Skip to main content

crossplane-extras

Crossplane providers and functions extending the core control plane.

crossplane-extras is a local kustomize overlay that installs Crossplane Provider, Function, and DeploymentRuntimeConfig resources on top of the base Crossplane installation. It wires in the OpenTofu provider and the composition helper functions used by infrastructure compositions in this cluster.

Installation​

Architecture​

Raw kustomize manifests (no HelmRelease). Deployed into namespace crossplane-system alongside the Crossplane core. Installs:

  • upbound/provider-opentofu — runs OpenTofu workspaces as Managed Resources
  • crossplane-contrib/function-go-templating — Go-template-based composition functions; since the 0.12 release a template can request extra resources itself, which replaced function-extra-resources in September 2026; the 0.13.0 release fixed the namespace being dropped from matchLabels requirements, after which the tofu-workspace templates lost their own namespace filters
  • crossplane-contrib/function-auto-ready — marks composed resources ready automatically
  • DeploymentRuntimeConfig: opentofu-hardening — applies hardened securityContext to the OpenTofu provider pod

Security​

The opentofu-hardening DeploymentRuntimeConfig enforces: runAsNonRoot: true, runAsUser/Group: 2000, allowPrivilegeEscalation: false, capabilities: drop: ALL, readOnlyRootFilesystem: true, seccompProfile: RuntimeDefault. Writable volumes (/tofu, /tmp, /tofu/plugin-cache) are provided via emptyDir mounts.

Updates​

Managed by Renovate through its crossplane manager, which reads spec.package of every Provider and Function manifest in the package directory; tags are semver-pinned with digests. The go-templating package comes from xpkg.upbound.io, since releases after 0.11 no longer land on xpkg.crossplane.io.

Usage​

The OpenTofu provider reconciles Workspace managed resources, running tofu plan/apply inside the cluster. Composition functions (go-templating, auto-ready) are referenced in Composition pipelines to build complex infrastructure abstractions. Operators write XR (Composite Resource) manifests; Crossplane calls these functions to render the final managed resources.

Cluster-specific deviations from the above live in the per-cluster README — see k8s/platform/crossplane-extras/talos/README.md.

Cluster Deployment​

Depends on

crossplane-extras — Talos cluster

Deviations from defaults​

  • provider-opentofu package pinned by digest (provider-opentofu.yaml) — verify-platform-images runs with verifyDigest: true; Crossplane runs the package image as the provider pod, so a tag-only package: is rejected on the next provider pod rollout. Renovate's crossplane manager is scoped to this file to keep tag and digest moving together.