Crossplane: How can we manage resources that were not created by Crossplane?

In this episode, we tackle managing existing resources with Crossplane. Learn how to take control of resources that weren't initially created by Crossplane. Those could be existing resources in Google Cloud, Azure, AWS, or anywhere else.
#Crossplane #CloudManagement #ResourceControl #CloudComputing
Consider joining the channel: / devopstoolkit
▬▬▬▬▬▬ 🔗 Additional Info 🔗 ▬▬▬▬▬▬
🔗 Crossplane: crossplane.io
▬▬▬▬▬▬ 💰 Sponsorships 💰 ▬▬▬▬▬▬
If you are interested in sponsoring this channel, please visit devopstoolkit.... for more information. Alternatively, feel free to contact me over Twitter or LinkedIn (see below).
▬▬▬▬▬▬ 👋 Contact me 👋 ▬▬▬▬▬▬
➡ Twitter: / vfarcic
➡ LinkedIn: / viktorfarcic
▬▬▬▬▬▬ 🚀 Other Channels 🚀 ▬▬▬▬▬▬
🎤 Podcast: www.devopspara...
💬 Live streams: / devopsparadox

[@M79L]

Victor - as always thank you for the video. Just a note here. When using Compositions which consists of multiple resources, we also cannot use some metadata name. So the external name is there the only option. Thank you for confirming that we are doing it right :)

[@kousikchatterjee3977]

Hi Victor, Thank you for your consistently informative videos; I always find them incredibly helpful. I have one query related to ArgoCD. I have successfully implemented several features with ArgoCD, as outlined below: 1. Deployed ArgoCD using Terraform. 2. Set up Single Sign-On with Keycloak. 3. Integrated AWS CodeCommit with ArgoCD. 4. Retrieved custom Helm values from AWS CodeCommit. 5. Configured an S3 bucket to fetch private Helm charts. 6. Monitored pipeline status effectively. 7. Established pipeline dependencies (app-to-app). I have a question regarding the suspension of applications in Argo. Specifically, I have five applications deployed, and I would like to disable or suspend one of them using Jenkins without modifying the source code stored in AWS CodeCommit. Could you please share your expertise on this matter? Your guidance would be greatly appreciated. Thank you!

[@DevOpsToolkit]

Thanks for saying that. What's your query?

[@kousikchatterjee3977]

@@DevOpsToolkit I have a query regarding the suspension of applications in Argo. Specifically, I have five applications deployed, and I would like to disable or suspend one of them using Jenkins without modifying the source code stored in AWS CodeCommit.

[@DevOpsToolkit]

A few follow up questions (mostly so that I understand what you're looking for). Are you trying to suspend synchronization so that changes to the desired state in Git are not synchronized to the cluster or are you trying to suspend your application so that it's not running in the cluster? Is there a reason why you would not like to change anything in Git? Is the requirement that change should be done by Jenkins but without it changing anything in Git?

[@kousikchatterjee3977]

@@DevOpsToolkit The primary reason for not wanting to change anything in Git is that our CodeCommit repository contains a generic manifest that serves multiple applications. Different projects require varying numbers of applications; for instance, one project may require two applications while another may require four. By suspending specific applications without modifying the manifest in Git, I can manage which applications are active or inactive based on the project requirements without creating multiple manifests for different projects.

[@ofirfr4804]

Its very nice, but for large enviroments the proccess of declaring every existing object on my provider on crossplane can be weeks. Is there any way to generate these yaml files automatically for a given aws / gce / azure (etc...) account?

[@DevOpsToolkit]

Not yet... News related to that are coming...

[@jirityr]

This sounds like a dangerous idea to take over an existing resource with possibly incomplete configuration on the Crossplane's side. The approach chosen by "terraform import" is much better IMHO.

[@DevOpsToolkit]

You can run them in observe-only mode that will not apply any changes but show what might be different.

[@rodoherty1]

Do you have a video on how to migrate claims from one apiVersion to another? I want to introduce a breaking change to my xrd but, from my own experiments, it's not straight-forward.

[@DevOpsToolkit]

Unfortunately, I don't have a video on that subject. I'll add it to my TODO list (probably as one of Thursday questions).

[@ofekedri7884]

If I have blue green EKS clusters, with stateless applications it is pretty easy to manage (just control the weight of DNS with external DNS operator, etc) wondering how to implement blue-green with cross-plan. For example, if for some reason, I create vpc with cross plan on "blue eks cluster", how can I manage it on "green cluster"? green cluster is not aware of vpc id (created but blue eks cluster) Hope the question is clear, thanks

[@DevOpsToolkit]

You would have to have external-name annotation either by adding it to yaml, backing up and restoring etcd, or any other way. That being said, I'm not sure I understood why you would do something like that.

[@ofekedri7884]

@@DevOpsToolkit, thanks for the quick response, I really like your videos, I saw you for the first time last year, AWS TLV, and it was awsome. I will try to use a better example. Let's assume I want to manage my API application + and some security group over kubernetes (security group with crossplane) My purpose is to ensure that all configurations are in both blue and green clusters. I assume if I apply security with crossplane on blue cluster, I supply name and annotation added with the security group id on the blue cluster, same as you demonstrate on video with vpc. green cluster is unaware of this security group ID, so I assume it will try to create another security group or something like this. Just to clarify, we are using blue-green for eks upgrades and some other big changes like migrations

[@DevOpsToolkit]

@ofekedri7884 I'm still not sure I understood why you would want to have managed resources for the same security group in both clusters and both referencing the same AWS security group? Are you trying to make crossplane itself fault tolerant or is that somehow in relation to applications or...? Would it be easier if we have a live chat? If it would, pick a time that works for you from calendar.app.google/Ze9HVDwzywSGStMS9.

[@ofekedri7884]

@@DevOpsToolkit i use blue cluster normally, when i upgrade or make big change, we move to green cluster, so i want green cluster to take control about everything, including deployment/pods and all application resources managed by crossplane. I can consider green cluster as DR as well

[@DevOpsToolkit]

Got it. If, in cases resources that cannot be named, you have external-name annotation, you should be able to run managed resources in both clusters. You can get those either by adding them yourself or backing up and restoring etcd. As a side note, we are working on a feature that will allow you to view and test changes to compositions before applying them. Once that is released you might not need bg, at least when using crossplane.

[@TiggyProph]

A-ha! This helps me explain some behavior. I had been playing with an early PoC last year to deploy some lambdas via a helm chart implementing Crossplane manifests. In the process of testing you naturally destroy and recreate the objects a lot of times. For one test I intended to do a full reset. I destroyed all the cluster objects related to the lambda to redefine them. I had forgotten to let it destroy the existing objects first by doing a proper delete leaving the objects orphaned in AWS. I was surprised when syncing the chart that all the objects reidentified right away. Now I understand that this was always the intended behavior. This gives me a lot of new ideas on pulling our existing custom terraform into reusable charts. This is very exciting.

[@Luther_Luffeigh]

Have you worked with customers who shifted their serverless infra from Terraform to Crossplane? Are there any gaps not supported/covered in crossplane?

[@DevOpsToolkit]

I know quite a few, often large companies who switch to crossplane. There are always things that could be improved in crossplane or anything else. However, what makes crossplane special is that it works with all other kubernetes native tools so many of the gaps are intentional since they are already covered with argo CD, kyverno, Prometheus, and so on and so forth. I would argue that kubernetes ecosystem is the biggest one we ever saw and, as a result, if you look at it as a whole, there are much fewer gaps than anywhere else.

[@Luther_Luffeigh]

@@DevOpsToolkit that’s great to hear, I will be starting an experiment to converting terraform modules into crossplane resources that’s further abstracted by helm charts…do you have any advice for me here? maybe a topic for new video?

[@DevOpsToolkit]

@Luther_Luffeigh if you're creating composite definitions, you'll be instantiating them through claims that will likely be 10-20 lines in total. You won't need to package that into helm.

[@Luther_Luffeigh]

@@DevOpsToolkit thank you very much

[@IvanRizzante]

I also have a question which could be a subject for another video. How do you observe applications and infrastructure signals (logs, metrics, traces) with Grafana Alloy and Beyla?

[@DevOpsToolkit]

Good one. Adding it to my TODO list.

[@holgerwinkelmann6219]

is there also a Discover or Observe tooling to fetch existing resources ?

[@DevOpsToolkit]

Yes. You can set Crossplane Managed Resources to be in observe mode and, in that case, they gather the info, but do not manage the destination resources.

[@holgerwinkelmann6219]

@@DevOpsToolkit Yes, but you still need to know the resources, would be nice to fetch or discover existing resources. But thats might be just tooling while developing the compositions, basically fetch&Observe and from there going to managed mode...

[@DevOpsToolkit]

@holgerwinkelmann6219 something in that direction is coming, i just cannot announce it right now.

[@holgerwinkelmann6219]

@@DevOpsToolkit nice to know anyway...

[@fpvclub7256]

Great question - Great video!!

[@mirceanton]

What about third party providers that are built on top of Terraform? I'm looking specifically at the Keycloak and MinIO providers. I was considering migrating our set-up at work from Terraform + Fluc-IaC/tofu-controller. The ability to manually step in to fix problematic scenarios is what's holding me back. With terraform I know I can import or do a `state rm` and whatnot. Not so sure about crossplane. For example, even migrating from TF to crossplane has me a bit worried since all of those resources are already created.

[@DevOpsToolkit]

There should not be a problem with providers built on top of Terraform. It's mostly code generation that uses Terraform modules to generate Crossplane Go code. It's a way to get to providers faster, not necessarily with worse quality. How they work behind the scene is very different.

[@OB-el5ih]

i have a problem. if i want to import ALL my infra - i need to obtain every id? i,ve tried to did it and ive realized that i need every id. is there a way to bulk import ALL infra from as example one account (vpcs vms and other stuff). maybe some cli tool or i need to write some script with sdk or smth like that? what is the right way or how you recomend to slove this case? as example keycloak provider - i needed to import EVERY user or client. i understand that i can do this programmatically but maybe there is another way?

[@DevOpsToolkit]

Many of the resources do not have auto-generated IDs so that issue would not apply to all of them. There is ongoing work to make it easier and faster, but I cannot say the date when it might be released.

[@gardnerjens]

I Azure, there is the resource called Api management, but everytime i have tried to add apis in Azure Api management which is managed by another team, i keep getting errors. So the question is how do i use resources that i dont own and dont want to manage?

[@DevOpsToolkit]

I will guess that you want to have crossplane resources reference some azure resources that are not managed by crossplane. If that is the case, you can create those azure resources with Crossplane on observe-only mode. In those cases, all the data will be pulled from azure to crossplane resources without them bring managed by them. Please let me know if I misunderstood your question.

[@tigercat123456]

@@DevOpsToolkitthanks! that scenario would definitely be worth a short video, as it is not uncommon in the field!

[@razvanbucurica5902]

I love Crossplane! Thank you for this video!