sig-security VS kubebuilder

Our journey began seven years ago when we launched CodeFresh to enhance software delivery in the cloud-native ecosystem, primarily focusing on Kubernetes. Alongside my responsibilities at CodeFresh, I actively contribute to SIG security within the Kubernetes community and oversee community-driven events like ArgoCon. Outside of work, I reside in Salt Lake City, where I indulge in my passion for snowboarding. Oh, and I'm a proud father of four, eagerly awaiting the arrival of our fifth child.

If you want to suggest extending the core k8s with this object, I think the place for this work would be in the K8s Security SIG (https://github.com/kubernetes/sig-security).

The whitepaper itself is available here as a PDF and starts with:

And it is only because of the focus on extensibility and interoperability that today, we can run WebAssembly workloads in Kubernetes so seamlessly. SpinKube is an open source stack of projects for running WebAssembly applications. A core piece of the stack is a containerd shim. I remember when containerd was donated to the CNCF in 2017. That took work and collaboration from several companies, most notably Docker, to make happen. SpinKube also depends on CRDs and operators. I recall seeing one the early demos of scaffolding an operator and a CRD in a SIG meeting from Phillip Wittrock, who went on to work on Kubebuilder in a Kubernetes SIG. Kubebuilder is a key piece of SpinKube’s Spin operator development. As I reflect on the last decade, I appreciate every contribution even more deeply.

Kubebuilder, a framework by Kubernetes SIGs, simplifies creating Kubernetes APIs using Custom Resource Definitions.

The Spin operator uses the Kubebuilder framework and contains a Spin App Custom Resource Definition (CRD) and controller. It watches Spin App Custom Resources and realizes the desired state in the K8s cluster. Aside from the immediate benefits gained by running Wasm workloads in k8s, additional optimizations such as Horizontal Pod Scaling (HPA) and k8s Event-driven Autoscaling (KEDA) can be achieved in a pinch.

kubebuilder: brew install kubebuilder

The operator that I've been working on is designed to manage the full lifecycle of a QuestDB database instance, including version and hardware upgrades, config changes, backups, and (eventually) recovery from node failure. I used the Operator SDK and kubebuilder frameworks to provide scaffolding and API support.

Recently, I've been spending a lot of time writing a Kubernetes operator using the go operator-sdk, which is built on top of the Kubebuilder framework. This is a list of a few tips and tricks that I've compiled over the past few months working with these frameworks.

Since we built our operator using the Kubebuilder framework, most standard monitoring tasks were handled for us out-of-the-box. Our operator automatically exposes a rich set of Prometheus metrics that measure reconciliation performance, the number of k8s API calls, workqueue statistics, and memory-related metrics. We we were able to ingest these metrics into pre-built dashboards by leveraging the grafana/v1-alpha plugin, which scaffolds two Grafana dashboards to monitor Operator resource usage and performance. All we had to do was add these to our existing Grafana manifests and we were good to go!

I wrote a CSI driver and some operators. I admire K8s, because you can find solution to almost any problem in the source code - API versioning, load balancing, request throttling, optimistic concurrency, security, and much much more. I recommend https://book.kubebuilder.io/ It is similar to Operator SDK, but without Openshift-specific stuff. It gradually introduces you to many k8s concepts, and follows design patterns that k8s uses internally.