Terraform 1.12 vs Crossplane 1.16: Infrastructure Provisioning Compared for Multi-Cloud

# Terraform 1.12 Multi-Cloud Provisioning Example
# Provider versions pinned for reproducibility
terraform {
  required_version = ">= 1.12.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.30.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 5.20.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.85.0"
    }
  }
  # Remote state configuration with locking
  backend "s3" {
    bucket         = "my-org-terraform-state"
    key            = "multi-cloud/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-lock"
  }
}

# AWS Configuration
provider "aws" {
  region = var.aws_region
  # Error handling: validate credentials on init
  skip_credentials_validation = false
  skip_region_validation      = false
}

# GCP Configuration
provider "google" {
  project = var.gcp_project_id
  region  = var.gcp_region
}

# Azure Configuration
provider "azurerm" {
  features {}
  subscription_id = var.azure_subscription_id
  tenant_id       = var.azure_tenant_id
}

# Variables with validation
variable "aws_region" {
  type        = string
  default     = "us-east-1"
  description = "AWS deployment region"
  validation {
    condition     = contains(["us-east-1", "us-west-2", "eu-west-1"], var.aws_region)
    error_message = "Unsupported AWS region. Choose from us-east-1, us-west-2, eu-west-1."
  }
}

variable "gcp_project_id" {
  type        = string
  description = "GCP project ID"
  validation {
    condition     = length(var.gcp_project_id) > 0
    error_message = "GCP project ID cannot be empty."
  }
}

variable "azure_subscription_id" {
  type        = string
  description = "Azure subscription ID"
  sensitive   = true
}

variable "azure_tenant_id" {
  type        = string
  description = "Azure tenant ID"
  sensitive   = true
}

# AWS EC2 Instance
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0" # Ubuntu 22.04 us-east-1
  instance_type = "t3.micro"
  tags = {
    Name        = "terraform-multi-cloud-ec2"
    ManagedBy   = "terraform"
    Environment = "prod"
  }
  # Error handling: ensure instance is running before marking complete
  timeouts {
    create = "10m"
    delete = "5m"
  }
}

# GCP Compute Instance
resource "google_compute_instance" "web" {
  name         = "terraform-multi-cloud-gce"
  machine_type = "e2-micro"
  zone         = "${var.gcp_region}-a"
  boot_disk {
    initialize_params {
      image = "ubuntu-2204-jammy-v20241001"
    }
  }
  network_interface {
    network = "default"
    access_config {} # Ephemeral public IP
  }
  tags = ["terraform-managed", "prod"]
}

# Azure Linux VM
resource "azurerm_linux_virtual_machine" "web" {
  name                = "terraform-multi-cloud-azure-vm"
  resource_group_name = azurerm_resource_group.main.name
  location            = "East US"
  size                = "Standard_B1s"
  admin_username      = "azureuser"
  admin_ssh_key {
    username   = "azureuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }
  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }
  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts"
    version   = "latest"
  }
  tags = {
    environment = "prod"
    managed_by  = "terraform"
  }
}

resource "azurerm_resource_group" "main" {
  name     = "terraform-multi-cloud-rg"
  location = "East US"
}

# Outputs
output "aws_instance_public_ip" {
  value = aws_instance.web.public_ip
}

output "gcp_instance_public_ip" {
  value = google_compute_instance.web.network_interface[0].access_config[0].nat_ip
}

output "azure_instance_public_ip" {
  value = azurerm_linux_virtual_machine.web.public_ip_address
}

# Crossplane 1.16 Multi-Cloud Provisioning Example
# Prerequisites: Crossplane 1.16 installed, providers for AWS/GCP/Azure configured
# Error handling: readiness checks, deletion policies, validation

apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: aws-provider-config
spec:
  credentials:
    source: Secret
    secretRef:
      name: aws-creds
      namespace: crossplane-system
      key: credentials
---
apiVersion: gcp.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: gcp-provider-config
spec:
  projectID: my-gcp-project-123
  credentials:
    source: Secret
    secretRef:
      name: gcp-creds
      namespace: crossplane-system
      key: credentials.json
---
apiVersion: azure.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: azure-provider-config
spec:
  credentials:
    source: Secret
    secretRef:
      name: azure-creds
      namespace: crossplane-system
      key: credentials
---
# AWS EC2 Instance
apiVersion: ec2.aws.crossplane.io/v1beta1
kind: Instance
metadata:
  name: crossplane-multi-cloud-ec2
  annotations:
    crossplane.io/external-name: crossplane-multi-cloud-ec2
spec:
  forProvider:
    region: us-east-1
    imageId: ami-0c55b159cbfafe1f0 # Ubuntu 22.04 us-east-1
    instanceType: t3.micro
    tags:
      - key: Name
        value: crossplane-multi-cloud-ec2
      - key: ManagedBy
        value: crossplane
      - key: Environment
        value: prod
  writeConnectionSecretToRef:
    name: ec2-connection-secret
    namespace: default
  deletionPolicy: Delete # Error handling: explicit deletion policy
---
# GCP Compute Instance
apiVersion: compute.gcp.crossplane.io/v1beta1
kind: Instance
metadata:
  name: crossplane-multi-cloud-gce
spec:
  forProvider:
    zone: us-central1-a
    machineType: e2-micro
    disks:
      - initializeParams:
          image: ubuntu-2204-jammy-v20241001
        boot: true
    networkInterfaces:
      - network: default
        accessConfigs:
          - type: ONE_TO_ONE_NAT # Ephemeral public IP
  deletionPolicy: Delete
---
# Azure Linux VM
apiVersion: compute.azure.crossplane.io/v1beta1
kind: VirtualMachine
metadata:
  name: crossplane-multi-cloud-azure-vm
spec:
  forProvider:
    location: East US
    resourceGroupName: crossplane-multi-cloud-rg
    vmSize: Standard_B1s
    storageProfile:
      osDisk:
        createOption: FromImage
        diskSizeGB: 30
        managedDisk:
          storageAccountType: Standard_LRS
      imageReference:
        publisher: Canonical
        offer: 0001-com-ubuntu-server-jammy
        sku: 22_04-lts
        version: latest
    osProfile:
      computerName: crossplane-azure-vm
      adminUsername: azureuser
      linuxConfiguration:
        ssh:
          publicKeys:
            - keyData: "ssh-rsa AAAA..." # Replace with your public key
    networkProfile:
      networkInterfaces:
        - id: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/crossplane-multi-cloud-rg/providers/Microsoft.Network/networkInterfaces/crossplane-azure-nic
  deletionPolicy: Delete
---
# Azure Resource Group (dependency for VM)
apiVersion: resources.azure.crossplane.io/v1beta1
kind: ResourceGroup
metadata:
  name: crossplane-multi-cloud-rg
spec:
  forProvider:
    location: East US
  deletionPolicy: Delete
---
# Composite Resource Definition (XRD) for multi-cloud web tier
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xwebapps.multi-cloud.example.com
spec:
  group: multi-cloud.example.com
  names:
    kind: XWebApp
    plural: xwebapps
  claimNames:
    kind: WebAppClaim
    plural: webappclaims
  versions:
    - name: v1alpha1
      served: true
      referenceable: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                region:
                  type: string
                  default: us-east-1
                instanceType:
                  type: string
                  default: t3.micro
              required:
                - region

#!/usr/bin/env python3
"""
Multi-Cloud Drift Detection Script for Terraform 1.12 and Crossplane 1.16
Compares desired state vs actual state, outputs reconciliation steps.
Requires: terraform ~1.12, kubectl ~1.29, boto3, google-cloud-compute, azure-mgmt-compute
"""

import subprocess
import json
import os
import sys
from typing import Dict, List, Tuple

# Configuration
TERRAFORM_DIR = "./terraform-configs"
KUBECONFIG = os.path.expanduser("~/.kube/config")
DRIFT_REPORT_PATH = "./drift-report.json"

class DriftDetector:
    def __init__(self):
        self.drift_results = {
            "terraform": {"drifted_resources": 0, "resources": []},
            "crossplane": {"drifted_resources": 0, "resources": []}
        }

    def detect_terraform_drift(self) -> None:
        """Run terraform plan to detect drift, parse output."""
        print("Detecting Terraform drift...")
        try:
            # Run terraform init first to ensure providers are installed
            init_result = subprocess.run(
                ["terraform", "init", "-input=false"],
                cwd=TERRAFORM_DIR,
                capture_output=True,
                text=True,
                check=True
            )
        except subprocess.CalledProcessError as e:
            print(f"Terraform init failed: {e.stderr}")
            sys.exit(1)

        try:
            # Run terraform plan with JSON output to detect drift
            plan_result = subprocess.run(
                ["terraform", "plan", "-json", "-input=false", "-detailed-exitcode"],
                cwd=TERRAFORM_DIR,
                capture_output=True,
                text=True
            )
            # Exit code 2 means resources are drifted
            if plan_result.returncode == 2:
                plan_output = json.loads(plan_result.stdout)
                for resource in plan_output.get("resource_changes", []):
                    if resource.get("change", {}).get("actions", []) != ["no-op"]:
                        self.drift_results["terraform"]["drifted_resources"] += 1
                        self.drift_results["terraform"]["resources"].append({
                            "address": resource.get("address"),
                            "actions": resource.get("change", {}).get("actions"),
                            "before": resource.get("change", {}).get("before"),
                            "after": resource.get("change", {}).get("after")
                        })
            elif plan_result.returncode == 1:
                print(f"Terraform plan failed: {plan_result.stderr}")
        except subprocess.CalledProcessError as e:
            print(f"Terraform plan failed: {e.stderr}")
        except json.JSONDecodeError as e:
            print(f"Failed to parse Terraform plan JSON: {e}")

    def detect_crossplane_drift(self) -> None:
        """Check Crossplane resources for sync errors, which indicate drift."""
        print("Detecting Crossplane drift...")
        try:
            # Get all Crossplane managed resources
            result = subprocess.run(
                ["kubectl", "get", "managed", "-A", "-o", "json"],
                capture_output=True,
                text=True,
                check=True
            )
            resources = json.loads(result.stdout)
            for item in resources.get("items", []):
                # Check if resource is synced (ready condition is True)
                conditions = item.get("status", {}).get("conditions", [])
                ready_condition = next((c for c in conditions if c.get("type") == "Ready"), None)
                if not ready_condition or ready_condition.get("status") != "True":
                    self.drift_results["crossplane"]["drifted_resources"] += 1
                    self.drift_results["crossplane"]["resources"].append({
                        "name": item.get("metadata", {}).get("name"),
                        "kind": item.get("kind"),
                        "namespace": item.get("metadata", {}).get("namespace"),
                        "status": ready_condition.get("message") if ready_condition else "Unknown"
                    })
        except subprocess.CalledProcessError as e:
            print(f"kubectl get managed failed: {e.stderr}")
        except json.JSONDecodeError as e:
            print(f"Failed to parse kubectl JSON: {e}")

    def generate_report(self) -> None:
        """Write drift report to file and print summary."""
        with open(DRIFT_REPORT_PATH, "w") as f:
            json.dump(self.drift_results, f, indent=2)
        print(f"\nDrift Report Summary:")
        print(f"Terraform Drifted Resources: {self.drift_results['terraform']['drifted_resources']}")
        print(f"Crossplane Drifted Resources: {self.drift_results['crossplane']['drifted_resources']}")
        print(f"Full report written to {DRIFT_REPORT_PATH}")

    def reconcile_terraform(self) -> None:
        """Run terraform apply to reconcile drift."""
        if self.drift_results["terraform"]["drifted_resources"] == 0:
            print("No Terraform drift to reconcile.")
            return
        print("Reconciling Terraform drift...")
        try:
            subprocess.run(
                ["terraform", "apply", "-auto-approve", "-input=false"],
                cwd=TERRAFORM_DIR,
                check=True
            )
            print("Terraform reconciliation complete.")
        except subprocess.CalledProcessError as e:
            print(f"Terraform apply failed: {e.stderr}")

    def reconcile_crossplane(self) -> None:
        """Re-apply Crossplane manifests to reconcile drift."""
        if self.drift_results["crossplane"]["drifted_resources"] == 0:
            print("No Crossplane drift to reconcile.")
            return
        print("Reconciling Crossplane drift...")
        try:
            subprocess.run(
                ["kubectl", "apply", "-f", "./crossplane-configs"],
                check=True
            )
            print("Crossplane reconciliation complete.")
        except subprocess.CalledProcessError as e:
            print(f"kubectl apply failed: {e.stderr}")

if __name__ == "__main__":
    detector = DriftDetector()
    detector.detect_terraform_drift()
    detector.detect_crossplane_drift()
    detector.generate_report()
    # Uncomment to auto-reconcile
    # detector.reconcile_terraform()
    # detector.reconcile_crossplane()

# Explicit cross-provider dependency example
resource "aws_iam_role" "gcp_access" {
  name = "gcp-access-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Effect = "Allow"
      Principal = {
        Federated = google_iam_workload_identity_pool.pool.name
      }
    }]
  })
}

resource "google_service_account" "cross_cloud_sa" {
  account_id   = "cross-cloud-sa"
  display_name = "Cross-Cloud Service Account"
  # Explicit dependency on AWS IAM role to parallelize providers
  depends_on = [aws_iam_role.gcp_access]
}

# Crossplane 1.16 ProviderConfig with batch sync
apiVersion: aws.crossplane.io/v1beta1
kind: ProviderConfig
metadata:
  name: aws-provider-config
spec:
  batchSyncMaxWorkers: 10
  syncPeriod: "5m" # Sync every 5 minutes
  credentials:
    source: Secret
    secretRef:
      name: aws-creds
      namespace: crossplane-system
      key: credentials

# Unified drift detection cron job
apiVersion: batch/v1
kind: CronJob
metadata:
  name: unified-drift-detection
spec:
  schedule: "*/15 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: drift-detector
            image: our-org/drift-detector:v1.2.0
            env:
            - name: TERRAFORM_DIR
              value: "/configs/terraform"
            - name: KUBECONFIG
              value: "/kube/config"
          restartPolicy: OnFailure
          volumes:
          - name: configs
            secret:
              secretName: drift-detector-configs