Building an S3-Backed App on EKS: Comparing kro and Crossplane Composition

Description and use

Developers can deploy an S3‑using application with a single YAML file; kro expands Kubernetes resources and Crossplane provisions AWS resources.

Problem

Enable developers to deploy an application that requires S3 and IAM resources without needing to understand Kubernetes or AWS details.

Outcome

A single YAML file (StorageApp) sufficed to provision both Kubernetes and AWS resources, reducing developer effort and ensuring consistent infrastructure.

Workflow

• 1. Prepare EKS cluster with eksctl and IAM configuration for Crossplane.
• 2. Deploy kro and Crossplane controllers.
• 3. Build application image and push to ECR via bash scripts/04-image.sh.
• 4. Create StorageApp YAML with storageId, image, replicas and apply via bash scripts/05-demo.sh.
• 5. kro expands StorageApp into Deployment, Service, ServiceAccount, and AWS MRs (Bucket, Role, etc.).
• 6. Crossplane AWS Provider reconciles MRs to create S3 bucket, IAM role, and Pod Identity Association.
• 7. Application starts, performs health checks and S3 read/write operations.
• 8. Verify readiness via kro readyWhen conditions and functional tests (PUT/GET file).

Evidence

For the demo, I built a simple application that stores files in S3. The idea was that a developer could say, "I want to run an application using this image," and the platform would provision not only the Deployment but also the S3 bucket and IAM resources required by the application.

Source

The entry point for this experiment is a custom resource called StorageApp. When a developer creates a single StorageApp, kro creates the required Kubernetes resources. Among those resources, the ones representing AWS resources are reconciled to AWS by the Provider.

Source

I use Pod Identity for AWS authentication. Both the application and the Provider use temporary credentials, so neither requires long-lived access keys.

Source