Install Crossplane on AWS with the Jet provider

crossplane kubernetes aws s3 jet provider

3 min read | by Jordi Prats

To start creating resources on AWS we can choose the AWS native provider or go with the Jet provider that uses terraform's AWS provider under the hood to generate a Crossplane provider

If we take a look at the number of CRDs exposes the native AWS provider, we have 124 on the version 0.24.1.

For the AWS Jet provider we have two versions:

  • The versions with just it's number, for example 0.4.0, are the light ones, with just the most heavily used CRDs. For the 0.4.0 version there are 81 CRDs. This versions was created because some K8s versions have difficulties with managing over 700 CRDs
  • The full versions have the -preview suffix, for example 0.4.0-preview. This versions contains all the XRM-conformant managed resources, being 763 CRDs for the fore mentioned 0.4.0-preview

To use the AWS Jet provider we will also need an IAM role to associate with any of the namespace's ServiceAccounts:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::123456789876:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/1B45E2E0B2D55D1E1BC9FA13D02A31CD"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringLike": {
                    "oidc.eks.eu-west-1.amazonaws.com/id/BC91B45B2E0D1F02AD55D1EA13DE231C:sub": "system:serviceaccount:crossplane-system:*"
                }
            }
        }
    ]
}

If we want to use the lightweight version we can configure it as follows:

apiVersion: pkg.crossplane.io/v1alpha1
kind: ControllerConfig
metadata:
  name: jet-aws-config
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789876:role/crossplane
spec:
  podSecurityContext:
    fsGroup: 2000
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: jet-provider-aws
spec:
  package: crossplane/provider-jet-aws:v0.4.0
  controllerConfigRef:
    name: jet-aws-config
---
apiVersion: aws.jet.crossplane.io/v1alpha1
kind: ProviderConfig
metadata:
  name: jet-aws-provider
spec:
  credentials:
    source: InjectedIdentity

Once the provider Pods are ready we can now create the resources, for example an S3 Bucket. Please notice how the apiVersion if different depending on the provider we are using:

apiVersion: s3.aws.jet.crossplane.io/v1alpha2
kind: Bucket
metadata:
  name: pet2cattle-xplane-test
spec:
  providerConfigRef:
    name: jet-aws-provider
  forProvider:
    region: 'eu-west-1'

Using kubectl describe we will be able to check for it's status. If there's some errors we might get terraform errors as well:

$ kubectl describe bucket.s3.aws.jet.crossplane.io/pet2cattle-xplane-test
Name:         pet2cattle-xplane-test
Namespace:    
Labels:       <none>
Annotations:  crossplane.io/external-create-pending: 2022-02-13T19:29:14Z
              crossplane.io/external-create-succeeded: 2022-02-13T19:29:21Z
              crossplane.io/external-name: pet2cattle-xplane-test
              terrajet.crossplane.io/provider-meta: null
API Version:  s3.aws.jet.crossplane.io/v1alpha2
Kind:         Bucket
Metadata:
  (...)
Spec:
  Deletion Policy:  Delete
  For Provider:
    Region:  eu-west-1
  Provider Config Ref:
    Name:  jet-aws-provider
Status:
  At Provider:
  Conditions:
    Last Transition Time:  2022-02-13T19:29:21Z
    Reason:                Creating
    Status:                False
    Type:                  Ready
    Last Transition Time:  2022-02-13T19:29:21Z
    Reason:                ReconcileSuccess
    Status:                True
    Type:                  Synced
Events:
  Type    Reason                   Age   From                                                    Message
  ----    ------                   ----  ----                                                    -------
  Normal  CreatedExternalResource  10s   managed/s3.aws.jet.crossplane.io/v1alpha2, kind=bucket  Successfully requested creation of external resource

Using the AWS cli we can double check that the bucket have been successfully created: 

$ aws s3 ls |  grep xplane
2022-02-13 19:29:21 pet2cattle-xplane-test

Posted on 02/03/2022

Categories