Infralib Requirements for Platform APIs

Platform APIs such as PostgreSQLInstance, ValkeyInstance or Zone only work when your Infralib configuration has three things in place. Check them in this order.

1. Include the base modules

Every platform API needs these modules in your Infralib agent config:

Step type	Module (`source`)	Required name	Why
`terraform`	`aws/vpc`	any	Subnets for databases, caches and node pools.
`terraform`	`aws/eks`	any	The Kubernetes cluster.
`terraform`	`aws/crossplane`	any	IAM role that Crossplane uses to manage AWS resources.
`argocd-apps`	`argocd`	any	Installs the other modules; Zones create ArgoCD projects in it.
`argocd-apps`	`crossplane-core`	`crossplane-system`	Crossplane itself. The IAM role trusts this namespace.
`argocd-apps`	`crossplane-aws`	`crossplane-aws`	AWS providers. Every API refers to the provider config by this name.
`argocd-apps`	`kyverno`	any	Policies that enforce Zone isolation.
`argocd-apps`	`external-secrets`	any	Delivers credentials to Kubernetes Secrets.
`argocd-apps`	`platform-apis`	any	The platform APIs themselves.

aws/kms is optional. With it, resources are encrypted with your own KMS keys; without it, AWS-managed keys are used.

2. Turn on two crossplane-aws settings

Both are off by default, and without them no platform API can create anything:

- name: crossplane-aws
  source: crossplane-aws
  inputs:
    global:
      createObservers: true
      createNamespacedObservers: true

What do these settings do?

They connect the platform APIs to the infrastructure Infralib has already built:

They install the AWS providers the APIs use, such as RDS, ElastiCache, EC2, EKS, ECR and Secrets Manager. Without them, only IAM, S3 and SQS are installed.
They make your existing VPC, subnets and EKS cluster visible in Kubernetes. Crossplane creates a read-only copy, an "observer", of each one under a fixed name such as vpc, eks or database. When you create a database, the platform looks up database to know which subnets to put it in.

3. Enable the APIs you need

Most APIs are on by default. Some need an extra flag or module:

API	Enable flag	Default	Also needs
Zone	`platform-apis.zone.install`	`true`	—
PostgreSQL	`platform-apis.postgresql.install`	`true`	`crossplane-sql` module.
MariaDB	`platform-apis.mariadb.install`	`false`	`crossplane-sql` module, `postgresql.install: true`.
Valkey	`platform-apis.valkey.install`	`true`	`postgresql.install: true`.
S3 bucket	`platform-apis.s3bucket.install`	`true`	—
Repository	`platform-apis.repository.install`	`true`	—
RabbitMQ	`platform-apis.rabbitmq.install`	`false`	`mq` in `crossplane-aws` `global.extraProviders`.
Kafka	`platform-apis.kafka.install`	`false`	`kafka` in `crossplane-aws` `global.extraProviders`, `crossplane-kafka` module, an existing MSK cluster.
Secret	—	—	`external-secrets` with `global.createClusterSecretStore: true`. Not a platform API.

MariaDB and Valkey reuse the database settings that are installed with PostgreSQL, so postgresql.install must stay true even if you do not create PostgreSQL instances.

When you set extraProviders, list every extra provider you need in one place. Helm replaces lists instead of merging them.

Full configuration example

A configuration with every API in this table enabled. Remove what you do not need.

steps:
  - name: net
    type: terraform
    modules:
      - name: main
        source: aws/vpc
      - name: kms
        source: aws/kms                # optional
  - name: infra
    type: terraform
    vpc:
      attach: true
    modules:
      - name: eks
        source: aws/eks
      - name: crossplane
        source: aws/crossplane
  - name: apps
    type: argocd-apps
    modules:
      - name: argocd
        source: argocd
      - name: crossplane-system        # name must be crossplane-system
        source: crossplane-core
      - name: crossplane-aws           # name must be crossplane-aws
        source: crossplane-aws
        inputs:
          global:
            createObservers: true
            createNamespacedObservers: true
            extraProviders: [mq, kafka]  # RabbitMQ and Kafka only
      - name: kyverno
        source: kyverno
      - name: external-secrets
        source: external-secrets
        inputs:
          global:
            createClusterSecretStore: true
      - name: crossplane-sql           # PostgreSQL and MariaDB users and databases
        source: crossplane-sql
      - name: crossplane-kafka         # Kafka only
        source: crossplane-kafka
      - name: platform-apis
        source: platform-apis
        inputs:
          platform-apis:
            mariadb:
              install: true
            rabbitmq:
              install: true
            kafka:
              install: true
              environmentConfig:
                kafkaNamespace: crossplane-kafka  # = the crossplane-kafka module name

Module names matter

In an argocd-apps step, the module name becomes the ArgoCD Application, the Helm release and the namespace. A few names are referred to by other modules:

crossplane-core must be named crossplane-system and crossplane-aws must be named crossplane-aws.
The external-secrets module name is also the name of its ClusterSecretStore. If you name the module external-secrets-dev, use external-secrets-dev in secretStoreRef.name.
kafkaNamespace must match the crossplane-kafka module name.