CINXE.COM

<!doctype html><html lang=en class=color-toggle-hidden color-theme=light><head><meta charset=utf-8><script type="text/javascript"> ;window.NREUM||(NREUM={});NREUM.init={distributed_tracing:{enabled:true},privacy:{cookies_enabled:true},ajax:{deny_list:["bam.nr-data.net"]}}; window.NREUM||(NREUM={}),__nr_require=function(t,e,n){function r(n){if(!e[n]){var o=e[n]={exports:{}};t[n][0].call(o.exports,function(e){var o=t[n][1][e];return r(o||e)},o,o.exports)}return e[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var o=0;o<n.length;o++)r(n[o]);return r}({1:[function(t,e,n){function r(t){try{s.console&&console.log(t)}catch(e){}}var o,i=t("ee"),a=t(32),s={};try{o=localStorage.getItem("__nr_flags").split(","),console&&"function"==typeof console.log&&(s.console=!0,o.indexOf("dev")!==-1&&(s.dev=!0),o.indexOf("nr_dev")!==-1&&(s.nrDev=!0))}catch(c){}s.nrDev&&i.on("internal-error",function(t){r(t.stack)}),s.dev&&i.on("fn-err",function(t,e,n){r(n.stack)}),s.dev&&(r("NR AGENT IN DEVELOPMENT MODE"),r("flags: "+a(s,function(t,e){return t}).join(", ")))},{}],2:[function(t,e,n){function r(t,e,n,r,s){try{l?l-=1:o(s||new UncaughtException(t,e,n),!0)}catch(f){try{i("ierr",[f,c.now(),!0])}catch(d){}}return"function"==typeof u&&u.apply(this,a(arguments))}function UncaughtException(t,e,n){this.message=t||"Uncaught error with no additional information",this.sourceURL=e,this.line=n}function o(t,e){var n=e?null:c.now();i("err",[t,n])}var i=t("handle"),a=t(33),s=t("ee"),c=t("loader"),f=t("gos"),u=window.onerror,d=!1,p="nr@seenError";if(!c.disabled){var l=0;c.features.err=!0,t(1),window.onerror=r;try{throw new Error}catch(h){"stack"in h&&(t(14),t(13),"addEventListener"in window&&t(7),c.xhrWrappable&&t(15),d=!0)}s.on("fn-start",function(t,e,n){d&&(l+=1)}),s.on("fn-err",function(t,e,n){d&&!n[p]&&(f(n,p,function(){return!0}),this.thrown=!0,o(n))}),s.on("fn-end",function(){d&&!this.thrown&&l>0&&(l-=1)}),s.on("internal-error",function(t){i("ierr",[t,c.now(),!0])})}},{}],3:[function(t,e,n){var r=t("loader");r.disabled||(r.features.ins=!0)},{}],4:[function(t,e,n){function r(){U++,L=g.hash,this[u]=y.now()}function o(){U--,g.hash!==L&&i(0,!0);var t=y.now();this[h]=~~this[h]+t-this[u],this[d]=t}function i(t,e){E.emit("newURL",[""+g,e])}function a(t,e){t.on(e,function(){this[e]=y.now()})}var s="-start",c="-end",f="-body",u="fn"+s,d="fn"+c,p="cb"+s,l="cb"+c,h="jsTime",m="fetch",v="addEventListener",w=window,g=w.location,y=t("loader");if(w[v]&&y.xhrWrappable&&!y.disabled){var x=t(11),b=t(12),E=t(9),R=t(7),O=t(14),T=t(8),P=t(15),S=t(10),M=t("ee"),N=M.get("tracer"),C=t(23);t(17),y.features.spa=!0;var L,U=0;M.on(u,r),b.on(p,r),S.on(p,r),M.on(d,o),b.on(l,o),S.on(l,o),M.buffer([u,d,"xhr-resolved"]),R.buffer([u]),O.buffer(["setTimeout"+c,"clearTimeout"+s,u]),P.buffer([u,"new-xhr","send-xhr"+s]),T.buffer([m+s,m+"-done",m+f+s,m+f+c]),E.buffer(["newURL"]),x.buffer([u]),b.buffer(["propagate",p,l,"executor-err","resolve"+s]),N.buffer([u,"no-"+u]),S.buffer(["new-jsonp","cb-start","jsonp-error","jsonp-end"]),a(T,m+s),a(T,m+"-done"),a(S,"new-jsonp"),a(S,"jsonp-end"),a(S,"cb-start"),E.on("pushState-end",i),E.on("replaceState-end",i),w[v]("hashchange",i,C(!0)),w[v]("load",i,C(!0)),w[v]("popstate",function(){i(0,U>1)},C(!0))}},{}],5:[function(t,e,n){function r(){var t=new PerformanceObserver(function(t,e){var n=t.getEntries();s(v,[n])});try{t.observe({entryTypes:["resource"]})}catch(e){}}function o(t){if(s(v,[window.performance.getEntriesByType(w)]),window.performance["c"+p])try{window.performance[h](m,o,!1)}catch(t){}else try{window.performance[h]("webkit"+m,o,!1)}catch(t){}}function i(t){}if(window.performance&&window.performance.timing&&window.performance.getEntriesByType){var a=t("ee"),s=t("handle"),c=t(14),f=t(13),u=t(6),d=t(23),p="learResourceTimings",l="addEventListener",h="removeEventListener",m="resourcetimingbufferfull",v="bstResource",w="resource",g="-start",y="-end",x="fn"+g,b="fn"+y,E="bstTimer",R="pushState",O=t("loader");if(!O.disabled){O.features.stn=!0,t(9),"addEventListener"in window&&t(7);var T=NREUM.o.EV;a.on(x,function(t,e){var n=t[0];n instanceof T&&(this.bstStart=O.now())}),a.on(b,function(t,e){var n=t[0];n instanceof T&&s("bst",[n,e,this.bstStart,O.now()])}),c.on(x,function(t,e,n){this.bstStart=O.now(),this.bstType=n}),c.on(b,function(t,e){s(E,[e,this.bstStart,O.now(),this.bstType])}),f.on(x,function(){this.bstStart=O.now()}),f.on(b,function(t,e){s(E,[e,this.bstStart,O.now(),"requestAnimationFrame"])}),a.on(R+g,function(t){this.time=O.now(),this.startPath=location.pathname+location.hash}),a.on(R+y,function(t){s("bstHist",[location.pathname+location.hash,this.startPath,this.time])}),u()?(s(v,[window.performance.getEntriesByType("resource")]),r()):l in window.performance&&(window.performance["c"+p]?window.performance[l](m,o,d(!1)):window.performance[l]("webkit"+m,o,d(!1))),document[l]("scroll",i,d(!1)),document[l]("keypress",i,d(!1)),document[l]("click",i,d(!1))}}},{}],6:[function(t,e,n){e.exports=function(){return"PerformanceObserver"in window&&"function"==typeof window.PerformanceObserver}},{}],7:[function(t,e,n){function r(t){for(var e=t;e&&!e.hasOwnProperty(u);)e=Object.getPrototypeOf(e);e&&o(e)}function o(t){s.inPlace(t,[u,d],"-",i)}function i(t,e){return t[1]}var a=t("ee").get("events"),s=t("wrap-function")(a,!0),c=t("gos"),f=XMLHttpRequest,u="addEventListener",d="removeEventListener";e.exports=a,"getPrototypeOf"in Object?(r(document),r(window),r(f.prototype)):f.prototype.hasOwnProperty(u)&&(o(window),o(f.prototype)),a.on(u+"-start",function(t,e){var n=t[1];if(null!==n&&("function"==typeof n||"object"==typeof n)){var r=c(n,"nr@wrapped",function(){function t(){if("function"==typeof n.handleEvent)return n.handleEvent.apply(n,arguments)}var e={object:t,"function":n}[typeof n];return e?s(e,"fn-",null,e.name||"anonymous"):n});this.wrapped=t[1]=r}}),a.on(d+"-start",function(t){t[1]=this.wrapped||t[1]})},{}],8:[function(t,e,n){function r(t,e,n){var r=t[e];"function"==typeof r&&(t[e]=function(){var t=i(arguments),e={};o.emit(n+"before-start",[t],e);var a;e[m]&&e[m].dt&&(a=e[m].dt);var s=r.apply(this,t);return o.emit(n+"start",[t,a],s),s.then(function(t){return o.emit(n+"end",[null,t],s),t},function(t){throw o.emit(n+"end",[t],s),t})})}var o=t("ee").get("fetch"),i=t(33),a=t(32);e.exports=o;var s=window,c="fetch-",f=c+"body-",u=["arrayBuffer","blob","json","text","formData"],d=s.Request,p=s.Response,l=s.fetch,h="prototype",m="nr@context";d&&p&&l&&(a(u,function(t,e){r(d[h],e,f),r(p[h],e,f)}),r(s,"fetch",c),o.on(c+"end",function(t,e){var n=this;if(e){var r=e.headers.get("content-length");null!==r&&(n.rxSize=r),o.emit(c+"done",[null,e],n)}else o.emit(c+"done",[t],n)}))},{}],9:[function(t,e,n){var r=t("ee").get("history"),o=t("wrap-function")(r);e.exports=r;var i=window.history&&window.history.constructor&&window.history.constructor.prototype,a=window.history;i&&i.pushState&&i.replaceState&&(a=i),o.inPlace(a,["pushState","replaceState"],"-")},{}],10:[function(t,e,n){function r(t){function e(){f.emit("jsonp-end",[],l),t.removeEventListener("load",e,c(!1)),t.removeEventListener("error",n,c(!1))}function n(){f.emit("jsonp-error",[],l),f.emit("jsonp-end",[],l),t.removeEventListener("load",e,c(!1)),t.removeEventListener("error",n,c(!1))}var r=t&&"string"==typeof t.nodeName&&"script"===t.nodeName.toLowerCase();if(r){var o="function"==typeof t.addEventListener;if(o){var a=i(t.src);if(a){var d=s(a),p="function"==typeof d.parent[d.key];if(p){var l={};u.inPlace(d.parent,[d.key],"cb-",l),t.addEventListener("load",e,c(!1)),t.addEventListener("error",n,c(!1)),f.emit("new-jsonp",[t.src],l)}}}}}function o(){return"addEventListener"in window}function i(t){var e=t.match(d);return e?e[1]:null}function a(t,e){var n=t.match(l),r=n[1],o=n[3];return o?a(o,e[r]):e[r]}function s(t){var e=t.match(p);return e&&e.length>=3?{key:e[2],parent:a(e[1],window)}:{key:t,parent:window}}var c=t(23),f=t("ee").get("jsonp"),u=t("wrap-function")(f);if(e.exports=f,o()){var d=/[?&](?:callback|cb)=([^&#]+)/,p=/(.*)\.([^.]+)/,l=/^(\w+)(\.|$)(.*)$/,h=["appendChild","insertBefore","replaceChild"];Node&&Node.prototype&&Node.prototype.appendChild?u.inPlace(Node.prototype,h,"dom-"):(u.inPlace(HTMLElement.prototype,h,"dom-"),u.inPlace(HTMLHeadElement.prototype,h,"dom-"),u.inPlace(HTMLBodyElement.prototype,h,"dom-")),f.on("dom-start",function(t){r(t[0])})}},{}],11:[function(t,e,n){var r=t("ee").get("mutation"),o=t("wrap-function")(r),i=NREUM.o.MO;e.exports=r,i&&(window.MutationObserver=function(t){return this instanceof i?new i(o(t,"fn-")):i.apply(this,arguments)},MutationObserver.prototype=i.prototype)},{}],12:[function(t,e,n){function r(t){var e=i.context(),n=s(t,"executor-",e,null,!1),r=new f(n);return i.context(r).getCtx=function(){return e},r}var o=t("wrap-function"),i=t("ee").get("promise"),a=t("ee").getOrSetContext,s=o(i),c=t(32),f=NREUM.o.PR;e.exports=i,f&&(window.Promise=r,["all","race"].forEach(function(t){var e=f[t];f[t]=function(n){function r(t){return function(){i.emit("propagate",[null,!o],a,!1,!1),o=o||!t}}var o=!1;c(n,function(e,n){Promise.resolve(n).then(r("all"===t),r(!1))});var a=e.apply(f,arguments),s=f.resolve(a);return s}}),["resolve","reject"].forEach(function(t){var e=f[t];f[t]=function(t){var n=e.apply(f,arguments);return t!==n&&i.emit("propagate",[t,!0],n,!1,!1),n}}),f.prototype["catch"]=function(t){return this.then(null,t)},f.prototype=Object.create(f.prototype,{constructor:{value:r}}),c(Object.getOwnPropertyNames(f),function(t,e){try{r[e]=f[e]}catch(n){}}),o.wrapInPlace(f.prototype,"then",function(t){return function(){var e=this,n=o.argsToArray.apply(this,arguments),r=a(e);r.promise=e,n[0]=s(n[0],"cb-",r,null,!1),n[1]=s(n[1],"cb-",r,null,!1);var c=t.apply(this,n);return r.nextPromise=c,i.emit("propagate",[e,!0],c,!1,!1),c}}),i.on("executor-start",function(t){t[0]=s(t[0],"resolve-",this,null,!1),t[1]=s(t[1],"resolve-",this,null,!1)}),i.on("executor-err",function(t,e,n){t[1](n)}),i.on("cb-end",function(t,e,n){i.emit("propagate",[n,!0],this.nextPromise,!1,!1)}),i.on("propagate",function(t,e,n){this.getCtx&&!e||(this.getCtx=function(){if(t instanceof Promise)var e=i.context(t);return e&&e.getCtx?e.getCtx():this})}),r.toString=function(){return""+f})},{}],13:[function(t,e,n){var r=t("ee").get("raf"),o=t("wrap-function")(r),i="equestAnimationFrame";e.exports=r,o.inPlace(window,["r"+i,"mozR"+i,"webkitR"+i,"msR"+i],"raf-"),r.on("raf-start",function(t){t[0]=o(t[0],"fn-")})},{}],14:[function(t,e,n){function r(t,e,n){t[0]=a(t[0],"fn-",null,n)}function o(t,e,n){this.method=n,this.timerDuration=isNaN(t[1])?0:+t[1],t[0]=a(t[0],"fn-",this,n)}var i=t("ee").get("timer"),a=t("wrap-function")(i),s="setTimeout",c="setInterval",f="clearTimeout",u="-start",d="-";e.exports=i,a.inPlace(window,[s,"setImmediate"],s+d),a.inPlace(window,[c],c+d),a.inPlace(window,[f,"clearImmediate"],f+d),i.on(c+u,r),i.on(s+u,o)},{}],15:[function(t,e,n){function r(t,e){d.inPlace(e,["onreadystatechange"],"fn-",s)}function o(){var t=this,e=u.context(t);t.readyState>3&&!e.resolved&&(e.resolved=!0,u.emit("xhr-resolved",[],t)),d.inPlace(t,y,"fn-",s)}function i(t){x.push(t),m&&(E?E.then(a):w?w(a):(R=-R,O.data=R))}function a(){for(var t=0;t<x.length;t++)r([],x[t]);x.length&&(x=[])}function s(t,e){return e}function c(t,e){for(var n in t)e[n]=t[n];return e}t(7);var f=t("ee"),u=f.get("xhr"),d=t("wrap-function")(u),p=t(23),l=NREUM.o,h=l.XHR,m=l.MO,v=l.PR,w=l.SI,g="readystatechange",y=["onload","onerror","onabort","onloadstart","onloadend","onprogress","ontimeout"],x=[];e.exports=u;var b=window.XMLHttpRequest=function(t){var e=new h(t);try{u.emit("new-xhr",[e],e),e.addEventListener(g,o,p(!1))}catch(n){try{u.emit("internal-error",[n])}catch(r){}}return e};if(c(h,b),b.prototype=h.prototype,d.inPlace(b.prototype,["open","send"],"-xhr-",s),u.on("send-xhr-start",function(t,e){r(t,e),i(e)}),u.on("open-xhr-start",r),m){var E=v&&v.resolve();if(!w&&!v){var R=1,O=document.createTextNode(R);new m(a).observe(O,{characterData:!0})}}else f.on("fn-end",function(t){t[0]&&t[0].type===g||a()})},{}],16:[function(t,e,n){function r(t){if(!s(t))return null;var e=window.NREUM;if(!e.loader_config)return null;var n=(e.loader_config.accountID||"").toString()||null,r=(e.loader_config.agentID||"").toString()||null,f=(e.loader_config.trustKey||"").toString()||null;if(!n||!r)return null;var h=l.generateSpanId(),m=l.generateTraceId(),v=Date.now(),w={spanId:h,traceId:m,timestamp:v};return(t.sameOrigin||c(t)&&p())&&(w.traceContextParentHeader=o(h,m),w.traceContextStateHeader=i(h,v,n,r,f)),(t.sameOrigin&&!u()||!t.sameOrigin&&c(t)&&d())&&(w.newrelicHeader=a(h,m,v,n,r,f)),w}function o(t,e){return"00-"+e+"-"+t+"-01"}function i(t,e,n,r,o){var i=0,a="",s=1,c="",f="";return o+"@nr="+i+"-"+s+"-"+n+"-"+r+"-"+t+"-"+a+"-"+c+"-"+f+"-"+e}function a(t,e,n,r,o,i){var a="btoa"in window&&"function"==typeof window.btoa;if(!a)return null;var s={v:[0,1],d:{ty:"Browser",ac:r,ap:o,id:t,tr:e,ti:n}};return i&&r!==i&&(s.d.tk=i),btoa(JSON.stringify(s))}function s(t){return f()&&c(t)}function c(t){var e=!1,n={};if("init"in NREUM&&"distributed_tracing"in NREUM.init&&(n=NREUM.init.distributed_tracing),t.sameOrigin)e=!0;else if(n.allowed_origins instanceof Array)for(var r=0;r<n.allowed_origins.length;r++){var o=h(n.allowed_origins[r]);if(t.hostname===o.hostname&&t.protocol===o.protocol&&t.port===o.port){e=!0;break}}return e}function f(){return"init"in NREUM&&"distributed_tracing"in NREUM.init&&!!NREUM.init.distributed_tracing.enabled}function u(){return"init"in NREUM&&"distributed_tracing"in NREUM.init&&!!NREUM.init.distributed_tracing.exclude_newrelic_header}function d(){return"init"in NREUM&&"distributed_tracing"in NREUM.init&&NREUM.init.distributed_tracing.cors_use_newrelic_header!==!1}function p(){return"init"in NREUM&&"distributed_tracing"in NREUM.init&&!!NREUM.init.distributed_tracing.cors_use_tracecontext_headers}var l=t(29),h=t(18);e.exports={generateTracePayload:r,shouldGenerateTrace:s}},{}],17:[function(t,e,n){function r(t){var e=this.params,n=this.metrics;if(!this.ended){this.ended=!0;for(var r=0;r<p;r++)t.removeEventListener(d[r],this.listener,!1);e.aborted||(n.duration=a.now()-this.startTime,this.loadCaptureCalled||4!==t.readyState?null==e.status&&(e.status=0):i(this,t),n.cbTime=this.cbTime,s("xhr",[e,n,this.startTime,this.endTime,"xhr"],this))}}function o(t,e){var n=c(e),r=t.params;r.hostname=n.hostname,r.port=n.port,r.protocol=n.protocol,r.host=n.hostname+":"+n.port,r.pathname=n.pathname,t.parsedOrigin=n,t.sameOrigin=n.sameOrigin}function i(t,e){t.params.status=e.status;var n=v(e,t.lastSize);if(n&&(t.metrics.rxSize=n),t.sameOrigin){var r=e.getResponseHeader("X-NewRelic-App-Data");r&&(t.params.cat=r.split(", ").pop())}t.loadCaptureCalled=!0}var a=t("loader");if(a.xhrWrappable&&!a.disabled){var s=t("handle"),c=t(18),f=t(16).generateTracePayload,u=t("ee"),d=["load","error","abort","timeout"],p=d.length,l=t("id"),h=t(24),m=t(22),v=t(19),w=t(23),g=NREUM.o.REQ,y=window.XMLHttpRequest;a.features.xhr=!0,t(15),t(8),u.on("new-xhr",function(t){var e=this;e.totalCbs=0,e.called=0,e.cbTime=0,e.end=r,e.ended=!1,e.xhrGuids={},e.lastSize=null,e.loadCaptureCalled=!1,e.params=this.params||{},e.metrics=this.metrics||{},t.addEventListener("load",function(n){i(e,t)},w(!1)),h&&(h>34||h<10)||t.addEventListener("progress",function(t){e.lastSize=t.loaded},w(!1))}),u.on("open-xhr-start",function(t){this.params={method:t[0]},o(this,t[1]),this.metrics={}}),u.on("open-xhr-end",function(t,e){"loader_config"in NREUM&&"xpid"in NREUM.loader_config&&this.sameOrigin&&e.setRequestHeader("X-NewRelic-ID",NREUM.loader_config.xpid);var n=f(this.parsedOrigin);if(n){var r=!1;n.newrelicHeader&&(e.setRequestHeader("newrelic",n.newrelicHeader),r=!0),n.traceContextParentHeader&&(e.setRequestHeader("traceparent",n.traceContextParentHeader),n.traceContextStateHeader&&e.setRequestHeader("tracestate",n.traceContextStateHeader),r=!0),r&&(this.dt=n)}}),u.on("send-xhr-start",function(t,e){var n=this.metrics,r=t[0],o=this;if(n&&r){var i=m(r);i&&(n.txSize=i)}this.startTime=a.now(),this.listener=function(t){try{"abort"!==t.type||o.loadCaptureCalled||(o.params.aborted=!0),("load"!==t.type||o.called===o.totalCbs&&(o.onloadCalled||"function"!=typeof e.onload))&&o.end(e)}catch(n){try{u.emit("internal-error",[n])}catch(r){}}};for(var s=0;s<p;s++)e.addEventListener(d[s],this.listener,w(!1))}),u.on("xhr-cb-time",function(t,e,n){this.cbTime+=t,e?this.onloadCalled=!0:this.called+=1,this.called!==this.totalCbs||!this.onloadCalled&&"function"==typeof n.onload||this.end(n)}),u.on("xhr-load-added",function(t,e){var n=""+l(t)+!!e;this.xhrGuids&&!this.xhrGuids[n]&&(this.xhrGuids[n]=!0,this.totalCbs+=1)}),u.on("xhr-load-removed",function(t,e){var n=""+l(t)+!!e;this.xhrGuids&&this.xhrGuids[n]&&(delete this.xhrGuids[n],this.totalCbs-=1)}),u.on("xhr-resolved",function(){this.endTime=a.now()}),u.on("addEventListener-end",function(t,e){e instanceof y&&"load"===t[0]&&u.emit("xhr-load-added",[t[1],t[2]],e)}),u.on("removeEventListener-end",function(t,e){e instanceof y&&"load"===t[0]&&u.emit("xhr-load-removed",[t[1],t[2]],e)}),u.on("fn-start",function(t,e,n){e instanceof y&&("onload"===n&&(this.onload=!0),("load"===(t[0]&&t[0].type)||this.onload)&&(this.xhrCbStart=a.now()))}),u.on("fn-end",function(t,e){this.xhrCbStart&&u.emit("xhr-cb-time",[a.now()-this.xhrCbStart,this.onload,e],e)}),u.on("fetch-before-start",function(t){function e(t,e){var n=!1;return e.newrelicHeader&&(t.set("newrelic",e.newrelicHeader),n=!0),e.traceContextParentHeader&&(t.set("traceparent",e.traceContextParentHeader),e.traceContextStateHeader&&t.set("tracestate",e.traceContextStateHeader),n=!0),n}var n,r=t[1]||{};"string"==typeof t[0]?n=t[0]:t[0]&&t[0].url?n=t[0].url:window.URL&&t[0]&&t[0]instanceof URL&&(n=t[0].href),n&&(this.parsedOrigin=c(n),this.sameOrigin=this.parsedOrigin.sameOrigin);var o=f(this.parsedOrigin);if(o&&(o.newrelicHeader||o.traceContextParentHeader))if("string"==typeof t[0]||window.URL&&t[0]&&t[0]instanceof URL){var i={};for(var a in r)i[a]=r[a];i.headers=new Headers(r.headers||{}),e(i.headers,o)&&(this.dt=o),t.length>1?t[1]=i:t.push(i)}else t[0]&&t[0].headers&&e(t[0].headers,o)&&(this.dt=o)}),u.on("fetch-start",function(t,e){this.params={},this.metrics={},this.startTime=a.now(),this.dt=e,t.length>=1&&(this.target=t[0]),t.length>=2&&(this.opts=t[1]);var n,r=this.opts||{},i=this.target;"string"==typeof i?n=i:"object"==typeof i&&i instanceof g?n=i.url:window.URL&&"object"==typeof i&&i instanceof URL&&(n=i.href),o(this,n);var s=(""+(i&&i instanceof g&&i.method||r.method||"GET")).toUpperCase();this.params.method=s,this.txSize=m(r.body)||0}),u.on("fetch-done",function(t,e){this.endTime=a.now(),this.params||(this.params={}),this.params.status=e?e.status:0;var n;"string"==typeof this.rxSize&&this.rxSize.length>0&&(n=+this.rxSize);var r={txSize:this.txSize,rxSize:n,duration:a.now()-this.startTime};s("xhr",[this.params,r,this.startTime,this.endTime,"fetch"],this)})}},{}],18:[function(t,e,n){var r={};e.exports=function(t){if(t in r)return r[t];var e=document.createElement("a"),n=window.location,o={};e.href=t,o.port=e.port;var i=e.href.split("://");!o.port&&i[1]&&(o.port=i[1].split("/")[0].split("@").pop().split(":")[1]),o.port&&"0"!==o.port||(o.port="https"===i[0]?"443":"80"),o.hostname=e.hostname||n.hostname,o.pathname=e.pathname,o.protocol=i[0],"/"!==o.pathname.charAt(0)&&(o.pathname="/"+o.pathname);var a=!e.protocol||":"===e.protocol||e.protocol===n.protocol,s=e.hostname===document.domain&&e.port===n.port;return o.sameOrigin=a&&(!e.hostname||s),"/"===o.pathname&&(r[t]=o),o}},{}],19:[function(t,e,n){function r(t,e){var n=t.responseType;return"json"===n&&null!==e?e:"arraybuffer"===n||"blob"===n||"json"===n?o(t.response):"text"===n||""===n||void 0===n?o(t.responseText):void 0}var o=t(22);e.exports=r},{}],20:[function(t,e,n){function r(){}function o(t,e,n,r){return function(){return u.recordSupportability("API/"+e+"/called"),i(t+e,[f.now()].concat(s(arguments)),n?null:this,r),n?void 0:this}}var i=t("handle"),a=t(32),s=t(33),c=t("ee").get("tracer"),f=t("loader"),u=t(25),d=NREUM;"undefined"==typeof window.newrelic&&(newrelic=d);var p=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],l="api-",h=l+"ixn-";a(p,function(t,e){d[e]=o(l,e,!0,"api")}),d.addPageAction=o(l,"addPageAction",!0),d.setCurrentRouteName=o(l,"routeName",!0),e.exports=newrelic,d.interaction=function(){return(new r).get()};var m=r.prototype={createTracer:function(t,e){var n={},r=this,o="function"==typeof e;return i(h+"tracer",[f.now(),t,n],r),function(){if(c.emit((o?"":"no-")+"fn-start",[f.now(),r,o],n),o)try{return e.apply(this,arguments)}catch(t){throw c.emit("fn-err",[arguments,this,t],n),t}finally{c.emit("fn-end",[f.now()],n)}}}};a("actionText,setName,setAttribute,save,ignore,onEnd,getContext,end,get".split(","),function(t,e){m[e]=o(h,e)}),newrelic.noticeError=function(t,e){"string"==typeof t&&(t=new Error(t)),u.recordSupportability("API/noticeError/called"),i("err",[t,f.now(),!1,e])}},{}],21:[function(t,e,n){function r(t){if(NREUM.init){for(var e=NREUM.init,n=t.split("."),r=0;r<n.length-1;r++)if(e=e[n[r]],"object"!=typeof e)return;return e=e[n[n.length-1]]}}e.exports={getConfiguration:r}},{}],22:[function(t,e,n){e.exports=function(t){if("string"==typeof t&&t.length)return t.length;if("object"==typeof t){if("undefined"!=typeof ArrayBuffer&&t instanceof ArrayBuffer&&t.byteLength)return t.byteLength;if("undefined"!=typeof Blob&&t instanceof Blob&&t.size)return t.size;if(!("undefined"!=typeof FormData&&t instanceof FormData))try{return JSON.stringify(t).length}catch(e){return}}}},{}],23:[function(t,e,n){var r=!1;try{var o=Object.defineProperty({},"passive",{get:function(){r=!0}});window.addEventListener("testPassive",null,o),window.removeEventListener("testPassive",null,o)}catch(i){}e.exports=function(t){return r?{passive:!0,capture:!!t}:!!t}},{}],24:[function(t,e,n){var r=0,o=navigator.userAgent.match(/Firefox[\/\s](\d+\.\d+)/);o&&(r=+o[1]),e.exports=r},{}],25:[function(t,e,n){function r(t,e){var n=[a,t,{name:t},e];return i("storeMetric",n,null,"api"),n}function o(t,e){var n=[s,t,{name:t},e];return i("storeEventMetrics",n,null,"api"),n}var i=t("handle"),a="sm",s="cm";e.exports={constants:{SUPPORTABILITY_METRIC:a,CUSTOM_METRIC:s},recordSupportability:r,recordCustom:o}},{}],26:[function(t,e,n){function r(){return s.exists&&performance.now?Math.round(performance.now()):(i=Math.max((new Date).getTime(),i))-a}function o(){return i}var i=(new Date).getTime(),a=i,s=t(34);e.exports=r,e.exports.offset=a,e.exports.getLastTimestamp=o},{}],27:[function(t,e,n){function r(t){return!(!t||!t.protocol||"file:"===t.protocol)}e.exports=r},{}],28:[function(t,e,n){function r(t,e){var n=t.getEntries();n.forEach(function(t){"first-paint"===t.name?p("timing",["fp",Math.floor(t.startTime)]):"first-contentful-paint"===t.name&&p("timing",["fcp",Math.floor(t.startTime)])})}function o(t,e){var n=t.getEntries();if(n.length>0){var r=n[n.length-1];if(c&&c<r.startTime)return;p("lcp",[r])}}function i(t){t.getEntries().forEach(function(t){t.hadRecentInput||p("cls",[t])})}function a(t){if(t instanceof v&&!g){var e=Math.round(t.timeStamp),n={type:t.type};e<=l.now()?n.fid=l.now()-e:e>l.offset&&e<=Date.now()?(e-=l.offset,n.fid=l.now()-e):e=l.now(),g=!0,p("timing",["fi",e,n])}}function s(t){"hidden"===t&&(c=l.now(),p("pageHide",[c]))}if(!("init"in NREUM&&"page_view_timing"in NREUM.init&&"enabled"in NREUM.init.page_view_timing&&NREUM.init.page_view_timing.enabled===!1)){var c,f,u,d,p=t("handle"),l=t("loader"),h=t(31),m=t(23),v=NREUM.o.EV;if("PerformanceObserver"in window&&"function"==typeof window.PerformanceObserver){f=new PerformanceObserver(r);try{f.observe({entryTypes:["paint"]})}catch(w){}u=new PerformanceObserver(o);try{u.observe({entryTypes:["largest-contentful-paint"]})}catch(w){}d=new PerformanceObserver(i);try{d.observe({type:"layout-shift",buffered:!0})}catch(w){}}if("addEventListener"in document){var g=!1,y=["click","keydown","mousedown","pointerdown","touchstart"];y.forEach(function(t){document.addEventListener(t,a,m(!1))})}h(s)}},{}],29:[function(t,e,n){function r(){function t(){return e?15&e[n++]:16*Math.random()|0}var e=null,n=0,r=window.crypto||window.msCrypto;r&&r.getRandomValues&&(e=r.getRandomValues(new Uint8Array(31)));for(var o,i="xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx",a="",s=0;s<i.length;s++)o=i[s],"x"===o?a+=t().toString(16):"y"===o?(o=3&t()|8,a+=o.toString(16)):a+=o;return a}function o(){return a(16)}function i(){return a(32)}function a(t){function e(){return n?15&n[r++]:16*Math.random()|0}var n=null,r=0,o=window.crypto||window.msCrypto;o&&o.getRandomValues&&Uint8Array&&(n=o.getRandomValues(new Uint8Array(31)));for(var i=[],a=0;a<t;a++)i.push(e().toString(16));return i.join("")}e.exports={generateUuid:r,generateSpanId:o,generateTraceId:i}},{}],30:[function(t,e,n){function r(t,e){if(!o)return!1;if(t!==o)return!1;if(!e)return!0;if(!i)return!1;for(var n=i.split("."),r=e.split("."),a=0;a<r.length;a++)if(r[a]!==n[a])return!1;return!0}var o=null,i=null,a=/Version\/(\S+)\s+Safari/;if(navigator.userAgent){var s=navigator.userAgent,c=s.match(a);c&&s.indexOf("Chrome")===-1&&s.indexOf("Chromium")===-1&&(o="Safari",i=c[1])}e.exports={agent:o,version:i,match:r}},{}],31:[function(t,e,n){function r(t){function e(){t(s&&document[s]?document[s]:document[i]?"hidden":"visible")}"addEventListener"in document&&a&&document.addEventListener(a,e,o(!1))}var o=t(23);e.exports=r;var i,a,s;"undefined"!=typeof document.hidden?(i="hidden",a="visibilitychange",s="visibilityState"):"undefined"!=typeof document.msHidden?(i="msHidden",a="msvisibilitychange"):"undefined"!=typeof document.webkitHidden&&(i="webkitHidden",a="webkitvisibilitychange",s="webkitVisibilityState")},{}],32:[function(t,e,n){function r(t,e){var n=[],r="",i=0;for(r in t)o.call(t,r)&&(n[i]=e(r,t[r]),i+=1);return n}var o=Object.prototype.hasOwnProperty;e.exports=r},{}],33:[function(t,e,n){function r(t,e,n){e||(e=0),"undefined"==typeof n&&(n=t?t.length:0);for(var r=-1,o=n-e||0,i=Array(o<0?0:o);++r<o;)i[r]=t[e+r];return i}e.exports=r},{}],34:[function(t,e,n){e.exports={exists:"undefined"!=typeof window.performance&&window.performance.timing&&"undefined"!=typeof window.performance.timing.navigationStart}},{}],ee:[function(t,e,n){function r(){}function o(t){function e(t){return t&&t instanceof r?t:t?f(t,c,a):a()}function n(n,r,o,i,a){if(a!==!1&&(a=!0),!l.aborted||i){t&&a&&t(n,r,o);for(var s=e(o),c=m(n),f=c.length,u=0;u<f;u++)c[u].apply(s,r);var p=d[y[n]];return p&&p.push([x,n,r,s]),s}}function i(t,e){g[t]=m(t).concat(e)}function h(t,e){var n=g[t];if(n)for(var r=0;r<n.length;r++)n[r]===e&&n.splice(r,1)}function m(t){return g[t]||[]}function v(t){return p[t]=p[t]||o(n)}function w(t,e){l.aborted||u(t,function(t,n){e=e||"feature",y[n]=e,e in d||(d[e]=[])})}var g={},y={},x={on:i,addEventListener:i,removeEventListener:h,emit:n,get:v,listeners:m,context:e,buffer:w,abort:s,aborted:!1};return x}function i(t){return f(t,c,a)}function a(){return new r}function s(){(d.api||d.feature)&&(l.aborted=!0,d=l.backlog={})}var c="nr@context",f=t("gos"),u=t(32),d={},p={},l=e.exports=o();e.exports.getOrSetContext=i,l.backlog=d},{}],gos:[function(t,e,n){function r(t,e,n){if(o.call(t,e))return t[e];var r=n();if(Object.defineProperty&&Object.keys)try{return Object.defineProperty(t,e,{value:r,writable:!0,enumerable:!1}),r}catch(i){}return t[e]=r,r}var o=Object.prototype.hasOwnProperty;e.exports=r},{}],handle:[function(t,e,n){function r(t,e,n,r){o.buffer([t],r),o.emit(t,e,n)}var o=t("ee").get("handle");e.exports=r,r.ee=o},{}],id:[function(t,e,n){function r(t){var e=typeof t;return!t||"object"!==e&&"function"!==e?-1:t===window?0:a(t,i,function(){return o++})}var o=1,i="nr@id",a=t("gos");e.exports=r},{}],loader:[function(t,e,n){function r(){if(!P++){var t=T.info=NREUM.info,e=v.getElementsByTagName("script")[0];if(setTimeout(f.abort,3e4),!(t&&t.licenseKey&&t.applicationID&&e))return f.abort();c(R,function(e,n){t[e]||(t[e]=n)});var n=a();s("mark",["onload",n+T.offset],null,"api"),s("timing",["load",n]);var r=v.createElement("script");0===t.agent.indexOf("http://")||0===t.agent.indexOf("https://")?r.src=t.agent:r.src=h+"://"+t.agent,e.parentNode.insertBefore(r,e)}}function o(){"complete"===v.readyState&&i()}function i(){s("mark",["domContent",a()+T.offset],null,"api")}var a=t(26),s=t("handle"),c=t(32),f=t("ee"),u=t(30),d=t(27),p=t(21),l=t(23),h=p.getConfiguration("ssl")===!1?"http":"https",m=window,v=m.document,w="addEventListener",g="attachEvent",y=m.XMLHttpRequest,x=y&&y.prototype,b=!d(m.location);NREUM.o={ST:setTimeout,SI:m.setImmediate,CT:clearTimeout,XHR:y,REQ:m.Request,EV:m.Event,PR:m.Promise,MO:m.MutationObserver};var E=""+location,R={beacon:"bam.nr-data.net",errorBeacon:"bam.nr-data.net",agent:"js-agent.newrelic.com/nr-spa-1212.min.js"},O=y&&x&&x[w]&&!/CriOS/.test(navigator.userAgent),T=e.exports={offset:a.getLastTimestamp(),now:a,origin:E,features:{},xhrWrappable:O,userAgent:u,disabled:b};if(!b){t(20),t(28),v[w]?(v[w]("DOMContentLoaded",i,l(!1)),m[w]("load",r,l(!1))):(v[g]("onreadystatechange",o),m[g]("onload",r)),s("mark",["firstbyte",a.getLastTimestamp()],null,"api");var P=0}},{}],"wrap-function":[function(t,e,n){function r(t,e){function n(e,n,r,c,f){function nrWrapper(){var i,a,u,p;try{a=this,i=d(arguments),u="function"==typeof r?r(i,a):r||{}}catch(l){o([l,"",[i,a,c],u],t)}s(n+"start",[i,a,c],u,f);try{return p=e.apply(a,i)}catch(h){throw s(n+"err",[i,a,h],u,f),h}finally{s(n+"end",[i,a,p],u,f)}}return a(e)?e:(n||(n=""),nrWrapper[p]=e,i(e,nrWrapper,t),nrWrapper)}function r(t,e,r,o,i){r||(r="");var s,c,f,u="-"===r.charAt(0);for(f=0;f<e.length;f++)c=e[f],s=t[c],a(s)||(t[c]=n(s,u?c+r:r,o,c,i))}function s(n,r,i,a){if(!h||e){var s=h;h=!0;try{t.emit(n,r,i,e,a)}catch(c){o([c,n,r,i],t)}h=s}}return t||(t=u),n.inPlace=r,n.flag=p,n}function o(t,e){e||(e=u);try{e.emit("internal-error",t)}catch(n){}}function i(t,e,n){if(Object.defineProperty&&Object.keys)try{var r=Object.keys(t);return r.forEach(function(n){Object.defineProperty(e,n,{get:function(){return t[n]},set:function(e){return t[n]=e,e}})}),e}catch(i){o([i],n)}for(var a in t)l.call(t,a)&&(e[a]=t[a]);return e}function a(t){return!(t&&t instanceof Function&&t.apply&&!t[p])}function s(t,e){var n=e(t);return n[p]=t,i(t,n,u),n}function c(t,e,n){var r=t[e];t[e]=s(r,n)}function f(){for(var t=arguments.length,e=new Array(t),n=0;n<t;++n)e[n]=arguments[n];return e}var u=t("ee"),d=t(33),p="nr@original",l=Object.prototype.hasOwnProperty,h=!1;e.exports=r,e.exports.wrapFunction=s,e.exports.wrapInPlace=c,e.exports.argsToArray=f},{}]},{},["loader",2,17,5,3,4]); ;NREUM.loader_config={accountID:"3768898",trustKey:"3768898",agentID:"1134285132",licenseKey:"NRJS-2bc9f9fb1efc463f27c",applicationID:"1134285132"} ;NREUM.info={beacon:"bam.nr-data.net",errorBeacon:"bam.nr-data.net",licenseKey:"NRJS-2bc9f9fb1efc463f27c",applicationID:"1134285132",sa:1} newrelic.addRelease("", "Remove-ControllerConfig-r-production-4dd74f6-17d951-17d94f"); </script><meta name=viewport content="width=device-width,initial-scale=1"><meta name=author content="Crossplane Community"><meta name=color-scheme content="light dark"><meta name=docsearch:language content="en"><meta name=generator content="Hugo 0.119.0"><link rel=preload href=/fonts/Avenir-Roman.woff2 as=font type=font/woff2 crossorigin><meta property="og:image" content="/img/crossplane-logo-og.webp"><meta property="twitter:card" content="/img/crossplane-logo-og.webp"><meta property="og:image:width" content="600"><meta property="og:image:height" content="199"><meta property="og:image:alt" content="Crossplane name and popsicle logo"><meta property="twitter:image:alt" content="Crossplane name and popsicle logo"><meta property="og:type" content="website"><meta name=twitter:site content="@crossplane_io"><meta property="og:site_name" content="Crossplane Documentation"><meta name=description content="Crossplane lets you build a control plane with Kubernetes-style declarative and API-driven configuration and management for anything."><meta property="og:url" content="https://docs.crossplane.io/latest/getting-started/provider-aws/"><meta name=docsearch:modified content="January 1, 1"><title>AWS Quickstart · Crossplane v1.18</title><link rel=canonical href=https://docs.crossplane.io/latest/getting-started/provider-aws/><script>(()=>{var e=window.matchMedia("(prefers-color-scheme: dark)").matches,t=localStorage.getItem("darkSwitch")!==null&&localStorage.getItem("darkSwitch")==="dark",n=localStorage.getItem("darkSwitch")!==null&&localStorage.getItem("darkSwitch")==="light";n&&(e=!1),t||e?document.documentElement.setAttribute("color-theme","dark"):document.documentElement.setAttribute("color-theme","light")})()</script><link rel=stylesheet href=https://cdn.jsdelivr.net/npm/@docsearch/css@3 media=print onload='this.media="all"'><link rel=preconnect href=https://9UXKYX61NK-dsn.algolia.net crossorigin data-proofer-ignore><link href="https://docs.crossplane.io/scss/docs.0346bfd4a8aeace526724de64ddada78a0e5122b3b0c83b1021770d6ddef1160.css" rel=stylesheet><link rel=apple-touch-icon sizes=180x180 href=/apple-touch-icon.png><link rel=icon type=image/png sizes=32x32 href=/favicon-32x32.png><link rel=icon type=image/png sizes=192x192 href=/android-chrome-192x192.png><link rel=icon type=image/png sizes=16x16 href=/favicon-16x16.png><link rel=manifest href=/site.webmanifest><link rel=mask-icon href=/safari-pinned-tab.svg color=#f87c44><meta name=apple-mobile-web-app-title content="Crossplane Docs"><meta name=application-name content="Crossplane Docs"><meta name=msapplication-TileColor content="#333f5b"><meta name=theme-color content="#ffffff"><meta property="og:title" content="Crossplane Docs · v1.18 · AWS Quickstart"><meta property="og:description" content="Connect Crossplane to AWS to create and manage cloud resources from Kubernetes with the Upbound AWS Provider. This guide is in two parts: Part 1 walks through installing Crossplane, configuring the …"></head><body><svg xmlns="http://www.w3.org/2000/svg" style="display:none"><symbol id="check2" viewBox="0 0 16 16"><path d="M13.854 3.646a.5.5.0 010 .708l-7 7a.5.5.0 01-.708.0l-3.5-3.5a.5.5.0 11.708-.708L6.5 10.293l6.646-6.647a.5.5.0 01.708.0z"/></symbol><symbol id="x" viewBox="0 0 16 16"><path d="M2.146 2.854a.5.5.0 11.708-.708L8 7.293l5.146-5.147a.5.5.0 01.708.708L8.707 8l5.147 5.146a.5.5.0 01-.708.708L8 8.707l-5.146 5.147a.5.5.0 01-.708-.708L7.293 8 2.146 2.854z"/></symbol><symbol id="chevron-expand" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M3.646 9.146a.5.5.0 01.708.0L8 12.793l3.646-3.647a.5.5.0 01.708.708l-4 4a.5.5.0 01-.708.0l-4-4a.5.5.0 010-.708zm0-2.292a.5.5.0 00.708.0L8 3.207l3.646 3.647a.5.5.0 00.708-.708l-4-4a.5.5.0 00-.708.0l-4 4a.5.5.0 000 .708z"/></symbol><symbol id="clipboard" viewBox="0 0 16 16"><path d="M4 1.5H3a2 2 0 00-2 2V14a2 2 0 002 2h10a2 2 0 002-2V3.5a2 2 0 00-2-2h-1v1h1a1 1 0 011 1V14a1 1 0 01-1 1H3a1 1 0 01-1-1V3.5a1 1 0 011-1h1v-1z"/><path d="M9.5 1a.5.5.0 01.5.5v1a.5.5.0 01-.5.5h-3A.5.5.0 016 2.5v-1a.5.5.0 01.5-.5h3zm-3-1A1.5 1.5.0 005 1.5v1A1.5 1.5.0 006.5 4h3A1.5 1.5.0 0011 2.5v-1A1.5 1.5.0 009.5.0h-3z"/></symbol><symbol id="plus" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8 2a.5.5.0 01.5.5v5h5a.5.5.0 010 1h-5v5a.5.5.0 01-1 0v-5h-5a.5.5.0 010-1h5v-5A.5.5.0 018 2z"/></symbol><symbol id="three-dots" viewBox="0 0 16 16"><path d="M3 9.5a1.5 1.5.0 110-3 1.5 1.5.0 010 3zm5 0a1.5 1.5.0 110-3 1.5 1.5.0 010 3zm5 0a1.5 1.5.0 110-3 1.5 1.5.0 010 3z"/></symbol><symbol id="info" viewBox="0 0 16 16"><path d="M8 15A7 7 0 118 1a7 7 0 010 14zm0 1A8 8 0 108 0a8 8 0 000 16z"/><path d="m8.93 6.588-2.29.287-.082.38.45.083c.294.07.352.176.288.469l-.738 3.468c-.194.897.105 1.319.808 1.319.545.0 1.178-.252 1.465-.598l.088-.416c-.2.176-.492.246-.686.246-.275.0-.375-.193-.304-.533L8.93 6.588zM9 4.5a1 1 0 11-2 0 1 1 0 012 0z"/></symbol><symbol id="check" viewBox="0 0 16 16"><path d="M8 15A7 7 0 118 1a7 7 0 010 14zm0 1A8 8 0 108 0a8 8 0 000 16z"/><path d="M10.97 4.97a.235.235.0 00-.02.022L7.477 9.417 5.384 7.323a.75.75.0 00-1.06 1.06L6.97 11.03a.75.75.0 001.079-.02l3.992-4.99A.75.75.0 0010.97 4.97z"/></symbol><symbol id="exclamation" viewBox="0 0 16 16"><path d="M8 15A7 7 0 118 1a7 7 0 010 14zm0 1A8 8 0 108 0a8 8 0 000 16z"/><path d="M7.002 11a1 1 0 112 0 1 1 0 01-2 0zM7.1 4.995a.905.905.0 111.8.0l-.35 3.507a.552.552.0 01-1.1.0L7.1 4.995z"/></symbol><symbol id="x-circle" viewBox="0 0 16 16"><path d="M8 15A7 7 0 118 1a7 7 0 010 14zm0 1A8 8 0 108 0a8 8 0 000 16z"/><path d="M4.646 4.646a.5.5.0 01.708.0L8 7.293l2.646-2.647a.5.5.0 01.708.708L8.707 8l2.647 2.646a.5.5.0 01-.708.708L8 8.707l-2.646 2.647a.5.5.0 01-.708-.708L7.293 8 4.646 5.354a.5.5.0 010-.708z"/></symbol><symbol id="fire" viewBox="0 0 16 16"><path d="M8 16c3.314.0 6-2 6-5.5.0-1.5-.5-4-2.5-6 .25 1.5-1.25 2-1.25 2C11 4 9 .5 6 0c.357 2 .5 4-2 6-1.25 1-2 2.729-2 4.5C2 14 4.686 16 8 16zm0-1c-1.657.0-3-1-3-2.75.0-.75.25-2 1.25-3C6.125 10 7 10.5 7 10.5c-.375-1.25.5-3.25 2-3.5-.179 1-.25 2 1 3 .625.5 1 1.364 1 2.25C11 14 9.657 15 8 15z"/></symbol><symbol id="search" viewBox="0 0 16 16"><path d="M11.742 10.344a6.5 6.5.0 10-1.397 1.398h-.001c.03.04.062.078.098.115l3.85 3.85a1 1 0 001.415-1.414l-3.85-3.85a1.007 1.007.0 00-.115-.1zM12 6.5a5.5 5.5.0 11-11 0 5.5 5.5.0 0111 0z"/></symbol><symbol id="clipboard-check" viewBox="0 0 16 16"><path d="M6.5.0A1.5 1.5.0 005 1.5v1A1.5 1.5.0 006.5 4h3A1.5 1.5.0 0011 2.5v-1A1.5 1.5.0 009.5.0h-3zm3 1a.5.5.0 01.5.5v1a.5.5.0 01-.5.5h-3A.5.5.0 016 2.5v-1a.5.5.0 01.5-.5h3z"/><path d="M4 1.5H3a2 2 0 00-2 2V14a2 2 0 002 2h10a2 2 0 002-2V3.5a2 2 0 00-2-2h-1v1A2.5 2.5.0 019.5 5h-3A2.5 2.5.0 014 2.5v-1zm6.854 7.354-3 3a.5.5.0 01-.708.0l-1.5-1.5a.5.5.0 01.708-.708L7.5 10.793l2.646-2.647a.5.5.0 01.708.708z"/></symbol><symbol id="pencil-square" viewBox="0 0 16 16"><path d="M15.502 1.94a.5.5.0 010 .706L14.459 3.69l-2-2L13.502.646a.5.5.0 01.707.0l1.293 1.293zm-1.75 2.456-2-2L4.939 9.21a.5.5.0 00-.121.196l-.805 2.414a.25.25.0 00.316.316l2.414-.805a.5.5.0 00.196-.12l6.813-6.814z"/><path fill-rule="evenodd" d="M1 13.5A1.5 1.5.0 002.5 15h11a1.5 1.5.0 001.5-1.5v-6a.5.5.0 00-1 0v6a.5.5.0 01-.5.5h-11a.5.5.0 01-.5-.5v-11a.5.5.0 01.5-.5H9a.5.5.0 000-1H2.5A1.5 1.5.0 001 2.5v11z"/></symbol><symbol id="github" viewBox="0 0 16 16"><path d="M8 0C3.58.0.0 3.58.0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38.0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95.0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12.0.0.67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15.0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48.0 1.07-.01 1.93-.01 2.2.0.21.15.46.55.38A8.012 8.012.0 0016 8c0-4.42-3.58-8-8-8z"/></symbol><symbol id="box-arrow-up-right" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M8.636 3.5a.5.5.0 00-.5-.5H1.5A1.5 1.5.0 000 4.5v10A1.5 1.5.0 001.5 16h10a1.5 1.5.0 001.5-1.5V7.864a.5.5.0 00-1 0V14.5a.5.5.0 01-.5.5h-10a.5.5.0 01-.5-.5v-10a.5.5.0 01.5-.5h6.636a.5.5.0 00.5-.5z"/><path fill-rule="evenodd" d="M16 .5a.5.5.0 00-.5-.5h-5a.5.5.0 000 1h3.793L6.146 9.146a.5.5.0 10.708.708L15 1.707V5.5a.5.5.0 001 0v-5z"/></symbol></svg><header class="navbar docs-navbar navbar-expand-lg py-0 align-items-center"><div class=docs-left-toggle><button class=navbar-toggler type=button data-bs-toggle=offcanvas data-bs-target=#bdSidebar aria-controls=bdSidebar aria-label="Toggle docs content"><svg xmlns="http://www.w3.org/2000/svg" width="1.5rem" height="1.5rem" fill="currentcolor" viewBox="0 0 16 16"><path fill-rule="evenodd" d="M2.5 11.5A.5.5.0 013 11h10a.5.5.0 010 1H3a.5.5.0 01-.5-.5zm0-4A.5.5.0 013 7h10a.5.5.0 010 1H3a.5.5.0 01-.5-.5zm0-4A.5.5.0 013 3h10a.5.5.0 010 1H3a.5.5.0 01-.5-.5z"/></svg> Browse</button></div><div class="docs-right-toggle order-3"><button class=navbar-toggler type=button data-bs-toggle=offcanvas data-bs-target=#offcanvas aria-controls=offcanvas aria-label="Toggle Crossplane navigation"><svg class="bi white" aria-hidden="true"><use xlink:href="#three-dots"/></svg></button></div><div class=navbar-brand><a href=https://www.crossplane.io aria-label=Crossplane><img src=/img/crossplane-logo.svg alt="Crossplane logo" srcset="/img/crossplane-logo.svg 1x, /img/crossplane-logo.svg 2x" width=152px decoding=async data-nimg=future loading=lazy></a></div><div class="w-100 offcanvas-lg offcanvas-end" tabindex=-1 id=offcanvas aria-labelledby=offcanvasLabel><div class="offcanvas-body p-0"><div class="offcanvas-header p-0"><div class=navbar-brand><a href=https://www.crossplane.io aria-label=Crossplane><img src=/img/crossplane-logo.svg alt="Crossplane logo" srcset="/img/crossplane-logo.svg 1x, /img/crossplane-logo.svg 2x" width=152px decoding=async data-nimg=future loading=lazy></a></div><button type=button class="btn-close btn-close-white" data-bs-dismiss=offcanvas aria-label=Close data-bs-target=#offcanvas></button></div><div class="navbar-center-links collapse navbar-collapse justify-content-evenly show"><ul class="navbar-nav align-items-center"><li class=nav-item><a class=navbar-link href=https://www.crossplane.io/why-control-planes>Why Control Planes?</a></li><li class=nav-item><a class=navbar-link aria-current=page href=https://docs.crossplane.io/>Documentation</a></li><li class=nav-item><a class=navbar-link href=https://www.crossplane.io/community>Community</a></li><li class=nav-item><a class=navbar-link href=https://blog.crossplane.io/>Blog</a></li></ul></div><div class="navbar-icons flex-shrink-1 show"><ul class=navbar-nav><li class="nav-item col-xs p-2"><a class=navbar-link href=https://github.com/crossplane title="Crossplane Github Repository" target=_blank rel=noopener><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentcolor" class="icon-github" viewBox="0 0 16 16"><path d="M8 0C3.58.0.0 3.58.0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38.0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95.0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12.0.0.67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15.0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48.0 1.07-.01 1.93-.01 2.2.0.21.15.46.55.38A8.012 8.012.0 0016 8c0-4.42-3.58-8-8-8z"/></svg>Crossplane GitHub</a></li><li class="nav-item col-xs p-2"><div id=slack><a class=navbar-link href=https://slack.crossplane.io title="Join the Crossplane Slack" target=_blank rel=noopener><svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentcolor" class="icon-slack" viewBox="0 0 16 16"><path d="M3.362 10.11c0 .926-.756 1.681-1.681 1.681S0 11.036.0 10.111C0 9.186.756 8.43 1.68 8.43h1.682v1.68zm.846.0c0-.924.756-1.68 1.681-1.68s1.681.756 1.681 1.68v4.21c0 .924-.756 1.68-1.68 1.68a1.685 1.685.0 01-1.682-1.68v-4.21zM5.89 3.362c-.926.0-1.682-.756-1.682-1.681S4.964.0 5.89.0s1.68.756 1.68 1.68v1.682H5.89zm0 .846c.924.0 1.68.756 1.68 1.681S6.814 7.57 5.89 7.57H1.68C.757 7.57.0 6.814.0 5.89c0-.926.756-1.682 1.68-1.682h4.21zm6.749 1.682c0-.926.755-1.682 1.68-1.682.925.0 1.681.756 1.681 1.681s-.756 1.681-1.68 1.681h-1.681V5.89zm-.848.0c0 .924-.755 1.68-1.68 1.68A1.685 1.685.0 018.43 5.89V1.68C8.43.757 9.186.0 10.11.0c.926.0 1.681.756 1.681 1.68v4.21zm-1.681 6.748c.926.0 1.682.756 1.682 1.681S11.036 16 10.11 16s-1.681-.756-1.681-1.68v-1.682h1.68zm0-.847c-.924.0-1.68-.755-1.68-1.68.0-.925.756-1.681 1.68-1.681h4.21c.924.0 1.68.756 1.68 1.68.0.926-.756 1.681-1.68 1.681h-4.21z"/></svg>Crossplane Slack</a></div></li><li class="nav-item col-x p-2"><div class="vr d-lg-flex mx-lg-2 text-white"></div></li><li class="nav-item col-xs p-2"><div class="form-check form-switch color-switcher"><input class="d-flex form-check-input" type=checkbox id=darkSwitch> <label class="d-flex navbar-link form-check-label" for=darkSwitch>Dark Mode</label></div></li></ul></div></div></div></header><div class="bd-layout docs-container" data-bs-spy=scroll data-bs-target=#TableOfContents data-bs-threshold=0,1 data-bs-root-margin="0% 0% -75%"><aside class=bd-sidebar><div class="offcanvas-lg offcanvas-start bd-sidebar-container" tabindex=-1 id=bdSidebar aria-labelledby=bdSidebarOffcanvasLabel><div class="offcanvas-header pb-4 border-bottom"><div class="d-flex offcanvas-title fw-bold" id=bdNavbarOffcanvasLabel>Crossplane Documentation - v</div><div class=d-flex><button type=button class="btn-close bi align-self-center p-0" data-bs-dismiss=offcanvas aria-label=Close data-bs-target=#bdSidebar></button></div></div><div class=offcanvas-body><div class="container-fluid p-0"><div class="search-container d-flex row pt-3 ps-4 docsearch opacity-50" data-bs-target=#bdSidebar data-bs-dismiss=offcanvas aria-label="Docs navigation"><div class=p-0 id=docSearch></div></div><nav class="bd-links-nav w-100" aria-label="Docs navigation"><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/>Overview</a></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100 active-parent"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/getting-started/>Getting Started</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" checked aria-label="Close or Expand Getting Started Section"> <label for=collapse-efba6416 class=sidebar-label data-bs-toggle=collapse data-bs-target=#collapse-efba6416 aria-expanded=false aria-label="Close or Expand Getting Started Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse show" id=collapse-efba6416><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/getting-started/introduction/>Crossplane Introduction</a></div></div><div class="container flex-row collapse show" id=collapse-efba6416><div class="d-flex flex-column"><a class="bd-links d-flex active" href=https://docs.crossplane.io/latest/getting-started/provider-aws/>AWS Quickstart</a></div></div><div class="container flex-row collapse show" id=collapse-efba6416><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/getting-started/provider-azure/>Azure Quickstart</a></div></div><div class="container flex-row collapse show" id=collapse-efba6416><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/getting-started/provider-gcp/>GCP Quickstart</a></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/software/>Install, Upgrade and Uninstall</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand Install, Upgrade and Uninstall Section"> <label for=collapse-501dbad3 class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-501dbad3 aria-expanded=false aria-label="Close or Expand Install, Upgrade and Uninstall Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse" id=collapse-501dbad3><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/software/install/>Install Crossplane</a></div></div><div class="container flex-row collapse" id=collapse-501dbad3><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/software/upgrade/>Upgrade Crossplane</a></div></div><div class="container flex-row collapse" id=collapse-501dbad3><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/software/uninstall/>Uninstall Crossplane</a></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/concepts/>Concepts</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand Concepts Section"> <label for=collapse-4e897d67 class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-4e897d67 aria-expanded=false aria-label="Close or Expand Concepts Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/pods/>Crossplane Pods</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/providers/>Providers</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/managed-resources/>Managed Resources</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/compositions/>Compositions</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/composition-revisions/>Composition Revisions</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/composite-resource-definitions/>Composite Resource Definitions</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/composite-resources/>Composite Resources</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/claims/>Claims</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/environment-configs/>Environment Configurations</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/usages/>Usages</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/connection-details/>Connection Details</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/packages/>Configuration Packages</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/server-side-apply/>Server-Side Apply</a></div></div><div class="container flex-row collapse" id=collapse-4e897d67><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/concepts/image-configs/>Image Configs</a></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/guides/>Guides</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand Guides Section"> <label for=collapse-81c7893d class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-81c7893d aria-expanded=false aria-label="Close or Expand Guides Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/disaster-recovery/>Disaster Recovery with Crossplane</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/metrics/>Metrics</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/function-patch-and-transform/>Function Patch and Transform</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/write-a-composition-function-in-go/>Write a Composition Function in Go</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/write-a-composition-function-in-python/>Write a Composition Function in Python</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/import-existing-resources/>Import Existing Resources</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/vault-as-secret-store/>Vault as an External Secret Store</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/vault-injection/>Vault Credential Injection</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/multi-tenant/>Multi-Tenant Crossplane</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/crossplane-with-argo-cd/>Configuring Crossplane with Argo CD</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/self-signed-ca-certs/>Self-Signed CA Certs</a></div></div><div class="container flex-row collapse" id=collapse-81c7893d><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/guides/troubleshoot-crossplane/>Troubleshoot Crossplane</a></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/cli/>CLI Reference</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand CLI Reference Section"> <label for=collapse-c88095d9 class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-c88095d9 aria-expanded=false aria-label="Close or Expand CLI Reference Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse" id=collapse-c88095d9><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/cli/command-reference/>Command Reference</a></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/api/>API Reference</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand API Reference Section"> <label for=collapse-5bb69ef1 class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-5bb69ef1 aria-expanded=false aria-label="Close or Expand API Reference Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href=https://docs.crossplane.io/latest/learn/>Learn More</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><input type=checkbox class="d-flex sidebar-checkbox" aria-label="Close or Expand Learn More Section"> <label for=collapse-8c90ec3f class="sidebar-label collapsed" data-bs-toggle=collapse data-bs-target=#collapse-8c90ec3f aria-expanded=false aria-label="Close or Expand Learn More Section"><svg class="flex bi sidebar-icon plus"><use xlink:href="#plus"/></svg><svg class="flex bi sidebar-icon x"><use xlink:href="#x"/></svg></label></div></div><div class="container flex-row collapse" id=collapse-8c90ec3f><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/learn/release-cycle/>Release Cycle</a></div></div><div class="container flex-row collapse" id=collapse-8c90ec3f><div class="d-flex flex-column"><a class="bd-links d-flex" href=https://docs.crossplane.io/latest/learn/feature-lifecycle/>Feature Lifecycle</a></div></div></div><div class="section-container container pe-0 pt-1"><div class=nav-container><a href=https://docs.crossplane.io/contribute/ class="d-inline-flex align-items-center">Contributing Guide</a></div></div><div class="section-container container pe-0 pt-1"><div class="container nav-container pe-0 d-flex w-100"><a class="d-flex w-100 border-0" href="https://github.com/orgs/crossplane/projects/20/views/9?pane=info" target=_blank>Crossplane Roadmap</a><div class="d-flex flex-shrink-1 sidebar-control-container align-self-center"><a href="https://github.com/orgs/crossplane/projects/20/views/9?pane=info"><svg class="flex bi"><use xlink:href="#box-arrow-up-right"/></svg></a></div></div></div></nav></div></div></aside><main class="bd-main order-1"><div class="bd-intro pt-2 ps-lg-2"><div class="d-md-flex flex-md-row-reverse align-items-center justify-content-between"><div class="mb-3 mb-md-0 d-flex"><div class="dropdown float-end bd-dropdown"><a class="btn btn-outline-secondary dropdown-toggle bd-dropdown-item text-reset" href=# role=button id=dropdownMenuLink data-bs-toggle=dropdown aria-haspopup=true aria-expanded=false>v1.18<div class="badge rounded-pill latest">Latest</div></a><div class="dropdown-menu bd-border-color bd-dropdown" aria-labelledby=dropdownMenuLink><a class="dropdown-item bd-dropdown-item" href=https://docs.crossplane.io/master/getting-started/provider-aws/>master</a> <a class="dropdown-item bd-dropdown-item active" aria-current=true href=https://docs.crossplane.io/v1.18/getting-started/provider-aws/>v1.18<div class="badge rounded-pill latest">Latest</div></a><a class="dropdown-item bd-dropdown-item" href=https://docs.crossplane.io/v1.17/getting-started/provider-aws/>v1.17</a> <a class="dropdown-item bd-dropdown-item" href=https://docs.crossplane.io/v1.16/getting-started/provider-aws/>v1.16</a></div></div></div><h1 class="bd-title mb-0" id=content>AWS Quickstart</h1></div></div><div class="bd-toc mt-3 mb-5 my-lg-0 ps-xl-3 mb-lg-5"><button class="btn btn-link p-md-0 mb-2 mb-md-0 text-decoration-none bd-toc-toggle d-md-none" type=button data-bs-toggle=collapse data-bs-target=#tocContents aria-expanded=false aria-controls=tocContents> On this page<svg class="bi d-md-none ms-2" aria-hidden="true"><use xlink:href="#chevron-expand"/></svg></button> On this page<hr class="d-none d-md-block my-2"><div class="collapse bd-toc-collapse" id=tocContents><nav id=TableOfContents><ul class=nav><li class=nav-item><a class=nav-link href=#prerequisites>Prerequisites</a></li><li class=nav-item><a class=nav-link href=#install-the-aws-provider>Install the AWS provider</a></li><li class=nav-item><a class=nav-link href=#create-a-kubernetes-secret-for-aws>Create a Kubernetes secret for AWS</a><ul class=nav><li class=nav-item><a class=nav-link href=#generate-an-aws-key-pair-file>Generate an AWS key-pair file</a></li><li class=nav-item><a class=nav-link href=#create-a-kubernetes-secret-with-the-aws-credentials>Create a Kubernetes secret with the AWS credentials</a></li></ul></li><li class=nav-item><a class=nav-link href=#create-a-providerconfig>Create a ProviderConfig</a></li><li class=nav-item><a class=nav-link href=#create-a-managed-resource>Create a managed resource</a></li><li class=nav-item><a class=nav-link href=#delete-the-managed-resource>Delete the managed resource</a></li><li class=nav-item><a class=nav-link href=#next-steps>Next steps</a></li></ul></li></ul></nav><nav class=pt-3><div class=pb-2><svg class="bi" width="1em" height="1em"><use xlink:href="#pencil-square"/></svg><a target=_blank href="https://github.com/crossplane/docs/issues/new?title=[Web%20Bug]%20-%20AWS%20Quickstart&body=%3c!--%20What%27s%20the%20problem?%20--%3e%0a%0a%0aURL:%20https://docs.crossplane.io/latest/getting-started/provider-aws/">Report a problem</a></div><div><svg class="bi" width="1em" height="1em"><use xlink:href="#github"/></svg><a href=https://github.com/crossplane/docs/tree/master/content/latest/getting-started/provider-aws.md>View page source</a></div></div></nav></div><div class="bd-content ps-lg-2 DocSearch-content">Connect Crossplane to AWS to create and manage cloud resources from Kubernetes with the <a href=https://marketplace.upbound.io/providers/upbound/provider-family-aws>Upbound AWS Provider</a>.This guide is in two parts:<ul><li>Part 1 walks through installing Crossplane, configuring the provider to authenticate to AWS and creating a Managed Resource in AWS directly from your Kubernetes cluster. This shows Crossplane can communicate with AWS.</li><li><a href=https://docs.crossplane.io/latest/getting-started/provider-aws-part-2/>Part 2</a> shows how to build and access a custom API with Crossplane.</li></ul><h2 id=prerequisites>Prerequisites <a class=anchor-link id=prerequisites href=#prerequisites aria-label="Link to this section: Prerequisites"></a></h2>This quickstart requires:<ul><li>a Kubernetes cluster with at least 2 GB of RAM</li><li>permissions to create pods and secrets in the Kubernetes cluster</li><li><a href=https://helm.sh/>Helm</a> version v3.2.0 or later</li><li>an AWS account with permissions to create an S3 storage bucket</li><li>AWS <a href=https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds>access keys</a></li></ul><div class=gdoc-include><h2 id=install-crossplane>Install Crossplane <a class=anchor-link id=install-crossplane href=#install-crossplane aria-label="Link to this section: Install Crossplane"></a></h2>Crossplane installs into an existing Kubernetes cluster.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>If you don’t have a Kubernetes cluster create one locally with <a href=https://kind.sigs.k8s.io/>Kind</a>.</div></div><h3 id=install-the-crossplane-helm-chart>Install the Crossplane Helm chart <a class=anchor-link id=install-the-crossplane-helm-chart href=#install-the-crossplane-helm-chart aria-label="Link to this section: Install the Crossplane Helm chart"></a></h3>Helm enables Crossplane to install all its Kubernetes components through a Helm Chart.Enable the Crossplane Helm Chart repository:<div class=highlight><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-0-1>1</a>helm repo add \ <a class=lnlinks href=#hl-0-2>2</a>crossplane-stable https://charts.crossplane.io/stable <a class=lnlinks href=#hl-0-3>3</a>helm repo update </code></pre></div>Run the Helm dry-run to see all the Crossplane components Helm installs.<div class=highlight><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-1-1>1</a>helm install crossplane \ <a class=lnlinks href=#hl-1-2>2</a>crossplane-stable/crossplane \ <a class=lnlinks href=#hl-1-3>3</a>--dry-run --debug \ <a class=lnlinks href=#hl-1-4>4</a>--namespace crossplane-system \ <a class=lnlinks href=#hl-1-5>5</a>--create-namespace </code></pre></div><div class="accordion mb-3" id=view-the-helm-dry-run-961-Parent><div class=accordion-item><h2 class=accordion-header id=view-the-helm-dry-run-961><button class="accordion-button collapsed" type=button data-bs-toggle=collapse data-bs-target=#view-the-helm-dry-run-961-Content aria-expanded=false aria-controls=view-the-helm-dry-run-961-Content> View the Helm dry-run</button></h2><div id=view-the-helm-dry-run-961-Content class="accordion-collapse collapse" aria-labelledby=view-the-helm-dry-run-961 data-bs-parent=#view-the-helm-dry-run-961-Parent><div class="accordion-body rounded-bottom"><div class=highlight><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-0-1> 1</a>helm install crossplane \ <a class=lnlinks href=#hl-0-2> 2</a>crossplane-stable/crossplane \ <a class=lnlinks href=#hl-0-3> 3</a>--dry-run --debug \ <a class=lnlinks href=#hl-0-4> 4</a>--namespace crossplane-system \ <a class=lnlinks href=#hl-0-5> 5</a>--create-namespace <a class=lnlinks href=#hl-0-6> 6</a>install.go:214: [debug] Original chart version: "" <a class=lnlinks href=#hl-0-7> 7</a>install.go:216: [debug] setting version to >0.0.0-0 <a class=lnlinks href=#hl-0-8> 8</a>install.go:231: [debug] CHART PATH: /Users/plumbis/Library/Caches/helm/repository/crossplane-1.15.0.tgz <a class=lnlinks href=#hl-0-9> 9</a> <a class=lnlinks href=#hl-0-10> 10</a>NAME: crossplane <a class=lnlinks href=#hl-0-11> 11</a>LAST DEPLOYED: Mon Feb 12 14:46:15 2024 <a class=lnlinks href=#hl-0-12> 12</a>NAMESPACE: default <a class=lnlinks href=#hl-0-13> 13</a>STATUS: pending-install <a class=lnlinks href=#hl-0-14> 14</a>REVISION: 1 <a class=lnlinks href=#hl-0-15> 15</a>TEST SUITE: None <a class=lnlinks href=#hl-0-16> 16</a>USER-SUPPLIED VALUES: <a class=lnlinks href=#hl-0-17> 17</a>{} <a class=lnlinks href=#hl-0-18> 18</a> <a class=lnlinks href=#hl-0-19> 19</a>COMPUTED VALUES: <a class=lnlinks href=#hl-0-20> 20</a>affinity: {} <a class=lnlinks href=#hl-0-21> 21</a>args: [] <a class=lnlinks href=#hl-0-22> 22</a>configuration: <a class=lnlinks href=#hl-0-23> 23</a> packages: [] <a class=lnlinks href=#hl-0-24> 24</a>customAnnotations: {} <a class=lnlinks href=#hl-0-25> 25</a>customLabels: {} <a class=lnlinks href=#hl-0-26> 26</a>deploymentStrategy: RollingUpdate <a class=lnlinks href=#hl-0-27> 27</a>extraEnvVarsCrossplane: {} <a class=lnlinks href=#hl-0-28> 28</a>extraEnvVarsRBACManager: {} <a class=lnlinks href=#hl-0-29> 29</a>extraObjects: [] <a class=lnlinks href=#hl-0-30> 30</a>extraVolumeMountsCrossplane: {} <a class=lnlinks href=#hl-0-31> 31</a>extraVolumesCrossplane: {} <a class=lnlinks href=#hl-0-32> 32</a>function: <a class=lnlinks href=#hl-0-33> 33</a> packages: [] <a class=lnlinks href=#hl-0-34> 34</a>hostNetwork: false <a class=lnlinks href=#hl-0-35> 35</a>image: <a class=lnlinks href=#hl-0-36> 36</a> pullPolicy: IfNotPresent <a class=lnlinks href=#hl-0-37> 37</a> repository: xpkg.upbound.io/crossplane/crossplane <a class=lnlinks href=#hl-0-38> 38</a> tag: "" <a class=lnlinks href=#hl-0-39> 39</a>imagePullSecrets: {} <a class=lnlinks href=#hl-0-40> 40</a>leaderElection: true <a class=lnlinks href=#hl-0-41> 41</a>metrics: <a class=lnlinks href=#hl-0-42> 42</a> enabled: false <a class=lnlinks href=#hl-0-43> 43</a>nodeSelector: {} <a class=lnlinks href=#hl-0-44> 44</a>packageCache: <a class=lnlinks href=#hl-0-45> 45</a> configMap: "" <a class=lnlinks href=#hl-0-46> 46</a> medium: "" <a class=lnlinks href=#hl-0-47> 47</a> pvc: "" <a class=lnlinks href=#hl-0-48> 48</a> sizeLimit: 20Mi <a class=lnlinks href=#hl-0-49> 49</a>podSecurityContextCrossplane: {} <a class=lnlinks href=#hl-0-50> 50</a>podSecurityContextRBACManager: {} <a class=lnlinks href=#hl-0-51> 51</a>priorityClassName: "" <a class=lnlinks href=#hl-0-52> 52</a>provider: <a class=lnlinks href=#hl-0-53> 53</a> packages: [] <a class=lnlinks href=#hl-0-54> 54</a>rbacManager: <a class=lnlinks href=#hl-0-55> 55</a> affinity: {} <a class=lnlinks href=#hl-0-56> 56</a> args: [] <a class=lnlinks href=#hl-0-57> 57</a> deploy: true <a class=lnlinks href=#hl-0-58> 58</a> leaderElection: true <a class=lnlinks href=#hl-0-59> 59</a> nodeSelector: {} <a class=lnlinks href=#hl-0-60> 60</a> replicas: 1 <a class=lnlinks href=#hl-0-61> 61</a> skipAggregatedClusterRoles: false <a class=lnlinks href=#hl-0-62> 62</a> tolerations: [] <a class=lnlinks href=#hl-0-63> 63</a>registryCaBundleConfig: <a class=lnlinks href=#hl-0-64> 64</a> key: "" <a class=lnlinks href=#hl-0-65> 65</a> name: "" <a class=lnlinks href=#hl-0-66> 66</a>replicas: 1 <a class=lnlinks href=#hl-0-67> 67</a>resourcesCrossplane: <a class=lnlinks href=#hl-0-68> 68</a> limits: <a class=lnlinks href=#hl-0-69> 69</a> cpu: 100m <a class=lnlinks href=#hl-0-70> 70</a> memory: 512Mi <a class=lnlinks href=#hl-0-71> 71</a> requests: <a class=lnlinks href=#hl-0-72> 72</a> cpu: 100m <a class=lnlinks href=#hl-0-73> 73</a> memory: 256Mi <a class=lnlinks href=#hl-0-74> 74</a>resourcesRBACManager: <a class=lnlinks href=#hl-0-75> 75</a> limits: <a class=lnlinks href=#hl-0-76> 76</a> cpu: 100m <a class=lnlinks href=#hl-0-77> 77</a> memory: 512Mi <a class=lnlinks href=#hl-0-78> 78</a> requests: <a class=lnlinks href=#hl-0-79> 79</a> cpu: 100m <a class=lnlinks href=#hl-0-80> 80</a> memory: 256Mi <a class=lnlinks href=#hl-0-81> 81</a>securityContextCrossplane: <a class=lnlinks href=#hl-0-82> 82</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-83> 83</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-84> 84</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-85> 85</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-86> 86</a>securityContextRBACManager: <a class=lnlinks href=#hl-0-87> 87</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-88> 88</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-89> 89</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-90> 90</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-91> 91</a>serviceAccount: <a class=lnlinks href=#hl-0-92> 92</a> customAnnotations: {} <a class=lnlinks href=#hl-0-93> 93</a>tolerations: [] <a class=lnlinks href=#hl-0-94> 94</a>webhooks: <a class=lnlinks href=#hl-0-95> 95</a> enabled: true <a class=lnlinks href=#hl-0-96> 96</a> <a class=lnlinks href=#hl-0-97> 97</a>HOOKS: <a class=lnlinks href=#hl-0-98> 98</a>MANIFEST: <a class=lnlinks href=#hl-0-99> 99</a>--- <a class=lnlinks href=#hl-0-100> 100</a># Source: crossplane/templates/rbac-manager-serviceaccount.yaml <a class=lnlinks href=#hl-0-101> 101</a>apiVersion: v1 <a class=lnlinks href=#hl-0-102> 102</a>kind: ServiceAccount <a class=lnlinks href=#hl-0-103> 103</a>metadata: <a class=lnlinks href=#hl-0-104> 104</a> name: rbac-manager <a class=lnlinks href=#hl-0-105> 105</a> namespace: default <a class=lnlinks href=#hl-0-106> 106</a> labels: <a class=lnlinks href=#hl-0-107> 107</a> app: crossplane <a class=lnlinks href=#hl-0-108> 108</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-109> 109</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-110> 110</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-111> 111</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-112> 112</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-113> 113</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-114> 114</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-115> 115</a>--- <a class=lnlinks href=#hl-0-116> 116</a># Source: crossplane/templates/serviceaccount.yaml <a class=lnlinks href=#hl-0-117> 117</a>apiVersion: v1 <a class=lnlinks href=#hl-0-118> 118</a>kind: ServiceAccount <a class=lnlinks href=#hl-0-119> 119</a>metadata: <a class=lnlinks href=#hl-0-120> 120</a> name: crossplane <a class=lnlinks href=#hl-0-121> 121</a> namespace: default <a class=lnlinks href=#hl-0-122> 122</a> labels: <a class=lnlinks href=#hl-0-123> 123</a> app: crossplane <a class=lnlinks href=#hl-0-124> 124</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-125> 125</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-126> 126</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-127> 127</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-128> 128</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-129> 129</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-130> 130</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-131> 131</a>--- <a class=lnlinks href=#hl-0-132> 132</a># Source: crossplane/templates/secret.yaml <a class=lnlinks href=#hl-0-133> 133</a># The reason this is created empty and filled by the init container is we want <a class=lnlinks href=#hl-0-134> 134</a># to manage the lifecycle of the secret via Helm. This way whenever Crossplane <a class=lnlinks href=#hl-0-135> 135</a># is deleted, the secret is deleted as well. <a class=lnlinks href=#hl-0-136> 136</a>apiVersion: v1 <a class=lnlinks href=#hl-0-137> 137</a>kind: Secret <a class=lnlinks href=#hl-0-138> 138</a>metadata: <a class=lnlinks href=#hl-0-139> 139</a> name: crossplane-root-ca <a class=lnlinks href=#hl-0-140> 140</a> namespace: default <a class=lnlinks href=#hl-0-141> 141</a>type: Opaque <a class=lnlinks href=#hl-0-142> 142</a>--- <a class=lnlinks href=#hl-0-143> 143</a># Source: crossplane/templates/secret.yaml <a class=lnlinks href=#hl-0-144> 144</a># The reason this is created empty and filled by the init container is we want <a class=lnlinks href=#hl-0-145> 145</a># to manage the lifecycle of the secret via Helm. This way whenever Crossplane <a class=lnlinks href=#hl-0-146> 146</a># is deleted, the secret is deleted as well. <a class=lnlinks href=#hl-0-147> 147</a>apiVersion: v1 <a class=lnlinks href=#hl-0-148> 148</a>kind: Secret <a class=lnlinks href=#hl-0-149> 149</a>metadata: <a class=lnlinks href=#hl-0-150> 150</a> name: crossplane-tls-server <a class=lnlinks href=#hl-0-151> 151</a> namespace: default <a class=lnlinks href=#hl-0-152> 152</a>type: Opaque <a class=lnlinks href=#hl-0-153> 153</a>--- <a class=lnlinks href=#hl-0-154> 154</a># Source: crossplane/templates/secret.yaml <a class=lnlinks href=#hl-0-155> 155</a># The reason this is created empty and filled by the init container is we want <a class=lnlinks href=#hl-0-156> 156</a># to manage the lifecycle of the secret via Helm. This way whenever Crossplane <a class=lnlinks href=#hl-0-157> 157</a># is deleted, the secret is deleted as well. <a class=lnlinks href=#hl-0-158> 158</a>apiVersion: v1 <a class=lnlinks href=#hl-0-159> 159</a>kind: Secret <a class=lnlinks href=#hl-0-160> 160</a>metadata: <a class=lnlinks href=#hl-0-161> 161</a> name: crossplane-tls-client <a class=lnlinks href=#hl-0-162> 162</a> namespace: default <a class=lnlinks href=#hl-0-163> 163</a>type: Opaque <a class=lnlinks href=#hl-0-164> 164</a>--- <a class=lnlinks href=#hl-0-165> 165</a># Source: crossplane/templates/clusterrole.yaml <a class=lnlinks href=#hl-0-166> 166</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-167> 167</a>kind: ClusterRole <a class=lnlinks href=#hl-0-168> 168</a>metadata: <a class=lnlinks href=#hl-0-169> 169</a> name: crossplane <a class=lnlinks href=#hl-0-170> 170</a> labels: <a class=lnlinks href=#hl-0-171> 171</a> app: crossplane <a class=lnlinks href=#hl-0-172> 172</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-173> 173</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-174> 174</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-175> 175</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-176> 176</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-177> 177</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-178> 178</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-179> 179</a>aggregationRule: <a class=lnlinks href=#hl-0-180> 180</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-181> 181</a> - matchLabels: <a class=lnlinks href=#hl-0-182> 182</a> rbac.crossplane.io/aggregate-to-crossplane: "true" <a class=lnlinks href=#hl-0-183> 183</a>--- <a class=lnlinks href=#hl-0-184> 184</a># Source: crossplane/templates/clusterrole.yaml <a class=lnlinks href=#hl-0-185> 185</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-186> 186</a>kind: ClusterRole <a class=lnlinks href=#hl-0-187> 187</a>metadata: <a class=lnlinks href=#hl-0-188> 188</a> name: crossplane:system:aggregate-to-crossplane <a class=lnlinks href=#hl-0-189> 189</a> labels: <a class=lnlinks href=#hl-0-190> 190</a> app: crossplane <a class=lnlinks href=#hl-0-191> 191</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-192> 192</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-193> 193</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-194> 194</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-195> 195</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-196> 196</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-197> 197</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-198> 198</a> crossplane.io/scope: "system" <a class=lnlinks href=#hl-0-199> 199</a> rbac.crossplane.io/aggregate-to-crossplane: "true" <a class=lnlinks href=#hl-0-200> 200</a>rules: <a class=lnlinks href=#hl-0-201> 201</a>- apiGroups: <a class=lnlinks href=#hl-0-202> 202</a> - "" <a class=lnlinks href=#hl-0-203> 203</a> resources: <a class=lnlinks href=#hl-0-204> 204</a> - events <a class=lnlinks href=#hl-0-205> 205</a> verbs: <a class=lnlinks href=#hl-0-206> 206</a> - create <a class=lnlinks href=#hl-0-207> 207</a> - update <a class=lnlinks href=#hl-0-208> 208</a> - patch <a class=lnlinks href=#hl-0-209> 209</a> - delete <a class=lnlinks href=#hl-0-210> 210</a>- apiGroups: <a class=lnlinks href=#hl-0-211> 211</a> - apiextensions.k8s.io <a class=lnlinks href=#hl-0-212> 212</a> resources: <a class=lnlinks href=#hl-0-213> 213</a> - customresourcedefinitions <a class=lnlinks href=#hl-0-214> 214</a> - customresourcedefinitions/status <a class=lnlinks href=#hl-0-215> 215</a> verbs: <a class=lnlinks href=#hl-0-216> 216</a> - "*" <a class=lnlinks href=#hl-0-217> 217</a>- apiGroups: <a class=lnlinks href=#hl-0-218> 218</a> - "" <a class=lnlinks href=#hl-0-219> 219</a> resources: <a class=lnlinks href=#hl-0-220> 220</a> - secrets <a class=lnlinks href=#hl-0-221> 221</a> verbs: <a class=lnlinks href=#hl-0-222> 222</a> - get <a class=lnlinks href=#hl-0-223> 223</a> - list <a class=lnlinks href=#hl-0-224> 224</a> - watch <a class=lnlinks href=#hl-0-225> 225</a> - create <a class=lnlinks href=#hl-0-226> 226</a> - update <a class=lnlinks href=#hl-0-227> 227</a> - patch <a class=lnlinks href=#hl-0-228> 228</a> - delete <a class=lnlinks href=#hl-0-229> 229</a>- apiGroups: <a class=lnlinks href=#hl-0-230> 230</a> - "" <a class=lnlinks href=#hl-0-231> 231</a> resources: <a class=lnlinks href=#hl-0-232> 232</a> - serviceaccounts <a class=lnlinks href=#hl-0-233> 233</a> - services <a class=lnlinks href=#hl-0-234> 234</a> verbs: <a class=lnlinks href=#hl-0-235> 235</a> - "*" <a class=lnlinks href=#hl-0-236> 236</a>- apiGroups: <a class=lnlinks href=#hl-0-237> 237</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-238> 238</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-239> 239</a> - secrets.crossplane.io <a class=lnlinks href=#hl-0-240> 240</a> resources: <a class=lnlinks href=#hl-0-241> 241</a> - "*" <a class=lnlinks href=#hl-0-242> 242</a> verbs: <a class=lnlinks href=#hl-0-243> 243</a> - "*" <a class=lnlinks href=#hl-0-244> 244</a>- apiGroups: <a class=lnlinks href=#hl-0-245> 245</a> - extensions <a class=lnlinks href=#hl-0-246> 246</a> - apps <a class=lnlinks href=#hl-0-247> 247</a> resources: <a class=lnlinks href=#hl-0-248> 248</a> - deployments <a class=lnlinks href=#hl-0-249> 249</a> verbs: <a class=lnlinks href=#hl-0-250> 250</a> - get <a class=lnlinks href=#hl-0-251> 251</a> - list <a class=lnlinks href=#hl-0-252> 252</a> - create <a class=lnlinks href=#hl-0-253> 253</a> - update <a class=lnlinks href=#hl-0-254> 254</a> - patch <a class=lnlinks href=#hl-0-255> 255</a> - delete <a class=lnlinks href=#hl-0-256> 256</a> - watch <a class=lnlinks href=#hl-0-257> 257</a>- apiGroups: <a class=lnlinks href=#hl-0-258> 258</a> - "" <a class=lnlinks href=#hl-0-259> 259</a> - coordination.k8s.io <a class=lnlinks href=#hl-0-260> 260</a> resources: <a class=lnlinks href=#hl-0-261> 261</a> - configmaps <a class=lnlinks href=#hl-0-262> 262</a> - leases <a class=lnlinks href=#hl-0-263> 263</a> verbs: <a class=lnlinks href=#hl-0-264> 264</a> - get <a class=lnlinks href=#hl-0-265> 265</a> - list <a class=lnlinks href=#hl-0-266> 266</a> - create <a class=lnlinks href=#hl-0-267> 267</a> - update <a class=lnlinks href=#hl-0-268> 268</a> - patch <a class=lnlinks href=#hl-0-269> 269</a> - watch <a class=lnlinks href=#hl-0-270> 270</a> - delete <a class=lnlinks href=#hl-0-271> 271</a>- apiGroups: <a class=lnlinks href=#hl-0-272> 272</a> - admissionregistration.k8s.io <a class=lnlinks href=#hl-0-273> 273</a> resources: <a class=lnlinks href=#hl-0-274> 274</a> - validatingwebhookconfigurations <a class=lnlinks href=#hl-0-275> 275</a> - mutatingwebhookconfigurations <a class=lnlinks href=#hl-0-276> 276</a> verbs: <a class=lnlinks href=#hl-0-277> 277</a> - get <a class=lnlinks href=#hl-0-278> 278</a> - list <a class=lnlinks href=#hl-0-279> 279</a> - create <a class=lnlinks href=#hl-0-280> 280</a> - update <a class=lnlinks href=#hl-0-281> 281</a> - patch <a class=lnlinks href=#hl-0-282> 282</a> - watch <a class=lnlinks href=#hl-0-283> 283</a> - delete <a class=lnlinks href=#hl-0-284> 284</a>--- <a class=lnlinks href=#hl-0-285> 285</a># Source: crossplane/templates/rbac-manager-allowed-provider-permissions.yaml <a class=lnlinks href=#hl-0-286> 286</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-287> 287</a>kind: ClusterRole <a class=lnlinks href=#hl-0-288> 288</a>metadata: <a class=lnlinks href=#hl-0-289> 289</a> name: crossplane:allowed-provider-permissions <a class=lnlinks href=#hl-0-290> 290</a> labels: <a class=lnlinks href=#hl-0-291> 291</a> app: crossplane <a class=lnlinks href=#hl-0-292> 292</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-293> 293</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-294> 294</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-295> 295</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-296> 296</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-297> 297</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-298> 298</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-299> 299</a>aggregationRule: <a class=lnlinks href=#hl-0-300> 300</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-301> 301</a> - matchLabels: <a class=lnlinks href=#hl-0-302> 302</a> rbac.crossplane.io/aggregate-to-allowed-provider-permissions: "true" <a class=lnlinks href=#hl-0-303> 303</a>--- <a class=lnlinks href=#hl-0-304> 304</a># Source: crossplane/templates/rbac-manager-clusterrole.yaml <a class=lnlinks href=#hl-0-305> 305</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-306> 306</a>kind: ClusterRole <a class=lnlinks href=#hl-0-307> 307</a>metadata: <a class=lnlinks href=#hl-0-308> 308</a> name: crossplane-rbac-manager <a class=lnlinks href=#hl-0-309> 309</a> labels: <a class=lnlinks href=#hl-0-310> 310</a> app: crossplane <a class=lnlinks href=#hl-0-311> 311</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-312> 312</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-313> 313</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-314> 314</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-315> 315</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-316> 316</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-317> 317</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-318> 318</a>rules: <a class=lnlinks href=#hl-0-319> 319</a>- apiGroups: <a class=lnlinks href=#hl-0-320> 320</a> - "" <a class=lnlinks href=#hl-0-321> 321</a> resources: <a class=lnlinks href=#hl-0-322> 322</a> - events <a class=lnlinks href=#hl-0-323> 323</a> verbs: <a class=lnlinks href=#hl-0-324> 324</a> - create <a class=lnlinks href=#hl-0-325> 325</a> - update <a class=lnlinks href=#hl-0-326> 326</a> - patch <a class=lnlinks href=#hl-0-327> 327</a> - delete <a class=lnlinks href=#hl-0-328> 328</a>- apiGroups: <a class=lnlinks href=#hl-0-329> 329</a> - "" <a class=lnlinks href=#hl-0-330> 330</a> resources: <a class=lnlinks href=#hl-0-331> 331</a> - namespaces <a class=lnlinks href=#hl-0-332> 332</a> verbs: <a class=lnlinks href=#hl-0-333> 333</a> - get <a class=lnlinks href=#hl-0-334> 334</a> - list <a class=lnlinks href=#hl-0-335> 335</a> - watch <a class=lnlinks href=#hl-0-336> 336</a>- apiGroups: <a class=lnlinks href=#hl-0-337> 337</a> - apps <a class=lnlinks href=#hl-0-338> 338</a> resources: <a class=lnlinks href=#hl-0-339> 339</a> - deployments <a class=lnlinks href=#hl-0-340> 340</a> verbs: <a class=lnlinks href=#hl-0-341> 341</a> - get <a class=lnlinks href=#hl-0-342> 342</a> - list <a class=lnlinks href=#hl-0-343> 343</a> - watch <a class=lnlinks href=#hl-0-344> 344</a># The RBAC manager creates a series of RBAC roles for each namespace it sees. <a class=lnlinks href=#hl-0-345> 345</a># These RBAC roles are controlled (in the owner reference sense) by the namespace. <a class=lnlinks href=#hl-0-346> 346</a># The RBAC manager needs permission to set finalizers on Namespaces in order to <a class=lnlinks href=#hl-0-347> 347</a># create resources that block their deletion when the <a class=lnlinks href=#hl-0-348> 348</a># OwnerReferencesPermissionEnforcement admission controller is enabled. <a class=lnlinks href=#hl-0-349> 349</a># See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement <a class=lnlinks href=#hl-0-350> 350</a>- apiGroups: <a class=lnlinks href=#hl-0-351> 351</a> - "" <a class=lnlinks href=#hl-0-352> 352</a> resources: <a class=lnlinks href=#hl-0-353> 353</a> - namespaces/finalizers <a class=lnlinks href=#hl-0-354> 354</a> verbs: <a class=lnlinks href=#hl-0-355> 355</a> - update <a class=lnlinks href=#hl-0-356> 356</a>- apiGroups: <a class=lnlinks href=#hl-0-357> 357</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-358> 358</a> resources: <a class=lnlinks href=#hl-0-359> 359</a> - compositeresourcedefinitions <a class=lnlinks href=#hl-0-360> 360</a> verbs: <a class=lnlinks href=#hl-0-361> 361</a> - get <a class=lnlinks href=#hl-0-362> 362</a> - list <a class=lnlinks href=#hl-0-363> 363</a> - watch <a class=lnlinks href=#hl-0-364> 364</a># The RBAC manager creates a series of RBAC cluster roles for each XRD it sees. <a class=lnlinks href=#hl-0-365> 365</a># These cluster roles are controlled (in the owner reference sense) by the XRD. <a class=lnlinks href=#hl-0-366> 366</a># The RBAC manager needs permission to set finalizers on XRDs in order to <a class=lnlinks href=#hl-0-367> 367</a># create resources that block their deletion when the <a class=lnlinks href=#hl-0-368> 368</a># OwnerReferencesPermissionEnforcement admission controller is enabled. <a class=lnlinks href=#hl-0-369> 369</a># See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement <a class=lnlinks href=#hl-0-370> 370</a>- apiGroups: <a class=lnlinks href=#hl-0-371> 371</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-372> 372</a> resources: <a class=lnlinks href=#hl-0-373> 373</a> - compositeresourcedefinitions/finalizers <a class=lnlinks href=#hl-0-374> 374</a> verbs: <a class=lnlinks href=#hl-0-375> 375</a> - update <a class=lnlinks href=#hl-0-376> 376</a>- apiGroups: <a class=lnlinks href=#hl-0-377> 377</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-378> 378</a> resources: <a class=lnlinks href=#hl-0-379> 379</a> - providerrevisions <a class=lnlinks href=#hl-0-380> 380</a> verbs: <a class=lnlinks href=#hl-0-381> 381</a> - get <a class=lnlinks href=#hl-0-382> 382</a> - list <a class=lnlinks href=#hl-0-383> 383</a> - watch <a class=lnlinks href=#hl-0-384> 384</a># The RBAC manager creates a series of RBAC cluster roles for each ProviderRevision <a class=lnlinks href=#hl-0-385> 385</a># it sees. These cluster roles are controlled (in the owner reference sense) by the <a class=lnlinks href=#hl-0-386> 386</a># ProviderRevision. The RBAC manager needs permission to set finalizers on <a class=lnlinks href=#hl-0-387> 387</a># ProviderRevisions in order to create resources that block their deletion when the <a class=lnlinks href=#hl-0-388> 388</a># OwnerReferencesPermissionEnforcement admission controller is enabled. <a class=lnlinks href=#hl-0-389> 389</a># See https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement <a class=lnlinks href=#hl-0-390> 390</a>- apiGroups: <a class=lnlinks href=#hl-0-391> 391</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-392> 392</a> resources: <a class=lnlinks href=#hl-0-393> 393</a> - providerrevisions/finalizers <a class=lnlinks href=#hl-0-394> 394</a> verbs: <a class=lnlinks href=#hl-0-395> 395</a> - update <a class=lnlinks href=#hl-0-396> 396</a>- apiGroups: <a class=lnlinks href=#hl-0-397> 397</a> - apiextensions.k8s.io <a class=lnlinks href=#hl-0-398> 398</a> resources: <a class=lnlinks href=#hl-0-399> 399</a> - customresourcedefinitions <a class=lnlinks href=#hl-0-400> 400</a> verbs: <a class=lnlinks href=#hl-0-401> 401</a> - get <a class=lnlinks href=#hl-0-402> 402</a> - list <a class=lnlinks href=#hl-0-403> 403</a> - watch <a class=lnlinks href=#hl-0-404> 404</a>- apiGroups: <a class=lnlinks href=#hl-0-405> 405</a> - rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-406> 406</a> resources: <a class=lnlinks href=#hl-0-407> 407</a> - clusterroles <a class=lnlinks href=#hl-0-408> 408</a> - roles <a class=lnlinks href=#hl-0-409> 409</a> verbs: <a class=lnlinks href=#hl-0-410> 410</a> - get <a class=lnlinks href=#hl-0-411> 411</a> - list <a class=lnlinks href=#hl-0-412> 412</a> - watch <a class=lnlinks href=#hl-0-413> 413</a> - create <a class=lnlinks href=#hl-0-414> 414</a> - update <a class=lnlinks href=#hl-0-415> 415</a> - patch <a class=lnlinks href=#hl-0-416> 416</a> # The RBAC manager may grant access it does not have. <a class=lnlinks href=#hl-0-417> 417</a> - escalate <a class=lnlinks href=#hl-0-418> 418</a>- apiGroups: <a class=lnlinks href=#hl-0-419> 419</a> - rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-420> 420</a> resources: <a class=lnlinks href=#hl-0-421> 421</a> - clusterroles <a class=lnlinks href=#hl-0-422> 422</a> verbs: <a class=lnlinks href=#hl-0-423> 423</a> - bind <a class=lnlinks href=#hl-0-424> 424</a>- apiGroups: <a class=lnlinks href=#hl-0-425> 425</a> - rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-426> 426</a> resources: <a class=lnlinks href=#hl-0-427> 427</a> - clusterrolebindings <a class=lnlinks href=#hl-0-428> 428</a> verbs: <a class=lnlinks href=#hl-0-429> 429</a> - "*" <a class=lnlinks href=#hl-0-430> 430</a>- apiGroups: <a class=lnlinks href=#hl-0-431> 431</a> - "" <a class=lnlinks href=#hl-0-432> 432</a> - coordination.k8s.io <a class=lnlinks href=#hl-0-433> 433</a> resources: <a class=lnlinks href=#hl-0-434> 434</a> - configmaps <a class=lnlinks href=#hl-0-435> 435</a> - leases <a class=lnlinks href=#hl-0-436> 436</a> verbs: <a class=lnlinks href=#hl-0-437> 437</a> - get <a class=lnlinks href=#hl-0-438> 438</a> - list <a class=lnlinks href=#hl-0-439> 439</a> - create <a class=lnlinks href=#hl-0-440> 440</a> - update <a class=lnlinks href=#hl-0-441> 441</a> - patch <a class=lnlinks href=#hl-0-442> 442</a> - watch <a class=lnlinks href=#hl-0-443> 443</a> - delete <a class=lnlinks href=#hl-0-444> 444</a>--- <a class=lnlinks href=#hl-0-445> 445</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-446> 446</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-447> 447</a>kind: ClusterRole <a class=lnlinks href=#hl-0-448> 448</a>metadata: <a class=lnlinks href=#hl-0-449> 449</a> name: crossplane-admin <a class=lnlinks href=#hl-0-450> 450</a> labels: <a class=lnlinks href=#hl-0-451> 451</a> app: crossplane <a class=lnlinks href=#hl-0-452> 452</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-453> 453</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-454> 454</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-455> 455</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-456> 456</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-457> 457</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-458> 458</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-459> 459</a>aggregationRule: <a class=lnlinks href=#hl-0-460> 460</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-461> 461</a> - matchLabels: <a class=lnlinks href=#hl-0-462> 462</a> rbac.crossplane.io/aggregate-to-admin: "true" <a class=lnlinks href=#hl-0-463> 463</a>--- <a class=lnlinks href=#hl-0-464> 464</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-465> 465</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-466> 466</a>kind: ClusterRole <a class=lnlinks href=#hl-0-467> 467</a>metadata: <a class=lnlinks href=#hl-0-468> 468</a> name: crossplane-edit <a class=lnlinks href=#hl-0-469> 469</a> labels: <a class=lnlinks href=#hl-0-470> 470</a> app: crossplane <a class=lnlinks href=#hl-0-471> 471</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-472> 472</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-473> 473</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-474> 474</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-475> 475</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-476> 476</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-477> 477</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-478> 478</a>aggregationRule: <a class=lnlinks href=#hl-0-479> 479</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-480> 480</a> - matchLabels: <a class=lnlinks href=#hl-0-481> 481</a> rbac.crossplane.io/aggregate-to-edit: "true" <a class=lnlinks href=#hl-0-482> 482</a>--- <a class=lnlinks href=#hl-0-483> 483</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-484> 484</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-485> 485</a>kind: ClusterRole <a class=lnlinks href=#hl-0-486> 486</a>metadata: <a class=lnlinks href=#hl-0-487> 487</a> name: crossplane-view <a class=lnlinks href=#hl-0-488> 488</a> labels: <a class=lnlinks href=#hl-0-489> 489</a> app: crossplane <a class=lnlinks href=#hl-0-490> 490</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-491> 491</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-492> 492</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-493> 493</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-494> 494</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-495> 495</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-496> 496</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-497> 497</a>aggregationRule: <a class=lnlinks href=#hl-0-498> 498</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-499> 499</a> - matchLabels: <a class=lnlinks href=#hl-0-500> 500</a> rbac.crossplane.io/aggregate-to-view: "true" <a class=lnlinks href=#hl-0-501> 501</a>--- <a class=lnlinks href=#hl-0-502> 502</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-503> 503</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-504> 504</a>kind: ClusterRole <a class=lnlinks href=#hl-0-505> 505</a>metadata: <a class=lnlinks href=#hl-0-506> 506</a> name: crossplane-browse <a class=lnlinks href=#hl-0-507> 507</a> labels: <a class=lnlinks href=#hl-0-508> 508</a> app: crossplane <a class=lnlinks href=#hl-0-509> 509</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-510> 510</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-511> 511</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-512> 512</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-513> 513</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-514> 514</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-515> 515</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-516> 516</a>aggregationRule: <a class=lnlinks href=#hl-0-517> 517</a> clusterRoleSelectors: <a class=lnlinks href=#hl-0-518> 518</a> - matchLabels: <a class=lnlinks href=#hl-0-519> 519</a> rbac.crossplane.io/aggregate-to-browse: "true" <a class=lnlinks href=#hl-0-520> 520</a>--- <a class=lnlinks href=#hl-0-521> 521</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-522> 522</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-523> 523</a>kind: ClusterRole <a class=lnlinks href=#hl-0-524> 524</a>metadata: <a class=lnlinks href=#hl-0-525> 525</a> name: crossplane:aggregate-to-admin <a class=lnlinks href=#hl-0-526> 526</a> labels: <a class=lnlinks href=#hl-0-527> 527</a> rbac.crossplane.io/aggregate-to-admin: "true" <a class=lnlinks href=#hl-0-528> 528</a> app: crossplane <a class=lnlinks href=#hl-0-529> 529</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-530> 530</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-531> 531</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-532> 532</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-533> 533</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-534> 534</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-535> 535</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-536> 536</a>rules: <a class=lnlinks href=#hl-0-537> 537</a># Crossplane administrators have access to view events. <a class=lnlinks href=#hl-0-538> 538</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-539> 539</a> resources: [events] <a class=lnlinks href=#hl-0-540> 540</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-541> 541</a># Crossplane administrators must create provider credential secrets, and may <a class=lnlinks href=#hl-0-542> 542</a># need to read or otherwise interact with connection secrets. They may also need <a class=lnlinks href=#hl-0-543> 543</a># to create or annotate namespaces. <a class=lnlinks href=#hl-0-544> 544</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-545> 545</a> resources: [secrets, namespaces] <a class=lnlinks href=#hl-0-546> 546</a> verbs: ["*"] <a class=lnlinks href=#hl-0-547> 547</a># Crossplane administrators have access to view the roles that they may be able <a class=lnlinks href=#hl-0-548> 548</a># to grant to other subjects. <a class=lnlinks href=#hl-0-549> 549</a>- apiGroups: [rbac.authorization.k8s.io] <a class=lnlinks href=#hl-0-550> 550</a> resources: [clusterroles, roles] <a class=lnlinks href=#hl-0-551> 551</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-552> 552</a># Crossplane administrators have access to grant the access they have to other <a class=lnlinks href=#hl-0-553> 553</a># subjects. <a class=lnlinks href=#hl-0-554> 554</a>- apiGroups: [rbac.authorization.k8s.io] <a class=lnlinks href=#hl-0-555> 555</a> resources: [clusterrolebindings, rolebindings] <a class=lnlinks href=#hl-0-556> 556</a> verbs: ["*"] <a class=lnlinks href=#hl-0-557> 557</a># Crossplane administrators have full access to built in Crossplane types. <a class=lnlinks href=#hl-0-558> 558</a>- apiGroups: <a class=lnlinks href=#hl-0-559> 559</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-560> 560</a> resources: ["*"] <a class=lnlinks href=#hl-0-561> 561</a> verbs: ["*"] <a class=lnlinks href=#hl-0-562> 562</a>- apiGroups: <a class=lnlinks href=#hl-0-563> 563</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-564> 564</a> resources: ["*"] <a class=lnlinks href=#hl-0-565> 565</a> verbs: ["*"] <a class=lnlinks href=#hl-0-566> 566</a># Crossplane administrators have access to view CRDs in order to debug XRDs. <a class=lnlinks href=#hl-0-567> 567</a>- apiGroups: [apiextensions.k8s.io] <a class=lnlinks href=#hl-0-568> 568</a> resources: [customresourcedefinitions] <a class=lnlinks href=#hl-0-569> 569</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-570> 570</a>--- <a class=lnlinks href=#hl-0-571> 571</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-572> 572</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-573> 573</a>kind: ClusterRole <a class=lnlinks href=#hl-0-574> 574</a>metadata: <a class=lnlinks href=#hl-0-575> 575</a> name: crossplane:aggregate-to-edit <a class=lnlinks href=#hl-0-576> 576</a> labels: <a class=lnlinks href=#hl-0-577> 577</a> rbac.crossplane.io/aggregate-to-edit: "true" <a class=lnlinks href=#hl-0-578> 578</a> app: crossplane <a class=lnlinks href=#hl-0-579> 579</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-580> 580</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-581> 581</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-582> 582</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-583> 583</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-584> 584</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-585> 585</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-586> 586</a>rules: <a class=lnlinks href=#hl-0-587> 587</a># Crossplane editors have access to view events. <a class=lnlinks href=#hl-0-588> 588</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-589> 589</a> resources: [events] <a class=lnlinks href=#hl-0-590> 590</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-591> 591</a># Crossplane editors must create provider credential secrets, and may need to <a class=lnlinks href=#hl-0-592> 592</a># read or otherwise interact with connection secrets. <a class=lnlinks href=#hl-0-593> 593</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-594> 594</a> resources: [secrets] <a class=lnlinks href=#hl-0-595> 595</a> verbs: ["*"] <a class=lnlinks href=#hl-0-596> 596</a># Crossplane editors may see which namespaces exist, but not edit them. <a class=lnlinks href=#hl-0-597> 597</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-598> 598</a> resources: [namespaces] <a class=lnlinks href=#hl-0-599> 599</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-600> 600</a># Crossplane editors have full access to built in Crossplane types. <a class=lnlinks href=#hl-0-601> 601</a>- apiGroups: <a class=lnlinks href=#hl-0-602> 602</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-603> 603</a> resources: ["*"] <a class=lnlinks href=#hl-0-604> 604</a> verbs: ["*"] <a class=lnlinks href=#hl-0-605> 605</a>- apiGroups: <a class=lnlinks href=#hl-0-606> 606</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-607> 607</a> resources: ["*"] <a class=lnlinks href=#hl-0-608> 608</a> verbs: ["*"] <a class=lnlinks href=#hl-0-609> 609</a>--- <a class=lnlinks href=#hl-0-610> 610</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-611> 611</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-612> 612</a>kind: ClusterRole <a class=lnlinks href=#hl-0-613> 613</a>metadata: <a class=lnlinks href=#hl-0-614> 614</a> name: crossplane:aggregate-to-view <a class=lnlinks href=#hl-0-615> 615</a> labels: <a class=lnlinks href=#hl-0-616> 616</a> rbac.crossplane.io/aggregate-to-view: "true" <a class=lnlinks href=#hl-0-617> 617</a> app: crossplane <a class=lnlinks href=#hl-0-618> 618</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-619> 619</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-620> 620</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-621> 621</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-622> 622</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-623> 623</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-624> 624</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-625> 625</a>rules: <a class=lnlinks href=#hl-0-626> 626</a># Crossplane viewers have access to view events. <a class=lnlinks href=#hl-0-627> 627</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-628> 628</a> resources: [events] <a class=lnlinks href=#hl-0-629> 629</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-630> 630</a># Crossplane viewers may see which namespaces exist. <a class=lnlinks href=#hl-0-631> 631</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-632> 632</a> resources: [namespaces] <a class=lnlinks href=#hl-0-633> 633</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-634> 634</a># Crossplane viewers have read-only access to built in Crossplane types. <a class=lnlinks href=#hl-0-635> 635</a>- apiGroups: <a class=lnlinks href=#hl-0-636> 636</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-637> 637</a> resources: ["*"] <a class=lnlinks href=#hl-0-638> 638</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-639> 639</a>- apiGroups: <a class=lnlinks href=#hl-0-640> 640</a> - pkg.crossplane.io <a class=lnlinks href=#hl-0-641> 641</a> resources: ["*"] <a class=lnlinks href=#hl-0-642> 642</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-643> 643</a>--- <a class=lnlinks href=#hl-0-644> 644</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-645> 645</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-646> 646</a>kind: ClusterRole <a class=lnlinks href=#hl-0-647> 647</a>metadata: <a class=lnlinks href=#hl-0-648> 648</a> name: crossplane:aggregate-to-browse <a class=lnlinks href=#hl-0-649> 649</a> labels: <a class=lnlinks href=#hl-0-650> 650</a> rbac.crossplane.io/aggregate-to-browse: "true" <a class=lnlinks href=#hl-0-651> 651</a> app: crossplane <a class=lnlinks href=#hl-0-652> 652</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-653> 653</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-654> 654</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-655> 655</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-656> 656</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-657> 657</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-658> 658</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-659> 659</a>rules: <a class=lnlinks href=#hl-0-660> 660</a># Crossplane browsers have access to view events. <a class=lnlinks href=#hl-0-661> 661</a>- apiGroups: [""] <a class=lnlinks href=#hl-0-662> 662</a> resources: [events] <a class=lnlinks href=#hl-0-663> 663</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-664> 664</a># Crossplane browsers have read-only access to compositions and XRDs. This <a class=lnlinks href=#hl-0-665> 665</a># allows them to discover and select an appropriate composition when creating a <a class=lnlinks href=#hl-0-666> 666</a># resource claim. <a class=lnlinks href=#hl-0-667> 667</a>- apiGroups: <a class=lnlinks href=#hl-0-668> 668</a> - apiextensions.crossplane.io <a class=lnlinks href=#hl-0-669> 669</a> resources: ["*"] <a class=lnlinks href=#hl-0-670> 670</a> verbs: [get, list, watch] <a class=lnlinks href=#hl-0-671> 671</a>--- <a class=lnlinks href=#hl-0-672> 672</a># Source: crossplane/templates/clusterrolebinding.yaml <a class=lnlinks href=#hl-0-673> 673</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-674> 674</a>kind: ClusterRoleBinding <a class=lnlinks href=#hl-0-675> 675</a>metadata: <a class=lnlinks href=#hl-0-676> 676</a> name: crossplane <a class=lnlinks href=#hl-0-677> 677</a> labels: <a class=lnlinks href=#hl-0-678> 678</a> app: crossplane <a class=lnlinks href=#hl-0-679> 679</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-680> 680</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-681> 681</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-682> 682</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-683> 683</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-684> 684</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-685> 685</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-686> 686</a>roleRef: <a class=lnlinks href=#hl-0-687> 687</a> apiGroup: rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-688> 688</a> kind: ClusterRole <a class=lnlinks href=#hl-0-689> 689</a> name: crossplane <a class=lnlinks href=#hl-0-690> 690</a>subjects: <a class=lnlinks href=#hl-0-691> 691</a>- kind: ServiceAccount <a class=lnlinks href=#hl-0-692> 692</a> name: crossplane <a class=lnlinks href=#hl-0-693> 693</a> namespace: default <a class=lnlinks href=#hl-0-694> 694</a>--- <a class=lnlinks href=#hl-0-695> 695</a># Source: crossplane/templates/rbac-manager-clusterrolebinding.yaml <a class=lnlinks href=#hl-0-696> 696</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-697> 697</a>kind: ClusterRoleBinding <a class=lnlinks href=#hl-0-698> 698</a>metadata: <a class=lnlinks href=#hl-0-699> 699</a> name: crossplane-rbac-manager <a class=lnlinks href=#hl-0-700> 700</a> labels: <a class=lnlinks href=#hl-0-701> 701</a> app: crossplane <a class=lnlinks href=#hl-0-702> 702</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-703> 703</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-704> 704</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-705> 705</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-706> 706</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-707> 707</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-708> 708</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-709> 709</a>roleRef: <a class=lnlinks href=#hl-0-710> 710</a> apiGroup: rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-711> 711</a> kind: ClusterRole <a class=lnlinks href=#hl-0-712> 712</a> name: crossplane-rbac-manager <a class=lnlinks href=#hl-0-713> 713</a>subjects: <a class=lnlinks href=#hl-0-714> 714</a>- kind: ServiceAccount <a class=lnlinks href=#hl-0-715> 715</a> name: rbac-manager <a class=lnlinks href=#hl-0-716> 716</a> namespace: default <a class=lnlinks href=#hl-0-717> 717</a>--- <a class=lnlinks href=#hl-0-718> 718</a># Source: crossplane/templates/rbac-manager-managed-clusterroles.yaml <a class=lnlinks href=#hl-0-719> 719</a>apiVersion: rbac.authorization.k8s.io/v1 <a class=lnlinks href=#hl-0-720> 720</a>kind: ClusterRoleBinding <a class=lnlinks href=#hl-0-721> 721</a>metadata: <a class=lnlinks href=#hl-0-722> 722</a> name: crossplane-admin <a class=lnlinks href=#hl-0-723> 723</a> labels: <a class=lnlinks href=#hl-0-724> 724</a> app: crossplane <a class=lnlinks href=#hl-0-725> 725</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-726> 726</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-727> 727</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-728> 728</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-729> 729</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-730> 730</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-731> 731</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-732> 732</a>roleRef: <a class=lnlinks href=#hl-0-733> 733</a> apiGroup: rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-734> 734</a> kind: ClusterRole <a class=lnlinks href=#hl-0-735> 735</a> name: crossplane-admin <a class=lnlinks href=#hl-0-736> 736</a>subjects: <a class=lnlinks href=#hl-0-737> 737</a>- apiGroup: rbac.authorization.k8s.io <a class=lnlinks href=#hl-0-738> 738</a> kind: Group <a class=lnlinks href=#hl-0-739> 739</a> name: crossplane:masters <a class=lnlinks href=#hl-0-740> 740</a>--- <a class=lnlinks href=#hl-0-741> 741</a># Source: crossplane/templates/service.yaml <a class=lnlinks href=#hl-0-742> 742</a>apiVersion: v1 <a class=lnlinks href=#hl-0-743> 743</a>kind: Service <a class=lnlinks href=#hl-0-744> 744</a>metadata: <a class=lnlinks href=#hl-0-745> 745</a> name: crossplane-webhooks <a class=lnlinks href=#hl-0-746> 746</a> namespace: default <a class=lnlinks href=#hl-0-747> 747</a> labels: <a class=lnlinks href=#hl-0-748> 748</a> app: crossplane <a class=lnlinks href=#hl-0-749> 749</a> release: crossplane <a class=lnlinks href=#hl-0-750> 750</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-751> 751</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-752> 752</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-753> 753</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-754> 754</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-755> 755</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-756> 756</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-757> 757</a>spec: <a class=lnlinks href=#hl-0-758> 758</a> selector: <a class=lnlinks href=#hl-0-759> 759</a> app: crossplane <a class=lnlinks href=#hl-0-760> 760</a> release: crossplane <a class=lnlinks href=#hl-0-761> 761</a> ports: <a class=lnlinks href=#hl-0-762> 762</a> - protocol: TCP <a class=lnlinks href=#hl-0-763> 763</a> port: 9443 <a class=lnlinks href=#hl-0-764> 764</a> targetPort: 9443 <a class=lnlinks href=#hl-0-765> 765</a>--- <a class=lnlinks href=#hl-0-766> 766</a># Source: crossplane/templates/deployment.yaml <a class=lnlinks href=#hl-0-767> 767</a>apiVersion: apps/v1 <a class=lnlinks href=#hl-0-768> 768</a>kind: Deployment <a class=lnlinks href=#hl-0-769> 769</a>metadata: <a class=lnlinks href=#hl-0-770> 770</a> name: crossplane <a class=lnlinks href=#hl-0-771> 771</a> namespace: default <a class=lnlinks href=#hl-0-772> 772</a> labels: <a class=lnlinks href=#hl-0-773> 773</a> app: crossplane <a class=lnlinks href=#hl-0-774> 774</a> release: crossplane <a class=lnlinks href=#hl-0-775> 775</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-776> 776</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-777> 777</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-778> 778</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-779> 779</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-780> 780</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-781> 781</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-782> 782</a>spec: <a class=lnlinks href=#hl-0-783> 783</a> replicas: 1 <a class=lnlinks href=#hl-0-784> 784</a> selector: <a class=lnlinks href=#hl-0-785> 785</a> matchLabels: <a class=lnlinks href=#hl-0-786> 786</a> app: crossplane <a class=lnlinks href=#hl-0-787> 787</a> release: crossplane <a class=lnlinks href=#hl-0-788> 788</a> strategy: <a class=lnlinks href=#hl-0-789> 789</a> type: RollingUpdate <a class=lnlinks href=#hl-0-790> 790</a> template: <a class=lnlinks href=#hl-0-791> 791</a> metadata: <a class=lnlinks href=#hl-0-792> 792</a> labels: <a class=lnlinks href=#hl-0-793> 793</a> app: crossplane <a class=lnlinks href=#hl-0-794> 794</a> release: crossplane <a class=lnlinks href=#hl-0-795> 795</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-796> 796</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-797> 797</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-798> 798</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-799> 799</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-800> 800</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-801> 801</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-802> 802</a> spec: <a class=lnlinks href=#hl-0-803> 803</a> serviceAccountName: crossplane <a class=lnlinks href=#hl-0-804> 804</a> hostNetwork: false <a class=lnlinks href=#hl-0-805> 805</a> initContainers: <a class=lnlinks href=#hl-0-806> 806</a> - image: "xpkg.upbound.io/crossplane/crossplane:v1.15.0" <a class=lnlinks href=#hl-0-807> 807</a> args: <a class=lnlinks href=#hl-0-808> 808</a> - core <a class=lnlinks href=#hl-0-809> 809</a> - init <a class=lnlinks href=#hl-0-810> 810</a> imagePullPolicy: IfNotPresent <a class=lnlinks href=#hl-0-811> 811</a> name: crossplane-init <a class=lnlinks href=#hl-0-812> 812</a> resources: <a class=lnlinks href=#hl-0-813> 813</a> limits: <a class=lnlinks href=#hl-0-814> 814</a> cpu: 100m <a class=lnlinks href=#hl-0-815> 815</a> memory: 512Mi <a class=lnlinks href=#hl-0-816> 816</a> requests: <a class=lnlinks href=#hl-0-817> 817</a> cpu: 100m <a class=lnlinks href=#hl-0-818> 818</a> memory: 256Mi <a class=lnlinks href=#hl-0-819> 819</a> securityContext: <a class=lnlinks href=#hl-0-820> 820</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-821> 821</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-822> 822</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-823> 823</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-824> 824</a> env: <a class=lnlinks href=#hl-0-825> 825</a> - name: GOMAXPROCS <a class=lnlinks href=#hl-0-826> 826</a> valueFrom: <a class=lnlinks href=#hl-0-827> 827</a> resourceFieldRef: <a class=lnlinks href=#hl-0-828> 828</a> containerName: crossplane-init <a class=lnlinks href=#hl-0-829> 829</a> resource: limits.cpu <a class=lnlinks href=#hl-0-830> 830</a> divisor: "1" <a class=lnlinks href=#hl-0-831> 831</a> - name: GOMEMLIMIT <a class=lnlinks href=#hl-0-832> 832</a> valueFrom: <a class=lnlinks href=#hl-0-833> 833</a> resourceFieldRef: <a class=lnlinks href=#hl-0-834> 834</a> containerName: crossplane-init <a class=lnlinks href=#hl-0-835> 835</a> resource: limits.memory <a class=lnlinks href=#hl-0-836> 836</a> divisor: "1" <a class=lnlinks href=#hl-0-837> 837</a> - name: POD_NAMESPACE <a class=lnlinks href=#hl-0-838> 838</a> valueFrom: <a class=lnlinks href=#hl-0-839> 839</a> fieldRef: <a class=lnlinks href=#hl-0-840> 840</a> fieldPath: metadata.namespace <a class=lnlinks href=#hl-0-841> 841</a> - name: POD_SERVICE_ACCOUNT <a class=lnlinks href=#hl-0-842> 842</a> valueFrom: <a class=lnlinks href=#hl-0-843> 843</a> fieldRef: <a class=lnlinks href=#hl-0-844> 844</a> fieldPath: spec.serviceAccountName <a class=lnlinks href=#hl-0-845> 845</a> - name: "WEBHOOK_SERVICE_NAME" <a class=lnlinks href=#hl-0-846> 846</a> value: crossplane-webhooks <a class=lnlinks href=#hl-0-847> 847</a> - name: "WEBHOOK_SERVICE_NAMESPACE" <a class=lnlinks href=#hl-0-848> 848</a> valueFrom: <a class=lnlinks href=#hl-0-849> 849</a> fieldRef: <a class=lnlinks href=#hl-0-850> 850</a> fieldPath: metadata.namespace <a class=lnlinks href=#hl-0-851> 851</a> - name: "WEBHOOK_SERVICE_PORT" <a class=lnlinks href=#hl-0-852> 852</a> value: "9443" <a class=lnlinks href=#hl-0-853> 853</a> - name: "TLS_CA_SECRET_NAME" <a class=lnlinks href=#hl-0-854> 854</a> value: crossplane-root-ca <a class=lnlinks href=#hl-0-855> 855</a> - name: "TLS_SERVER_SECRET_NAME" <a class=lnlinks href=#hl-0-856> 856</a> value: crossplane-tls-server <a class=lnlinks href=#hl-0-857> 857</a> - name: "TLS_CLIENT_SECRET_NAME" <a class=lnlinks href=#hl-0-858> 858</a> value: crossplane-tls-client <a class=lnlinks href=#hl-0-859> 859</a> containers: <a class=lnlinks href=#hl-0-860> 860</a> - image: "xpkg.upbound.io/crossplane/crossplane:v1.15.0" <a class=lnlinks href=#hl-0-861> 861</a> args: <a class=lnlinks href=#hl-0-862> 862</a> - core <a class=lnlinks href=#hl-0-863> 863</a> - start <a class=lnlinks href=#hl-0-864> 864</a> imagePullPolicy: IfNotPresent <a class=lnlinks href=#hl-0-865> 865</a> name: crossplane <a class=lnlinks href=#hl-0-866> 866</a> resources: <a class=lnlinks href=#hl-0-867> 867</a> limits: <a class=lnlinks href=#hl-0-868> 868</a> cpu: 100m <a class=lnlinks href=#hl-0-869> 869</a> memory: 512Mi <a class=lnlinks href=#hl-0-870> 870</a> requests: <a class=lnlinks href=#hl-0-871> 871</a> cpu: 100m <a class=lnlinks href=#hl-0-872> 872</a> memory: 256Mi <a class=lnlinks href=#hl-0-873> 873</a> startupProbe: <a class=lnlinks href=#hl-0-874> 874</a> failureThreshold: 30 <a class=lnlinks href=#hl-0-875> 875</a> periodSeconds: 2 <a class=lnlinks href=#hl-0-876> 876</a> tcpSocket: <a class=lnlinks href=#hl-0-877> 877</a> port: readyz <a class=lnlinks href=#hl-0-878> 878</a> ports: <a class=lnlinks href=#hl-0-879> 879</a> - name: readyz <a class=lnlinks href=#hl-0-880> 880</a> containerPort: 8081 <a class=lnlinks href=#hl-0-881> 881</a> - name: webhooks <a class=lnlinks href=#hl-0-882> 882</a> containerPort: 9443 <a class=lnlinks href=#hl-0-883> 883</a> securityContext: <a class=lnlinks href=#hl-0-884> 884</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-885> 885</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-886> 886</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-887> 887</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-888> 888</a> env: <a class=lnlinks href=#hl-0-889> 889</a> - name: GOMAXPROCS <a class=lnlinks href=#hl-0-890> 890</a> valueFrom: <a class=lnlinks href=#hl-0-891> 891</a> resourceFieldRef: <a class=lnlinks href=#hl-0-892> 892</a> containerName: crossplane <a class=lnlinks href=#hl-0-893> 893</a> resource: limits.cpu <a class=lnlinks href=#hl-0-894> 894</a> divisor: "1" <a class=lnlinks href=#hl-0-895> 895</a> - name: GOMEMLIMIT <a class=lnlinks href=#hl-0-896> 896</a> valueFrom: <a class=lnlinks href=#hl-0-897> 897</a> resourceFieldRef: <a class=lnlinks href=#hl-0-898> 898</a> containerName: crossplane <a class=lnlinks href=#hl-0-899> 899</a> resource: limits.memory <a class=lnlinks href=#hl-0-900> 900</a> divisor: "1" <a class=lnlinks href=#hl-0-901> 901</a> - name: POD_NAMESPACE <a class=lnlinks href=#hl-0-902> 902</a> valueFrom: <a class=lnlinks href=#hl-0-903> 903</a> fieldRef: <a class=lnlinks href=#hl-0-904> 904</a> fieldPath: metadata.namespace <a class=lnlinks href=#hl-0-905> 905</a> - name: POD_SERVICE_ACCOUNT <a class=lnlinks href=#hl-0-906> 906</a> valueFrom: <a class=lnlinks href=#hl-0-907> 907</a> fieldRef: <a class=lnlinks href=#hl-0-908> 908</a> fieldPath: spec.serviceAccountName <a class=lnlinks href=#hl-0-909> 909</a> - name: LEADER_ELECTION <a class=lnlinks href=#hl-0-910> 910</a> value: "true" <a class=lnlinks href=#hl-0-911> 911</a> - name: "TLS_SERVER_SECRET_NAME" <a class=lnlinks href=#hl-0-912> 912</a> value: crossplane-tls-server <a class=lnlinks href=#hl-0-913> 913</a> - name: "TLS_SERVER_CERTS_DIR" <a class=lnlinks href=#hl-0-914> 914</a> value: /tls/server <a class=lnlinks href=#hl-0-915> 915</a> - name: "TLS_CLIENT_SECRET_NAME" <a class=lnlinks href=#hl-0-916> 916</a> value: crossplane-tls-client <a class=lnlinks href=#hl-0-917> 917</a> - name: "TLS_CLIENT_CERTS_DIR" <a class=lnlinks href=#hl-0-918> 918</a> value: /tls/client <a class=lnlinks href=#hl-0-919> 919</a> volumeMounts: <a class=lnlinks href=#hl-0-920> 920</a> - mountPath: /cache <a class=lnlinks href=#hl-0-921> 921</a> name: package-cache <a class=lnlinks href=#hl-0-922> 922</a> - mountPath: /tls/server <a class=lnlinks href=#hl-0-923> 923</a> name: tls-server-certs <a class=lnlinks href=#hl-0-924> 924</a> - mountPath: /tls/client <a class=lnlinks href=#hl-0-925> 925</a> name: tls-client-certs <a class=lnlinks href=#hl-0-926> 926</a> volumes: <a class=lnlinks href=#hl-0-927> 927</a> - name: package-cache <a class=lnlinks href=#hl-0-928> 928</a> emptyDir: <a class=lnlinks href=#hl-0-929> 929</a> medium: <a class=lnlinks href=#hl-0-930> 930</a> sizeLimit: 20Mi <a class=lnlinks href=#hl-0-931> 931</a> - name: tls-server-certs <a class=lnlinks href=#hl-0-932> 932</a> secret: <a class=lnlinks href=#hl-0-933> 933</a> secretName: crossplane-tls-server <a class=lnlinks href=#hl-0-934> 934</a> - name: tls-client-certs <a class=lnlinks href=#hl-0-935> 935</a> secret: <a class=lnlinks href=#hl-0-936> 936</a> secretName: crossplane-tls-client <a class=lnlinks href=#hl-0-937> 937</a>--- <a class=lnlinks href=#hl-0-938> 938</a># Source: crossplane/templates/rbac-manager-deployment.yaml <a class=lnlinks href=#hl-0-939> 939</a>apiVersion: apps/v1 <a class=lnlinks href=#hl-0-940> 940</a>kind: Deployment <a class=lnlinks href=#hl-0-941> 941</a>metadata: <a class=lnlinks href=#hl-0-942> 942</a> name: crossplane-rbac-manager <a class=lnlinks href=#hl-0-943> 943</a> namespace: default <a class=lnlinks href=#hl-0-944> 944</a> labels: <a class=lnlinks href=#hl-0-945> 945</a> app: crossplane-rbac-manager <a class=lnlinks href=#hl-0-946> 946</a> release: crossplane <a class=lnlinks href=#hl-0-947> 947</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-948> 948</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-949> 949</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-950> 950</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-951> 951</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-952> 952</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-953> 953</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-954> 954</a>spec: <a class=lnlinks href=#hl-0-955> 955</a> replicas: 1 <a class=lnlinks href=#hl-0-956> 956</a> selector: <a class=lnlinks href=#hl-0-957> 957</a> matchLabels: <a class=lnlinks href=#hl-0-958> 958</a> app: crossplane-rbac-manager <a class=lnlinks href=#hl-0-959> 959</a> release: crossplane <a class=lnlinks href=#hl-0-960> 960</a> strategy: <a class=lnlinks href=#hl-0-961> 961</a> type: RollingUpdate <a class=lnlinks href=#hl-0-962> 962</a> template: <a class=lnlinks href=#hl-0-963> 963</a> metadata: <a class=lnlinks href=#hl-0-964> 964</a> labels: <a class=lnlinks href=#hl-0-965> 965</a> app: crossplane-rbac-manager <a class=lnlinks href=#hl-0-966> 966</a> release: crossplane <a class=lnlinks href=#hl-0-967> 967</a> helm.sh/chart: crossplane-1.15.0 <a class=lnlinks href=#hl-0-968> 968</a> app.kubernetes.io/managed-by: Helm <a class=lnlinks href=#hl-0-969> 969</a> app.kubernetes.io/component: cloud-infrastructure-controller <a class=lnlinks href=#hl-0-970> 970</a> app.kubernetes.io/part-of: crossplane <a class=lnlinks href=#hl-0-971> 971</a> app.kubernetes.io/name: crossplane <a class=lnlinks href=#hl-0-972> 972</a> app.kubernetes.io/instance: crossplane <a class=lnlinks href=#hl-0-973> 973</a> app.kubernetes.io/version: "1.15.0" <a class=lnlinks href=#hl-0-974> 974</a> spec: <a class=lnlinks href=#hl-0-975> 975</a> serviceAccountName: rbac-manager <a class=lnlinks href=#hl-0-976> 976</a> initContainers: <a class=lnlinks href=#hl-0-977> 977</a> - image: "xpkg.upbound.io/crossplane/crossplane:v1.15.0" <a class=lnlinks href=#hl-0-978> 978</a> args: <a class=lnlinks href=#hl-0-979> 979</a> - rbac <a class=lnlinks href=#hl-0-980> 980</a> - init <a class=lnlinks href=#hl-0-981> 981</a> imagePullPolicy: IfNotPresent <a class=lnlinks href=#hl-0-982> 982</a> name: crossplane-init <a class=lnlinks href=#hl-0-983> 983</a> resources: <a class=lnlinks href=#hl-0-984> 984</a> limits: <a class=lnlinks href=#hl-0-985> 985</a> cpu: 100m <a class=lnlinks href=#hl-0-986> 986</a> memory: 512Mi <a class=lnlinks href=#hl-0-987> 987</a> requests: <a class=lnlinks href=#hl-0-988> 988</a> cpu: 100m <a class=lnlinks href=#hl-0-989> 989</a> memory: 256Mi <a class=lnlinks href=#hl-0-990> 990</a> securityContext: <a class=lnlinks href=#hl-0-991> 991</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-992> 992</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-993> 993</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-994> 994</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-995> 995</a> env: <a class=lnlinks href=#hl-0-996> 996</a> - name: GOMAXPROCS <a class=lnlinks href=#hl-0-997> 997</a> valueFrom: <a class=lnlinks href=#hl-0-998> 998</a> resourceFieldRef: <a class=lnlinks href=#hl-0-999> 999</a> containerName: crossplane-init <a class=lnlinks href=#hl-0-1000>1000</a> resource: limits.cpu <a class=lnlinks href=#hl-0-1001>1001</a> - name: GOMEMLIMIT <a class=lnlinks href=#hl-0-1002>1002</a> valueFrom: <a class=lnlinks href=#hl-0-1003>1003</a> resourceFieldRef: <a class=lnlinks href=#hl-0-1004>1004</a> containerName: crossplane-init <a class=lnlinks href=#hl-0-1005>1005</a> resource: limits.memory <a class=lnlinks href=#hl-0-1006>1006</a> containers: <a class=lnlinks href=#hl-0-1007>1007</a> - image: "xpkg.upbound.io/crossplane/crossplane:v1.15.0" <a class=lnlinks href=#hl-0-1008>1008</a> args: <a class=lnlinks href=#hl-0-1009>1009</a> - rbac <a class=lnlinks href=#hl-0-1010>1010</a> - start <a class=lnlinks href=#hl-0-1011>1011</a> - --provider-clusterrole=crossplane:allowed-provider-permissions <a class=lnlinks href=#hl-0-1012>1012</a> imagePullPolicy: IfNotPresent <a class=lnlinks href=#hl-0-1013>1013</a> name: crossplane <a class=lnlinks href=#hl-0-1014>1014</a> resources: <a class=lnlinks href=#hl-0-1015>1015</a> limits: <a class=lnlinks href=#hl-0-1016>1016</a> cpu: 100m <a class=lnlinks href=#hl-0-1017>1017</a> memory: 512Mi <a class=lnlinks href=#hl-0-1018>1018</a> requests: <a class=lnlinks href=#hl-0-1019>1019</a> cpu: 100m <a class=lnlinks href=#hl-0-1020>1020</a> memory: 256Mi <a class=lnlinks href=#hl-0-1021>1021</a> securityContext: <a class=lnlinks href=#hl-0-1022>1022</a> allowPrivilegeEscalation: false <a class=lnlinks href=#hl-0-1023>1023</a> readOnlyRootFilesystem: true <a class=lnlinks href=#hl-0-1024>1024</a> runAsGroup: 65532 <a class=lnlinks href=#hl-0-1025>1025</a> runAsUser: 65532 <a class=lnlinks href=#hl-0-1026>1026</a> env: <a class=lnlinks href=#hl-0-1027>1027</a> - name: GOMAXPROCS <a class=lnlinks href=#hl-0-1028>1028</a> valueFrom: <a class=lnlinks href=#hl-0-1029>1029</a> resourceFieldRef: <a class=lnlinks href=#hl-0-1030>1030</a> containerName: crossplane <a class=lnlinks href=#hl-0-1031>1031</a> resource: limits.cpu <a class=lnlinks href=#hl-0-1032>1032</a> - name: GOMEMLIMIT <a class=lnlinks href=#hl-0-1033>1033</a> valueFrom: <a class=lnlinks href=#hl-0-1034>1034</a> resourceFieldRef: <a class=lnlinks href=#hl-0-1035>1035</a> containerName: crossplane <a class=lnlinks href=#hl-0-1036>1036</a> resource: limits.memory <a class=lnlinks href=#hl-0-1037>1037</a> - name: LEADER_ELECTION <a class=lnlinks href=#hl-0-1038>1038</a> value: "true" <a class=lnlinks href=#hl-0-1039>1039</a> <a class=lnlinks href=#hl-0-1040>1040</a>NOTES: <a class=lnlinks href=#hl-0-1041>1041</a>Release: crossplane <a class=lnlinks href=#hl-0-1042>1042</a> <a class=lnlinks href=#hl-0-1043>1043</a>Chart Name: crossplane <a class=lnlinks href=#hl-0-1044>1044</a>Chart Description: Crossplane is an open source Kubernetes add-on that enables platform teams to assemble infrastructure from multiple vendors, and expose higher level self-service APIs for application teams to consume. <a class=lnlinks href=#hl-0-1045>1045</a>Chart Version: 1.15.0 <a class=lnlinks href=#hl-0-1046>1046</a>Chart Application Version: 1.15.0 <a class=lnlinks href=#hl-0-1047>1047</a> <a class=lnlinks href=#hl-0-1048>1048</a>Kube Version: v1.27.3 </code></pre></div></div></div></div></div>Install the Crossplane components using <code>helm install</code>.<div class=highlight><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-2-1>1</a>helm install crossplane \ <a class=lnlinks href=#hl-2-2>2</a>crossplane-stable/crossplane \ <a class=lnlinks href=#hl-2-3>3</a>--namespace crossplane-system \ <a class=lnlinks href=#hl-2-4>4</a>--create-namespace </code></pre></div>Verify Crossplane installed with <code>kubectl get pods</code>.<div class=highlight copy-lines=1><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-3-1>1</a>kubectl get pods -n crossplane-system <a class=lnlinks href=#hl-3-2>2</a>NAME READY STATUS RESTARTS AGE <a class=lnlinks href=#hl-3-3>3</a>crossplane-d4cd8d784-ldcgb 1/1 Running 0 54s <a class=lnlinks href=#hl-3-4>4</a>crossplane-rbac-manager-84769b574-6mw6f 1/1 Running 0 54s </code></pre></div>Installing Crossplane creates new Kubernetes API end-points. Look at the new API end-points with <code>kubectl api-resources | grep crossplane</code>.<div class=highlight label=grep copy-lines=1><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-4-1> 1</a>kubectl api-resources | grep crossplane <a class=lnlinks href=#hl-4-2> 2</a>compositeresourcedefinitions xrd,xrds apiextensions.crossplane.io/v1 false CompositeResourceDefinition <a class=lnlinks href=#hl-4-3> 3</a>compositionrevisions comprev apiextensions.crossplane.io/v1 false CompositionRevision <a class=lnlinks href=#hl-4-4> 4</a>compositions comp apiextensions.crossplane.io/v1 false Composition <a class=lnlinks href=#hl-4-5> 5</a>environmentconfigs envcfg apiextensions.crossplane.io/v1beta1 false EnvironmentConfig <a class=lnlinks href=#hl-4-6> 6</a>usages apiextensions.crossplane.io/v1alpha1 false Usage <a class=lnlinks href=#hl-4-7> 7</a>configurationrevisions pkg.crossplane.io/v1 false ConfigurationRevision <a class=lnlinks href=#hl-4-8> 8</a>configurations pkg.crossplane.io/v1 false Configuration <a class=lnlinks href=#hl-4-9> 9</a>controllerconfigs pkg.crossplane.io/v1alpha1 false ControllerConfig <a class=lnlinks href=#hl-4-10>10</a>deploymentruntimeconfigs pkg.crossplane.io/v1beta1 false DeploymentRuntimeConfig <a class=lnlinks href=#hl-4-11>11</a>functionrevisions pkg.crossplane.io/v1beta1 false FunctionRevision <a class=lnlinks href=#hl-4-12>12</a>functions pkg.crossplane.io/v1beta1 false Function <a class=lnlinks href=#hl-4-13>13</a>locks pkg.crossplane.io/v1beta1 false Lock <a class=lnlinks href=#hl-4-14>14</a>providerrevisions pkg.crossplane.io/v1 false ProviderRevision <a class=lnlinks href=#hl-4-15>15</a>providers pkg.crossplane.io/v1 false Provider <a class=lnlinks href=#hl-4-16>16</a>storeconfigs secrets.crossplane.io/v1alpha1 false StoreConfig </code></pre></div></div><h2 id=install-the-aws-provider>Install the AWS provider <a class=anchor-link id=install-the-aws-provider href=#install-the-aws-provider aria-label="Link to this section: Install the AWS provider"></a></h2>Install the AWS S3 provider into the Kubernetes cluster with a Kubernetes configuration file.<div class=highlight label=provider copy-lines=all><pre tabindex=0 class=chroma><code class=language-yaml data-lang=yaml><a class=lnlinks href=#hl-0-1>1</a>cat <<EOF | kubectl apply -f - <a class=lnlinks href=#hl-0-2>2</a>apiVersion: pkg.crossplane.io/v1 <a class=lnlinks href=#hl-0-3>3</a>kind: Provider <a class=lnlinks href=#hl-0-4>4</a>metadata: <a class=lnlinks href=#hl-0-5>5</a> name: provider-aws-s3 <a class=lnlinks href=#hl-0-6>6</a>spec: <a class=lnlinks href=#hl-0-7>7</a> package: xpkg.upbound.io/upbound/provider-aws-s3:v1.17.0 <a class=lnlinks href=#hl-0-8>8</a>EOF </code></pre></div>The Crossplane <code><highlight-term id=1731573033990662761 data-label=provider data-line=3>Provider</highlight-term></code> installs the Kubernetes Custom Resource Definitions (CRDs) representing AWS S3 services. These CRDs allow you to create AWS resources directly inside Kubernetes.Verify the provider installed with <code>kubectl get providers</code>.<div class=highlight copy-lines=1 label=getProvider><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-1-1>1</a>kubectl get providers <a class=lnlinks href=#hl-1-2>2</a>NAME INSTALLED HEALTHY PACKAGE AGE <a class=lnlinks href=#hl-1-3>3</a>provider-aws-s3 True True xpkg.upbound.io/upbound/provider-aws-s3:1.1.0 97s <a class=lnlinks href=#hl-1-4>4</a>upbound-provider-family-aws True True xpkg.upbound.io/upbound/provider-family-aws:1.1.0 88s </code></pre></div>The S3 Provider installs a second Provider, the <code><highlight-term id=1731573033990701128 data-label=getProvider data-line=4>upbound-provider-family-aws</highlight-term></code>. The family provider manages authentication to AWS across all AWS family Providers.You can view the new CRDs with <code>kubectl get crds</code>. Every CRD maps to a unique AWS service Crossplane can provision and manage.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>See details about all the supported CRDs in the <a href=https://marketplace.upbound.io/providers/upbound/provider-aws-s3/v1.1.0>Upbound Marketplace</a>.</div></div><h2 id=create-a-kubernetes-secret-for-aws>Create a Kubernetes secret for AWS <a class=anchor-link id=create-a-kubernetes-secret-for-aws href=#create-a-kubernetes-secret-for-aws aria-label="Link to this section: Create a Kubernetes secret for AWS"></a></h2>The provider requires credentials to create and manage AWS resources. Providers use a Kubernetes Secret to connect the credentials to the provider.Generate a Kubernetes Secret from your AWS key-pair and then configure the Provider to use it.<h3 id=generate-an-aws-key-pair-file>Generate an AWS key-pair file <a class=anchor-link id=generate-an-aws-key-pair-file href=#generate-an-aws-key-pair-file aria-label="Link to this section: Generate an AWS key-pair file"></a></h3>For basic user authentication, use an AWS Access keys key-pair file.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>The <a href=https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-quickstart.html#cli-configure-quickstart-creds>AWS documentation</a> provides information on how to generate AWS Access keys.</div></div>Create a text file containing the AWS account <code>aws_access_key_id</code> and <code>aws_secret_access_key</code>.<div class=highlight copy-lines=all><pre tabindex=0 class=chroma><code class=language-ini data-lang=ini><a class=lnlinks href=#hl-0-1>1</a>[default] <a class=lnlinks href=#hl-0-2>2</a>aws_access_key_id = " contenteditable=true><svg class="bi text-white" width="1em" height="1em"><use xlink:href="#pencil-square"/></svg> <a class=lnlinks href=#hl-0-3>3</a>aws_secret_access_key = " contenteditable=true><svg class="bi text-white" width="1em" height="1em"><use xlink:href="#pencil-square"/></svg> </code></pre></div>Save this text file as <code>aws-credentials.txt</code>.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>The <a href=https://docs.upbound.io/providers/provider-aws/authentication/>Authentication</a> section of the AWS Provider documentation describes other authentication methods.</div></div><h3 id=create-a-kubernetes-secret-with-the-aws-credentials>Create a Kubernetes secret with the AWS credentials <a class=anchor-link id=create-a-kubernetes-secret-with-the-aws-credentials href=#create-a-kubernetes-secret-with-the-aws-credentials aria-label="Link to this section: Create a Kubernetes secret with the AWS credentials"></a></h3>A Kubernetes generic secret has a name and contents. Use <code><highlight-term id=1731573033991124008 data-label=kube-create-secret data-line=1>kubectl create secret</highlight-term></code> to generate the secret object named <code><highlight-term id=1731573033991144828 data-label=kube-create-secret data-line=2>aws-secret</highlight-term></code> in the <code><highlight-term id=1731573033991171424 data-label=kube-create-secret data-line=3>crossplane-system</highlight-term></code> namespace.Use the <code><highlight-term id=1731573033991191629 data-label=kube-create-secret data-line=4>--from-file=</highlight-term></code> argument to set the value to the contents of the <code><highlight-term id=1731573033991210416 data-label=kube-create-secret data-line=4>aws-credentials.txt</highlight-term></code> file.<div class=highlight label=kube-create-secret copy-lines=all><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-2-1>1</a>kubectl create secret \ <a class=lnlinks href=#hl-2-2>2</a>generic aws-secret \ <a class=lnlinks href=#hl-2-3>3</a>-n crossplane-system \ <a class=lnlinks href=#hl-2-4>4</a>--from-file=creds=./aws-credentials.txt </code></pre></div>View the secret with <code>kubectl describe secret</code><div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>The size may be larger if there are extra blank spaces in your text file.</div></div><div class=highlight copy-lines=1><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-3-1> 1</a>kubectl describe secret aws-secret -n crossplane-system <a class=lnlinks href=#hl-3-2> 2</a>Name: aws-secret <a class=lnlinks href=#hl-3-3> 3</a>Namespace: crossplane-system <a class=lnlinks href=#hl-3-4> 4</a>Labels: <none> <a class=lnlinks href=#hl-3-5> 5</a>Annotations: <none> <a class=lnlinks href=#hl-3-6> 6</a> <a class=lnlinks href=#hl-3-7> 7</a>Type: Opaque <a class=lnlinks href=#hl-3-8> 8</a> <a class=lnlinks href=#hl-3-9> 9</a>Data <a class=lnlinks href=#hl-3-10>10</a>==== <a class=lnlinks href=#hl-3-11>11</a>creds: 114 bytes </code></pre></div><h2 id=create-a-providerconfig>Create a ProviderConfig <a class=anchor-link id=create-a-providerconfig href=#create-a-providerconfig aria-label="Link to this section: Create a ProviderConfig"></a></h2>A <code><highlight-term id=1731573033991269845 data-label=providerconfig data-line=3>ProviderConfig</highlight-term></code> customizes the settings of the AWS Provider.Apply the <code><highlight-term id=1731573033991288856 data-label=providerconfig data-line=3>ProviderConfig</highlight-term></code> with the this Kubernetes configuration file:<div class=highlight label=providerconfig copy-lines=all><pre tabindex=0 class=chroma><code class=language-yaml data-lang=yaml><a class=lnlinks href=#hl-4-1> 1</a>cat <<EOF | kubectl apply -f - <a class=lnlinks href=#hl-4-2> 2</a>apiVersion: aws.upbound.io/v1beta1 <a class=lnlinks href=#hl-4-3> 3</a>kind: ProviderConfig <a class=lnlinks href=#hl-4-4> 4</a>metadata: <a class=lnlinks href=#hl-4-5> 5</a> name: default <a class=lnlinks href=#hl-4-6> 6</a>spec: <a class=lnlinks href=#hl-4-7> 7</a> credentials: <a class=lnlinks href=#hl-4-8> 8</a> source: Secret <a class=lnlinks href=#hl-4-9> 9</a> secretRef: <a class=lnlinks href=#hl-4-10>10</a> namespace: crossplane-system <a class=lnlinks href=#hl-4-11>11</a> name: aws-secret <a class=lnlinks href=#hl-4-12>12</a> key: creds <a class=lnlinks href=#hl-4-13>13</a>EOF </code></pre></div>This attaches the AWS credentials, saved as a Kubernetes secret, as a <code><highlight-term id=1731573033991310719 data-label=providerconfig data-line=9>secretRef</highlight-term></code>.The <code><highlight-term id=1731573033991334743 data-label=providerconfig data-line=11>spec.credentials.secretRef.name</highlight-term></code> value is the name of the Kubernetes secret containing the AWS credentials in the <code><highlight-term id=1731573033991354413 data-label=providerconfig data-line=10>spec.credentials.secretRef.namespace</highlight-term></code>.<h2 id=create-a-managed-resource>Create a managed resource <a class=anchor-link id=create-a-managed-resource href=#create-a-managed-resource aria-label="Link to this section: Create a managed resource"></a></h2>A managed resource is anything Crossplane creates and manages outside of the Kubernetes cluster.This guide creates an AWS S3 bucket with Crossplane.The S3 bucket is a managed resource.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>AWS S3 bucket names must be globally unique. To generate a unique name the example uses a random hash. Any unique name is acceptable.</div></div><div class=highlight label=xr><pre tabindex=0 class=chroma><code class=language-yaml data-lang=yaml><a class=lnlinks href=#hl-5-1> 1</a>cat <<EOF | kubectl create -f - <a class=lnlinks href=#hl-5-2> 2</a>apiVersion: s3.aws.upbound.io/v1beta1 <a class=lnlinks href=#hl-5-3> 3</a>kind: Bucket <a class=lnlinks href=#hl-5-4> 4</a>metadata: <a class=lnlinks href=#hl-5-5> 5</a> generateName: crossplane-bucket- <a class=lnlinks href=#hl-5-6> 6</a>spec: <a class=lnlinks href=#hl-5-7> 7</a> forProvider: <a class=lnlinks href=#hl-5-8> 8</a> region: us-east-2 <a class=lnlinks href=#hl-5-9> 9</a> providerConfigRef: <a class=lnlinks href=#hl-5-10>10</a> name: default <a class=lnlinks href=#hl-5-11>11</a>EOF </code></pre></div>The <code><highlight-term id=1731573033991416036 data-label=xr data-line=3>apiVersion</highlight-term></code> and <code><highlight-term id=1731573033991436243 data-label=xr data-line=4>kind</highlight-term></code> are from the provider’s CRDs.The <code><highlight-term id=1731573033991455194 data-label=xr data-line=6>metadata.name</highlight-term></code> value is the name of the created S3 bucket in AWS. This example uses the generated name <code>crossplane-bucket-<hash></code> in the <code><highlight-term id=1731573033991472667 data-label=xr data-line=6>$bucket</highlight-term></code> variable.The <code><highlight-term id=1731573033991490262 data-label=xr data-line=9>spec.forProvider.region</highlight-term></code> tells AWS which AWS region to use when deploying resources.The region can be any <a href=https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints>AWS Regional endpoint</a> code.Use <code>kubectl get buckets</code> to verify Crossplane created the bucket.<div class="admonition tip d-flex flex-column mx-4 p-0"><div class=admonition-title><svg class="bi flex-shrink-0" role="img" aria-label="tip:"><use xlink:href="#check"/></svg>Tip</div><div class=admonition-content>Crossplane created the bucket when the values <code>READY</code> and <code>SYNCED</code> are <code>True</code>. This may take up to 5 minutes.</div></div><div class=highlight copy-lines=1><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-6-1>1</a>kubectl get buckets <a class=lnlinks href=#hl-6-2>2</a>NAME READY SYNCED EXTERNAL-NAME AGE <a class=lnlinks href=#hl-6-3>3</a>crossplane-bucket-hhdzh True True crossplane-bucket-hhdzh 5s </code></pre></div><h2 id=delete-the-managed-resource>Delete the managed resource <a class=anchor-link id=delete-the-managed-resource href=#delete-the-managed-resource aria-label="Link to this section: Delete the managed resource"></a></h2>Before shutting down your Kubernetes cluster, delete the S3 bucket just created.Use <code>kubectl delete bucket <bucketname></code> to remove the bucket.<div class=highlight copy-lines=1><pre tabindex=0 class=chroma><code class=language-shell data-lang=shell><a class=lnlinks href=#hl-7-1>1</a>kubectl delete bucket crossplane-bucket-hhdzh <a class=lnlinks href=#hl-7-2>2</a>bucket.s3.aws.upbound.io "crossplane-bucket-hhdzh" deleted </code></pre></div><h2 id=next-steps>Next steps <a class=anchor-link id=next-steps href=#next-steps aria-label="Link to this section: Next steps"></a></h2><ul><li><a href=https://docs.crossplane.io/latest/getting-started/provider-aws-part-2/>Continue to part 2</a> to create and use a custom API with Crossplane.</li><li>Explore AWS resources that Crossplane can configure in the <a href=https://marketplace.upbound.io/providers/upbound/provider-family-aws/>Provider CRD reference</a>.</li><li>Join the <a href=https://slack.crossplane.io/>Crossplane Slack</a> and connect with Crossplane users and contributors.</li></ul></div></main></div><footer class="bd-footer p-5"><div class="container text-center"><div class="row pb-5 top-row"><div class="col-lg img-col"><img src=/img/crossplane-logo.svg alt="Crossplane logo" srcset="/img/crossplane-logo.svg 1x, /img/crossplane-logo.svg 2x" width=185 height=40 decoding=async data-nimg=future loading=lazy class="d-flex crossplane-footer"></div><div class="col-lg links-col d-fill justify-content-evenly ms-5"><div class=row><div class=col-lg><a class=footer-link target=_blank href=https://twitter.com/crossplane_io>Twitter</a></div><div class=col-lg><a class=footer-link target=_blank href=https://www.youtube.com/channel/UC19FgzMBMqBro361HbE46Fw>Youtube</a></div><div class=col-lg><a class=footer-link target=_blank href="https://www.youtube.com/playlist?list=PL510POnNVaaYFuK-B_SIUrpIonCtLVOzT">Podcast</a></div><div class=col-lg><a class=footer-link target=_blank href=https://groups.google.com/g/crossplane-dev>Forum</a></div></div></div></div><div class="row pb-5"><div class="col-lg copyright-col pe-4 border-end">© Crossplane Authors 2024. Documentation distributed under <a target=_blank href=https://creativecommons.org/licenses/by/4.0/>CC-BY-4.0</a>.© 2024 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our <a target=_blank href=https://www.linuxfoundation.org/legal/trademark-usage>Trademark Usage</a> page.</div><div class="col-lg cncf-col ms-5"><a class=d-flex target=_blank href=https://www.cncf.io/><img alt=cncfLogo src=/img/cncf-white.webp width=702 height=114 decoding=async data-nimg=future loading=lazy class="cncf-footer py-3"></a>We are a Cloud Native Computing Foundation incubating project.</div></div></div></footer><script src=https://docs.crossplane.io/js/main-727bf178.bundle.min.js data-no-instant></script><script type=text/javascript>(function(e,t,n,s,o,i,a){e[n]=e[n]||function(){(e[n].q=e[n].q||[]).push(arguments)},i=t.createElement(s),i.async=1,i.src="https://www.clarity.ms/tag/"+o,a=t.getElementsByTagName(s)[0],a.parentNode.insertBefore(i,a)})(window,document,"clarity","script","el5517lxor")</script> <script>(function(e,t,n,s,o){e[s]=e[s]||[],e[s].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var a=t.getElementsByTagName(n)[0],i=t.createElement(n),r=s!="dataLayer"?"&l="+s:"";i.async=!0,i.src="https://www.googletagmanager.com/gtm.js?id="+o+r,a.parentNode.insertBefore(i,a)})(window,document,"script","dataLayer","GTM-WFF2NQHG")</script><noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-WFF2NQHG" height=0 width=0 style=display:none;visibility:hidden></iframe></noscript><script type=text/javascript>adroll_adv_id="B4XQTO44VJFVDGCGM332GU",adroll_pix_id="6ROIBHUPMVCSXN7HHIKJTK",adroll_version="2.0",function(e,t,n,s,o){e.__adroll_loaded=!0,e.adroll=e.adroll||[],e.adroll.f=["setProperties","identify","track"];var i="https://s.adroll.com/j/"+adroll_adv_id+"/roundtrip.js";for(o=0;o<e.adroll.f.length;o++)e.adroll[e.adroll.f[o]]=e.adroll[e.adroll.f[o]]||function(t){return function(){e.adroll.push([t,arguments])}}(e.adroll.f[o]);n=t.createElement("script"),s=t.getElementsByTagName("script")[0],n.async=1,n.src=i,s.parentNode.insertBefore(n,s)}(window,document),adroll.track("pageView")</script><script src=https://cdn.jsdelivr.net/npm/@docsearch/js@3></script> <script>docsearch({container:"#docSearch",appId:"9UXKYX61NK",indexName:"crossplane",apiKey:"e07e181044d561f6a4cb7261931d980a",placeholder:"Search the docs"})</script></body></html>