Skip to main content

Crossplane Compositions

Obmondo-authored chart (no vendored upstream charts/ - the compositions are KubeAid's own) that installs Crossplane CompositeResourceDefinitions (XRDs) and Compositions defining KubeAid's Azure infrastructure APIs, plus the ProviderConfig those compositions authenticate through.

Why it's in KubeAid​

CAPZ-provisioned (self-managed) Azure clusters need supporting Azure infrastructure that ClusterAPI does not provision itself: a storage account for the OIDC/workload-identity issuer, managed identities and role assignments for CAPZ and Azure Service Operator, and (optionally) a Velero backup identity and blob containers for disaster recovery. This chart turns those into two composite APIs cluster operators apply as plain Kubernetes claims. See Azure hosting.

Prerequisites​

Key values / KubeAid-specific configuration​

ValueDescriptionDefault
azure.enableInstall the azure sub-chart (XRDs + Compositions)false
azure.compositions.workloadIdentityInfrastructure.enableInstall the WorkloadIdentityInfrastructure compositiontrue
azure.compositions.disasterRecoveryInfrastructure.enableInstall the DisasterRecoveryInfrastructure compositionfalse

WorkloadIdentityInfrastructure claim (azure.kubeaid.org/v1alpha1)​

Given subscriptionID, clusterName, location, aadApplicationPrincipalID, and storageAccountName, provisions: a ResourceGroup, a Blob storage Account + oidc-provider Container (the OIDC issuer for workload identity), a capi UserAssignedIdentity with a Contributor role assignment, and federated identity credentials for both CAPZ (capz-manager) and Azure Service Operator (azureserviceoperator-default).

DisasterRecoveryInfrastructure claim (azure.kubeaid.org/v1alpha1)​

Given subscriptionID, clusterName, location, and storageAccountName, provisions: velero-backups and sealed-secrets-backups blob Containers, a velero UserAssignedIdentity with a Storage Blob Data Owner role assignment, and a federated identity credential for the velero ServiceAccount.

Operational notes​

  • Both compositions use mode: Pipeline with the go-templating, patch-and-transform, and auto-ready functions from crossplane-providers-and-functions.
  • defaultCompositionUpdatePolicy: Manual on both XRDs - composition changes require an explicit revision bump on existing claims, they are not applied automatically.
  • Deletion policy on the ResourceGroup and storage Account/Container resources is Orphan.