Crossplane ProviderConfig Multi-Tenancy Prompt
Design Crossplane ProviderConfig and credential-injection patterns so multiple teams or accounts share one control plane without leaking cloud credentials across tenant boundaries.
- Target user
- Platform engineers operating a shared Crossplane control plane
- Difficulty
- Advanced
- Tools
- Claude, Gemini
The prompt
You are a senior platform engineer who runs a multi-tenant Crossplane control plane. I will provide: - The tenancy model (namespaces per team, accounts/subscriptions per tenant). - The cloud provider(s) and how credentials are sourced (IRSA/Workload Identity, secrets, or OIDC). - Isolation requirements (which tenant may reference which ProviderConfig). Your job: 1. **Design ProviderConfigs** — define one ProviderConfig per tenant/account with the right `credentials.source` (Secret, InjectedIdentity, or Upbound/OIDC) and naming convention. 2. **Scope credentials** — recommend least-privilege cloud roles per ProviderConfig and where the referenced Secret lives. 3. **Bind compositions to tenants** — show how Composition/Claim selectors pick the correct ProviderConfig so a tenant cannot target another's account. 4. **Enforce isolation** — add RBAC and admission policy (Kyverno/OPA) preventing a claim from referencing a ProviderConfig outside its tenant. 5. **Rotate safely** — outline credential rotation without disrupting reconciliation of existing managed resources. 6. **Observe** — recommend signals for ProviderConfig usage and failed reconciliations per tenant. 7. **Failure modes** — cover what happens when a ProviderConfig is deleted while managed resources still reference it. Output as: (a) example ProviderConfig manifests, (b) the claim-to-ProviderConfig binding pattern, (c) the RBAC/admission guardrails, (d) a rotation runbook. Flag any path where a tenant could reference another tenant's ProviderConfig or credential Secret.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
CloudFormation Dynamic References for SSM & Secrets Manager Prompt
Replace hardcoded secrets and config in CloudFormation templates with resolve dynamic references to SSM Parameter Store and Secrets Manager, including versioning, rotation, and no-echo handling.
-
Crossplane Managed Resource Import & Observe-Only Prompt
Bring existing brownfield cloud resources under Crossplane management using the crossplane.io/external-name annotation and observe-only policies, without recreating or mutating live infrastructure.
-
Crossplane v2 Namespaced XR Migration Prompt
Plan the migration from Crossplane v1 cluster-scoped composite resources and claims to v2 namespaced XRs, updating XRDs, compositions, and RBAC without orphaning managed resources.
-
Crossplane Composition Revision Rollout & Pinning Prompt
Roll out changes to a Crossplane Composition safely across many live claims — using CompositionRevisions, revision pinning, and automatic-vs-manual update policies so a bad composition change cannot ripple into every managed resource at once.
More Infrastructure as Code prompts & error guides
Browse every Infrastructure as Code prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.