Kubernetes controllers

3 min read | by Jordi Prats

In Kubernetes, controllers are continuously watching the state of your cluster. If needed it will make or request changes where needed, trying to move the current cluster state closer to the desired state.

Secrets

• ExternalSecret: Unpack JSON-encoded secret: Using ExternalSecret we can unpack a JSON-encoded secret into a Kubernetes Secret
• Using versioned secrets from the AWS Secrets Manager with ExternalSecrets: External Secrets operator can retrieve specific versions of a secrets
• External Secrets with template: Using ExternalSecrets we can use a template to format the Secret that it is going to create
• External Secrets Operator with Vault: Vault can be configure as a datasource for the External Secrets Operator
• External Secrets Operator: Updating an external secret: Update an external secret using the External Secrets Operator
• Install External Secrets Operator: Install External Secrets Operator
• Kubernetes External Secrets: Using KES we can use secrets stores on AWS Secrets Manager or the Systems Manager
• AWS Secrets and Configuration Provider: Using ASCP we can access a secret on AWS Secrets Manager as a file

SSL

• Reuest SSL certficates with cert-manager: We can use cert-manager to request SSL certificates for Kubernetes Ingress objects

Backups

• Velero operations: We can use Kubernetes objects to backup, schedule, restore and delete velero backups
• Kubernetes RBAC: ResourceNames: Velero can be used to backup kubernetes workloads into an S3 bucket and use snapshots for PersistentVolumes

Policy enforcement

• OPA gatekeeper: restrict scope globally: Restrict gatekeeper to namespaces with a specific label
• OPA gatekeeper: rule excluding namespaces: Restrict the scope of a gatekeeper rule to exclude some namespaces
• OPA gatekeeper: write custom rule: We'll need to write rego code to write custom rules for OPA gatekeeper
• Kubernetes OPA gatekeeper: Using OPA gatekeeper on a Kubernetes cluster we can enforce compliance

Rule creation

• OPA gatekeeper: warning only rule: gatekeeper can be used to issue warnings to the user

External metrics provider

• HPA: autoscaling version 2: Using the new autoscaling/v2 API, external metrics becomes a first-class citizen
• HorizontalPodAutoscaler using Prometheus as it's data source: Using the prometheus-adapter we can use prometheus metrics to scale deployments on a Kubernetes cluster
• Datadog external metrics: We can use metrics from datadog to autoscale

DNS

• CoreDNS on Kubernetes: Allow zone transfer: On Kubernetes we can use dig to start a zone transfer as long as we have CoreDNS configured to allow it
• Kubernetes: external-DNS: We can use external-DNS on EKS to add DNS records on Route53

Lifecycle

• Expire Pods based on a label or an annotation: Using the bestby controller we can configure how often a Pod needs to be replaced

Autoscaling

• Vertical Pod Autoscaler: Using the Vertical Pod Autoscaler we can calculate recommendations for Pods and containers
• Node autoscaling with AWS Karpenter: AWS Karpenter is a Cluster Autoscaler alternative

Spot instances

• Termination handler for spot instances: Using the AWS node termination handler we canb drain nodes when we receive a termination notice for a spot instance

Object mutation

• kubernetes: Mutate objects: Using KubeMod we can modify objects as they are pushed into a Kubernetes cluster to, for example, inject a sidecar

SecurityGroups for Pods

• AWS EKS: SecurityGroups for Pods - installation: What needs to be done on the cluster side to configure SecurityGroups for Pods