}}. +This API's kind is +{{}}NoSQL{{}} -_XRDs_ require both -{{}}versions.served{{}} -and -{{}}versions.referenceable{{}}. - -```yaml {label="xrdVersion"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: custom-api-definition -spec: - group: custom-api.example.org - names: - kind: database - plural: databases - versions: - - name: v1alpha1 - served: true - referenceable: true +```yaml {label="kind",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL ``` -{{}} -For more information on defining versions in Kubernetes read the -[API versioning](https://kubernetes.io/docs/reference/using-api/#api-versioning) section of the Kubernetes documentation. -{{< /hint >}} - -### Create the API schema -With an API endpoint named, now define the API schema, or what's allowed -inside the `spec` of the new Kubernetes object. +### Define a spec -{{< hint "note" >}} -_XRDs_ follow the Kubernetes -[_custom resource definition_ rules for schemas](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/#specifying-a-structural-schema). -{{}} +The most important part of an API is the schema. The schema defines the inputs +accepted from users. -Place the API -{{< hover label="xrdSchema" line="8" >}}schema{{}} -under the -{{< hover label="xrdSchema" line="7" >}}version.name{{}} +This API allows users to provide a +{{}}location{{}} of where to run their +cloud resources. -The _XRD_ type defines the next lines. They're always the same. +All other resource settings can't be configurable by the users. This allows +Crossplane to enforce any policies and standards without worrying about +user errors. - - -{{< hover label="xrdSchema" line="9" >}}openAPIV3Schema{{}} specifies -how the schema gets validated. - - -Next, the entire API is an -{{< hover label="xrdSchema" line="10" >}}object{{}} -with a -{{< hover label="xrdSchema" line="11" >}}property{{}} of -{{< hover label="xrdSchema" line="12" >}}spec{{}}. - -The -{{< hover label="xrdSchema" line="12" >}}spec{{}} is also an -{{< hover label="xrdSchema" line="13" >}}object{{}} with -{{< hover label="xrdSchema" line="14" >}}properties{{}}. - -```yaml {label="xrdSchema"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - # Removed for brevity - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - type: object - properties: - spec: - type: object - properties: +```yaml {label="spec",copy-lines="none"} +apiVersion: database.example.com/v1alpha1 +kind: NoSQL +spec: + location: "US" ``` -{{< hint "tip" >}} -An _XRD_ is a Kubernetes _custom resource definition_. -For more information on the values allowed in the _XRD_ view the _XRD_ object with -`kubectl describe crd compositeresourcedefinitions` -{{< /hint >}} +### Apply the API -Now, define the custom API. Your custom API continues under the last -{{}}properties{{}} definition in the -previous example. - -This custom API has only one setting: - -* {{}}region{{}} - where to deploy -the resources, a choice of "EU" or "US" - - -Users can't change any other settings of the S3 bucket or DynamoDB instance. - -The{{}}region{{}} -is a {{}}string{{}} -and can match the regular expression that's -{{}}oneOf{{}} -{{}}EU{{}} -or -{{}}US{{}}. - -This API requires the setting -{{}}region{{}}. - - -```yaml {label="customAPI"} -# Removed for brevity -# schema.openAPIV3Schema.type.properties.spec -properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' -required: - - region -``` +Crossplane uses +{{}}Composite Resource Definitions{{}} +(also called an `XRD`) to install your custom API in +Kubernetes. -### Enable claims to the API -Allow a _claim_ to use this _XRD_ by defining the _claim_ API endpoint under the _XRD_ -{{}}spec{{< /hover >}}. +The XRD {{}}spec{{}} contains all the +information about the API including the +{{}}group{{}}, +{{}}version{{}}, +{{}}kind{{}} and +{{}}schema{{}}. -```yaml {label="XRDclaim"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: -# Removed for brevity - claimNames: - kind: customDatabase - plural: customDatabases -``` +The XRD's {{}}name{{}} must be the +combination of the {{}}plural{{}} and +{{}}group{{}}. -{{}} -The [Claims](#create-a-claim) section later in this guide discusses _claims_. -{{< /hint >}} +The {{}}schema{{}} uses the +{{}}OpenAPIv3{{}} specification to define +the API {{}}spec{{}}. -### Apply the composite resource definition -Apply the complete _XRD_ to your Kubernetes cluster. +The API defines a {{}}location{{}} that +must be {{}}oneOf{{}} either +{{}}EU{{}} or +{{}}US{{}}. +Apply this XRD to create the custom API in your Kubernetes cluster. -```yaml +```yaml {label="xrd",copy-lines="all"} cat <}}claimNames{{}} allows users +to access this API either at the cluster level with the +{{}}nosql{{}} endpoint or in a namespace +with the +{{}}nosqlclaim{{}} endpoint. -```shell {copy-lines="1",label="getXRD"} -kubectl get xrd -NAME ESTABLISHED OFFERED AGE -databases.custom-api.example.org True True 9s -``` +The namespace scoped API is a Crossplane _Claim_. +{{}} +For more details on the fields and options of Composite Resource Definitions +read the +[XRD documentation]({{}}). +{{< /hint >}} -## Create a composite resource -Creating an _XRD_ allows the creation _composite resources_. - -_Composite resources_ are a convenient way to create multiple resources with a standard template. +View the installed XRD with `kubectl get xrd`. -A _composite resource_ uses the custom API created in the _XRD_. +```shell {copy-lines="1"} +kubectl get xrd +NAME ESTABLISHED OFFERED AGE +nosqls.database.example.com True True 2s +``` -Looking at part of the _XRD_: +View the new custom API endpoints with `kubectl api-resources | grep nosql` -```yaml {label="xrdSnip"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - group: custom-api.example.org - names: - kind: database -# Removed for brevity - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' +```shell {copy-lines="1",label="apiRes"} +kubectl api-resources | grep nosql +nosqlclaim database.example.com/v1alpha1 true NoSQLClaim +nosqls database.example.com/v1alpha1 false NoSQL ``` -The _XRD_ {{}}group{{}} -becomes the _composite resource_ -{{}}apiVersion{{}}. +## Create a deployment template -The _XRD_ {{}}kind{{}} -is the _composite resource_ -{{}}kind{{}} +When users access the custom API Crossplane takes their inputs and combines them +with a template describing what infrastructure to deploy. Crossplane calls this +template a _Composition_. -The _XRD_ API {{}}spec{{}} defines the -_composite resource_ {{}}spec{{}}. +The {{}}Composition{{}} defines all the +cloud resources to deploy. +Each entry in the template +is a full resource definitions, defining all the resource settings and metadata +like labels and annotations. -The _XRD_ {{}}properties{{}} section -defines the options for the _composite resource_ -{{}}spec{{}}. +This template creates an AWS +{{}}S3{{}} +{{}}Bucket{{}} and a +{{}}DynamoDB{{}} +{{}}Table{{}}. -The one option is {{}}region{{}} and it -can be either {{}}EU{{}} or -{{}}US{{}}. +Crossplane uses {{}}patches{{}} to apply +the user's input to the resource template. +This Composition takes the user's +{{}}location{{}} input and uses it as the +{{}}region{{}} used in the individual +resource. -This _composite resource_ uses -{{}}region: US{{}}. - -### Apply the composite resource +Apply this Composition to your cluster. -Apply the composite resource to the Kubernetes cluster. - -```yaml {label="xr"} +```yaml {label="comp",copy-lines="all"} cat <}}compositeTypeRef{{}} defines +which custom APIs can use this template to create resources. -```shell {copy-lines="1"} -kubectl get composite -NAME SYNCED READY COMPOSITION AGE -my-composite-resource True True dynamo-with-bucket 31s -``` +{{}} +Read the [Composition documentation]({{}}) for +more information on configuring Compositions and all the available options. -The output mentions the _composite_ template that the _composite resource_ used. +Read the +[Patch and Transform documentation]({{}}) +for more information on how Crossplane uses patches to map user inputs to +Composition resource templates. +{{< /hint >}} -Now look at the S3 `bucket` and DynmoDB `table` _managed resources_ with -`kubectl get bucket` and `kubectl get table`. +View the Composition with `kubectl get composition` ```shell {copy-lines="1"} -kubectl get bucket -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-8b6tx True True my-composite-resource-8b6tx 56s +kubectl get composition +NAME XR-KIND XR-APIVERSION AGE +dynamo-with-bucket NoSQL database.example.com/v1alpha1 3s ``` -```shell {copy-lines="1"} -kubectl get table -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-m6vk6 True True my-composite-resource-m6vk6 59s +## Install the DynamoDB Provider + +Part 1 only installed the AWS S3 Provider. Deploying a DynamoDB Table requires +the DynamoDB Provider as well. + +Add the new Provider to the cluster. + +```yaml +cat <}}NoSQL{{}} object to create the +cloud resources. + +```yaml {copy-lines="all",label="xr"} cat <}} -There may a delay in deleting the _managed resources_. Crossplane is making API -calls to AWS and waits for AWS to confirm they deleted the resources before -updating the state in Kubernetes. -{{}} - -Now only one bucket and table exist. +Delete the resources with `kubectl delete nosql`. ```shell {copy-lines="1"} -kubectl get bucket -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-8b6tx True True my-composite-resource-8b6tx 7m34s +kubectl delete nosql my-nosql-database +nosql.database.example.com "my-nosql-database" deleted ``` -```shell {copy-lines="1"} -kubectl get table -NAME READY SYNCED EXTERNAL-NAME AGE -my-composite-resource-m6vk6 True True my-composite-resource-m6vk6 7m37s -``` +Verify Crossplane deleted the resources with `kubectl get managed` -Delete the second _composite resource_ to remove the last `bucket` and `table` -_managed resources_. +{{}} +It may take up to 5 minutes to delete the resources. +{{< /hint >}} -```shell -kubectl delete composite my-composite-resource +```shell {copy-lines="1"} +kubectl get managed +No resources found ``` -_Composite resources_ are great for creating multiple related resources against -a template, but all _composite resources_ exist at the Kubernetes "cluster -level." There's no isolation between _composite resources_. Crossplane uses -_claims_ to create resources with namespace isolation. +## Using the API with namespaces -## Create a claim +Accessing the API `nosql` happens at the cluster scope. +Most organizations +isolate their users into namespaces. -_Claims_, just like _composite resources_ use the custom API defined in the -_XRD_. Unlike a _composite resource_, Crossplane can create _claims_ in a -namespace. +A Crossplane _Claim_ is the custom API within a namespace. -### Create a new Kubernetes namespace -Create a new namespace with `kubectl create namespace`. - -```shell -kubectl create namespace test -``` +Creating a _Claim_ is just like accessing the custom API endpoint, but with the +{{}}kind{{}} +from the custom API's `claimNames`. -A _claim_ uses the same {{}}group{{}} -a _composite resource_ uses but a different -{{}}kind{{}}. +Create a new namespace to test create a Claim in. -```yaml {label="XRDclaim2"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: -# Removed for brevity - group: custom-api.example.org - claimNames: - kind: custom-database - plural: custom-databases +```shell +kubectl create namespace crossplane-test ``` -Like the _composite resource_, create a new object with the -{{}}custom-api.example.org{{}} API -endpoint. - -The _XRD_ -{{}}ClaimNames.kind{{}} defines the -{{}}kind{{}}. - -The {{}}spec{{}} uses the same -API options as the _composite resource_. +Then create a Claim in the `crossplane-test` namespace. -### Apply the claim -Apply the _claim_ to your Kubernetes cluster. - -```yaml {label="claim"} +```yaml {label="claim",copy-lines="all"} cat <}} +It may take up to 5 minutes to delete the resources. +{{< /hint >}} -### Delete the claims -Removing the _claims_ removes the _composite resources_ and the associated -_managed resources_. +Verify Crossplane deleted the composite resource with `kubectl get composite`. -```shell -kubectl delete claim claimed-database -n test -kubectl delete claim claimed-database -n test2 +```shell {copy-lines="1"} +kubectl get composite +No resources found ``` -Verify Crossplane removed all the _managed resources_. +Verify Crossplane deleted the managed resources with `kubectl get managed`. -```shell -kubectl get bucket -kubectl get table -``` - -Claims are powerful tools to give users resources in their own isolated -namespace. But these examples haven't shown how the custom API can change -the settings defined in the _composition_. This _composition patching_ applies -the API settings when creating resources. -[Part 3]({{< ref "provider-aws-part-3">}}) of this guide covers _composition -patches_ and making all this configuration portable in Crossplane _packages_. - -## Next steps -* [**Continue to part 3**]({{< ref "provider-aws-part-3">}}) to create a learn - about _patching_ resources and creating Crossplane _packages_. -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. \ No newline at end of file +```shell {copy-lines="1"} +kubectl get managed +No resources found +``` \ No newline at end of file diff --git a/content/v1.13/getting-started/provider-aws-part-3.md b/content/v1.13/getting-started/provider-aws-part-3.md deleted file mode 100644 index 47f14649b..000000000 --- a/content/v1.13/getting-started/provider-aws-part-3.md +++ /dev/null @@ -1,652 +0,0 @@ ---- -title: AWS Quickstart Part 3 -weight: 120 -tocHidden: true ---- - -{{< hint "important" >}} -This guide is part 3 of a series. - -Follow [**part 1**]({{}}) -to install Crossplane and connect your Kubernetes cluster to AWS. - -Follow [**part 2**]({{}}) to create a _composition_, -_custom resource definition_ and a _claim_. -{{< /hint >}} - -[Part 2]({{}}) created a _composite resource -definition_ to define the schema of the custom API. Users create a _claim_ to -use the custom API and apply their options. Part 2 didn't show how the options -set in a _claim_ change or get applied the associated _composite resources_. - -## Prerequisites -* Complete quickstart [part 1]({{}}) and - [Part 2]({{}}) to install Crossplane and the quickstart - configurations. - -{{}} -1. Add the Crossplane Helm repository and install Crossplane -```shell -helm repo add \ -crossplane-stable https://charts.crossplane.io/stable -helm repo update - -helm install crossplane \ -crossplane-stable/crossplane \ ---namespace crossplane-system \ ---create-namespace -``` - -2. When the Crossplane pods finish installing and are ready, apply the AWS Provider - -```yaml {label="provider",copy-lines="all"} -cat < -aws_secret_access_key = -``` - -4. Create a Kubernetes secret from the AWS keys -```shell {label="kube-create-secret",copy-lines="all"} -kubectl create secret \ -generic aws-secret \ --n crossplane-system \ ---from-file=creds=./aws-credentials.txt -``` - -5. Create a _ProviderConfig_ -```yaml {label="providerconfig",copy-lines="all"} -cat <}} - -## Enable composition patches -In a _composition_ `patches` map fields in the custom API to fields inside the -_managed resources_. - -The _composition_ has two _managed resources_, a -{{}}bucket{{}} and a -{{}}table{{}}. - -```yaml {label="compResources"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -# Removed for Brevity -resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - forProvider: - region: "us-east-2" - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - region: "us-east-2" - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID -``` - -The custom API defined a single option, -{{}}region{{}}. A -{{}}region{{}} can be either -{{}}EU{{}} or -{{}}US{{}}. - - -```yaml {label="xrdSnip"} -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -# Removed for brevity -spec: - group: custom-api.example.org - names: - kind: database -# Removed for brevity - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' -``` - -Creating a _composition_ `patch` allows Crossplane to update the settings of the -_composite resource_. Patches apply to the individual _managed resources_ -inside the _composition_. - -A {{}}patch{{}} has a -{{}}fromField{{}} and a -{{}}toField{{}} specifying which value -_from_ the custom API should apply _to_ the _managed resource_. -Patches can create a -{{}}transform{{}} to change the _from_ -field before it's applied. - -The transform -{{}}type{{}} is what kind of change to -make on the _from_ field. Types of changes could include appending a string, -preforming a math operation or mapping one value to another. - -Applying a {{}}patch{{}} to the -{{}}Bucket{{}} uses the custom API -{{}}region{{}} to use as the _managed resource_ -{{}}region{{}}. - - -The custom API value "EU" is -{{}}mapped{{}} to the value "eu-north-1" -and "US" is {{}}mapped{{}} to the value -"us-east-2." - - - -```yaml {label="patch"} -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -# Removed for Brevity -resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - spec: - forProvider: - region: "us-east-2" - patches: - - fromFieldPath: "region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-2" -``` - -Patching is a powerful tool enabling simpler or abstracted APIs. A developer -isn't required to know the specific AWS region identifier, only the abstracted -option of "EU" or "US." - - -### Apply the updated composition -Apply the same `patch` to the `Table` _managed resource_ and apply the updated -_composition_. - -```yaml -cat <}}region{{}} to "EU." - -```yaml {label="claim"} -cat < -Using {{}}region: "EU"{{}} patches the -_composite resource_, updating the AWS region from `us-east-2` to `eu-north-1`. -The developer creating the claim isn't required to know which specific AWS -region or the naming conventions. Using the abstract API options of "EU" or "US" -the developer places their resources in the desired location. - - -Deleting the claim removes the _managed resources_. - -{{}} -The _managed resources_ take up to 5 minutes to delete. -{{< /hint >}} - -```shell -kubectl delete claim claimed-eu-database -n test -``` - -## Create a Crossplane configuration package - -Crossplane _configuration packages_ allow users to combine their _custom -resource definition_ and _composition_ files into an OCI image. - -{{< hint "note" >}} -The [Open Container Initiative](https://opencontainers.org/faq/) -defines the OCI image standard. -An OCI images is a standard way to package data. -{{< /hint >}} - -You can host configuration packages in image registries like -[Docker Hub](https://hub.docker.com/) or the -[Upbound Marketplace](https://marketplace.upbound.io/). - -Crossplane can download and install configuration packages into a Kubernetes -cluster. - -Creating a configuration package makes your Crossplane custom APIs portable -and versioned. - -Building and installing configuration packages requires an OCI image compatible -tool. - -{{< hint "note" >}} -You can use any software that builds OCI images. This includes -[Docker](https://www.docker.com/) or -[Upbound's Up CLI)](https://github.com/upbound/up). -{{< /hint >}} - -A configuration package includes three files: -* `crossplane.yaml` defines the metadata of the package. -* `definition.yaml` is the _composite resource definition_ for the package. -* `composition.yaml` is the _composition_ template for the package. - - - -### Create a crossplane.yaml file - -Configuration packages describe their contents and requirements with a -`crossplane.yaml` file. - -The `crossplane.yaml` file lists the required Crossplane _providers_ and their -compatible versions as well as the required Crossplane version. - -The Crossplane -{{}}meta.pkg{{}} API defines the schema -for a -{{}}Configuration{{}}. - -Inside the {{}}spec{{}} define the -required Crossplane -{{}}version{{}}. - -The {{}}dependsOn{{}} section lists the -dependencies for a package. - -This package lists the Upbound -{{}}provider-aws{{}} -version {{}}0.27.0{{}} or later as a -dependency. - -{{}} -Crossplane automatically installs dependencies. Dependencies can include other -configuration packages. -{{< /hint >}} - -```yaml {label="xpyaml"} -apiVersion: meta.pkg.crossplane.io/v1 -kind: Configuration -metadata: - name: crossplane-aws-quickstart -spec: - crossplane: - version: ">=v1.11.0" - dependsOn: - - provider: xpkg.upbound.io/upbound/provider-aws - version: ">=v0.27.0" -``` - -Create a new directory and save the `crossplane.yaml` file. - -```yaml -mkdir crossplane-aws-quickstart -cat < crossplane-aws-quickstart/crossplane.yaml -apiVersion: meta.pkg.crossplane.io/v1 -kind: Configuration -metadata: - name: crossplane-aws-quickstart -spec: - crossplane: - version: ">=v1.11.0" - dependsOn: - - provider: xpkg.upbound.io/upbound/provider-aws - version: ">=v0.27.0" -EOF -``` - - - -### Create a definition.yaml file - - -A configuration package requires a _composite resource definition_ (XRD) to define the -custom API. - -Save the _XRD_ as `definition.yaml` in the same directory as the -`crossplane.yaml` file. - -```yaml -cat < crossplane-aws-quickstart/definition.yaml -apiVersion: apiextensions.crossplane.io/v1 -kind: CompositeResourceDefinition -metadata: - name: databases.custom-api.example.org -spec: - group: custom-api.example.org - names: - kind: database - plural: databases - versions: - - name: v1alpha1 - served: true - referenceable: true - schema: - openAPIV3Schema: - type: object - properties: - spec: - type: object - properties: - region: - type: string - oneOf: - - pattern: '^EU$' - - pattern: '^US$' - required: - - region - claimNames: - kind: custom-database - plural: custom-databases -EOF -``` - - - -### Create a composition.yaml file - - -The _composition_ template creates the _managed resources_ and allows _patches_ -to customize the _managed resources_. - -Copy the _composition_ into the `composition.yaml` file in the same directory as -`crossplane.yaml`. - -```yaml -cat < crossplane-aws-quickstart/composition.yaml -apiVersion: apiextensions.crossplane.io/v1 -kind: Composition -metadata: - name: dynamo-with-bucket -spec: - compositeTypeRef: - apiVersion: custom-api.example.org/v1alpha1 - kind: database - resources: - - name: s3Bucket - base: - apiVersion: s3.aws.upbound.io/v1beta1 - kind: Bucket - metadata: - name: crossplane-quickstart-bucket - spec: - providerConfigRef: - name: default - patches: - - fromFieldPath: "spec.region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-1" - - name: dynamoDB - base: - apiVersion: dynamodb.aws.upbound.io/v1beta1 - kind: Table - metadata: - name: crossplane-quickstart-database - spec: - forProvider: - writeCapacity: 1 - readCapacity: 1 - attribute: - - name: S3ID - type: S - hashKey: S3ID - patches: - - fromFieldPath: "spec.region" - toFieldPath: "spec.forProvider.region" - transforms: - - type: map - map: - EU: "eu-north-1" - US: "us-east-1" -EOF -``` - -### Install the Crossplane command-line -To build a configuration package install the Crossplane Kubernetes command-line -extension. - -```shell -curl "https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh" -./install.sh -sudo mv kubectl-crossplane /usr/bin -``` - -Verify the Crossplane command-line installed with `kubectl crossplane --help` - -```shell -kubectl crossplane --help -Usage: kubectl crossplane - -A command line tool for interacting with Crossplane. - -Flags: - -h, --help Show context-sensitive help. - -v, --version Print version and quit. - --verbose Print verbose logging statements. -# Ouptut removed for brevity -``` - -### Build a configuration package - -Use the `kubectl crossplane` command to create an `.xpkg` file containing the -custom APIs and Crossplane configuration. - -```shell -kubectl crossplane build configuration -f crossplane-aws-quickstart/ --name="crossplane-aws-quickstart" -``` - -Now an `.xpkg` OCI image is inside the `crossplane-aws-quickstart` directory. - -```shell -ls crossplane-aws-quickstart/ -composition.yaml crossplane-aws-quickstart.xpkg crossplane.yaml definition.yaml -``` - -## Next steps -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. -* Read more about [Crossplane concepts]({{}}) \ No newline at end of file diff --git a/content/v1.13/getting-started/provider-aws.md b/content/v1.13/getting-started/provider-aws.md index e5e47a415..4bf4b783f 100644 --- a/content/v1.13/getting-started/provider-aws.md +++ b/content/v1.13/getting-started/provider-aws.md @@ -3,1092 +3,97 @@ title: AWS Quickstart weight: 100 --- -Connect Crossplane to AWS to create and manage cloud resources from Kubernetes with the [Upbound AWS Provider](https://marketplace.upbound.io/providers/upbound/provider-aws). +Connect Crossplane to AWS to create and manage cloud resources from Kubernetes +with the +[Upbound AWS Provider](https://marketplace.upbound.io/providers/upbound/provider-family-aws/v0.37.0). -This guide is in three parts: +This guide is in two parts: * Part 1 walks through installing Crossplane, configuring the provider to authenticate to AWS and creating a _Managed Resource_ in AWS directly from your Kubernetes cluster. This shows Crossplane can communicate with AWS. -* [Part 2]({{< ref "provider-aws-part-2" >}}) creates a -_Composite Resource Definition_ (XRD), _Composite Resource_ (XR) and a _Claim_ -(XRC) to show how to create and use custom APIs. -* [Part 3]({{< ref "provider-aws-part-3" >}}) demonstrates how to patch -_Compositions_ with values used in a _Claim_ and how to build a Crossplane -_Package_. +* [Part 2]({{< ref "provider-aws-part-2" >}}) shows how to build and access a + custom API with Crossplane. + ## Prerequisites This quickstart requires: -* a Kubernetes cluster with at least 6 GB of RAM +* a Kubernetes cluster with at least 2 GB of RAM * permissions to create pods and secrets in the Kubernetes cluster * [Helm](https://helm.sh/) version v3.2.0 or later * an AWS account with permissions to create an S3 storage bucket * AWS [access keys](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) -## Install Crossplane - -Crossplane installs into an existing Kubernetes cluster. - -{{< hint type="tip" >}} -If you don't have a Kubernetes cluster create one locally with [Kind](https://kind.sigs.k8s.io/). -{{< /hint >}} - - -### Install the Crossplane Helm chart - -Helm enables Crossplane to install all its Kubernetes components through a _Helm Chart_. - -Enable the Crossplane Helm Chart repository: - -```shell -helm repo add \ -crossplane-stable https://charts.crossplane.io/stable -helm repo update -``` - -Run the Helm dry-run to see all the Crossplane components Helm installs. - -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---dry-run --debug \ ---namespace crossplane-system \ ---create-namespace -``` -{{}} -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---dry-run --debug \ ---namespace crossplane-system \ ---create-namespace -install.go:193: [debug] Original chart version: "" -install.go:210: [debug] CHART PATH: /home/vagrant/.cache/helm/repository/crossplane-1.10.1.tgz - -NAME: crossplane -LAST DEPLOYED: Thu Jan 19 15:52:08 2023 -NAMESPACE: crossplane-system -STATUS: pending-install -REVISION: 1 -TEST SUITE: None -USER-SUPPLIED VALUES: -{} - -COMPUTED VALUES: -affinity: {} -args: {} -configuration: - packages: [] -customAnnotations: {} -customLabels: {} -deploymentStrategy: RollingUpdate -extraEnvVarsCrossplane: {} -extraEnvVarsRBACManager: {} -image: - pullPolicy: IfNotPresent - repository: crossplane/crossplane - tag: v1.10.1 -imagePullSecrets: {} -leaderElection: true -metrics: - enabled: false -nodeSelector: {} -packageCache: - medium: "" - pvc: "" - sizeLimit: 5Mi -podSecurityContextCrossplane: {} -podSecurityContextRBACManager: {} -priorityClassName: "" -provider: - packages: [] -rbacManager: - affinity: {} - args: {} - deploy: true - leaderElection: true - managementPolicy: All - nodeSelector: {} - replicas: 1 - skipAggregatedClusterRoles: false - tolerations: {} -registryCaBundleConfig: {} -replicas: 1 -resourcesCrossplane: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi -resourcesRBACManager: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi -securityContextCrossplane: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 -securityContextRBACManager: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 -serviceAccount: - customAnnotations: {} -tolerations: {} -webhooks: - enabled: false - -HOOKS: -MANIFEST: ---- -# Source: crossplane/templates/rbac-manager-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" ---- -# Source: crossplane/templates/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" ---- -# Source: crossplane/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-crossplane: "true" ---- -# Source: crossplane/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:system:aggregate-to-crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - crossplane.io/scope: "system" - rbac.crossplane.io/aggregate-to-crossplane: "true" -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - update - - patch - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - "*" -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - serviceaccounts - - services - verbs: - - "*" -- apiGroups: - - apiextensions.crossplane.io - - pkg.crossplane.io - - secrets.crossplane.io - resources: - - "*" - verbs: - - "*" -- apiGroups: - - extensions - - apps - resources: - - deployments - verbs: - - get - - list - - create - - update - - patch - - delete - - watch -- apiGroups: - - "" - - coordination.k8s.io - resources: - - configmaps - - leases - verbs: - - get - - list - - create - - update - - patch - - watch - - delete -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - - mutatingwebhookconfigurations - verbs: - - get - - list - - create - - update - - patch - - watch - - delete ---- -# Source: crossplane/templates/rbac-manager-allowed-provider-permissions.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:allowed-provider-permissions - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" ---- -# Source: crossplane/templates/rbac-manager-clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -- apiGroups: - - "" - resources: - - events - verbs: - - create - - update - - patch - - delete -- apiGroups: - - "" - resources: - - namespaces - - serviceaccounts - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.crossplane.io - resources: - - compositeresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - pkg.crossplane.io - resources: - - providerrevisions - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - - roles - verbs: - - get - - list - - watch - - create - - update - - patch - # The RBAC manager may grant access it does not have. - - escalate -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - verbs: - - bind -- apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterrolebindings - verbs: - - "*" -- apiGroups: - - "" - - coordination.k8s.io - resources: - - configmaps - - leases - verbs: - - get - - list - - create - - update - - patch - - watch - - delete ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-admin - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-admin: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-edit - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-edit: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-view - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-view: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane-browse - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.crossplane.io/aggregate-to-browse: "true" ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-admin - labels: - rbac.crossplane.io/aggregate-to-admin: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane administrators have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane administrators must create provider credential secrets, and may -# need to read or otherwise interact with connection secrets. They may also need -# to create or annotate namespaces. -- apiGroups: [""] - resources: [secrets, namespaces] - verbs: ["*"] -# Crossplane administrators have access to view the roles that they may be able -# to grant to other subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [clusterroles, roles] - verbs: [get, list, watch] -# Crossplane administrators have access to grant the access they have to other -# subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [clusterrolebindings, rolebindings] - verbs: ["*"] -# Crossplane administrators have full access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: ["*"] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: ["*"] -# Crossplane administrators have access to view CRDs in order to debug XRDs. -- apiGroups: [apiextensions.k8s.io] - resources: [customresourcedefinitions] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-edit - labels: - rbac.crossplane.io/aggregate-to-edit: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane editors have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane editors must create provider credential secrets, and may need to -# read or otherwise interact with connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] -# Crossplane editors may see which namespaces exist, but not edit them. -- apiGroups: [""] - resources: [namespaces] - verbs: [get, list, watch] -# Crossplane editors have full access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: ["*"] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-view - labels: - rbac.crossplane.io/aggregate-to-view: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane viewers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane viewers may see which namespaces exist. -- apiGroups: [""] - resources: [namespaces] - verbs: [get, list, watch] -# Crossplane viewers have read-only access to built in Crossplane types. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: [get, list, watch] -- apiGroups: - - pkg.crossplane.io - resources: [providers, configurations, providerrevisions, configurationrevisions] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-browse - labels: - rbac.crossplane.io/aggregate-to-browse: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane browsers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane browsers have read-only access to compositions and XRDs. This -# allows them to discover and select an appropriate composition when creating a -# resource claim. -- apiGroups: - - apiextensions.crossplane.io - resources: ["*"] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -# The below ClusterRoles are aggregated to the namespaced RBAC roles created by -# the Crossplane RBAC manager when it is running in --manage=All mode. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-admin - labels: - rbac.crossplane.io/aggregate-to-ns-admin: "true" - rbac.crossplane.io/base-of-ns-admin: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace admins have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane namespace admins may need to read or otherwise interact with -# resource claim connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] -# Crossplane namespace admins have access to view the roles that they may be -# able to grant to other subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [roles] - verbs: [get, list, watch] -# Crossplane namespace admins have access to grant the access they have to other -# subjects. -- apiGroups: [rbac.authorization.k8s.io] - resources: [rolebindings] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-edit - labels: - rbac.crossplane.io/aggregate-to-ns-edit: "true" - rbac.crossplane.io/base-of-ns-edit: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace editors have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] -# Crossplane namespace editors may need to read or otherwise interact with -# resource claim connection secrets. -- apiGroups: [""] - resources: [secrets] - verbs: ["*"] ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: crossplane:aggregate-to-ns-view - labels: - rbac.crossplane.io/aggregate-to-ns-view: "true" - rbac.crossplane.io/base-of-ns-view: "true" - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -rules: -# Crossplane namespace viewers have access to view events. -- apiGroups: [""] - resources: [events] - verbs: [get, list, watch] ---- -# Source: crossplane/templates/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane -subjects: -- kind: ServiceAccount - name: crossplane - namespace: crossplane-system ---- -# Source: crossplane/templates/rbac-manager-clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane-rbac-manager -subjects: -- kind: ServiceAccount - name: rbac-manager - namespace: crossplane-system ---- -# Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: crossplane-admin - labels: - app: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: crossplane-admin -subjects: -- apiGroup: rbac.authorization.k8s.io - kind: Group - name: crossplane:masters ---- -# Source: crossplane/templates/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: crossplane - labels: - app: crossplane - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -spec: - replicas: 1 - selector: - matchLabels: - app: crossplane - release: crossplane - strategy: - type: RollingUpdate - template: - metadata: - labels: - app: crossplane - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - spec: - securityContext: - {} - serviceAccountName: crossplane - initContainers: - - image: crossplane/crossplane:v1.10.1 - args: - - core - - init - imagePullPolicy: IfNotPresent - name: crossplane-init - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: POD_SERVICE_ACCOUNT - valueFrom: - fieldRef: - fieldPath: spec.serviceAccountName - containers: - - image: crossplane/crossplane:v1.10.1 - args: - - core - - start - imagePullPolicy: IfNotPresent - name: crossplane - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: LEADER_ELECTION - value: "true" - volumeMounts: - - mountPath: /cache - name: package-cache - volumes: - - name: package-cache - emptyDir: - medium: - sizeLimit: 5Mi ---- -# Source: crossplane/templates/rbac-manager-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: crossplane-rbac-manager - labels: - app: crossplane-rbac-manager - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" -spec: - replicas: 1 - selector: - matchLabels: - app: crossplane-rbac-manager - release: crossplane - strategy: - type: RollingUpdate - template: - metadata: - labels: - app: crossplane-rbac-manager - release: crossplane - helm.sh/chart: crossplane-1.10.1 - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: cloud-infrastructure-controller - app.kubernetes.io/part-of: crossplane - app.kubernetes.io/name: crossplane - app.kubernetes.io/instance: crossplane - app.kubernetes.io/version: "1.10.1" - spec: - securityContext: - {} - serviceAccountName: rbac-manager - initContainers: - - image: crossplane/crossplane:v1.10.1 - args: - - rbac - - init - imagePullPolicy: IfNotPresent - name: crossplane-init - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - containers: - - image: crossplane/crossplane:v1.10.1 - args: - - rbac - - start - - --manage=All - - --provider-clusterrole=crossplane:allowed-provider-permissions - imagePullPolicy: IfNotPresent - name: crossplane - resources: - limits: - cpu: 100m - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsUser: 65532 - env: - - name: LEADER_ELECTION - value: "true" - -NOTES: -Release: crossplane - -Chart Name: crossplane -Chart Description: Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume. -Chart Version: 1.10.1 -Chart Application Version: 1.10.1 - -Kube Version: v1.24.9 -``` -{{< /expand >}} - -Install the Crossplane components using `helm install`. - -```shell -helm install crossplane \ -crossplane-stable/crossplane \ ---namespace crossplane-system \ ---create-namespace -``` - -Verify Crossplane installed with `kubectl get pods`. - -```shell {copy-lines="1"} -kubectl get pods -n crossplane-system -NAME READY STATUS RESTARTS AGE -crossplane-d4cd8d784-ldcgb 1/1 Running 0 54s -crossplane-rbac-manager-84769b574-6mw6f 1/1 Running 0 54s -``` - -Installing Crossplane creates new Kubernetes API end-points. Look at the new API end-points with `kubectl api-resources | grep crossplane`. - -```shell {label="grep",copy-lines="1"} -kubectl api-resources | grep crossplane -compositeresourcedefinitions xrd,xrds apiextensions.crossplane.io/v1 false CompositeResourceDefinition -compositionrevisions apiextensions.crossplane.io/v1alpha1 false CompositionRevision -compositions apiextensions.crossplane.io/v1 false Composition -configurationrevisions pkg.crossplane.io/v1 false ConfigurationRevision -configurations pkg.crossplane.io/v1 false Configuration -controllerconfigs pkg.crossplane.io/v1alpha1 false ControllerConfig -locks pkg.crossplane.io/v1beta1 false Lock -providerrevisions pkg.crossplane.io/v1 false ProviderRevision -providers pkg.crossplane.io/v1 false Provider -storeconfigs secrets.crossplane.io/v1alpha1 false StoreConfig -``` +{{}} ## Install the AWS provider -Install the provider into the Kubernetes cluster with a Kubernetes configuration file. +Install the AWS S3 provider into the Kubernetes cluster with a Kubernetes +configuration file. ```yaml {label="provider",copy-lines="all"} cat <}}Provider{{}} Custom Resource Definition tells Kubernetes how to -connect to the provider. +The Crossplane {{< hover label="provider" line="3" >}}Provider{{}} +installs the Kubernetes _Custom Resource Definitions_ (CRDs) representing AWS S3 +services. These CRDs allow you to create AWS resources directly inside +Kubernetes. Verify the provider installed with `kubectl get providers`. -{{< hint type="note" >}} -It may take up to five minutes for the provider to list `HEALTHY` as `True`. -{{< /hint >}} -```shell {copy-lines="1"} +```shell {copy-lines="1",label="getProvider"} kubectl get providers -NAME INSTALLED HEALTHY PACKAGE AGE -upbound-provider-aws True True xpkg.upbound.io/upbound/provider-aws:v0.27.0 12m +NAME INSTALLED HEALTHY PACKAGE AGE +provider-aws-s3 True True xpkg.upbound.io/upbound/provider-aws-s3:v0.37.0 2m53s +upbound-provider-family-aws True True xpkg.upbound.io/upbound/provider-family-aws:v0.37.0 2m48s ``` -A provider installs their own Kubernetes _Custom Resource Definitions_ (CRDs). These CRDs allow you to create AWS resources directly inside Kubernetes. +The S3 Provider installs a second Provider, the +{{}}upbound-provider-family-aws{{}}. +The family provider manages authentication to AWS across all AWS family +Providers. -You can view the new CRDs with `kubectl get crds`. Every CRD maps to a unique AWS service Crossplane can provision and manage. +You can view the new CRDs with `kubectl get crds`. +Every CRD maps to a unique AWS service Crossplane can provision and manage. {{< hint type="tip" >}} -See details about all the supported CRDs in the [Upbound Marketplace](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). +See details about all the supported CRDs in the +[Upbound Marketplace](https://marketplace.upbound.io/providers/upbound/provider-aws-s3/v0.37.0). {{< /hint >}} ## Create a Kubernetes secret for AWS -The provider requires credentials to create and manage AWS resources. Providers use a Kubernetes _Secret_ to connect the credentials to the provider. +The provider requires credentials to create and manage AWS resources. +Providers use a Kubernetes _Secret_ to connect the credentials to the provider. -First generate a Kubernetes _Secret_ from your AWS key-pair and then configure the Provider to use it. - -{{< hint type="note" >}} -Other authentication methods exist and are beyond the scope of this guide. The [Provider documentation](https://marketplace.upbound.io/providers/upbound/provider-aws/latest/docs/configuration) contains information on alternative authentication methods. -{{< /hint >}} +Generate a Kubernetes _Secret_ from your AWS key-pair and +then configure the Provider to use it. ### Generate an AWS key-pair file For basic user authentication, use an AWS Access keys key-pair file. {{< hint type="tip" >}} -The [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) provides information on how to generate AWS Access keys. +The [AWS documentation](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds) +provides information on how to generate AWS Access keys. {{< /hint >}} Create a text file containing the AWS account `aws_access_key_id` and `aws_secret_access_key`. +{{< editCode >}} ```ini {copy-lines="all"} [default] -aws_access_key_id = -aws_secret_access_key = +aws_access_key_id = $@$@ +aws_secret_access_key = $@$@ ``` +{{< /editCode >}} Save this text file as `aws-credentials.txt`. @@ -1097,7 +102,13 @@ The [Configuration](https://marketplace.upbound.io/providers/upbound/provider-aw {{< /hint >}} ### Create a Kubernetes secret with the AWS credentials -A Kubernetes generic secret has a name and contents. Use {{< hover label="kube-create-secret" line="1">}}kubectl create secret{{< /hover >}} to generate the secret object named {{< hover label="kube-create-secret" line="2">}}aws-secret{{< /hover >}} in the {{< hover label="kube-create-secret" line="3">}}crossplane-system{{}} namespace. +A Kubernetes generic secret has a name and contents. +Use +{{< hover label="kube-create-secret" line="1">}}kubectl create secret{{}} +to generate the secret object named +{{< hover label="kube-create-secret" line="2">}}aws-secret{{< /hover >}} +in the {{< hover label="kube-create-secret" line="3">}}crossplane-system{{}} namespace. + Use the {{< hover label="kube-create-secret" line="4">}}--from-file={{}} argument to set the value to the contents of the {{< hover label="kube-create-secret" line="4">}}aws-credentials.txt{{< /hover >}} file. ```shell {label="kube-create-secret",copy-lines="all"} @@ -1128,9 +139,12 @@ creds: 114 bytes ``` ## Create a ProviderConfig -A `ProviderConfig` customizes the settings of the AWS Provider. +A {{< hover label="providerconfig" line="3">}}ProviderConfig{{}} +customizes the settings of the AWS Provider. -Apply the {{< hover label="providerconfig" line="2">}}ProviderConfig{{}} with the command: +Apply the +{{< hover label="providerconfig" line="3">}}ProviderConfig{{}} +with the this Kubernetes configuration file: ```yaml {label="providerconfig",copy-lines="all"} cat <}}secretRef{{}}. +This attaches the AWS credentials, saved as a Kubernetes secret, as a +{{< hover label="providerconfig" line="9">}}secretRef{{}}. -The {{< hover label="providerconfig" line="11">}}spec.credentials.secretRef.name{{< /hover >}} value is the name of the Kubernetes secret containing the AWS credentials in the {{< hover label="providerconfig" line="10">}}spec.credentials.secretRef.namespace{{< /hover >}}. +The +{{< hover label="providerconfig" line="11">}}spec.credentials.secretRef.name{{< /hover >}} +value is the name of the Kubernetes secret containing the AWS credentials in the +{{< hover label="providerconfig" line="10">}}spec.credentials.secretRef.namespace{{< /hover >}}. ## Create a managed resource -A _managed resource_ is anything Crossplane creates and manages outside of the Kubernetes cluster. This creates an AWS S3 bucket with Crossplane. The S3 bucket is a _managed resource_. +A _managed resource_ is anything Crossplane creates and manages outside of the +Kubernetes cluster. + +This guide creates an AWS S3 bucket with Crossplane. + +The S3 bucket is a _managed resource_. {{< hint type="note" >}} AWS S3 bucket names must be globally unique. To generate a unique name the example uses a random hash. @@ -1175,13 +198,20 @@ spec: EOF ``` -The {{< hover label="xr" line="3">}}apiVersion{{< /hover >}} and {{< hover label="xr" line="4">}}kind{{}} are from the provider's CRDs. +The {{< hover label="xr" line="3">}}apiVersion{{< /hover >}} and +{{< hover label="xr" line="4">}}kind{{}} are from the provider's CRDs. + +The {{< hover label="xr" line="6">}}metadata.name{{< /hover >}} value is the +name of the created S3 bucket in AWS. +This example uses the generated name `crossplane-bucket-` in the +{{< hover label="xr" line="6">}}$bucket{{}} variable. -The {{< hover label="xr" line="6">}}metadata.name{{< /hover >}} value is the name of the created S3 bucket in AWS. -This example uses the generated name `crossplane-bucket-` in the {{< hover label="xr" line="6">}}`$bucket`{{}} variable. +The {{< hover label="xr" line="9">}}spec.forProvider.region{{< /hover >}} tells +AWS which AWS region to use when deploying resources. -The {{< hover label="xr" line="9">}}spec.forProvider.region{{< /hover >}} tells AWS which AWS region to use when deploying resources. The region can be any [AWS Regional endpoint](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) code. +The region can be any +[AWS Regional endpoint](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints) code. Use `kubectl get buckets` to verify Crossplane created the bucket. @@ -1207,6 +237,9 @@ bucket.s3.aws.upbound.io "crossplane-bucket-45eed4ae0" deleted ``` ## Next steps -* [**Continue to part 2**]({{< ref "provider-aws-part-2">}})** to create a Crossplane _Composite Resource_ and _Claim_. -* Explore AWS resources that Crossplane can configure in the [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). -* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with Crossplane users and contributors. \ No newline at end of file +* [**Continue to part 2**]({{< ref "provider-aws-part-2">}}) to create a + Crossplane _Composite Resource_ and _Claim_. +* Explore AWS resources that Crossplane can configure in the + [Provider CRD reference](https://marketplace.upbound.io/providers/upbound/provider-family-aws/). +* Join the [Crossplane Slack](https://slack.crossplane.io/) and connect with + Crossplane users and contributors. \ No newline at end of file