How do you implement usage-based cost tracking and resource quotas with Crossplane?

Implementing usage-based cost tracking and resource quotas with Crossplane requires a combination of cloud-native billing integration, Kubernetes-native policy enforcement, and Crossplane's own resource management features. In an enterprise where teams like payments-api, order-processing-service, checkout-service, user-auth-service, and inventory-sync provision infrastructure through Claims, the platform team needs visibility into which team is spending how much and the ability to set guardrails that prevent runaway costs.

Cost tracking starts with consistent tagging. Every managed resource provisioned through Crossplane must carry tags that identify the owning team, project, environment, and cost center. Compositions are the enforcement point: the platform team adds patches that automatically propagate labels from the Claim to tags on every managed resource in the Composition. When the payments-api team creates a database Claim in the payments namespace, the Composition patches the namespace, Claim name, and team label into AWS resource tags. These tags flow through to AWS Cost Explorer, GCP Billing, or Azure Cost Management, enabling per-team cost allocation without relying on developers to remember to add tags.

For real-time cost visibility, integrate cloud billing APIs with a cost management platform like Kubecost, Vantage, or Infracost. These tools can correlate Crossplane-managed resources (identified by their tags) with actual cloud spending. The platform team builds dashboards showing cost trends per team, per environment, and per resource type. Alerts fire when a team's monthly spending exceeds a threshold. For pre-provisioning cost estimation, Infracost can analyze Crossplane Compositions and estimate the monthly cost of each Claim type. The checkout-service team sees that a 'large' database Claim costs approximately $2,400 per month before they submit it, enabling informed decisions about resource sizing.

Resource quotas in Crossplane operate at multiple levels. The first level is Composition-level constraints: t-shirt size mappings (small, medium, large) in Compositions prevent teams from requesting arbitrary instance types. The Composition's transform map converts 'large' to db.r6g.2xlarge, and there is no way for the checkout-service team to request a db.r6g.16xlarge because the Composition does not include that mapping. The second level is namespace-level quotas enforced through OPA Gatekeeper or Kyverno policies. A policy can count the number of existing PostgreSQLInstance Claims in a namespace and reject new Claims if the count exceeds the quota. This prevents the inventory-sync team from creating 50 database instances when their allocation is 5.

Crossplane's Usage resource provides dependency-based protection rather than quotas, but it can be combined with quotas for comprehensive resource governance. A Usage resource declares that a managed resource is in use by another resource, preventing accidental deletion. For cost governance, Usage resources ensure that expensive shared infrastructure like a Transit Gateway or a dedicated VPN connection cannot be deleted while dependent resources from the payments-api or order-processing-service teams still reference it.

Advanced cost governance integrates with the organization's FinOps workflow. The platform team publishes a service catalog with cost estimates for each Claim type and size combination. Budget owners approve Claims that exceed a threshold amount through a custom approval webhook. Monthly cost reports are generated by querying both the cloud billing APIs and the Crossplane control plane to correlate spending with specific Claims and the teams that created them. Chargeback or showback models assign costs to business units based on the tags propagated through Compositions, creating accountability for infrastructure spending across the checkout-service, payments-api, user-auth-service, and inventory-sync teams.