gridscale infrastructure as Kubernetes custom resources

provider-gridscale

Declare servers, networks, load balancers, managed databases, and Kubernetes clusters in YAML — Crossplane reconciles them against gridscale. This is an Upjet (v2) provider generated from the gridscale Terraform provider.

Unaffiliated. Community PlatformRelay project — not affiliated with, endorsed by, or an official product of gridscale GmbH.

Docs map:docs/README.md · API reference · ADRs · Roadmap · Assurance

Why this provider?

• One control plane — manage gridscale next to other clouds with the same Crossplane claims / compositions / GitOps flow.
• Cluster and namespaced APIs — gridscale.platformrelay.io (cluster) and gridscale.m.platformrelay.io (namespaced) so multi-tenant teams can own their own ProviderConfig.
• 34 managed resources / 8 API groups — servers, storage, networking, PaaS databases, K8s, object storage, marketplace apps, and more.
• Signed packages — GHCR + Upbound Marketplace publishes are keyless-cosign signed with an SBOM (from v0.2.0 onward).

flowchart LR
Git["Git / CI"] --> XP["Crossplane"]
XP --> MR["Managed Resources<br/>Server · Network · K8S · …"]
MR --> GS["gridscale API"]
PC["ProviderConfig<br/>Secret creds"] --> XP

Loading

Quick start

Needs a cluster with Crossplane and gridscale API credentials (User-UUID + token from the gridscale panel).

kubectl apply -f examples/install.yamlkubectl apply -f - <<'EOF'apiVersion: v1kind: Secretmetadata: name: gridscale-creds namespace: crossplane-systemtype: OpaquestringData: credentials: | {"uuid":"<your-user-uuid>","token":"<your-api-token>"}EOFkubectl apply -f - <<'EOF'apiVersion: gridscale.platformrelay.io/v1beta1kind: ProviderConfigmetadata: name: defaultspec: credentials: source: Secret secretRef: name: gridscale-creds namespace: crossplane-system key: credentialsEOFkubectl get providers

Package path in examples/install.yaml:

xpkg.upbound.io/platformrelay/provider-gridscale:v0.3.0

Also published to GHCR: ghcr.io/platformrelay/provider-gridscale:v0.3.0.

Next: apply a resource from examples/cluster/ or examples/namespaced/, then kubectl explain servers (or the matching CRD plural).

Credential JSON

Key	Required	Description
uuid	yes	gridscale User-UUID
token	yes	API token with full-access permissions
api_url	no	Defaults to https://api.gridscale.io

Namespaced ProviderConfig / ClusterProviderConfig live under gridscale.m.platformrelay.io — see examples/namespaced/.

Supported resources

34 managed resources across 8 API groups, each served under both the cluster-scoped and namespaced families. Kind names below are the exact API server values (Upjet casing) — copy straight into kind:.

API group	Managed resources (Kind)
gridscale	Backupschedule, Filesystem, Firewall, IPv4, IPv6, Isoimage, K8S, Loadbalancer, Mariadb, Memcached †, MySQL †, Network, Paas, Postgresql, PublicNetwork, Server, Snapshot, Snapshotschedule, Sqlserver, Sshkey, Storage, Template
marketplace	Application, ApplicationImport
mysql8	MySQL8
object	StorageAccesskey, StorageBucket
paas	Securityzone
redis	Cache, Store
ssl	Certificate
storage	BackupList, Clone, StorageImport

† Upstream-deprecated — see Deprecations.

Authoritative schema: package/crds/ and the generated API reference.

Deprecations

Upstream Terraform deprecations surface in CRD field descriptions. Prefer:

Deprecated	Replacement
securityZoneUuid / security_zone_uuid (PaaS-style)	networkUuid / network_uuid
Memcached	Redis Cache / Store
MySQL (5.7)	MySQL8 in the mysql8 group
K8SnetworkUuid	Prefer omit, or k8sPrivateNetworkUuid — notsecurityZoneUuid
Servernetwork[].ordering	Order follows network entry order

Known limitations

Terraform datasources are not generated (Upjet consumes resource schemas only). For resource-twinned lookups, import with Observe-Only policies:

apiVersion: gridscale.gridscale.platformrelay.io/v1alpha1kind: Networkmetadata:
name: existing-networkspec:
managementPolicies: ["Observe"]forProvider: {}providerConfigRef:
name: default

Set the Crossplane external name to the gridscale UUID. Pure lookup datasources without a resource twin (backup_list, public_network) have no equivalent until upstream Upjet grows datasource support. Details: docs/assurance.md.

Live uptest against a real gridscale lab is operator-gated (no CI secrets yet) — examples are curated for manual / /test-examples runs.

Developing

go run cmd/generator/main.go "$PWD" # codegenmake test # unit + coverage → cover.outmake reviewable # generate + lint + tidy (PR gate)make run # run against a clustermake build # provider binary + xpkg

See CONTRIBUTING.md and AGENTS.md.

Branding

Shipping icon: gridscale press Bildmarke (see docs/assets/branding/).

Community

Contributing	CONTRIBUTING.md
Code of Conduct	CODE_OF_CONDUCT.md
Governance	GOVERNANCE.md
Security	SECURITY.md — private reports only
Issues	GitHub Issues

License

Apache License 2.0 — see LICENSE. Generated with Upjet; wraps the gridscale Terraform provider under its own license.