--- title: Building imperative operational tools on a declarative... description: Brian Grant explores building imperative operational CLI tools on top of a declarative Kubernetes-based platform (ConfigHub), arguing this approach is more... canonical: https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Building imperative operational tools on a declarative platform | daily.dev og:description: Brian Grant explores building imperative operational CLI tools on top of a declarative Kubernetes-based platform (ConfigHub), arguing this approach is more... og:url: https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl og:image: https://api.daily.dev/og/posts/8Oc1jshpl.png og:image:alt: Building imperative operational tools on a declarative platform og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Building imperative operational tools on a declarative platform **[ITNEXT](https://daily.dev/sources/itnext)** · 15 min read · 0 upvotes · 1 comments ## Summary Brian Grant explores building imperative operational CLI tools on top of a declarative Kubernetes-based platform (ConfigHub), arguing this approach is more ergonomic and safer than configuration-as-code. He demonstrates a `cub-eks` tool that manages EKS clusters using Crossplane managed resources instead of CloudFormation or Terraform. The tool supports cluster creation, scaling, upgrades with prerequisite checks, guardrails via CEL-based triggers, findings/security analysis, fleet-wide inspection, and dry-run-by-default mutations. Key advantages over Crossplane compositions include avoiding exclusive actuation, enabling read-modify-write workflows, and providing domain-specific validation and impact analysis before deployment. The post argues AI can build deterministic, testable domain-specific tools against stable APIs rather than editing bespoke template layers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why does cub-eks manage Crossplane managed resources directly instead of using Crossplane compositions? Crossplane compositions enforce exclusive actuation, meaning all changes must go through composition inputs or functions, which blocks composable, read-modify-write tools from directly editing generated resources. Any out-of-band change to those resources is treated as configuration drift, and layering generators like Helm or Backstage templates on top makes managed resources even harder to change operationally, so cub-eks operates on managed resources directly instead. _Teams weighing Crossplane compositions versus direct managed-resource control can compare trade-offs discussed on daily.dev._ ### What does eksctl generate under the hood when creating an EKS cluster? Eksctl generates CloudFormation to create EKS clusters, giving a simpler developer experience than writing raw CloudFormation, Terraform, or OpenTofu configuration directly, for example via a single command like eksctl create cluster. A comparable tool, cub-eks, instead creates, updates, reads, and validates Crossplane managed resources in ConfigHub rather than generating CloudFormation. _Developers choosing between CloudFormation-based and Crossplane-based EKS tooling can track these comparisons on daily.dev._ ### Why would an EKS control plane upgrade get blocked when trying to move nodegroups to a newer Kubernetes version? EKS only allows nodegroups to advance one minor version at a time, so if nodegroups are already behind the current control plane version, moving the control plane further would strand them beyond what EKS supports. In one documented case, three nodegroups running 1.34 had to be upgraded to 1.35 first before the control plane could move from 1.35 to 1.36, since EKS also permits only one cluster update at a time. _Engineers planning EKS version upgrades can keep track of sequencing constraints like this via daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@trevorsuna** · 0 upvotes > The dry-run-by-default part is especially valuable. Declarative state is great for reconciliation, but operators still need safe, intent-shaped actions like “upgrade this fleet after checking prerequisites.” A deterministic CLI over stable APIs feels easier to test and audit than having an agent rewrite templates directly. ## Similar posts on daily.dev - [Crossplane and AI: The case for API-first infrastructure](https://daily.dev/posts/crossplane-and-ai-the-case-for-api-first-infrastructure-8au3afsc9) · CNCF · 6 upvotes · 0 comments - [Building tools to manage cross-cutting concerns in Kubernetes](https://daily.dev/posts/building-tools-to-manage-cross-cutting-concerns-in-kubernetes-ksy5gqspn) · ITNEXT · 1 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#kubernetes](https://daily.dev/tags/kubernetes), [#platform-engineering](https://daily.dev/tags/platform-engineering), [#crossplane](https://daily.dev/tags/crossplane) [View this post on daily.dev](https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Building imperative operational tools on a declarative platform","url":"https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl"},"datePublished":"2026-08-08T14:18:01.060Z","dateModified":"2026-09-14T06:53:23.303Z","description":"Brian Grant explores building imperative operational CLI tools on top of a declarative Kubernetes-based platform (ConfigHub), arguing this approach is more...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e6a049da7731807adb6e8234e12a57b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e6a049da7731807adb6e8234e12a57b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ITNEXT","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ITNEXT","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/itnext2","url":"https://daily.dev/sources/itnext"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"aws,kubernetes,platform-engineering,crossplane","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ITNEXT","item":"https://daily.dev/sources/itnext"},{"@type":"ListItem","position":3,"name":"Building imperative operational tools on a declarative platform"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl","comment":[{"@type":"Comment","text":"The dry-run-by-default part is especially valuable. Declarative state is great for reconciliation, but operators still need safe, intent-shaped actions like “upgrade this fleet after checking prerequisites.” A deterministic CLI over stable APIs feels easier to test and audit than having an agent rewrite templates directly.","datePublished":"2026-08-09T04:23:07.931Z","url":"https://daily.dev/posts/8Oc1jshpl#c-DnQuavjEb","author":{"@type":"Person","name":"Trevor Suna","url":"https://daily.dev/trevorsuna","image":"https://media.daily.dev/image/upload/s--dZ7gXxpp--/f_auto/v1784081551/avatars/avatar_EMoP47rpuw8DNjhp6R1b6?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/building-imperative-operational-tools-on-a-declarative-platform-8oc1jshpl#faq","mainEntity":[{"@type":"Question","name":"Why does cub-eks manage Crossplane managed resources directly instead of using Crossplane compositions?","acceptedAnswer":{"@type":"Answer","text":"Crossplane compositions enforce exclusive actuation, meaning all changes must go through composition inputs or functions, which blocks composable, read-modify-write tools from directly editing generated resources. Any out-of-band change to those resources is treated as configuration drift, and layering generators like Helm or Backstage templates on top makes managed resources even harder to change operationally, so cub-eks operates on managed resources directly instead. Teams weighing Crossplane compositions versus direct managed-resource control can compare trade-offs discussed on daily.dev."}},{"@type":"Question","name":"What does eksctl generate under the hood when creating an EKS cluster?","acceptedAnswer":{"@type":"Answer","text":"Eksctl generates CloudFormation to create EKS clusters, giving a simpler developer experience than writing raw CloudFormation, Terraform, or OpenTofu configuration directly, for example via a single command like eksctl create cluster. A comparable tool, cub-eks, instead creates, updates, reads, and validates Crossplane managed resources in ConfigHub rather than generating CloudFormation. Developers choosing between CloudFormation-based and Crossplane-based EKS tooling can track these comparisons on daily.dev."}},{"@type":"Question","name":"Why would an EKS control plane upgrade get blocked when trying to move nodegroups to a newer Kubernetes version?","acceptedAnswer":{"@type":"Answer","text":"EKS only allows nodegroups to advance one minor version at a time, so if nodegroups are already behind the current control plane version, moving the control plane further would strand them beyond what EKS supports. In one documented case, three nodegroups running 1.34 had to be upgraded to 1.35 first before the control plane could move from 1.35 to 1.36, since EKS also permits only one cluster update at a time. Engineers planning EKS version upgrades can keep track of sequencing constraints like this via daily.dev."}}]} ```