# Crossplane Competence Center Switzerland > Deep Crossplane production expertise in Switzerland. VSHN helps you design, deploy, and operate Crossplane-based cloud infrastructure on any provider. Crossplane lets your developers provision cloud resources with kubectl, not HCL. VSHN is an official Crossplane vendor: we design, build, and operate Crossplane platforms on Swiss cloud providers so your team gets a self-service infrastructure API without the state-file headaches. ## Pages - [Homepage](https://www.crossplane.ch/): Crossplane Experts in Switzerland – Cloud IaC | VSHN - [Crossplane vs Terraform vs Pulumi: Comparison | VSHN](https://www.crossplane.ch/comparison.md) - [Partner with VSHN on Crossplane | VSHN](https://www.crossplane.ch/partners.md) - [Crossplane Sovereignty — CLOUD Act-Free IaC | VSHN](https://www.crossplane.ch/sovereignty.md) ## Features - **Official Crossplane Vendor**: VSHN has deep Crossplane production experience and is a recognized official Crossplane commercial vendor. We bring battle-tested knowledge from real production deployments - from initial architecture through day-two operations. Our engineers know the pitfalls, the best practices, and the shortcuts that save you months of effort. - **Infrastructure as Code with Kubernetes**: Crossplane extends Kubernetes with custom resource definitions for cloud infrastructure. Manage databases, storage, networking, and more using familiar kubectl workflows and GitOps pipelines - all from a single control plane running on your chosen infrastructure. - **Multi-Cloud Architecture**: Crossplane enables multi-cloud infrastructure from a single control plane. VSHN has hands-on production experience with Crossplane providers for cloudscale.ch and Exoscale, and can help you integrate additional cloud providers. Avoid vendor lock-in while maintaining consistent governance across your environments. Learn more in our [sovereignty assessment](/sovereignty/). - **Self-Service Developer Platform**: Build a golden path for your development teams. Crossplane Compositions let platform engineers define approved infrastructure blueprints that developers can provision on demand - with guardrails, cost controls, and compliance built in from the start. VSHN helps you design and implement these abstractions. - **CNCF Graduated Project**: Crossplane is a Cloud Native Computing Foundation graduated project, backed by a vibrant open-source community. No license surprises, no vendor lock-in. VSHN actively contributes to the Crossplane ecosystem and brings deep production experience to every engagement. - **Consulting, Training & Support**: From architecture reviews and proof-of-concept builds to hands-on training with specialist partners and ongoing support - VSHN offers the full spectrum of Crossplane services. We help your team become self-sufficient or provide long-term operational partnership, whichever fits your needs. ## What VSHN offers for Crossplane - Architecture design and review for Crossplane-based platforms - Proof-of-concept builds and production rollouts - Custom Composition and provider development - Migration from Terraform or other IaC tools to Crossplane - Hands-on training for platform and development teams via [letsboot](https://www.letsboot.ch/kurs/crossplane) - Ongoing operational support and incident response - Integration with GitOps workflows and CI/CD pipelines - Swiss-based consulting with transparent engagement terms ## Crossplane FAQ ### What Crossplane services does VSHN offer? VSHN offers consulting, architecture design, implementation, training, and operational support for Crossplane. Whether you are evaluating Crossplane for the first time or running it in production, we bring hands-on experience to accelerate your project. Engagements are scoped to your needs - from a one-day architecture review to a multi-month platform build. ### What is Crossplane? Crossplane is an open-source, Cloud Native Computing Foundation (CNCF) graduated project that extends Kubernetes with the ability to provision and manage cloud infrastructure. It lets you define infrastructure resources - databases, networks, storage, managed services - as Kubernetes custom resources. Platform teams use Crossplane to build self-service infrastructure platforms with guardrails, while developers consume infrastructure using familiar Kubernetes APIs and GitOps workflows. ### Why is VSHN the right partner for Crossplane in Europe? VSHN has deep Crossplane production experience and is listed as an official commercial vendor on https://crossplane.io/commercial/. We have built internal developer platforms, multi-cloud orchestration layers, and self-service provisioning systems for customers across Switzerland and Europe. This experience means we know which Crossplane patterns work at scale, how to structure Compositions for maintainability, and how to avoid common pitfalls that can cost teams weeks of debugging. ### Can VSHN help us migrate from Terraform to Crossplane? Yes. Migrating from Terraform to Crossplane is one of our core competencies. We assess your existing Terraform estate, design a migration strategy, build equivalent Crossplane Compositions, and execute the migration with minimal downtime for your running infrastructure. Many organizations move to Crossplane to unify their platform tooling on Kubernetes and benefit from continuous reconciliation instead of plan-and-apply workflows. ### What cloud providers does VSHN support with Crossplane? VSHN has hands-on production experience with Crossplane providers for cloudscale.ch and Exoscale, as well as Kubernetes, Helm, and SQL providers for in-cluster and database resources. We have also developed open-source Crossplane providers for these platforms. If your cloud provider has a Crossplane provider available, we can help you integrate it. Swiss cloud providers are a natural fit for organizations with data residency requirements. ### Does VSHN offer Crossplane training? Yes. VSHN works with training partner [letsboot](https://www.letsboot.ch/kurs/crossplane) to deliver hands-on Crossplane training for platform engineers and development teams. Training covers Crossplane architecture, provider configuration, Composition design, XRDs, testing strategies, and day-two operations. Sessions can be delivered on-site in Switzerland or remotely, tailored to your team's experience level and your specific infrastructure. ### Can Crossplane replace Terraform? Crossplane and Terraform solve similar problems but take different approaches. Terraform uses a declarative HCL language and a plan-and-apply workflow. Crossplane uses the Kubernetes resource model with continuous reconciliation - infrastructure drifts are automatically corrected. Many organizations migrate from Terraform to Crossplane to unify their platform tooling on Kubernetes. VSHN can assist with migration planning and execution, ensuring a smooth transition with minimal downtime for your running infrastructure. ### Does VSHN run Crossplane on its own platform? Yes. VSHN uses Crossplane extensively on APPUiO, our Swiss Kubernetes managed platform, to provision and manage customer infrastructure. This gives us deep, first-hand operational experience with Crossplane at scale - including upgrades, monitoring, managing state data at the GB scale, and incident response. Our production platform targets up to 99.99% availability, and Crossplane is a key component of how we deliver that SLA to our customers. ### How do I engage VSHN for Crossplane consulting? Contact us using the form below. Describe your project - whether it is an architecture review, a proof of concept, a production migration, or ongoing support. We provide a written scope and cost estimate in CHF estimate within one business day. There is no commitment at the scoping stage. Engagements typically start within one to two weeks of agreement. ### Can consulting firms engage VSHN for Crossplane in client projects? Yes. Consulting firms and platform teams engage VSHN to design and operate Crossplane-based infrastructure for their clients. VSHN brings Crossplane expertise and operational experience while your team focuses on the client's application requirements and business logic. Engagements typically cover Crossplane architecture, custom composition development, and ongoing platform operations with 24/7 support. ## Contact us Ready to manage cloud infrastructure with Crossplane? Contact us for a free initial consultation. Consulting at CHF 250 per hour, scoped to your needs. Want to hear from a customer first? We can arrange a reference call. Booking: #contact --- ## Crossplane vs Terraform vs Pulumi: Comparison | VSHN # Crossplane vs Terraform vs Pulumi: Which Infrastructure Automation Fits Your Platform? Platform teams choosing infrastructure automation face a fundamental decision: traditional Infrastructure as Code (Terraform, Pulumi) or Kubernetes-native control planes (Crossplane). Each approach has different trade-offs for developer self-service, multi-cloud governance, and operational complexity. ## Quick comparison | | Crossplane (self-hosted) | Upbound (managed Crossplane) | Terraform / OpenTofu | Pulumi | |---|---|---|---|---| | **Approach** | Kubernetes-native control plane | Managed Kubernetes control plane | Declarative IaC, plan-and-apply | SDK-based IaC, imperative | | **State management** | Kubernetes etcd (no state files) | Managed by Upbound | State files (local, S3, Terraform Cloud) | State files (local, S3, Pulumi Cloud) | | **Reconciliation** | Continuous, detects and fixes drift | Continuous | Manual: `terraform plan && apply` | Manual: `pulumi up` | | **Developer self-service** | Native: `kubectl apply` or GitOps | Native: `kubectl apply` or GitOps | Requires CI/CD wrapper | Requires CI/CD wrapper | | **Multi-cloud** | Single control plane, any provider | Single control plane, any provider | Separate configs per provider | Separate programs per provider | | **Swiss providers** | cloudscale.ch, Exoscale providers available | cloudscale.ch, Exoscale via self-hosted | cloudscale.ch, Exoscale providers available | cloudscale.ch, Exoscale providers available | | **Maturity** | CNCF Graduated (2024) | Commercial (Upbound, founded 2020) | Mature (HashiCorp, since 2014) | Growing (Pulumi, since 2018) | | **License** | Apache 2.0 | Commercial SaaS | BSL 1.1 (Terraform) / MPL 2.0 (OpenTofu) | Apache 2.0 (engine) / Commercial (Cloud) | | **Best for** | Platform teams on Kubernetes | Crossplane without operations overhead | Traditional ops teams, brownfield infra | Developer-centric teams wanting real code | ## Terraform / OpenTofu Terraform is the most widely adopted IaC tool. You define infrastructure in HCL files, run `terraform plan` to preview changes, and `terraform apply` to execute them. **Strengths:** - Mature ecosystem with thousands of providers - Well-understood plan-and-apply workflow - Large community, extensive documentation - OpenTofu fork available under MPL 2.0 license **Limitations:** - **State file management is a constant operational burden.** Lost or corrupted state means manual recovery. - No continuous reconciliation. Drift between plan and reality goes undetected until the next `apply`. - No native developer self-service. Developers submit tickets or PRs; platform team runs `apply`. - HCL is a DSL, not a general-purpose language. Limited logic and testing capabilities. - HashiCorp's BSL license change (2023) created uncertainty; OpenTofu fork addresses this **Best for:** Teams managing traditional infrastructure (VMs, networks, DNS) that don't need developer self-service. ## Pulumi Pulumi uses real programming languages (Python, TypeScript, Go) instead of a DSL. Infrastructure is defined as code in the same languages developers already use. **Strengths:** - Real programming languages: loops, conditionals, tests, and IDE tooling - Familiar developer experience - Good for application-infrastructure co-location - Supports all major cloud providers **Limitations:** - Still requires state files (Pulumi Cloud or self-managed backend) - No continuous reconciliation. Same drift problem as Terraform. - No native Kubernetes integration. Separate tool from your container platform. - Smaller ecosystem than Terraform - **Small talent pool.** Fewer Pulumi engineers available in Switzerland compared to Terraform or Kubernetes specialists. Hiring or contracting for Pulumi expertise is harder. - Commercial cloud service for team features **Best for:** Developer-centric teams that want infrastructure in the same language as their applications. ## Crossplane (self-hosted) Crossplane runs as a Kubernetes controller. You define infrastructure as Kubernetes custom resources, and Crossplane continuously reconciles the desired state against reality. **Strengths:** - **No state files.** Kubernetes etcd is the source of truth. - **Continuous reconciliation.** Detects and fixes drift automatically. - **Developer self-service.** Developers provision infrastructure via `kubectl apply` or GitOps, same as deploying applications. - **Compositions.** Platform teams define guardrails and abstractions; developers get a simple API. - **Multi-cloud from one control plane:** AWS, Azure, GCP, cloudscale.ch, Exoscale, Kubernetes, Helm, SQL. - **Builds on Kubernetes skills.** Any engineer familiar with Kubernetes controllers and CRDs can operate Crossplane, unlike tools that require learning a separate ecosystem. - CNCF Graduated project with vendor-neutral governance. - Apache 2.0 license. No BSL surprises. **Limitations:** - Steeper learning curve than Terraform, especially Composition Functions - Kubernetes cluster required to run the control plane - Smaller provider ecosystem than Terraform (growing rapidly) - Debugging can be harder (Kubernetes events vs Terraform output) **Best for:** Platform teams already on Kubernetes that want developer self-service and continuous reconciliation. ## Upbound (managed Crossplane) Upbound offers a managed Crossplane control plane as a SaaS product, plus commercial features for enterprise teams. **Strengths:** - Crossplane without operating the control plane yourself - Commercial support and enterprise features - Upbound Marketplace for provider packages **Limitations:** - US-based SaaS. Data processed outside Switzerland. - Starting at $1,000+/month for managed control planes - Vendor dependency for a control plane that could be self-hosted - Less flexibility than self-hosted for Swiss provider integrations **Best for:** US/global teams wanting Crossplane without Kubernetes operations expertise. ## VSHN Crossplane Consulting and Operations VSHN is an official Crossplane commercial vendor (listed on crossplane.io). We help Swiss platform teams adopt Crossplane: architecture review, composition development, migration, and production operations. **What VSHN offers:** - **Architecture review:** Assess your infrastructure automation needs and design a Crossplane architecture (1-day engagement). - **Composition development:** Build custom Compositions and Composition Functions for your team's self-service APIs. - **Migration from Terraform:** Plan and execute migration of existing Terraform-managed infrastructure to Crossplane. - **Training:** Hands-on Crossplane training for your platform team, delivered with training partners. - **24/7 operations:** VSHN operates your Crossplane control plane on APPUiO Cloud or your own Kubernetes cluster. - **Swiss providers:** Production-proven Crossplane providers for cloudscale.ch and Exoscale. **Pricing:** CHF 250/hour consulting. Scoped engagements from 1-day architecture reviews to multi-month platform builds. **Production track record:** VSHN has run Crossplane in production since 2021, powering the entire VSHN Application Catalog on APPUiO Cloud. Hundreds of managed service instances are provisioned and reconciled daily. **Best for:** Swiss platform teams adopting Crossplane who want hands-on expertise and operational support from an official vendor. ## Crossplane vs Terraform: the key difference Terraform automates infrastructure provisioning. Crossplane builds an **infrastructure platform** with developer self-service. If your developers submit Jira tickets for infrastructure and your platform team runs `terraform apply`, Crossplane eliminates that bottleneck. Developers provision what they need via `kubectl` or GitOps, within the guardrails your platform team defines. If you manage static infrastructure that rarely changes, Terraform's plan-and-apply workflow is simpler and more mature. ## When to choose Crossplane with VSHN Crossplane with VSHN makes sense when: - Your platform team wants to offer developer self-service for infrastructure - You're already on Kubernetes and want infrastructure automation in the same ecosystem - You need multi-cloud governance from a single control plane - Terraform state management has become a pain point - You want Swiss-specific providers (cloudscale.ch, Exoscale) or custom Crossplane providers implemented for your control plane - Your team needs hands-on help from an official Crossplane vendor Try Swiss cloud infrastructure with Crossplane: [Exoscale]({{partner:exoscale.signup_url}}) (Swiss IaaS with Crossplane provider). Want help? [Contact us](#contact). For a detailed sovereignty analysis, see our [Crossplane sovereignty assessment](/sovereignty/).

Evaluate Crossplane for your platform

30-minute call with our Crossplane team. We review your setup and outline next steps.

Book a free consultation
## Next steps Ready to evaluate Crossplane for your platform? [Book a free 30-minute call](#contact) with our Crossplane team. We discuss your current setup, identify where Crossplane fits, and outline next steps. --- ## Partner with VSHN on Crossplane | VSHN # Partner with VSHN on Crossplane You bring the customer relationship and infrastructure-as-code expertise: Crossplane composition authoring, cloud resource modelling, developer platform design. VSHN brings Crossplane operations, provider management, monitoring, upgrades, and 24/7 support. Together you deliver a complete Crossplane platform without either side building capabilities you don't have. ## How we collaborate **Lead Partner model.** For each project, one of us is the customer's single point of contact. Who leads depends on the project, agreed per engagement. The Lead Partner drives the project, handles invoicing, and owns first-level support. **Joint delivery.** You handle consulting, integration, and project management. VSHN handles infrastructure operations, monitoring, backups, and SLA. Or the other way around, depending on the project. Roles are agreed per engagement, not locked into a rigid structure. **Flexible billing.** Invoice the customer together or separately, agreed per project. Both models are supported: each party invoices their share directly, or one party invoices the full amount and redistributes. **Protected relationships.** No undercutting. Your customer stays your customer. Existing relationships are respected on both sides, with contractual protections for both parties. ## Division of labour for Crossplane | Your role | VSHN's role | |-----------|-------------| | Infrastructure-as-code design | Crossplane operations | | Crossplane composition authoring | Provider management | | Cloud resource modelling | Monitoring, alerting, and 24/7 incident response | | Developer platform design | Upgrades and SLA | | Project management and customer relationship | | ## Partners delivering Crossplane Our partner network is growing. See current VSHN partners at [servala.com/partners](https://servala.com/partners/). ## Become a partner Interested in delivering Crossplane platforms together? Let's explore how we complement each other. [Book a partnership discovery call](https://vshn.cal.vs.hn/crossplane) or [start a partnership conversation](#contact). --- ## Crossplane Sovereignty — CLOUD Act-Free IaC | VSHN # Crossplane Sovereignty: Infrastructure-as-Code After the License Wars Your infrastructure-as-code tool defines every resource in your cloud environment: networks, databases, storage, secrets, IAM policies. Whoever controls the IaC platform controls the blueprint of your entire infrastructure. In August 2023, HashiCorp switched Terraform from MPL 2.0 to the Business Source License (BSL 1.1), restricting how competitors can use the software. In April 2024, IBM acquired HashiCorp for $6.4 billion, placing Terraform under a US corporation with a restrictive license and [CLOUD Act](https://en.wikipedia.org/wiki/CLOUD_Act) obligations. AWS CloudFormation, Azure ARM Templates, and Google Deployment Manager are proprietary and locked to their respective US hyperscaler ecosystems. Crossplane is a **CNCF Graduated project** (Apache 2.0 license), Kubernetes-native, and governed by the same foundation that oversees Kubernetes itself. VSHN operates Crossplane on Swiss infrastructure and is a [listed Crossplane commercial vendor](https://www.crossplane.io/commercial/). ## Why Crossplane is the sovereign infrastructure-as-code choice The HashiCorp acquisition crystallized a risk that was always present with single-vendor open source: - **Apache 2.0 license**: permissive, irrevocable for released versions, no usage restrictions. Unlike Terraform's BSL, Crossplane's license cannot be changed retroactively - **CNCF Graduated**: the highest level of open-source governance, same as Kubernetes and Prometheus. No single company can change the license or governance - **Kubernetes-native**: uses standard Kubernetes APIs and CRDs, no separate state backend or vendor-hosted registry - **Multi-cloud by design**: manages resources across any cloud provider via Crossplane Providers, avoiding single-hyperscaler lock-in - **No SaaS dependency**: unlike Terraform Cloud (HashiCorp/IBM) or Pulumi Cloud, Crossplane runs entirely on your own Kubernetes cluster - **VSHN is an active contributor**: VSHN develops and maintains [Crossplane providers](https://github.com/vshn) used in production ## Crossplane sovereignty compared | Dimension | Terraform (HashiCorp/IBM) | AWS CloudFormation | Azure ARM / Bicep | Google Deployment Manager | VSHN Managed Crossplane | |-----------|--------------------------|-------------------|------------------|--------------------------|------------------------| | **Governance** | IBM (USA) | Amazon (USA) | Microsoft (USA) | Google (USA) | CNCF (open governance) | | **License** | BSL 1.1 (restrictive) | Proprietary | Proprietary | Proprietary | Apache 2.0 (permissive) | | **CLOUD Act** | Exposed (HCP Cloud) | Exposed | Exposed | Exposed | Not exposed | | **State storage** | Terraform Cloud (IBM) or self-managed | AWS-managed | Azure-managed | GCP-managed | Kubernetes etcd (Swiss infrastructure) | | **Cloud lock-in** | Multi-cloud (but IBM-governed) | AWS only | Azure only | GCP only | Multi-cloud, Kubernetes-native | | **SaaS dependency** | Terraform Cloud for collaboration | AWS Console | Azure Portal | GCP Console | None — runs on your K8s cluster | | **Community governance** | Single company (IBM) | Single company | Single company | Single company | CNCF graduated, multi-vendor | | **Operator** | Self-managed or IBM SaaS | AWS-managed | Microsoft-managed | Google-managed | VSHN AG (Switzerland) | ## The license and acquisition argument The Terraform license change and IBM acquisition illustrate a fundamental sovereignty risk with single-vendor open source: 1. **License revocation**: HashiCorp changed Terraform from MPL 2.0 to BSL 1.1, restricting competing commercial use. Organizations that built their infrastructure practice around "open source Terraform" discovered the license was a single board decision away from restriction. 2. **Corporate acquisition**: IBM's acquisition placed Terraform under a US defense contractor subject to the CLOUD Act, ITAR, and EAR regulations. Terraform Cloud state files are now accessible to IBM under US law: they contain the complete blueprint of your infrastructure. 3. **OpenTofu fork**: the community responded with [OpenTofu](https://opentofu.org/) (Linux Foundation), but it remains a catch-up fork tied to HashiCorp's HCL design decisions and faces ongoing legal uncertainty around code provenance. Crossplane avoids these risks structurally: - **CNCF governance** means no single company can change the license - **Apache 2.0** is irrevocable for released versions - **Kubernetes-native architecture** means state lives in your cluster's etcd, not a vendor SaaS - **Provider ecosystem** is community-maintained, not controlled by one company ## VSHN sovereignty self-assessment We applied the EU's [Cloud Sovereignty Framework](https://commission.europa.eu/document/09579818-64a6-4dd5-9577-446ab6219113_en) (v1.2.1, October 2025) to our own services. This framework was used to score providers in the EU's [EUR 180M sovereign cloud tender](https://ec.europa.eu/commission/presscorner/detail/en/ip_26_833) in April 2026. Three pure-European providers achieved SEAL-3, while a consortium involving Google Cloud scored only SEAL-2. *This is a self-assessment, not a formal SEAL certification. We publish it for transparency so customers can evaluate our sovereignty profile using the same structured criteria the EU uses.* | # | Dimension | Weight | Assessment | Evidence | |---|-----------|--------|-----------|----------| | SOV-1 | Strategic | 15% | **Strong** | Swiss AG, no foreign parent, all shareholders Swiss citizens ([Commercial Register](https://zh.chregister.ch/cr-portal/auszug/auszug.xhtml?uid=CHE-275.566.226)) | | SOV-2 | Legal | 10% | **Strong** | Swiss law ([GTC](https://products.vshn.ch/legal/gtc_en.html)), no CLOUD Act, [EU adequacy decision](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) | | SOV-3 | Data & AI | 10% | **Strong** | Swiss DCs by default. Sovereign key management via [Managed OpenBao](https://www.openbao.ch) + [Swiss HSM](https://cloud.securosys.com/cloudhsm) | | SOV-4 | Operational | 15% | **Strong** | Swiss 24/7 ops, [Swiss-only support option](https://products.vshn.ch/support_plans.html#_option_switzerland_only_support). All services on vanilla Kubernetes | | SOV-5 | Supply Chain | 20% | **Strong** | Infrastructure-agnostic — [customer chooses provider](https://servala.com/providers/). Open-source software | | SOV-6 | Technology | 15% | **Strong** | 100% open source. VSHN contributes to [K8up](https://github.com/k8up-io) (CNCF), [Crossplane providers](https://github.com/vshn), [Project Syn](https://github.com/projectsyn) | | SOV-7 | Security | 10% | **Strong** | [ISO 27001](https://www.vshn.ch/wp-content/uploads/2025/12/ISO-27001-certificate-VSHN-2024.pdf), ISAE 3402 Type II, Swiss SOC. [FINMA-regulated customers](https://www.vshn.ch/en/solutions/solutions-for-banks-and-financial-service-providers/) | | SOV-8 | Environmental | 5% | **Moderate** | DC operators: Green Datacenter AG (ISO 22301/27001/27701), [Exoscale sustainability](https://www.exoscale.com/sustainability/). [VSHN CSR policy](https://handbook.vshn.ch/corporate_social_responsibility_policy.html) | **Overall: SEAL-3 equivalent**, the same level achieved by the winners of the EU's own sovereignty tender. No provider worldwide achieved SEAL-4: it requires fully EU/EEA-sourced hardware supply chains and open-source foundations, structural gaps shared by every cloud provider. Try Swiss cloud infrastructure with Crossplane: [Exoscale]({{partner:exoscale.signup_url}}) (Swiss IaaS with Crossplane provider). Want help? [Contact us](#contact). ## Get a sovereignty assessment for your infrastructure-as-code Still on Terraform after the IBM acquisition? We assess your sovereignty profile against the EU framework and plan a migration to Crossplane on Swiss infrastructure. VSHN is a listed Crossplane commercial vendor and active upstream contributor.