Managed resources

One CRD per cloud resource.

Intermediate12 min · lesson 3 of 12

A managed resource (MR) is the atom of Crossplane: one Kubernetes custom resource representing exactly one external cloud resource. You write a manifest with a spec.forProvider block that mirrors the cloud API’s fields, apply it, and the provider’s controller creates the real thing and writes its observed status back into the object. It is the lowest level — one MR, one bucket or instance or role.

bucket.yaml

apiVersion: s3.aws.upbound.io/v1beta1
kind: Bucket
metadata:
  name: acme-logs-prod
spec:
  forProvider:
    region: us-east-1
  providerConfigRef:
    name: default          # which credentials to use (next lessons)

Status and readiness

After you apply it, the MR is not instantly done — the controller calls the cloud, and you watch the object’s conditions move to Ready and Synced. Synced means Crossplane reconciled the spec with the API; Ready means the cloud reports the resource as available. kubectl describe shows the events and any error the cloud returned, which is where you debug a resource that will not become ready.

terminal

$ kubectl apply -f bucket.yaml
$ kubectl get bucket acme-logs-prod
NAME             READY   SYNCED   EXTERNAL-NAME
acme-logs-prod   True    True     acme-logs-prod
$ kubectl describe bucket acme-logs-prod   # events + any cloud API error

deletionPolicy decides if delete destroys the cloud resource

By default, deleting the Kubernetes MR deletes the real cloud resource — convenient, and dangerous for stateful things. Set spec.deletionPolicy: Orphan on databases and buckets you do not want a kubectl delete to destroy, so removing the Kubernetes object leaves the cloud resource intact. This is the Crossplane equivalent of a retain/deletion policy.

Installing Crossplane & a providerReconciliation & state without a…