The "Fire and Forget" Limitation
Think of Terraform like a contractor who builds exactly what you specify, hands you the keys, and leaves. If someone later knocks down a wall, the contractor doesn't know — and won't know until you call them back. This is how most infrastructure tools work: you run a command, infrastructure gets created, and the tool stops caring.
Terraform is a Command Line Interface (CLI) tool that follows this passive model:
- You run
terraform apply. - It talks to AWS (or GCP, Azure, etc.) and builds infrastructure.
- It stops. Terraform has no ongoing awareness of what it created.
If someone deletes that infrastructure 5 minutes later, Terraform doesn't know until you run it again. This gap between "what Terraform thinks exists" and "what actually exists" is called configuration drift, and it's one of the most common sources of production incidents.
The Control Plane Paradigm
Crossplane flips this model entirely. Instead of a CLI tool you run occasionally, Crossplane is a Universal Control Plane — a continuously running system that actively manages infrastructure the same way Kubernetes manages containers.
To understand why this matters, you need to understand Kubernetes' core design pattern. Kubernetes is famous for running containers, but its real architectural innovation is the reconciliation loop:
- Desired State: You declare "I want 3 replicas of this app."
- Current State: Kubernetes observes "I can only find 2 replicas right now."
- Action: A Controller detects the gap and starts a new replica.
- Repeat: This loop runs continuously, forever.
Crossplane extends this exact pattern to cloud infrastructure. It installs Controllers inside Kubernetes that manage AWS S3 buckets, Google Cloud SQL databases, and Azure Virtual Networks with the same continuous reconciliation logic that manages Pods. The infrastructure is never "handed off" — it is perpetually supervised.
Why This Distinction Matters at Scale
At small scale, running terraform apply in a CI pipeline every 15 minutes approximates continuous reconciliation. At large scale — hundreds of teams, thousands of resources — the passive model breaks down. Drift accumulates faster than pipelines can catch it, and the blast radius of undetected drift grows. Crossplane's architecture makes drift correction a platform-level guarantee rather than a process-level discipline.
Interviewers frequently ask: "How does Crossplane differ from Terraform?" A weak answer focuses on syntax (YAML vs. HCL). A strong answer focuses on the operational model: Terraform is a CLI tool with point-in-time execution; Crossplane is a control plane with continuous reconciliation. The key implication is that Crossplane provides automatic drift correction while Terraform requires a pipeline re-run to detect and fix drift. Follow up by noting that this comes with trade-offs — Crossplane adds operational complexity (it runs inside your cluster) and requires Kubernetes as a dependency.