Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2022, 1 Jun 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Writing Crossplane Providers with Code Generation - Muvaffak Onuş & Hasan Türken, Upbound

Description

Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Writing Crossplane Providers with Code Generation - Muvaffak Onuş & Hasan Türken, Upbound

Crossplane providers are Kubernetes controllers that act as the bridges between your cluster and any external API. However, it’s always been a challenge to write them with CRDs that satisfy the Crossplane Resource Model and in turn Kubernetes Resource Model. In this talk, we will go over the steps of creating a provider with the latest Crossplane Runtime and code generation tooling and then we will see how we can wire that provider up to our application to provision external infrastructure.

A

um It's a tutorial form, uh so we're gonna, like you, know, hands-on, develop a crossband provider which is, like you know, a set of kubernetes controllers with their own crds so uh before, starting how many uh like hands up if you have been using cross playing with, like you know, other providers right now, nice, uh so how many of you just heard crossplane, but not using it yet or just like you know, at the consideration phase nice and how many of you started actually developing provider and, like you know, got stuck somewhere so you're, looking like how to develop that yeah cool, all right cool, um so yeah writing cross pain providers so cross paying providers.

A

Allow you to bring any external resource external api into your cluster, as is as crds. So this is not like. You know, really like a unknown or like a very novel thing, but, like you know, with the tools and runtime and code generation tooling, we built we have now a framework optimized for interacting with crud external resource apis.

A

For, for example, like you know, the main thing with the kubernetes control is like apply logic like hey update. If it already exists and like you know, create only if it doesn't et cetera so like all these are like you know, handled uh towards, like you know, optimus optimized, for assuming that the external api is like you know, uh in design in corrupt method, not like in a declarative fashion. So essentially, what we do here, like you know, have a framework that contains, like you, know, runtime and code generation, tooling.

A

That will allow you to take an imperative api and expose it as declarative, api and use cross-plain, primitives, abstractions and compositions. On top of it.

A

So yeah a little bit up about us, so I'm well uh I work at that pound and I make I've been a crosstalk maintainer since v 0.3, which is around like three years now, and I had worked at sap before that again, developing kubernetes controllers in sun.

B

Yeah, I'm hasan and just like I'm working at upbound and I am the newest maintainer of crossplane, uh with crossplane 1.7 release. We shipped the external secret store feature, and after that uh I am honored to be a uh crossband maintainer.

A

Yeah- and there are lots of, like you know, provider maintainers, which are like you know, on the orders of 10 so feel free to like after this tutorial, feel free to go ahead and contribute and, like you know, become a maintainer cool. So we can. We can start. So what is a cross pin provider, as I just mentioned just like you, create pods and deployment resources.

A

Crosspin providers brings the ability to your cluster to create external resources like buckets. For example, this is from provider aws s3 database cross, pane io and you can create a bucket with, like you know, a lot of uh like all the configurations that are available via aws cli or the api.

A

So this is like you know in its essence. That's what, like you know what it adds to your cluster and then so.

A

Technically, though, like you know, what makes up a crosspin provider is first custom resource definition for this type, which is like a schema, and one thing that is different. Like you know, then, the generic kubernetes controllers is that we have this concept of xrm crosspin resource model, which we will go into details in a minute and then implementation of the kubernetes controller, reconciling that crd and then provider, config type, which is also a little bit like a crosspin specific term that tells like you know, for every resource.

A

You need to tell how it will authenticate to the target api for aws, for example, this points to a secret with a like aws access, key and stuff so per resource you have to, like you know, say: okay, this is the provider config that you should use for this resource and the package metadata these cont. These providers are packaged as oca oci images, and you can use crosspin package manager to install them.

A

um Yeah cross pay resource model. So this is, uh I think, the crux of like you know, cross pm providers and like why would you develop a crosspin provider as opposed like you know, a standard, kubernetes controller.

A

uh This resource model is based on kubernetes resource model krm, which, like you know you can take a look at after the session, uh which is, like you know, a bowl of text with like api conventions, uh references optionality and everything. So on top of that, as a superset of that krm model, we have many conventions that make up crosspin resource model. For example, the first and most important one is high fidelity.

A

So on the right ucdb instance, which is like you know, rds from aws high fidelity says that you should be able to do everything with that crd. That api allows so, like you know, there are only a couple of fields right now to make it like, you know, fit there, but there are close to 100 fields of rds instance.

A

So, like you know at because this is like you know, the lowest level primitive in your cluster that we will build. On top of it has to expose everything like it's, not an abstraction but more like representation of the external resource, so it has to show all knobs and toggles and in the status it should show, like you know, everything that you can't configure like.

A

You know: health of the db instance, for example, or the uh url generated by the by the cloud provider, and then there are like you know, other uh features like for provider at provider. So when you, when you are targeting like any external resource that it's really hard to come up with, like you know, common denominators right like summaries, some apis are like uh they have different names and different structs and everything.

A

So what this one says like you know, the spec specification should go under four provider struct, so other than that, like you know, deletion policy and, like you know, highest level, things are cross, pin specific. So at every cross pin provider you can expect to see deletion policy. You can expect to see provider config, for example, but inside for provider that is resource, specific and then under status. You have ad provider so status that ad provider would be like. You know what that specific provider returns from the api and similar to deletion policy.

A

For example, you can find a ready condition, which is also like you know, signaled by the cloud provider, so you can, for example, have a standard there, like you know, hey. If a resource reports ready, then it's definitely like ready to be used, and that is across all club club providers and all apis, and I I don't want to go to like in the detail of all of them because, like you know, I know everyone is safe to start coding.

A

But, like you know, just at the high level external name and tagging, we have the standard identification for all apis. So, like you know, you don't have to find vpcid rds id and everything. It's always external name and we handle the binding to, like you, know, actual identification in the code and no sensitive information. As you can see here, there cannot be a master user password field on the cr, so you have to like a reference, a secret and then controller will take the password from there and references.

A

I think this is like you know one of the best features of crosspin providers and we'll go into detail how we handle that it is about, like you know, referencing other resources only with their custom resource name, for example, vpc id right. If you create a vpc, its id is assigned later. So, if you you can you are able to give its name metadata name, cr name in a folder like in a bit bunch of infrastructure, and when you keep ctl apply it, it will wait for vpc id to appear and then use it.

A

So it will become eventually consistent. You don't have to like, you know, create vpc, take the id and copy it to other resource so that it can start creating and then connection secret is also like you know, as standard right connection secret to ref. So when I create this rdsdb instance, it publishes once it's ready. It publishes a connection secret that you can mount to your pods, which we will do as part of the demo to connect planet scale database to wordpress uh via connection secret, and then deletion policy is like you know.

A

If you, if you don't want dbst to be ever deleted, you can keep it orphaned and even though you delete this resource, it's going to be, like you know, still in aws um and yeah and others uh readiness conditions, crd categories, which we can take a look later, and there is this link to for the whole xrm spec yeah. So um so all these external features.

A

As I said in the beginning, we have a framework that, composed of like you, know, a runtime code generation and some scaffolding, so that it's like you know, you already have to re write. Only the cloud provider's specific stuff right. So, for example, this is a usual gcp cloud. Sql instance. Crd here you see like you know, we have inline xpv one resource spec that comes from cross, plane, runtime and it has the standard fields so under four provider.

A

Then you start to give like you know: hey cloud sql instance requires these parameters to work with. So that's like you know this. This is like scaffold file which we will create with a command and then populate inside these parameters and observation structs because, like you know, they are the ones that are like you know, api, specific and the rest is like you know, cross plane generic.

A

So as an example, the resource specs struck from cross plane runtime, contains this right connection: secret ref provider, config graph and deletion policy. So you can be sure that, like you know, at every crosspin provider and crd, you can find these fields and build your assumptions on top of them.

A

And then the controller, I think this is one of the key parts. So when you develop a crossplane provider, you yourself don't actually write the whole controller logic and what I mean by control controller logic. uh If, if you have developed kubernetes controllers before this function, signature should be like. You know really familiar to you, because it's what upstream controller runtime requires right. So in crossplan runtime we actually develop that signature for.

C

A

And then ask only the crowd methods of the api, so you don't have to think about. Like you know, okay, is this function? I'd important is this function like you know, uh if, if at the same two controllers reconcile at the same time will create be called two times, for example, how does the like you know, calls uh are made for like no deletion, for example?

A

So all these, like you, know, basic logic that you have to write for every api are handled in this controller, so, for example, if you can see here like we uh get the resource like new managed and I will go into like you know, I will show you the interface there, so it works with. Like you know, interface and, like you know, I'll show how it's generated, and then here the logic starts right. For example, it's like if if the resource is deleted and if, if it's orphan, like you know, don't touch it.

A

If it's not orphan, like you do that and do this, like you know, the whole logic is implemented here. So, in order for this controller to work that is, like you know what you need to provide as uh functions of the crowd functions in your actual implementation, because, like you know, that is the point that we cannot generalize across all apis right, we cannot know, like you know, observe implementation of cloud sql instance.

A

While we write we'll write this, like you know, in cross, pin runtime. So that's where you come in and, like you know, add these functions, which we will do for two resources in a minute like observe, create, update and delete, and then uh this is the you remember. There was a new managed call, and this is like you know, another interface that has to be satisfied by your crd, and that is like you know how we impose these standards at a technical level. So, like you know it's not only a convention.

A

Whenever we can, we impose those, like you know, as technical limitations, for example, it has to have like provider config reference interface. It has to implement that it has to implement conditional interface, which is like already conditioned sync condition, and it has to, like you know, have connection secret writer to interface implemented and for all these, because they are like generic across all resources.

A

We have code generation tools that will help you just to like you know, scaffold make your changes, run, make generate and all is filled and, like you know, ready to be used, and this is an example of generated code by our angry jet tool. So, as you can see, cloud sql instance get condition, get deletion policy. These are all and, like your code, is analyzed statically and then, like you know, if it sees resource spec in line, it generates all of these automatically, so that you don't have to think about. Okay, like you know now.

A

What do I need to like? You know implement extra to to to satisfy this interface, because we want to keep as little as possible to for implementation so that you can focus on your api bindings like the crud methods that I showed earlier and the next one is the referencing that I mentioned in the xrm, and this is like you know, one of the key differences between, like you know, other infrastructure as code tools is that it works just like kubernetes references right in kubernetes.

A

You refer to, like you know, specific, like with label selector, you refer to services from services to parts, for example, and that is like you know how we do the same thing with infrastructure.

A

For example, you can refer from rds instance to three subnets and vpcs and security groups all in the similar way with kubernetes, and that is like you know how we technically implement this. You add reference and selector, and these are like same as kubernetes structs, and then we annotate this field so that it generates the actual reference dissolving function.

A

For example, in other tools, you you, whenever you need to uh reference another object. You have to give the field pass like hey, go and take this information from spec for provider vpc id and that and then maybe normalize it with like. You know, concatenate it and do that all this is built in in the in the in the provider code.

A

So you only need to give always like you know the custom resource name and the eventual consistency and, like you know, with one cube, ctl apply, you can bring up the whole world of cloud resources.

A

Yeah- and this is the actual, like you know, generated code for the reference reserval, and this is also like you know what we will say in a minute. I'm just like you know, keeping giving you like a little peaks of the code that we will be working with. uh You see it like resolve references, and then we use the fields and report like you know: it's not resolved so yeah, it's it's. uh It's all generated code um and yeah. Now uh we will start the implementation.

A

uh Hassan will be helping here so plan a scale provider. We will implement a database crd and it requires password password. Api is a different api, so we have to implement a different crd for that and then we will have. We will write a composition, cross, plane, composition that has one database, one password and one wordpress installation with helm. So with composition we will have a new api, we will define it via yaml xrd and we will go into details after the implementation and then, like you know, with one namespace yaml you will have both.

A

You will have all these three, like you know, provisioned immediately and yeah. So I will uh let hassan take over and start the implementation.

B

Thank you um yeah, so maybe I should quickly uh talk about why we choose planet scale in our implementation.

B

So plan scale is a managed service with cool features and it's based on or works on top of open source, vts project and uh the the first point is: it does not have a crossplan provider yet so we will implement it here together from scratch. uh Another thing is like: it allows you to have one database for a free account so that you can just uh you know like try that out by creating an account and getting an access token.

B

So uh this is why we choose planetscale yeah. So let me start so. uh First of all, uh we will start, I don't know like I. I believe there will be someone who will try following the uh implementation, so I will try to be as slow as possible.

B

So first of all, we will need to go to crossplane slash provider template.

B

So this is a template, github template and it has all the you know like scaffold or all the functionalities, including ci, including builds make files etc. So we can just make a quick start from here and then it will be easier to build our provider.

B

So first thing is we'll need to hit this use, this template button and then select an organization. I will start this under crossplane contrib, but you can select it select your own gita pork planet, scale, provider plan scale. So now I'm hitting create repository.

B

All right so now I'm cloning it to my demo directory.

B

This text size is good for everyone, okay, so cd provider, planet scale, and let me open my goland.

D

B

So right now everything uh like we only have template inside the repository you can see like in the readme. We have provider template in image names. We have template template controller, we have a sample api and we only have a sample controller like in this state. You can already build and run this controller and it will have a sample api. You can play with it, but now we will not do that. We will immediately start building our own providers.

B

So first step is, as you would expect, to replace the name template with planet scale, so that we can, you know like we can have the correct name of our provider, so we have recently added uh a helper utility helper make targets, I would say so. Let me open my notes.

B

Yeah so, first of all, after you know cloning we need to run make sub modules so that we get build sub module, uh which is a common sub module. That is, you know under a pound uh organization, but it contains like really useful utilities for building and pushing images and help charts etc.

B

So we have we got it and the make target that I mentioned is make provider.prepare, and then we gave the provider name and it will be planetscale yeah. So, let's check what happened yeah as you can see all the name. Template names replaced with planet scale and we got rid of the sample api.

B

We don't have any api. Yet in this controller. So now, let's use the other, you know helper make target and to generate and generate the database type. So for any type. You would need to define a group and a kind in kubernetes and also a api version.

B

So I will not give api version and it will default to v1 alpha one, but I will need to find a group and a you know, a kind so typically for aws services, for example, you can have ec2 as group name and then instance as kind, but in the case of planet scale like we have database, and we could of course say it's database and kind, as instance, but I choose to use a database group and database as the name of the kind.

B

So so now, I'm running this command provider at type provider, name group, database and kind database.

B

Yeah so yeah here at this time I don't know if I can make this bigger.

B

But does anybody know that experience.

B

I can try this one.

A

B

It doesn't work well, so tools are the windows.

B

Okay, anyway, so here you can see like database. Api is created with just some placeholder, but this part is just common. We don't have to do anything specific to our resource at this section, but here you can see like spec, has a database, spec and database. The database spec contains the crossplane runtimes resource spec, which already has the built-in or common xram methods or functions or types. So here you can see right connection, secret, publish connection details, provider, config reference deletion policy.

B

We don't have to do anything uh for for those, so they they just come for free.

B

We only need to change this database parameters section- and here you can see like it is a placeholder configurable field, and we will change this in a minute so, but but before that, let's also generate the other type, which is a branch password uh in in plan scale. After after you create a database to use that database, you will need to create a password. This is a different step like in ui.

B

You can uh click and get the password, but behind the scenes it it makes another api call and uh for the branch that you selected, you can create a password. So uh this this time we use group name as branch and kind will be password.

B

B

Yeah this, this password type is also added. There is two steps that is not automated yet with this make targets, but they are relatively simple. So, first of all, we need to register our apis in this api, slash plan scale.go file, and then we also need to register our controllers. So let's go there yeah here you can see, we got rid of actually the sample and we now have database, and this should be database.

B

We want alpha one database, we want iphone and then we also have a branch group.

B

B

Okay, so we have registered our apis under apis directory now. The next thing is uh to register our controllers, so you can see we have database type and password type and we no longer have my type. So, let's change it database database, dot, setup and password and password.setup okay, so we have types generated controllers generated as placeholders or as scaffold and registered those apis and controllers.

B

Now, if we check here like in schema builder register, it fails like gives an error, like some methods are missing, deep copy object, etc.

B

So at this point we use code generation tools, uh controller, runtime, controller tools uh will generate these deep copy methods like the the methods common to any kubernetes object like just like you are building a normal crossplane kubernetes operator, but the cross plane tools will also do the same and generate the required methods for cross-plane x-ray.

B

So let's call make that generate.

B

Okay, so let's see what we had generated yeah, so you can see like generated that deep copy. This is generated by uh controller tools and we also have generated that managed, managed resource managed is a concept in kubernetes. In crossplane we call external resource representations as managed resources. So here we see like the generated methods for to satisfy crossplane xram.

B

So I think we are in a good state, so it's good to commit these changes not to lose. So I will just add everything.

B

And generate types generate and register types. So now we have our controller with types, but there is no business logic in it. So, let's, let's do that right now.

B

So, first of all, uh since this is uh you know, like the controllers are implemented in golang, we will need to find a go client for the api that we will be interacting with. So I will search for planet scale.

B

B

Yeah so let's see what we have in database yeah, so here you can see, create database request and it has these fields. So in our spec we will also need the same fields, so I will just copy them here and go to api database database type and parameters, four parameters and database parameters, so I will just put them here and do some minor modifications.

B

First of all, I will need to you know, add a json tag for this as well, and it is organization.

B

We don't need name because we will use the metadata.name of our custom resource, so I'm yeah our external name, yeah external name uh and I'm getting rid of this, and one thing uh like one important point here, like uh notes and region, has empty text which indicates that these are optional fields. uh You can verify this by. You know like creating a database from ui, and you see that those are optional. So since they are optional, we will need to change their type from string to pointer to string type.

B

So when it is string pointer, we can, you know like check whether it is nil or not. If it is nil, we we just uh do not pass anything so for optional types in crossplane. We uh you know set this.

B

So, let's also add the q builder tag optional.

B

Optional yeah, so I think we are good to continue so in the observation section. uh This will be the output of the uh or add status part. So, let's see what we have, we can always add. You know like more along the way, but let's say we have a created at fields and a state that would be interesting at the end of the day. We will add all of them, but let's start with just having state here so states and have it as string for the sake of simplicity,.

B

B

Okay, so we con, we added our parameters and observation fields, and now we can continue with the controller part. So here is the controller. This is uh just this. Just has uh the you know, uh crap methods that mo fact showed uh with a you know like a good level of initial initialization code, so we will implement, observe, creates, updates and deletes, and for that first of all, we will need to implement the connect method in the connect method.

B

We we need to initialize a client of the external service, which is a planet scale service, and for that of course, we need to extract some credentials or find some credentials from somewhere, so in cross plane. This is done by reading the provider config and usually, or typically, this provider configs refer to a kubernetes secret and that secret contains the actual api credential.

B

So these placeholder codes will extract the uh you know secret that we need and then pass to new service function and new service function gets a credentials as a credential as input and then returns an interface. So we will need to define this interface like we no longer need to use knob service. So I will replace it as a planet scale.

B

Okay, so we will initialize the planet scale service and before that, let me just go and get planet scale go client, so that uh goland could help me to you know autocomplete. So I get. I got the plant scale, goat client. So now in this plant scale, clients blendscape service, we will have a pcli, and this pcli should be type of planet scale, dot, client, and we will need to initialize this client, somehow credits and return it.

B

So, let's so there are two ways uh in class case service to authenticate to api. One is service, account tokens, the other is access token.

B

Somehow I couldn't make it with make it work with service account tokens, but it works with access tokens. So I already have my access token configured. If anyone interested, I can show you how you can get it because it's not straightforward, you cannot just get it from the ui. uh I had to initialize client and read from a local directory.

B

So, but the point is uh now we we assume that this grads is access token and uh let's initialize uh our client planet scale. Dots new clients and planet scale that, with access token and access token, is actually coming as crates so string.

B

And this also returns an error, and if error is not oh, I think I don't even need that pcli c and error. Okay, now new planet scale, service function, returns a client, initializes and returns the client for us okay. So this should be pointer to planet scale, service and uh this signature has changed. So we also need to change the signatures.

B

Okay, I think we are good to go.

B

So we have our client initialized and now we will need to implement those crude methods, and here we of course need to pass service as planet scale service and let's go and implement our observer methods.

B

Okay, we can also start with create to make it uh more exciting, so, uh let's implement the create. So what we have we have that external and service, and it has our plan scale. Client. Now I can call databases create, we have context and it requires a planet scale.

B

Database database creates requests or create database requests, yeah so fill all fields, and this requires a pointer okay. Now we need an organization and uh in the ui I have my organization as turkan here to can h. So, let's use that, oh actually, we will just get what we have from spec, so cr dot, spec, spec.for provider, dot organization. So we get our uh organization and for metadata for for name actually, we will use uh the external name, so metadata get external name of custom resource and these are optional fields.

B

So, let's check if they are really set spec dot for provider. That notes, if it is not nil, let's say note.

B

Empty nodes equals.

B

Okay, do the same for region.

B

Okay, so this returns a db and an error, and now we can check the state of the db.

B

Cr dot, situs dot.

B

B

And no not set conditions.

B

State equals db dot states and let's convert it to a string because it has. It is an enum okay. So now we don't get any connection details here. I can show it so you can see like what are returned from the api nodes region. State atm html, url name created and updated it. So, as we said in the beginning, we will need to implement another resource for that.

B

Okay. Now I think we are good to give it a try just to make it a bit more exciting. So what I will do is, I will run make generate once.

B

B

B

Okay, so I have a brand new kind cluster. So, first of all I will apply the crds that were already generated for me. You can see password database provider, config and others, and now I can run my controller with make run.

B

So while it is running.

B

Okay, so let's find an example here and just I think I can just rename it factory name, database and refactor rename database.

B

And I have databases, group plan scale and then database and for provider. I have organization here.

B

Here- and it is my organization and let's also add a note, hello from crossplane.

B

And I will also need to create a provider config, let's make it default, so an example provider config. I have my token secret, so I'm deleting this one and let's use it. Okay, so uh cube ctl, apply, f,.

B

P scale token secret.

B

B

I will create my provider config.

B

All right so now I can create our database. So let's have a final look. If everything is looking good, so it will be named, as example, and it will be under to turkey and h organization, and it will have this uh note so cuba ctrl create examples.

B

Database, database.tml, ctl.

B

Get database, let's watch it.

B

Okay, so it says it is synced, but since we didn't set any ready condition yet uh it didn't report ready. We usually set this in observe method, so we observe and verify that it's really exist and its state is ready, after that we set it as ready. So, let's see what we have in here, we don't have anything.

B

B

External resources up to.

A

B

Okay, so we should implement, observe as well yeah, so we couldn't make it fast anyway. So I will stop and uh create method is not called because in observe. We should observe and make sure that it is not existing. So we will also need to implement observe method.

B

So, let's do it quickly so see that service dot, pcli databases get ctx planetscale.getdatabase.

B

Request fill all fields, organization, cr, dot, inspect that for provider, organization and meta dots, get external name cr and.

B

Okay, so tb error and now we need to check like we get. We try to get the database, and now we need to check whether it's really it's. It is an not found error or something else.

B

So we do that, like that and error planet scale errors and if it is planet, scale, error and its code is a.

B

Not found, then, so these group methods expect this. You know like managed external observation result and return, managed external observation, and if it does not exist, we should just say resource exists as false and if it exists.

B

Nil and if it exists, then we will need to uh you know: if db dot state equals planet scale that database ready, then cr, dot status, dot, set condition, xp, v1, dot available.

B

Okay, so in the database spec there is no field to to be updated in in scale database. U api! So if it exists, we just return as existent. uh That's it so now we can just run it again. We didn't make any api changes, so we don't need to regenerate anything.

B

Okay, what's this.

B

Error is not filling its scale errors.

B

Okay, this one.

B

Okay, now it says true, let's check yeah, as you can see, our database is created and our node is available here and we are almost done with the database resource one one last method that we will need to implement this delete method. But at this point, if there are any questions, we can try to respond any questions up to this point.

B

Okay, so um we have our database ready and also the last method that we will need to implement is just delete and cr dot, not cr c dot, service, dot, cli databases, delete context and planet scale, delete database requests, fill all fields, cr dot, spec, that for provider organization and for the database name, meta, dot get external name, and we have cr here.

B

This only returns an error, so we can just return its results back in the delete.

B

All right so, let's run it again and also verify delete as well.

B

How can I do that.

B

Okay, here you can see the database is gone and uh we have completed the implementation of the database. So let us it's adds commits.

B

Database, okay, now the next resource that we need to implement is password. I will try to be as fast as possible because most of the parts will be just duplicate, so I'm just copying this part here. Ideally, we should not repeat ourselves, but just to be fast. I'm copying here so, and new service function.

B

Service, so we don't have to do anything here.

B

Let's kill service okay in observe, we get c dot service, dot, pcli passwords gets ctx scale, get password or password his branch password requests, and here.

B

Oh, we need to fill the api first, so we cannot be that fast.

B

So we need to check the passwords here and we again have organization database branch display name, so I will just get them from database and.

B

B

Yes, organization create: what is the create.

B

Transition database branch.

B

B

B

We also have a display name.

B

We can use display name as metadata name, so I'm deleting this one as well.

B

And password id.

D

B

Okay, so let's get back to implementation, password spec for provider organization and.

B

Cr dot expect that for provider.database.

B

And cr.spec.forprovider.com.

B

See all that name letter., it's external name, cr and p error and return error here.

B

All right so, let's also have create implemented, see that service dot, pcli password, create context, planet scale, database branch, password request, fill all fields, cr, dot, spec, that provider organization.

B

For provider database.

B

And cr dot spec dot for provider branch, and this is an optional field. We can implement it later and metadata name.

B

Display name is just method: cr.name, okay, so this is create.

B

P, the p error and.

B

And now uh cr dot status, that's its provider that id password from the id okay. So this is create. We don't have any update and finally, we will need to have the delete method.

B

uh Sorry starts cli, password tx when it's scale that.

B

B

B

B

So these three, I don't believe.

B

Okay, so password should also be available now and let's also create an example for it.

B

B

Vector password okay, so it is under branch group. Its name is password.

B

And it has a database.

B

Okay, so uh our password implementation is also ready. So let's uh try it now uh yeah before that. We also need to publish the connection details so um and create yeah so host. We need to find this somewhere and I'm just starting and username.

B

B

B

So for host, I remember it was.

B

Yeah this one- and this should be a byte array, so let's convert it.

B

P, dot p dot public id.

B

Writes p dot, plain text and finally,.

B

P dots do we have it here now, cr dots expect that for provider database.

B

All right, so this should be good to go. uh Since we have api changes in password. I I will need to regenerate and reapply the name types.

B

Ctl apply f package crds.

B

Okay, so make run.

B

C

B

Now we don't have any managed resources, so let's create the database again so that we can create a password for it and pass search.

B

Fingers crossed.

B

Did we have a right connection secret to refilled? I guess not in the example okay, so we also need to set to see the connection.

B

So I'm deleting this one.

D

B

Okay, so our database is ready. I will create the password now before. I would like to check if we are in a clean state, because we stopped in the middle so yeah that one. Let me clean this okay now I will create the password again.

B

Write connection secret to ref.

B

Okay, cuba, city I'll, get passwords.

B

Yeah we have our uh password is also created. We didn't set the uh available, so it's not reporting ready, but we will fix it so, but before that, let's see if our connection secret also available get secrets yeah here you can see the db con and if we check its content yeah, we have all the fields filled. So let's see what we have as host just as an example.

B

This is our host generated by planetscale for us. So let's do the final touches and then we will continue with using it from the application. So the final touch number one is uh that's number two number one is yeah to mark it as a as ready. After observing we observed it is available, and now we can cr dot status, dot, set conditions, xp v1.

B

Available yeah, this is first one. The next one is, as you might have noticed. We have the database here and actually database is another managed resource and instead of giving its name hardcore as hard coded, we can also create references, and this is especially important in the case of composition, because you would like to usually you would like to combine resources in the same composition with each other, so that you can refer, for example, to the database in the same composition. So we will also need to implement references.

B

Actually, this is just auto generation. So let's continue. Let's do that password and uh we will have database ref. In fact, do you remember the exact type reference? Okay and json.

B

Database ref and.

B

Call it empty and we also have a selector.

B

Database selector empty selector, and now we will need to say that we will refer to that previous resource. We have so let me check quickly, cross plane, tools.

B

It says that how to define resolvers.

B

Okay, so we will need to show the reference type dot com, slash cross, plane, contrib, slash provider, planet scale, then apis right, mophack and database.

B

Is this enough or should I go down.

B

B

This one is it okay,.

E

Yes, take a look at the example.

B

B

Okay, not this one.

B

One not that database okay.

B

So one thing: what is our goal? Module name? It is this one, so I would need to use that instead, instead of repo okay, so let's run make generates.

B

Okay, so what did happened is uh this new method is generated, this new file generated, and here we can see like the result, references function resolves the reference from password to uh database. So this is also good.

B

Ctl get managed.

B

I think one last try and okay, since crd has changed. I need to apply this again and make run and after seeing it as true true.

B

E

B

B

It's managed so what's wrong here.

B

I'm guessing we hit some intermediary state during development. So let's.

B

B

Okay, ctl gets managed.

B

B

Okay, I think we are good to go except this one reset that right.

B

Controller password observe here.

B

Okay, we need to set the external name here: cr dot, set external name letter set external name cr, then uh p dot public id okay. This was missing.

B

B

Okay, so let's see how it goes, let's also clean this.

E

B

Okay, so uh I think something messed up during the development, but uh we hope that, like with composition with clean installation, it will work.

A

Yeah so now we will use this now. We will use these resources in a composition and consume them from wordpress, so that wordpress works with planet scale uses as database.

A

Maybe a bit somebody about.

A

Yeah, maybe a bit about the composition, so here is the composition that we are going to use. So the main point of composition is that you don't have to like you know you don't have to create database password and everything else every time.

A

So you expose an api that that is like specific to your use case and then, like you know, let crossplane create those for you by with the configuration you give so, for example, in this case we are defining a new api with composite resource definition, type from core crossplane, and it has only one parameters: parameter block, name right and then we are saying that, like you know, for every instance of that api go ahead and create one planet scale database, one password and one hand release that installs, the the wordpress to the existing cluster in cluster, the kind cluster that right now we are using- and there are like you know some details, like the one example is here.

A

So we say that, like you know the customer that the user gives, like you, know this small claim, let me show you: they only create this one and we take spec.blog name here in composition. To say: okay, like you know, use this as the as the block name here by adding a patch.

A

So we don't write a controller for, like you know, aggregating all these resources, but we only instruct it via ammo. So without writing code, you can compose everything like that and similarly, for example, uh we can build like you know, similar apis for clusters. For example, you can have like you know in one composition, just like database and password, you can have vpc three subnet security group, internet gateway, and if you go to crossplan.io, you can see an example like more complex examples like this.

A

So right now, what we are going to do is first to create our abstraction api, which will be like kubecon, wordpress type.

A

Okay, so cube city um composition, cube ctl, apply.

A

Apply f, xrd, so once I create this, there will be two crds created by crossplane as a result.

B

You should need to install crosstalk, oh.

A

Crossplane is not installed so.

B

I have not created.

A

Yeah for xrd's and compositions, you need crossplane itself so far we haven't needed it because of like you know, with local development we don't need to package the whole provider. We just run make run and we run it locally, so um yeah so now, cuba cross plane is installed, still get ports dash and okay.

A

So now, I'm going to say cube ctl apply, define my crd xrd and then I will apply my composition, which you can see one database, one password and then hand release and by default it uses the same cluster in cluster, and for that I need to install hand provider.

A

So I am going to use crosspin cli to install hand provider in a minute. Okay, because, like you know, all the providers used in one composition should be ready and installed before you create your clay. So now I'm going to create my composition.

A

So now I have the api definition and I told crossplane to what's what what I need to happen. When an instance of that api is created, I see our custom resources created so now. I will first check whether all providers are in place in cross plane system, yeah provider. Helm is up now and I locally run the.

A

The planet, skid provider.

A

So what I will do is to first create the provider configs landscape provider. Config is already there, so what I will do is to create provider config of hand provider, because I am going to use the service account of hand provider to deploy the same cluster. I need to give it uh more permissions by default. It doesn't have the permissions to deploy to your own cluster. You would need to give a quick config to target another cluster, so I'm just like now with the small quicks, I will give permission with cluster roll binding cool.

A

So now I can create the provider config for ham. Saying, like you know, hey use this uh same cluster.

A

B

Ctrl get matched.

A

So get managed just to make sure that there is nothing in the cluster so um and because, right now we run the provider call uh the provider plans k, scale locally it. The cross plane itself does not have the permissions to deploy its crds. So we will need to give that permission to crosby. Instead, normally you would install it just like provider hand and get the permissions.

A

So what I'm going to do is to do the same thing with cross plane. Cluster roll as well just for the sake of demo.

A

Service accounts.

A

A

Cool so now crossplane has the permissions. As I said, like you know, when it's sold through the package manager, you don't need to do that. So I'm going to create this claim with, like you know, cross painting, kubecon blog name so cubectl apply claim to my namespace, which is default.

A

So now I'm going to like you know, see it started to what.

A

A

A

See all these three objects are created by cross plane with the with the configuration that you gave with composition, so I did not have to go like and create each one of them.

B

So well, I think we have five minutes left, so maybe we can leave that to the questions until it's uh yeah.

A

Getting ready, yeah so uh yeah, we need to wrap up, so let me get back to the slides while it's getting ready um so yeah. This is like you know how you uh develop a provider we had to, like. You know, develop to manage resources so that, like you know it, we can have a connection secret with the host and password details and mount mounted to pro wordpress, which is also done in that composition.

A

So, like you know, composition allows you to like you know, make all sorts of, like you know, relations between resources from different providers. So right now, for example, my cluster has a cube, convert press api available for my developers, so whenever they need, they can just create that cr and, like you know, get database password and wordpress.

A

So yeah uh you can go to crosspin io for more compositions and, like you know, go multi-cloud or multi-tire cloud or, like you know, use planet scale, azure, aws together. Everything like you know, composition is not opinionated on, like you know which providers you need to use, but it is opinionated that it needs to be a crossband provider and packages.

A

There are a lot more details about the packages, so you can package providers and also the configurations which is like you know, xrd and composition together, so you can publish them just like you know, terraform modules and registry and lastly, terrajet terajet is one of the latest uh code generation framework we have and it generates all the all. What we did uh just a minute ago, like you know, using its own generic controller, to call terraform providers under the hood. So you don't have to write the cloud vendor specific stuff.

A

So yeah, if you have any questions ready to answer and it's I think wordpress might be ready now.

A

Okay, yeah, it's it's probably something small messed up so.

B

Yeah we will uh like shortly after this demo. We will commit that provider planet scale to crossplane contrib organization, so you can check the code stage like this. uh The code that we have implemented live here will be available for you, and we will also share the composition that we are showing here.

A

Yeah- and there are like you know, other compositions like, for example right now. We use the existing cluster, but you can have, for example, gk cluster from provider gcp and connect it to like. You know, handle release object so, like you know, once you create wordpress on kubecon, it will create a cluster, it would install. uh It would create database password and then install hand, release of wordpress and then connect everything and you will get a url saying, like you know, wordpress is ready to be accessed.

A

A

Yeah yeah yeah yeah, exactly yeah, that is uh by default on, and I actually you can't really turn it off. So, like you know, it's checks like you know, uh for every event, it checks the custom resource and runs the whole reconciliation logic, and if there is no event, there is no change in your kubernetes cluster for every minute it checks, it still runs the reconciliation. We checks the external api, for example.

A

If I went to planet scale and change the description like nodes field, then it will see that it will correct that so source of the truth is the custom resource and it continues to reconcile, for example, in aws. If you change a parameter, it will likely fix that as well, so it continuously fixes just like deployment and pod deployment. Here is the database custom resource and pod. Here is the resource in the cloud. So, for example, if you delete pod deployment, will recreate it immediately and same thing with cross plain providers.

A

If you like, you know, delete the database right now, it will create a new one with the same name.

C

A

Yeah exactly so that is, that is one part that we kind of skipped. So you see there is a function. There is a field here resource up to date. So what you do here, like you know in the logic you have the p available here right and cr available. So you say, like you know, hey if p like. Let's say something like this p dot, like um I don't know, name is not equal to c r that get name. Let's say, like you, know, notes and not like in both sides.

A

So you report that and then reconciler sees it and it calls the update method so that it fixes the the the changes and.

E

A

Like you know, both ways fix the corrections and then also for every event in the cr it. It calls the update if it's necessary, yeah.

B

Actually, the the two resources that we have implemented today are a bit special in a way that, like they don't have updatable fields. So you cannot update anything on the password resource and also for the database.

B

There is no updatable parameters but, for example, if it was an aws rds database, there was a storage size and in the desired state you specify the storage size and then, if you go to aws, console and change it to something else, a crossband controller will go and actively reconcile it back to the desired state.

A

A

uh I can repeat the question yeah.

B

Yeah here is my preference.

E

B

E

For a nice talk uh really impressive work. Could you maybe uh also judge a bit on the subject of importing already existing resources yeah and how the create method gets a little bit more complicated in? In that sense,.

A

Yeah yeah, so uh if you noticed there is this external name notion here right like we, don't actually use the custom resource name because, like there are certain names that kubernetes does not allow you to name the custom resource, and you may not know it beforehand right so we use the external name annotation to get and, like you know, if provider allows, we also use that, like you know, for example, for database, you are able to give its name right in the create. So we use get external name.

A

So if you create the custom resource with an existing external name, annotation, what's going to happen, is that first observe is run for every reconcile and it will not report that resource does not exist right because create is called only if you return false here. So if it's going to, like you know, run the get call and just continue as if it was the one who created it so crosspin does not care whether it created the resource or not. So it's just like you know.

A

If there's an external name, it hits the api says, like you know, hey does that exist and if it exists, it starts to reconcile it just like, as if it was the one who created it.

E

Okay, is it okay that I ask another question yeah, um so you specified a password on uh for this database right.

E

Let's say that I compromised my password somehow is there a way to like do key rollovers with this like so I could roll over my password and then my app could like get it automatically. Do you have like a way of changing like terraform.

A

Yeah, so so in this specific example, planet scale does not allow you to give a password in plain text right. So it's only like you know, we request the password it returns and we save it to the connection secret. So in this implementation, for example, it's only published in create right, but in a you know, like you know, in an implementation that we would merge upstream. It would also like you know, publish it here in observe as well right.

A

If, if the plan scale landscape returns it but a lot of times, they either allow it to, like you know, to send over create or return as the result of create and not return it via get because it's like available for one time but, like you know, for the reso, for example, eks cluster is a great example.

A

It refreshes its token for every 15 minutes, so at every observe we actually fetch the eks cluster and then publish it so that, like you know, new token is published and then you get it updated and your application gets, like you know, refresh token and keep working so like it depends on the api. Like you know, if the api allows it, uh we do that, but one main difference with terraform there, for example. In this case, password change would require deletion of the password right.

A

We don't delete it like you know, just to get the refresh token. You have to keep ctl deleted in terraform. Like you know, if you I don't know like change it, it would delete and recreate it. There is no logic such logic in cross play like it always has to like you need to delete the resource and new one could be created, which is like you know, a great use case for composition.

A

Like you know, it's all deployed everywhere. Okay, I want to refresh the password you go and delete the manage resource. Password and composition will create a new one automatically, because that's how you configured it, like you know in in your composition, yaml, so.

E

Like to summarize changing would be deleting my resource and then getting a new one in.

A

This specific case, yes, cool, thank you you're welcome uh any other yeah last one yeah. I think we're a little bit over time.

C

Hi sorry, I had two questions, but maybe we'll see how much time we have. um If I make my own custom resource, do I need to observe for every possible configuration out there. So, for example, if I'm getting a database right, I might just observe, like name size whatever, but what, if there's a configuration configuration change down the line that I didn't monitor for and that changes is cross been able to detect as a change or only on things, I'm trying to monitor.

A

So if I understand you're asking like you know, do I have to like you know the comparison logic that I mentioned. Do I have to do that for every field right. So uh actually, yes, like you.

C

A

For example, idea systems has, like you know, 75 fields, let's say so, like you know what what I do is like. You know, look at the update api to see. What's what can be updated and you check, like you know, every field they're, like you know, with if conditions and stuff and like you know, report back, hey, there's a uh we need to update the resource and then update start so they're. Like you know, every every upgradable field needs to be checked one by one.

C

Okay, that makes sense. Thank you yep, and the second part is what happens when this cluster goes down. What happens.

A

When this cluster goes down, yeah yeah, so this is like a control plane. It's not a data plane. So, like you know, if this cut, if I do kind delete database will still be there. Password will still be there because I can, unless you keep ctl deleted and provided a css and calls the delete implementation.

A

We don't touch it. So it's not like a data plane that will, like you know, stop the the data flow. It's like a control plane that is just like you know, provisions and deletes and, like you know, make sure everything is, is correct.

B

Yeah, actually one thing that we, uh you know like for the sake of simplicity in the demo. We use that control plane to deploy our application as well. So this is not the typical use case of cross plane, so in cross plane you don't have the application workloads on the control plane.

B

So, as muffak said, if control plane goes down, you only lose active reconciliation. If you recover it back, it will just automatically get reconciling again, but in the in the meantime your resources are just running there.

A

Yeah yeah, usually like you know, you have one control plane like special to crossplane and not run wordpress on it. For example, and like you know, you would have an existing cluster, let's say and your composition, for example, you can point to that or in your claim api you can say: okay, give me a cluster name that is already available in the cluster, so that I can use that. So, like you know, I mean there are like you know, different deployment.

A

Architectures, like you know, one is like this one and but like you know the more like you know, we see more and more people using like you know one control plane specific to cross plane and manage, like you, know, all their deployments and infrastructure through that with composition.

C

Okay, thank you.

A

Yeah welcome right, cool, uh I think that's it. You can find uh me and hassan at either crosstalk booth or upbound booth. Thank you for listening.