Authorized Product Claim
Stable consumer contract
Approved desired state
Outcome-oriented API
RECONCILE · PRODUCT CONTROL PLANE
Authorized product state becomes
continuously reconciled infrastructure.
Crossplane is the authoritative product-control-plane technology in this reference architecture. It is deliberately not presented as an Infrastructure Product Works application: it is machinery behind the product boundary that reconciles authorized claims through replaceable provider implementations.
THE PROBLEM
Provider APIs make good machinery and poor product contracts.
If developers consume AWS, Azure or GCP topology directly, provider details become part of the customer contract. That makes product evolution and portability harder. The reference architecture instead exposes an outcome-oriented product API and lets a control plane translate that authorized state into provider-specific implementation.
CONTROL-PLANE MODEL
Stable product contracts in. Provider implementations behind the boundary.
The consumer asks for the product outcome. Authorized product state reaches Crossplane through a stable contract. Crossplane continuously reconciles that desired state while provider-specific topology remains implementation detail.
→
Crossplane Control Plane
Composition selection
Continuous reconciliation
Drift convergence
Provider abstraction
→
Provider Implementations
Replaceable cloud-specific resources and controllers.
AWSAzureGCP
Crossplane is machinery behind the counter, not the menu.
Storefront exposes the product experience. Contracts define the boundary. Authorized people decide. Crossplane reconciles the authorized state.
AUTHORITATIVE RECONCILERSTABLE PRODUCT CONTRACTREPLACEABLE PROVIDERSCONTINUOUS RECONCILIATION
Claim
Receive an authorized infrastructure-product claim through the stable API.
Compose
Select the bounded composition and implementation appropriate to the product.
Reconcile
Continuously drive observed infrastructure toward authorized desired state.
Observe
Return status and evidence without exposing provider topology as the consumer contract.
DESIGN DECISIONS
Productize above the provider layer.
Outcome-oriented claims
Consumers ask for a supported infrastructure product rather than assembling a provider-specific graph of resources.
Implementation behind the contract
Composition logic can evolve independently as long as the product contract and governed outcome remain compatible.
Portability by design
AWS, Azure and GCP remain implementation targets behind the boundary rather than becoming the developer-facing product vocabulary.
Reconciliation, not one-time creation
The control plane continuously compares desired and observed state, making product operation a lifecycle rather than a provisioning event.
The product contract stays stable.
The implementation can change behind it.
That separation is the architectural reason Crossplane belongs behind the counter. Developers consume products; platform teams retain freedom to evolve the machinery.
AUTHORITY BOUNDARY
Reconciliation begins after authorization.
Crossplane's role here is authoritative reconciliation of approved product state. It does not replace Guard validation, Forge proposal boundaries, Console review context, Assurance safeguards or human authorization.