Docker & Kubernetes
Example operator
Learn a simple operator scenario.
An example operator
The complete flow of the backup operator: the user writes a Yedek; the operator produces a CronJob from it (with an owner reference); it writes the CronJob's last successful run into the status; when the Yedek is deleted, the CronJob goes too through the garbage collector. The operator itself runs as a Deployment with its own ServiceAccount and RBAC permissions:
make docker-build docker-push IMG=ghcr.io/ali/yedek-operator:0.1.0
make deploy IMG=ghcr.io/ali/yedek-operator:0.1.0
kubectl get deploy -n yedek-operator-system
kubectl logs -n yedek-operator-system deploy/yedek-operator-controller-manager -f
RBAC markers
The markers in the controller file produce the operator's ClusterRole; the principle of least privilege applies here too:
// +kubebuilder:rbac:groups=yedek.ornek.com,resources=yedekler,verbs=get;list;watch;update;patch
// +kubebuilder:rbac:groups=yedek.ornek.com,resources=yedekler/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch;create;update;patch;delete
make manifests writes these into config/rbac/role.yaml.
Exercise Release the operator
Write four commands: make docker-build docker-push with IMG=ghcr.io/ali/yedek-operator:0.1.0; make deploy with the same IMG; list the deployments in the yedek-operator-system namespace; follow the logs of deploy/yedek-operator-controller-manager in that namespace live.
Show example solution
make docker-build docker-push IMG=ghcr.io/ali/yedek-operator:0.1.0
make deploy IMG=ghcr.io/ali/yedek-operator:0.1.0
kubectl get deploy -n yedek-operator-system
kubectl logs -n yedek-operator-system deploy/yedek-operator-controller-manager -f
Test yourself
-
What does the operator need to be able to create CronJobs?
- RBAC granting its ServiceAccount create/update on cronjobs in the batch group
- Always cluster-admin
- No permissions
- Node access
Show answer
RBAC granting its ServiceAccount create/update on cronjobs in the batch group — In Kubebuilder, // +kubebuilder:rbac markers produce these permissions.
-
Deploy the operator to the cluster.
make ____ IMG=ghcr.io/ali/yedek-operator:0.1.0
Show answer
make deploy IMG=ghcr.io/ali/yedek-operator:0.1.0
-
Match.
- make docker-build
- Operator image
- make deploy
- Install in the cluster
- +kubebuilder:rbac
- Permission markers
- controller-manager
- Operator pod
Next lesson: Summary - Operator
