How every backed-up app gets a restic target on Backblaze B2 — the k8up Schedule declares intent, the Crossplane TofuWorkspace composition provisions the bucket and a bucket-scoped application key, and External Secrets fences the one human-managed credential to the workspace namespaces.
Universal control plane for managing infrastructure and cloud resources via Kubernetes APIs.
Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.
Reusable Kustomize component that gives an app a per-namespace TofuWorkspace — Crossplane renders an OpenTofu workspace that owns the app's backup buckets, Backblaze keys and internal DNS records, and tears them down with the namespace.