Crossplane Security

Crossplane leverages Kubernetes-native security: RBAC, network policies, admission controllers, and secrets management. Security model extends cluster security to infrastructure management.

Composite Resource Definitions (XRDs) and Claims use Kubernetes RBAC for access control. Platform team defines compositions; developers create claims. Namespace-scoped claims isolate tenant resources. Cluster-scoped XRDs for platform-level resources.

Crossplane uses Kubernetes Secrets for connection secrets. External Secrets Operator integrates with AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, GCP Secret Manager. Secrets never leave the cluster control plane. Encryption at rest via Kubernetes encryption providers.

OPA Gatekeeper and Kyverno validate compositions and claims at admission time. Policies enforce: required labels, forbidden resource types, encryption requirements, network policies, resource limits. Composition validation prevents invalid infrastructure definitions.

Providers run as controllers in the cluster with least-privilege ServiceAccounts. Network policies restrict provider communication. Node-level security via host networking restrictions. Upbound Cloud adds managed control plane with dedicated VPC, encryption, and SOC 2 compliance.

Provider packages signed and verified. Provider images from trusted registries. Composition functions (KCL, Go templates) audited. SBOM generation. Upbound Marketplace for curated providers.