Composition reference
Every platform API available in this cluster. These are generated
directly from the CompositeResourceDefinition manifests in
compositions/, so they always match what is deployed.
Azure
| Composition |
Summary |
| XAIBackend |
An Azure AI Services account, a pinned Azure OpenAI model deployment, and account-scoped inference access for an App Service managed identity. |
| XAppService |
An Azure Linux Web App and its Service Plan, using a container image. |
| XContainerApp |
An Azure Container App and its managed Container App Environment. |
| XDataCollectionRule |
— |
| XDatabase |
An Azure PostgreSQL Flexible Server and database with a password supplied by a Kubernetes Secret. An optional skuName overrides compute while size still determines storage; regional SKU support does not guarantee capacity. |
| XDiagnosticSetting |
— |
| XKeyVault |
An Azure Key Vault with RBAC enabled. The Crossplane provider receives Key Vault Secrets Officer and an optional XAppService identity receives Key Vault Secrets User. |
| XKeyVaultSecret |
Copies one value from a namespaced Kubernetes Secret into an XKeyVault. |
| XLandingZoneArchitecture |
— |
| XLogAnalyticsWorkspace |
— |
| XNetworkManager |
An Azure Virtual Network Manager, the subscription-scoped service that owns IPAM pools and central network configuration. |
| XNetworkManagerIPAMPool |
An IPAM pool on a network manager, so virtual networks get address space allocated automatically instead of teams picking CIDRs by hand. |
| XResourceGroup |
An Azure resource group: the container every other resource in this platform is created inside. |
| XSubscription |
— |
| XUserAssignedIdentity |
— |
| XVirtualMachine |
A Linux or Windows virtual machine with its network interface, attached to an existing virtual network subnet. |
| XVirtualNetwork |
A virtual network with its subnets, network security groups and IPAM-driven address space. |
Entraid
| Composition |
Summary |
| XAccessPackage |
An Entra access package that references a same-namespace catalog by catalogRef.name and includes a subset of its registered groupIds without owning catalog associations. It creates a request policy with primary and secondary escalation approvers referenced by same-namespace XSecurityGroup names, and reviews assignments quarterly. The secondary group is notified after seven days; requests are denied after fourteen days without approval. The default 14-day review window removes access if reviewers do not respond. |
| XAccessPackageCatalog |
An Entra entitlement management catalog. Optional XSecurityGroup object IDs can be granted the built-in Catalog Reader role; no write-enabled catalog roles are assigned. Register groupIds once here; the catalog owns their associations and publishes status.groupAssociations. Multiple packages reference this catalog by catalogRef.name and select groups without owning or deleting these shared associations. |
| XEnterpriseApp |
A single-tenant Entra ID application registration and enterprise service principal with web redirect URIs and an automatically rotated client credential. The credential is written to a Kubernetes connection Secret; consumers should copy it into their own secret store. |
| XSecurityGroup |
An Entra ID security group. In Declared mode, optional members and owners are user principal names (UPNs), looked up in Microsoft Graph and applied on the next reconcile. Set membershipMode to External when another system, such as an access package, manages membership; members must be empty then. |
Environments
| Composition |
Summary |
| XManagementSubscription |
— |
| XWebApplication |
A complete Azure web application environment with a resource group, PostgreSQL database, Linux App Service, and Key Vault-backed database credential. Microsoft Entra ID authentication can be enabled with an automatically managed enterprise application and rotating client secret. |