►
From YouTube: TGI Kubernetes 146: Crossplane
Description
Full notes up at https://github.com/vmware-tanzu/tgik/tree/master/episodes/146
- 00:00:25 - Welcome to TGIK!
- 00:03:36 - Week in Review
- 00:11:11 - Welcome to Crossplane
- 00:13:40 - Brief OAM digression
- 00:18:50 - Crossplane install
- 00:24:20 - Install Crossplane kubectl extension
- 00:29:50 - Exploring Crossplane RBAC-manager
- 00:34:45 - Installing the AWS provider
- 00:43:30 - Diving into Crossplane packaging
- 00:46:00 - Mention of dependency confusion attacks: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610
- 00:49:25 - Using https://github.com/wagoodman/dive to view package contents
- 00:50:20 - Creating a PostgreSQL instance
- 00:56:20 - Diving in to how a PostgreSQL db backed by RDS is represented in Crossplane
- 01:02:40 - Resource parameters, patches and resource sizing
- 01:09:00 - Trying to figure out how to say "database with 8GB RAM" at different cloud providers
- 01:13:00 - Investigating patch options
- 01:16:10 - Got the RDS instance running!
- 01:19:20 - Crossplane resource category list
- 01:23:00 - Discussion about cluster-level Crossplane Providers and Compositions (vs namespace level)
- 01:25:10 - Dependencies / building your own Compositions
Come hang out with Evan Anderson (@e_k_anderson) and learn about Crossplane as he does so. Evan's familiar with Kubernetes and operators, but what can he build with Crossplane?
A
A
A
A
B
A
A
A
I
don't
know
if
we've
got
any
core
kubernetes
news,
but
there's
a
whole
bunch
of
ecosystem
news
here
that
I'm
happy
to
call
out
clustered
as
it
looks
like
it's
a
new
channel
for
showing
how
awesomely
you
can
break
kubernetes
and
stump
the
experts,
so
that
sounds
kind
of
fun.
I
know
I
have
stumped
myself
at
least
once
or
twice
with
my
own
cluster,
so
I
don't
know
who
all
is
fixing
it
thanks,
dims.
A
A
A
A
A
So
you
can,
you
can
go
in
here
and
you
can
take
a
look
at.
You
can
pivot
things.
It
looks
like
a
little
bit
around
your
different
workloads
and
they
show
how,
for
example,
you
might
forget
to
include
a
namespace
selector
or
you
might
accidentally
have
a
network
policy
that
doesn't
allow
you
to
speak
to
cube
dns,
and
then
you
got
a
really
bad
day
sounds
like
a
clustered
episode
and
it
looks
like
it
also
provides
you
a
little
clarity
as
to
how
things
actually
work
and
gives
you
some
nice
visualization.
A
A
A
Oh
eks
security
groups
yeah,
so
I
don't
know
if
we're
gonna
end
up
needing
to
do
a
lot
of
eks
security
groups
today,
but
whether
we
are
or
not,
if
you
are
on
eks,
you
have
to
worry
about
security
groups
as
well
as
your
kubernetes
network
policy.
It
looks
like
this
is
a
walk
through
on
how
to
implement
that
network
policy.
B
A
Rate
limiting,
oh
rate,
limiting
this
sounds
like
an
issue
near
and
dear
to
my
heart.
I
think
matt
moore
can
probably
tell
you
some
stories
about
when
we
introduced
a
little
bit
of
of
stress
testing
on
the
leader
election
in
the
k-native
controllers,
and
we
managed
to
beat
up
the
api
server
pretty
badly
by
killing
the
the
leader
every
30
seconds
so
that
it
had
to
switch
to
a
new
one
and
it
would
encue
a
whole
new
set
of
reconciliations
and
being
it.
A
Let's
see,
what
else
do
we
have
here
looks
like
that's
most
of
the
news:
here's
the
harbor
release.
Are
there
any
any
harbor
features
yeah
the
chaos
duck
was
what
matt
called
it
and
it's
I
don't
know
if
matt
wants
to
post
some
slides
there,
but
that
was
a
pretty
cool
feature
system
level.
Robot
account
any
particular
callouts
for
for
harvard22
that
we
should.
A
A
B
A
B
A
I
made
sure
that
all
of
those
were
up
to
date
and
asking
each
developer
to
do
that,
particularly
as
you
start
to
have
several
of
these
things
to
worry
about
it's,
it's
a
mess
and
it'd
be
nice.
If
you
could
just
say,
here's
one
tool
you
need
to
learn
and
so
cross
cross
plane
is
attempting
to
make
it
easy
to
manage
a
bunch
of
different
clouds.
A
The
fine
folks
at
upbound
started
the
project,
but
I
know
that
they've
been
working
with
aws
and
it
looks
like
lots
of
other
clouds
to
be
able
to
provision
not
just
not
just
like
cappy
lets
you
provision
vms,
so
that
you
can
have
a
cluster,
but
this
actually
lets
you
provision.
Like
databases
like
I
want
an
rds
instance.
I
don't
actually
want
to
run
an
operator
and
upgrade
it.
I
just
I
like
paying
amazon
to
make
the
database
their
fault.
A
If
it
doesn't
behave,
I
guess
if
it's
too
small,
it's
my
fault,
that
I
didn't
pay
them
enough
money,
but
other
than
that
I
can
just
say:
hey.
I
want
sql,
I'm
willing
to
pay.
It
looks
like
it
also
is
letting
us
build
infrastructure
abstractions.
So
we
can
build
a
stack
of
stuff.
Not
just
you
know.
Oh
give
me
a
give
me
an
rds
database,
but
like
hey,
I
know
that.
Usually
I
want
like
a
database
and
a
cache
layer
and
maybe
something
else.
A
And
then
I'm
not
quite
familiar
enough
with
oam
to
give
you
a
good
opinion
here,
it
looks
like
there's
a
lot
of
stuff.
There's
a
spec
define
your
apps
and
then
and
then,
hopefully,
everyone
can
kind
of
share
that
app
definition
and
it's
easier
to
set
up
like
staging
and
production
clusters,
purpose
and
goals.
A
B
A
I
mean
it's
software,
it
gives
you
kubernetes
wherever
you
are,
but
it's
not
guaranteed
to
be
cloud.
So,
let's
see
I
love
how
everything
is
talking
about
applications,
and
I
really
wish
we
had
a
common
definition
for
what
an
application
was.
One
thing
I
would
love
to
see
actually
is
the
ability
to
drive,
like
a
jam,
stack
application
off
of
a
consistent
deployment
mechanism
that
doesn't
tie
me
to
you
know
like
netlifly,
plus
kubernetes,
plus,
like
whatever
my
api
gateway,
is
oh,
a
work
provider.
That
sounds
handy.
A
A
A
A
A
A
A
A
A
And
yeah
this
all
seems,
like
you
know,
motherhood
and
apple
pie
to
me.
So
let's
see
how
do
I
kick
the
tires
now
that
I've
decided?
I
want
to
do
all
this.
That
is
back
at
the
top
documentation,
install
and
configure
awesome.
It's
great
that
I
I
love.
I
want
to
call
out
because
I
think
this
is
really
nice
here.
You've
got
I
like
the
tabs
layout
and
I
like
that.
You've
got
both
a
self-hosted
and
a
just
get
me.
A
You
know
just
get
me
going
option,
I'm
going
to
do
the
self-hosted,
because
I
want
to
understand
what's
going
on
here,
but
it's
really
nice
for
people
to
be
able
to
get
into
like
if
you're
looking
to
do
a
developer
experience
type
of
thing.
Yet
you
need
to
have
infrastructure
to
make
that
work.
It's
I
work
on
something
called
serverless
and
let
me
tell
you,
there's
servers
there.
A
A
A
A
But
I
I
like
to
get
some
empathy
for
folks
who
are
running
on
windows.
I
know
that
a
lot
of
developers
are,
and
so
I
will
admit
I
do
also
have
ubuntu
here.
If
I
need
it
ironically,
the
place
where
I
discover
that
I
need
this.
The
most
is
when
I
need
to
base64
and
decode
secrets
from
kubernetes,
but
but
it's
nice
yeah
most
most
developers
do
and
windows
terminal
is
really
nice.
Also,
if
you
haven't
used
the
power
toys,
that's
got
some
nice
stuff
too.
A
A
A
B
B
A
A
B
A
A
A
A
A
B
A
A
A
B
A
A
A
A
A
A
A
A
Okay,
I've
renamed
it
to
keep
control
crossplane
off
on
the
side,
so
that
should
work
more
crds
incoming-
oh,
oh
yeah,
okay,
so
that
installs
a
whole
bunch
more
now,
where
did
these
come
in?
From?
Did
these
I'm
going
to
take
a
look
at
one
of
these
and
I'm
wondering
whether
the
aws
provider
put
it
in
or
if
crossplane
installed
it
as
part
of
the
package.
A
A
A
A
A
A
A
A
A
A
A
A
You
know
add
this
other
thing
without
knowing
the
scope,
I
don't
know
how
many
people
recently
saw
a
whole
bunch
of
companies
got
owned,
fortunately,
by
a
demonstration
that,
where
someone
published
packages
that
had
name
collisions
with
that
with
internal
packages,
like
you
know,
trying
to
remember
who
some
of
the
big
who
some
of
the
big
names
were
there,
I
want
to
say
like
lift.
For
example,
there
was
a
public
lift
package
name
and
then
you
could
just
go
to.
A
A
A
A
A
A
A
A
I
bet
there's
probably
a
way
to
name
these
resources
if
I
needed
to
certainly
if
I
was
doing
it
with
yaml,
I
could
but
it's
nice
to
just
be
able
to
say
like
do
the
thing
and
you
figure
out
the
name,
so
nice
touch
on
the
cli
for
that
and
you've
also
filled
in
enough
of
the
crd
information.
That
list
looks
nice.
So
that's
that's
a
nice
added
plus
too
I've
got
a
provider
config
named.
A
A
A
A
B
A
Yeah,
I
don't
matt
may
be
able
to
give
more
references
to
other
tools.
Dive
is
the
first
one
I've
found
of
I've
found.
I
think
I
have
120
kubernetes
to
ask
answer.
The
last
question.
Matt
may
be
able
to
point
out
just
point
some
other
nice
container
registry
tools
out
there.
Someone
pointed
me
to
dive,
and
I
found
it
a
lot
more
useful
than
not
having
it.
A
A
A
A
Okay,
so
this
looks
like
okay.
This
is
a
postgres
database
that
references
an
aws
database,
I'm
not
sure
what
the
example.org
bit
at
the
end
is
and
here's
a
resource
ref
on
an
rds
instance.
So
I
can
probably
look
at
that
next
and
it's
going
to
write
a
connection
secret
over
here
and
selected
composition.
A
B
A
So
yeah
I
just
dug
through
several
layers
and
it
looks
like
it's
currently
backing
up
and
isn't
quite
ready.
Yet
I
went
through
that
kind
of
quickly
if
people
want
me
to
go
through
a
little
bit
more
slowly,
let's
see
so
I
did
describe
on
my
the
resource.
I
created
here
a
postgresql
instance,
and
then
I
looked
at
the
spec
and
the
spec
has
this
resource
ref.
A
A
A
A
Oh
how
many
aws
resources
are
covered
by
crossplane.
I
can
show
you
that
over
here,
if
you
click
on
provider
aws
in
the
docs,
you
can
see
it
looks
like
they
have
58
crds.
So
I'm
going
to
guess
that's
about
58
things,
but
I
see
a
whole.
Bunch
of
them
are,
for
example,
a
api
gateway
v2,
and
I
don't
know
if
dbsubnet
group
is
a
thing
that
I
care
about,
but
I'd
probably
say
there's
at
least
20
or
25
real
honest
to
goodness
things
you
might
want
to
provision
here.
A
Oh
and
it
sounds
like
there's
even
more
coming,
the
other
nice
thing
it
looks
like
is
there's
documentation.
If
there's
one
that
you,
if
there's
something
you
really
need
that,
isn't
there.
I
know
it's
shocking
that
they
wouldn't
have
full
coverage
of
every
single
aws
service
out
there.
For
those
of
you
who
are
going
to
use
kubernetes
to
manage
your
cloud
hsm.
A
A
B
A
A
A
A
Oh,
that's
actually,
a
good
point,
let's
see
so
there's
a
storage
gigs
parameter
here
we
started
with
my
postgres
database
says
it
wants
20
gigs
of
storage,
let's
track
where
that
storage
gigs
goes
so
this
references,
the
postgresql
instance-
and
we
can
see
again,
it's
got
this
storage
gigs
of
20
and
it's
got
another
resource
reference
and
it
says,
write
the
secret
to
this
thing
in
cross
plane
system
and
presumably
it's
going
to
carry
the
secret
from
cross
plane
system
over
to
the
public
part.
So
this
is
kind
of
some
internal
stuff.
A
There's
a
patches
section,
so
here's
a
base
definition
and
then
it
looks
like
you
can
copy
like
a
uid
from
metadata
uid
to
this
value
and
add
dash
postgresql,
and
we
saw
over
here
that
that's
copied
and
then
copy
from
storage
gb
to
allocated
storage
in
here.
So
it
should
be.
If
we
do
a
cube
control
get
rds
instance,
ibs
instance.
A
A
And
then
abstract
postgres,
so
it
looks,
like
instance,
type.
I'm
also
wondering
how
this
works.
If
I
want
to
be
able
to
say,
hey
I'd
like
a
database
with
eight
gigs
of
ram,
which,
frankly
I
don't
know
how
I
would
do
that
by
hand
without
going
to
all
the
documentation,
so
google
cloud,
sequel,
db,
sizing,
aws,
ids,.
A
A
B
A
B
A
A
A
B
B
B
A
A
A
Let's
see
so
here
we
are
and
we've
got
a
postgres
instances,
and
I
can
click
in
here
and
get
well.
I
can
get
the
yaml
and
stuff,
but
I
can
actually
see
what
I've
got
in
here.
That's
interesting
and
then
you
know
it
works
with
all
the
other
normal
tools
for
figuring
out
the
status
of
things
and
it
even
gets
a
green
checkbox.
I
think,
because
it's
stuff
is
provisioned,
oh,
never
mind
it.
Doesn't
it
probably
should,
but
it
does
have
a
status
over
here.
A
Yeah,
I
know
google
well,
actually
I
don't
know
if
you
can
with
cloud
sql
if
you
can
do
custom
sizes,
but
I'm
guessing
you
can
because
I
think
I
saw
vcpu
and
memory
prices.
I
don't
know
if
they
charge
a
premium
for
that,
but
yeah.
If
it
was
important
to
you
that
you
get
exactly
five
gigs
of
ram
for
your
database,
then
google
lets
you
do.
A
A
A
A
A
Wait
are
these
all
global?
No,
this
is
a
provider,
config
usage
and
here's
my
rds
instance
and
here's
my
provider
config
and
the
other
thing
that's
weird
here
is
this
doesn't
tell
me
actually
which
ones
of
these
are
in
my
name
space
and
which
ones
are
global
resources,
but
that's
a
cube,
control
output
issue.
A
B
A
So
it
looks
like
compositions
and
everything
else
are
global,
so
yeah
one
thing:
that's
kind
of
powerful,
but
also
frustrating
in
kubernetes.
Is
you
kind
of
have
to
choose
for
each
resource
if
it's
going
to
be
namespace
level
and
something
that
you
can
manage
if
you're,
just
in
a
namespace
or
if
it's
going
to
be
global
and
something
that
you
can
share
across
namespaces
and
it'd
be
really
nice
if
there
was
better
support
for
having
like
both
a
provider
config
and
a
cluster
provider,
config.
A
And
so
you
could
actually
narrow
it
down
and
make
sure
that
you
know
okay,
I've
built
my
little
kingdom
in
here
and
I
can't
I'm
not
sharing
it
with
someone
else,
but
it
sounds
like
the
idea
is
that
your
cluster
administrator
would
set
up
all
of
your
compositions
and
so
forth,
and
then
you
would
just
provision
claims
for
it.
So
this
isn't
complete
like
I
wouldn't
call
it
a
complete
app
delivery
platform,
necessarily
because
you
might
want
to
be
able
to
say
you
know.
A
Okay,
this
is
my
develop
environment
and,
like
six
of
us,
are
iterating
on
this
packaging,
but
we
don't
want
to
get
sre
involved
because
you
know
this
is
a
sandbox
thing,
but
you
could
use
crossplane
to
configure
the
the
database
for
each
one,
and
so
you'd
have
a
like
a
template
of
yeml
files
that
everyone
has
a
fork
of
and
then
they'd
apply
their
local
fork
and
people
don't
have
to
figure
out.
You
know,
okay,
you
know.
A
A
A
That
describes
this
stuff
with
annotations
and
says
it
depends
on
another
provider.
So
this
is
a
provider,
that's
already
published,
I'm
guessing,
and
then
you
can
build
and
push
the
configuration
and
it
will
just
pull
in
the
existing
aws
stuff
see.
It
looks
like
you've
kind
of
got
a
little
bit
of
a
dependency
management
process.
A
A
A
We
don't
want
to
package,
you
know
we
don't
want
to
package
istio
or
courier
or
kong,
or
something
like
that.
If
you
already
have
one
in
your
cluster,
but
if
you
don't
have
any,
then
we're
like
go
off
and
follow
their
instructions
for
installing
or
here's
our
instructions
for
installing
which
are
lagging
a
certain
amount
behind.
A
A
A
A
A
B
B
A
B
A
Handy
so
thanks
for
having
me,
I
had
a
lot
of
fun.
I
even
got
a
sql
database
out
of
it
eventually,
but
more
importantly,
I
got
to
see
a
lot
of
what
crossplane
is
doing
and
wrap
my
head
a
lot
better
around
what
it
is
and
how
it's
supposed
to
be
used,
because
I
was
trying
to
fit
it
into
the
application.
Packaging
bundle
and
it's
really
an
infrastructure
management
bundle
which
is
really
handy
when
you're
pro,
when
you're
going
across
multiple
clouds.