Crossplane Composition RBAC ABAC Policy —

Crossplane RBAC ABAC

Crossplane Composition RBAC ABAC Policy Infrastructure as Code Kubernetes CRD Claim Multi-tenant OPA Kyverno Access Control Platform API Cloud Resources

Policy Engine	Language	Complexity	K8s Native	เหมาะกับ
OPA Gatekeeper	Rego	สูง	Admission	Complex Policy
Kyverno	YAML	ต่ำ	Admission + Mutation	Simple Policy
K8s RBAC	YAML	ต่ำ	Built-in	Who can do what
CEL	Expression	ปานกลาง	ValidatingAdmissionPolicy	Simple Validation

Crossplane Composition

=== Crossplane Composition ===

CompositeResourceDefinition (XRD)

apiVersion: apiextensions.crossplane.io/v1

kind: CompositeResourceDefinition

metadata:

name: databases.platform.example.com

spec:

group: platform.example.com

names:

kind: Database

plural: databases

claimNames:

kind: DatabaseClaim

plural: databaseclaims

versions:

• name: v1alpha1

served: true

reachable: true

schema:

openAPIV3Schema:

type: object

properties:

spec:

type: object

properties:

engine:

type: string

enum: [postgres, mysql]

size:

type: string

enum: [small, medium, large]

environment:

type: string

enum: [dev, staging, prod]

เนื้อหาเกี่ยวข้อง — ทำความเข้าใจ โอนเงินจากกสิกรไปออมสินเงินไม่เข้า

Composition

apiVersion: apiextensions.crossplane.io/v1

kind: Composition

metadata:

name: database-aws

spec:

compositeTypeRef:

apiVersion: platform.example.com/v1alpha1

kind: Database

แนะนำเพิ่มเติม — ติดตาม XM Signal

resources:

• name: rds-instance

base:

apiVersion: rds.aws.upbound.io/v1beta1

kind: Instance

spec:

forProvider:

engine: postgres

instanceClass: db.t3.medium

allocatedStorage: 20

• name: security-group

base:

apiVersion: ec2.aws.upbound.io/v1beta1

kind: SecurityGroup

Claim (Developer uses this)

apiVersion: platform.example.com/v1alpha1

kind: DatabaseClaim

metadata:

name: my-app-db

namespace: team-alpha

spec:

engine: postgres

size: medium

เนื้อหาเกี่ยวข้อง — อ่านต่อ: swift code ttb ดูตรงไหน

environment: dev

from dataclasses import dataclass

@dataclass

class Composition:

name: str

resources: int

providers: str

claims: int

teams: int

compositions = [

Composition("Database", 4, "AWS RDS, SG, Subnet, SSM", 12, 5),

Composition("Kubernetes Cluster", 8, "EKS, VPC, IAM, NodeGroup", 3, 2),

Composition("Storage Bucket", 2, "S3, IAM Policy", 25, 8),

แนะนำเพิ่มเติม — เรียนเทรดกับ iCafeForex

Composition("Redis Cache", 3, "ElastiCache, SG, Subnet", 8, 4),

Composition("VPC Network", 6, "VPC, Subnet, IGW, NAT, RT", 5, 3),

]

RBAC ABAC Policy

=== RBAC + ABAC Policy ===

Kubernetes RBAC for Crossplane Claims

เนื้อหาเกี่ยวข้อง — Data Driven Organization Structure —

apiVersion: rbac.authorization.k8s.io/v1

kind: Role

metadata:

name: database-user

namespace: team-alpha

rules:

• apiGroups: ["platform.example.com"]

resources: ["databaseclaims"]

verbs: ["get", "list", "create", "update", "delete"]

• apiGroups: ["platform.example.com"]

resources: ["storagebucketclaims"]

verbs: ["get", "list", "create"]

Kyverno Policy — Enforce Labels and Limits

apiVersion: kyverno.io/v1

kind: ClusterPolicy

metadata:

name: crossplane-claim-policy

spec:

rules:

• name: require-team-label

match:

resources:

kinds: ["DatabaseClaim", "StorageBucketClaim"]

validate:

message: "Claims must have team and cost-center labels"

pattern:

metadata:

labels:

team: "?*"

cost-center: "?*"

• name: restrict-prod-size

match:

resources:

kinds: ["DatabaseClaim"]

preconditions:

• key: "{{request.object.spec.environment}}"

operator: Equals

value: "dev"

validate:

message: "Dev environment only allows small/medium"

เนื้อหาเกี่ยวข้อง — อ่านต่อ: Vector Database Pinecone Remote Work Setup —

pattern:

spec:

size: "small | medium"

@dataclass

class PolicyRule:

name: str

type: str

scope: str

action: str

violations_30d: int

policies = [

PolicyRule("Require Team Label", "Validation", "All Claims", "Block", 5),

PolicyRule("Dev Size Limit", "Validation", "DatabaseClaim (dev)", "Block", 8),

PolicyRule("Prod Approval Required", "Validation", "All Claims (prod)", "Block + Alert", 2),

PolicyRule("Budget Limit per Team", "ABAC", "All Claims", "Block at limit", 3),

PolicyRule("Naming Convention", "Mutation", "All Claims", "Auto-fix", 15),

PolicyRule("Auto-add Tags", "Mutation", "All Resources", "Inject tags", 0),

]

เคล็ดลับ

• Composition: สร้าง Composition ซ่อนความซับซ้อนจาก Dev
• RBAC: ใช้ K8s RBAC จำกัดสิทธิ์ต่อ Namespace
• Kyverno: ใช้ Kyverno สำหรับ Policy ง่ายกว่า OPA
• Labels: บังคับ Labels ทุก Claim สำหรับ Cost Tracking
• Budget: ตั้ง Budget Limit ต่อ Team ป้องกันบานปลาย

Crossplane Composition คืออะไร

รวม Cloud Resources เป็น API เดียว CRD Claim Developer ไม่ต้องรู้ Cloud RDS SG Subnet SSM Platform API Kubernetes