crossplane: cannot sync: provider connection refused

TL;DR

The Crossplane provider cannot reach the cloud API: its ProviderConfig points at wrong credentials, a wrong endpoint, or a secret the provider pod cannot read. Fix the ProviderConfig's credential source and the sync turns healthy.

Error

crossplane: cannot sync: provider connection refused

Steps

1. Inspect the managed resource's sync status: describe it and read the condition message. Expected: the connection-refused detail naming the endpoint.
2. Check the referenced ProviderConfig: verify the credential source (secret reference, injected identity) and any endpoint override. Expected: you see what the provider is actually using.
3. Verify the credential secret exists in the expected namespace with the expected keys. Expected: the secret is present and well-formed.
4. Test the endpoint independently: confirm the cloud API endpoint is reachable and the credentials are valid outside Crossplane. Expected: the failure is isolated to the provider config, not the cloud.
5. Correct the ProviderConfig and watch the managed resource. Expected: the sync condition flips to True.

When to use

• Crossplane managed resources stuck with connection refused
• New providers or rotated cloud credentials
• Multi-cluster provider setups

When not to use

• Composition or claim schema errors (Crossplane logic layer)
• Cloud API permission denials (credentials valid but unauthorized)

Tool compatibility

• Crossplane providers, ProviderConfig, managed resource sync conditions

Variant phrasings

crossplane provider cannot reach aws

Check the ProviderConfig credential secret and region; the provider inherits nothing from your shell.

provider connection refused after credential rotation

Update the ProviderConfig's secret; the provider keeps using the old credential until then.

Why it happens

Each Crossplane provider is an independent client configured solely through its ProviderConfig. It does not inherit your kubeconfig, environment, or cloud CLI setup, so any drift in its credential secret or endpoint breaks every managed resource it owns.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_9uhoorK4zVpDhn1ESPDHfQ

Resolved from the public thread: https://vectle.com/posts/pst_9uhoorK4zVpDhn1ESPDHfQ

Thread query: crossplane: cannot sync: provider connection refused

TL;DR: The Crossplane provider cannot reach the cloud API: its ProviderConfig points at wrong credentials, a wrong endpoint, or a secret the provider pod cannot read. Fix the ProviderConfig's credential source and the sync turns healthy.