I am trying to find a way? If I create a new namespace then I want it to create a RBAC rule for that serviceaccount automatically.
I know one way is to create an operator so, that there is an event that is traced by reconciler / api server and it creates the resources based on CRD's. Is there any other way?
While not really intended for this kind of thing you could use admission controllers (https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) to achieve something like that.
Due to it's nature the admission controller is called before the namespace exists and you would need to wait until its creation is finished to create objects within that namespace. For that the admission controller call needs to be completed, else the namespace can't be created. I.e. by calling a second service that waits until the namespace is actually created.
I asked a similar question here: Automatically create Kubernetes resources after namespace creation (I didn’t find yours at that time).
I ended up writing a controller that does exactly what you need: https://github.com/blakelead/nsinjector
In short, you deploy a custom resource specifying resources to deploy and patterns for namespace names you want to target.
Related
I have my application deployed on Kubernetes cluster, managed by operator (A). I am mounting secrets with ssl key materials to the deployment, so application could access to the content.
I have separate operator (B) deployment, which is responsible to create those secrets with the ssl key materials. Now I have a use case where my secrets are recreated by operator (B), and it deletes/restarts the pods, which managed by operator (A).
I am trying understand - is it common practice to allow separately deployed operator delete pods?
My perception was that operator should work only with resources it manages, nothing more.
Community wiki to summarise the topic.
If it is as you say:
both operators are proprietary,
it is impossible to give a definite yes or no answer. Everything will depend on what is really going on there, and we are not able to check and evaluate it.
Look at the well provided comments by David Maze:
That sort of seems like a bug...but also, Pods are pretty disposable and the usual expectation is that a ReplicaSet or another controller will recreate them...?
Note that the essence of the Kubernetes controller model is that the controller looks at the current state of the Kubernetes configuration store (not changes or events, just which objects exist and which don't) and tries to make the things it manages match that, so if the controller believes it should manage some external resource and there's not a matching Kubernetes object, it could delete it.
I'm currently writing a custom admission webhook to accept/deny at the creation of a CRD that I defined.
My main purpose is to ensure the creation of this resource won't go beyond a certain quota but with some custom logic around it.
I can do this easily with an atomic counter on the custom webhook.
The thing is I'm not sure what happens with that custom admission if another webhook would fail just after (making my "customRessourceQuota" out of sync as it will be incremented by 1 but no resource has booted).
So my question is how do K8s chains its admission webhooks?
Does custom ones are the ending ones?
Can we adjust the order ourselves?
Should I use another mechanism of K8s to make my own quota?
PS: I've looked into the ResourceQuota calculator code but didn't find a good answer to this neither
Mutating webhooks all run in a functionally random order, then validating webhooks all run concurrently after that.
I have created a custom resource definition (CRD) and a custom resource (CR) in my Kubernetes cluster, but in my CR controller, how do I create Kubernetes events which are attached to my custom resource? I hope with events, users will be able to see important messages associated with the CR when they run kubectl describe <cr>.
You're looking for an operator. There are already a few pre-written ones out there, check OperatorHub. They are essentially controllers for custom resources, watching for events and acting on them.
You can also write your own, e.g. with the Operator SDK. When you write your own, you can update the status of the CR, depending on what your operator should do, which then shows up when calling kubectl describe.
A good start might be this post on Operators, and this here for listening to events from your custom resources.
Description
I have a CR associated with a POD with a container that is exposing an API, eg:
/available
returning for example
{"available":"true"}
Is there a way to create a controller watcher on that API call that whenever the response changes will trigger the reconcile function?
I believe it could be possible using a channel with the controller watcher, but I don't see any similar examples out there
Using
Kubernetes operator-sdk version v0.5.0+git
I'm afraid it's not as easy as you hope. The Kubernetes controller objects react to add/edit/delete operations of some kind of resource in the cluster. A value exposed inside an API of something running inside the Pod is not visible in the resource database. There is not event going off, notifying about the change either.
I see two things you can consider doing:
Create a regular controller that would have the reconcile function triggered fairly often, but would check the availability value inside it's reconcile function. If it changed, it would do something, if it didn't it would do nothing.
Just create a separate task, outside the controller domain, that would monitor this API value and do something.
Controllers work using notifications, they don't actively watch for changes, they are notified about them. That's different than what you want to do - periodically check the API response.
I am trying to create a custom kubernetes controller which keeps the track of the number kubernetes resources, for example count the number services created in a cluster.
there are 2 parts to the above question:
1st I need to create a controller which listens to when a service is created, lets call this counter as svc_count. This is easy, as I can write a custom controller to listen on services.
I need to store the svc_count in the etcd, so that I can show the value
when some user queries for the svc_count. So I thought of using the CRD's. I can do that by following the example in https://github.com/yaronha/kube-crd. This has the Rest-API-client to POST,PUT,GET.
The 3rd part is relating the part 1 and part 2. Whenever a Service is created, then in the ADD eventhandler of the controller I need make changes to the CRD, so that the user can see the update.
Issue/Question: My question how to update a CRD from the custom controller's eventhandler??. Can I save the CRD rest-api-client in the custom controller and call the respective Update function.
Please, let me know if there is any other way of doing this.
Thanks