Custom Resources and the Operator Pattern

Configuration and Security / Guide 31 of 44 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 17 min

A CRD is cluster-scoped even when the resources it defines are namespaced, so creating one changes the whole cluster's API surface. The one created here has a deliberately unique group (ckad.certgrid.test) and is deleted at the end. Deleting a CRD deletes every object of that kind, everywhere, without further warning.

This guide includes

Use this when a task involves a resource that is not part of Kubernetes. This matters because a CRD gives you a real object with validation and kubectl support - and no behaviour whatsoever until an operator is watching it.

• listing what already extends this cluster before writing anything of your own
• defining a new kind with a CRD, including its printer columns
• using it exactly as you would a native object, and watching the schema reject an invalid one
• confirming that nothing happens, because a definition is not a controller
• seeing a real operator - Argo Rollouts - acting on a CRD of its own

Before you start

• A cluster where you can create a CustomResourceDefinition, which is a cluster-scoped object.
• The Argo Rollouts controller for the last step. The session reads it rather than installing it.

1. 1

   What already extends this cluster

2. 2

   A CRD of your own

3. 3

   It behaves like a native object

4. 4

   The schema is enforced

5. 5

   And nothing happens

6. 6

   An operator is the half that acts

Official sources

• Custom Resources
• Extend the Kubernetes API with CustomResourceDefinitions
• Operator pattern