Kubernetes Extensibility

This repo contains the source code that showcases how we can use Kubernetes extensibility constructs like CRDs, Operators and Admission Controller to build an API backend for an application.

Project structure

The project consists of 3 main parts:

CRDs

The Custom Resource Definitions represent the domain objects in the API.

Can be found here.

The CRDs are initially generated via kubebuilder. Any later changes to the CRDs are made by first editing the go files at api/v1 and running make manifests.

Operator

The operator code is in this folder. Most of the code is generated by kubebuilder. The only code that is written after the generation is the implementation of the Reconcile methods in ConferenceTalkReconciler and SpeakerReconciler.

Admission Controller

The admission controller code is in the admission folder.

For more info, see the README.md at that folder.

How to run locally

1. Get a Kubernetes cluster and "point" your kubeconfig at that cluster

2. Create the CRDs

kubectl apply -f config/crd/bases

3. Run the operator

kubectl apply -f k8s/spec.yaml

4. Run the admission controller

kubectl apply -f admission/k8s/secret.yaml
kubectl apply -f admission/k8s/auth.yaml
kubectl apply -f admission/k8s/admissionreview.yaml
kubectl apply -f admission/k8s/deployment.yaml
kubectl apply -f admission/k8s/service.yaml

5. Now you start creating resources

This will successfully create 2 conference talks and 2 speakers:

$ kubectl apply -f config/samples/conference_talks_with_speakers.yaml
speaker.istacon.org/anton-sankov created
conferencetalk.istacon.org/kubernetes-extensibility created
speaker.istacon.org/uncle-bob created
conferencetalk.istacon.org/demanding-technical-excellence-and-professionalism created

You can verify that by getting them:

$ kubectl get speakers.istacon.org
NAME           AGE
anton-sankov   27s
uncle-bob      27s
$ kubectl get conferencetalks.istacon.org
NAME                                                 AGE
demanding-technical-excellence-and-professionalism   39s
kubernetes-extensibility                             40s

This apply will fail, because the speaker referenced in this conference talk does not exist. This proves that our validation works:

$ kubectl apply -f config/samples/conference_talk_no_speaker.yaml
Error from server: error when creating "config/samples/conference_talk_no_speaker.yaml": admission webhook "conference-talk-validation.istacon.org" denied the request: Speaker with ID [does-not-exist] does not exist.