Snowplane

Kubernetes-native control plane for Snowflake.

Manage Snowflake resources declaratively as Kubernetes custom resources — similar in spirit to AWS ACK and Crossplane. Define your Snowflake infrastructure as CRDs and let the operator reconcile them.

Get Started View on GitHub

---

Custom Resources

Full lifecycle management for every resource — create, alter, drop, drift detection, adoption, and deletion policies.

Category	Resources
Core Infrastructure	Database, Schema, Warehouse
Data Objects	Table, View, MaterializedView, InternalStage, ExternalStage, StreamOnTable, StreamOnView, StreamOnExternalTable, StreamOnDirectoryTable, StreamOnDynamicTable, DynamicTable, FileFormat, Pipe, Sequence, ExternalTable
Identity & Access	User, AccountRole, DatabaseRole, GrantPrivilegesToAccountRole, GrantPrivilegesToDatabaseRole, AccountRoleAssignment, DatabaseRoleAssignment, GrantPrivilegesToShare, GrantOwnership
Data Sharing	Share
Orchestration	Task, Alert
Programmability	FunctionJava, FunctionJavascript, FunctionPython, FunctionScala, FunctionSQL, ProcedureJava, ProcedureJavascript, ProcedurePython, ProcedureScala, ProcedureSQL, ExternalFunction
Integrations	StorageIntegrationAWS, StorageIntegrationGCS, StorageIntegrationAzure, ExternalOAuthIntegration, SAML2Integration, SCIMIntegration, EmailNotificationIntegration, QueueNotificationIntegration, WebhookNotificationIntegration, APIIntegration
API Authentication	APIAuthenticationIntegration, APIAuthenticationIntegrationWithAuthorizationCodeGrant, APIAuthenticationIntegrationWithClientCredentials, APIAuthenticationIntegrationWithJWTBearer
Security & Governance	AuthenticationPolicy, NetworkPolicy, NetworkRule, PasswordPolicy, MaskingPolicy, RowAccessPolicy, Tag, ResourceMonitor
Snowpark Container Services	ComputePool, Service, ImageRepository
Utilities	FieldExport

---

Key Capabilities

Observe-Diff-Apply Reconciliation

Only altered fields are pushed to Snowflake — minimizing API calls and avoiding unnecessary mutations.

Drift Detection & Correction

Field-level drift detection with structured reporting. Use detect-only policy for monitoring without correction.

Cross-Resource References

Schemas reference Databases; Tables, Views, MaterializedViews, and Stages (InternalStage, ExternalStage) reference Schemas. Dependency resolution and backoff are automatic. See the Resource Dependencies guide for full details.

Resource Adoption

Adopt pre-existing Snowflake objects via spec.managementPolicies.adoptionPolicy: adopt — no data migration needed. Spec fields are automatically late-initialized from observed Snowflake state.

Immutable Field Enforcement

Two layers of protection — CRD-level CEL validation and reconciler-level error reporting.

Three Authentication Methods

RSA key pair, username/password, or Workload Identity Federation (EKS, GKE, AKS).

---

Quick Start

Install CRDs and run the operator

git clone https://github.com/hupe1980/snowplane.git && cd snowplane
kubectl apply -f config/crd/bases/
just build && ./bin/manager

Configure a ProviderConfig

apiVersion: snowplane.hupe1980.github.io/v1alpha1
kind: ProviderConfig
metadata:
  name: default
spec:
  account: "your-account"
  user: "your-user"
  role: "SYSADMIN"
  authenticationType: KeyPair
  credentials:
    secretRef:
      name: snowflake-credentials
      key: privateKey

Create a Database

apiVersion: snowplane.hupe1980.github.io/v1alpha1
kind: Database
metadata:
  name: analytics
spec:
  name: ANALYTICS
  comment: "Managed by Snowplane"
  providerRef:
    name: default

kubectl apply -f database.yaml
kubectl get databases

For production deployments, use the Helm chart instead of running the binary directly.

---

Architecture

┌──────────────────────────────────────────────────┐
│                Kubernetes Cluster                 │
│                                                   │
│  ┌────────────────┐   ┌────────────────────────┐  │
│  │ ProviderConfig │   │   Snowflake Resource   │  │
│  │      CR        │   │    Custom Resources    │  │
│  └──────┬─────────┘   └────────┬───────────────┘  │
│         │                      │                   │
│  ┌──────▼──────────────────────▼──────────────────┐│
│  │          Snowplane Controller Manager          ││
│  │                                                ││
│  │  ┌─────────────────────────────────────────┐   ││
│  │  │  Reference Resolver                     │   ││
│  │  │  databaseRef/schemaRef → Snowflake FQN  │   ││
│  │  └─────────────────────────────────────────┘   ││
│  │                                                ││
│  │  ┌─────────────────────────────────────────┐   ││
│  │  │  Resource Controllers                   │   ││
│  │  │  Observe → Diff → Apply                 │   ││
│  │  └─────────────────────────────────────────┘   ││
│  │                                                ││
│  │  ┌──────────────────┐ ┌────────────────────┐   ││
│  │  │  FieldExport     │ │  Drift Engine      │   ││
│  │  └──────────────────┘ └────────────────────┘   ││
│  └────────────────────┬───────────────────────────┘│
│                       │                            │
└───────────────────────┼────────────────────────────┘
                        │
               ┌────────▼────────┐
               │    Snowflake    │
               │     Account    │
               └─────────────────┘

---

Observability

Built-in Prometheus metrics, structured logging, Kubernetes events, and a Grafana dashboard.

Metric	Type	Description
snowplane_reconcile_duration_seconds	Histogram	End-to-end reconciliation latency
snowplane_snowflake_operation_duration_seconds	Histogram	Individual Snowflake SQL operation latency
snowplane_reconcile_total	Counter	Total reconciliations (success/error)
snowplane_snowflake_operation_total	Counter	Total Snowflake operations
snowplane_drift_detected_total	Counter	Drift detection events
snowplane_account_rate_limit_waits_total	Counter	Per-account aggregate rate limiter waits
snowplane_providerconfig_healthy	Gauge	Provider health (1 = healthy)

Full metrics reference → | API Reference →

---

License

Snowplane is licensed under the Apache License 2.0.