You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/master/managed-resources/managed-resource-activation-policies.md
+67-9Lines changed: 67 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,18 +7,22 @@ description: ManagedResourceActivationPolicies control which ManagedResourceDefi
7
7
---
8
8
9
9
{{<hint "important">}}
10
-
Managed resource activation policies work with [managed resource definitions]({{<ref "managed-resource-definitions">}}), which are enabled by default in Crossplane v2.0+. To disable this behavior, set `--enable-custom-to-managed-resource-conversion=false` when installing Crossplane.
10
+
Managed resource activation policies work with [managed resource definitions]({{<ref "managed-resource-definitions">}}), which Crossplane v2.0+ enables by default. To disable this behavior, set `--enable-custom-to-managed-resource-conversion=false` when installing Crossplane.
11
11
{{</hint>}}
12
12
13
13
A `ManagedResourceActivationPolicy` (MRAP) controls which [ManagedResourceDefinitions]({{<ref "managed-resource-definitions">}}) become active in your cluster. MRAPs enable selective installation of provider resources, allowing you to activate only the 10 managed resources you need instead of the 100+ that a provider ships.
14
14
15
15
## The selective activation problem
16
16
17
-
Modern Crossplane providers can ship dozens or hundreds of managed resources, but most users only need a small subset. Before MRAPs, it was "all or nothing" - installing a provider meant getting every managed resource it supported, consuming unnecessary cluster resources.
17
+
Modern Crossplane providers can ship dozens or hundreds of managed resources, but most users only need a small subset. Before MRAPs, you got "all or nothing" - installing a provider meant getting every managed resource it supported, consuming unnecessary cluster resources.
18
18
19
-
MRAPs solve this by providing pattern-based activation of ManagedResourceDefinitions, letting you choose exactly which provider resources to enable.
19
+
MRAPs solve this by providing pattern-based activation of ManagedResourceDefinitions, letting you choose which provider resources to enable.
20
20
21
+
<!-- vale Google.Headings = NO -->
22
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
21
23
## How MRAPs work
24
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
25
+
<!-- vale Google.Headings = YES -->
22
26
23
27
MRAPs contain activation patterns that match ManagedResourceDefinition names. When you create or update an MRAP, Crossplane:
24
28
@@ -45,7 +49,7 @@ When you apply this MRAP, Crossplane activates the specified S3 Bucket, RDS Inst
45
49
46
50
-**Pattern-based matching**: Use wildcards to activate groups of resources
47
51
-**Multiple policy support**: Different MRAPs can activate different resource sets
48
-
-**Status tracking**: See exactly which resources each policy activated
52
+
-**Status tracking**: See which resources each policy activated
49
53
-**Automatic activation**: New MRDs matching existing patterns activate automatically
50
54
51
55
## Pattern matching
@@ -75,7 +79,7 @@ spec:
75
79
```
76
80
77
81
{{<hint "important">}}
78
-
MRAPs use prefix-only wildcards, not full regular expressions. Only `*` at the beginning of a pattern is supported (e.g., `*.s3.aws.crossplane.io`). Patterns like `s3.*.aws.crossplane.io` or `*.s3.*` are not valid.
82
+
MRAPs use prefix-only wildcards, not full regular expressions. Only `*` at the beginning of a pattern works (for example, `*.s3.aws.crossplane.io`). Patterns like `s3.*.aws.crossplane.io` or `*.s3.*` aren't valid.
79
83
{{</hint>}}
80
84
81
85
{{<hint "tip">}}
@@ -165,7 +169,11 @@ spec:
165
169
- databases.rds.aws.crossplane.io # Just RDS databases
166
170
```
167
171
172
+
<!-- vale Google.Headings = NO -->
173
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
168
174
## Multiple MRAPs
175
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
176
+
<!-- vale Google.Headings = YES -->
169
177
170
178
You can have multiple MRAPs in your cluster. Crossplane processes all MRAPs together and activates any MRD that matches at least one pattern.
171
179
@@ -213,17 +221,29 @@ spec:
213
221
- certificates.acm.aws.crossplane.io # For HTTPS
214
222
```
215
223
224
+
<!-- vale Google.Headings = NO -->
225
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
216
226
## Working with MRAPs
227
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
228
+
<!-- vale Google.Headings = YES -->
217
229
230
+
<!-- vale Google.Headings = NO -->
231
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
218
232
### Creating MRAPs
233
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
234
+
<!-- vale Google.Headings = YES -->
219
235
220
236
Apply an MRAP like any Kubernetes resource:
221
237
222
238
```shell
223
239
kubectl apply -f my-activation-policy.yaml
224
240
```
225
241
242
+
<!-- vale Google.Headings = NO -->
243
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
226
244
### Viewing MRAPs
245
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
246
+
<!-- vale Google.Headings = YES -->
227
247
228
248
List all MRAPs:
229
249
@@ -256,18 +276,34 @@ status:
256
276
- vpcs.ec2.aws.crossplane.io
257
277
```
258
278
279
+
<!-- vale Google.Headings = NO -->
280
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
259
281
## MRAP status conditions
282
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
283
+
<!-- vale Google.Headings = YES -->
260
284
261
285
### Healthy condition
262
286
263
-
- **`Healthy: True, Reason: Running`**: MRAP is working correctly
287
+
<!-- vale write-good.Weasel = NO -->
288
+
- **`Healthy: True, Reason: Running`**: MRAP works correctly
289
+
<!-- vale write-good.Weasel = YES -->
264
290
- **`Healthy: Unknown, Reason: EncounteredErrors`**: Some MRDs failed to activate
265
291
292
+
<!-- vale Google.Headings = NO -->
293
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
266
294
## Troubleshooting MRAPs
295
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
296
+
<!-- vale Google.Headings = YES -->
267
297
298
+
<!-- vale Google.Headings = NO -->
299
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
268
300
### MRAP exists but resources aren't activated
301
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
302
+
<!-- vale Google.Headings = YES -->
269
303
304
+
<!-- vale Google.Colons = NO -->
270
305
**Symptoms**: MRAP shows `activated: []` or missing expected resources
306
+
<!-- vale Google.Colons = YES -->
271
307
272
308
**Causes and solutions:**
273
309
@@ -282,7 +318,9 @@ status:
282
318
283
319
2. **MRDs don't exist yet**
284
320
- Install the required provider first
285
-
- MRDs are created when providers start
321
+
- <!-- vale write-good.Passive = NO -->
322
+
Providers create MRDs when they start
323
+
<!-- vale write-good.Passive = YES -->
286
324
287
325
3. **Provider doesn't support activation**
288
326
```shell
@@ -291,9 +329,15 @@ status:
291
329
# Look for "safe-start"
292
330
```
293
331
332
+
<!-- vale Google.Headings = NO -->
333
+
<!-- vale Microsoft.HeadingAcronyms = NO -->
294
334
### MRAP shows activation errors
335
+
<!-- vale Microsoft.HeadingAcronyms = YES -->
336
+
<!-- vale Google.Headings = YES -->
295
337
338
+
<!-- vale Google.Colons = NO -->
296
339
**Symptoms**: MRAP has `Healthy: Unknown` status with errors
340
+
<!-- vale Google.Colons = YES -->
297
341
298
342
**Status condition example:**
299
343
@@ -305,20 +349,32 @@ conditions:
305
349
message: "failed to activate 2 of 5 ManagedResourceDefinitions"
306
350
```
307
351
352
+
<!-- vale Google.Colons = NO -->
308
353
**Solution**: Check MRAP events for specific failure details:
354
+
<!-- vale Google.Colons = YES -->
309
355
310
356
```shell
311
357
kubectl describe mrap <name>
312
358
# Look at the Events section for activation errors
313
359
```
314
360
315
-
### Resources activate unexpectedly
361
+
### <!-- vale Microsoft.Adverbs = NO -->
362
+
<!-- vale write-good.Weasel = NO -->
363
+
Resources activate unexpectedly
364
+
<!-- vale write-good.Weasel = YES -->
365
+
<!-- vale Microsoft.Adverbs = YES -->
316
366
367
+
<!-- vale Google.Colons = NO -->
317
368
**Symptoms**: More resources are active than expected
369
+
<!-- vale Google.Colons = YES -->
318
370
371
+
<!-- vale Google.Colons = NO -->
319
372
**Cause**: Multiple MRAPs with overlapping patterns (this is normal behavior)
373
+
<!-- vale Google.Colons = YES -->
320
374
375
+
<!-- vale Google.Colons = NO -->
321
376
**Solution**: Review all MRAP patterns to understand which policies are activating which resources
MRAPs are additive - multiple MRAPs can activate the same resource without conflicts. This enables team-based activation strategies and Configuration package dependencies.
334
390
335
391
1. **Start specific, broaden as needed** - Begin with exact resource names, add wildcards only when beneficial for maintainability
336
-
2. **Plan for provider evolution** - Design wildcard patterns that accommodate new resources as providers add them (e.g., `*.s3.aws.crossplane.io` works for future S3 resources)
392
+
2. **Plan for provider evolution** - Design wildcard patterns that accommodate new resources as providers add them (for example, `*.s3.aws.crossplane.io` works for future S3 resources)
337
393
3. **Group related resources logically** - Create MRAPs that activate resources teams actually use together
338
394
4. **Include activation dependencies in Configuration packages** - Configuration packages should declare what MRDs they need rather than assuming resources are available
395
+
<!-- vale alex.ProfanityUnlikely = NO -->
339
396
5. **Use conservative patterns in shared environments** - Avoid overly broad wildcards that activate unnecessary resources when multiple teams share providers
0 commit comments