learninfra · Linux · Networking · Kubernetes · System Design · AI Infrastructure · Exam blueprints · Drills

CRDs, Operators & API Versions (CKAD)

Teach the API a new noun, let an operator act on it, and keep your manifests alive when old API versions are removed.

An interactive Kubernetes lesson: 22 steps, about 30 minutes, on a live simulation in your browser.

Your shop's backend, api, wants to store orders in Postgres. It is already dialling orders-db:5432, and every attempt fails, because nothing by that name exists yet.

You could build it from parts you know: a StatefulSet, a Service, a Secret for the password, a CronJob for backups. Then someone has to handle failover, upgrades and restores, for every database every team asks for.

What you will learn

  1. The API is a list of nouns

    • The shop needs a database: The Kubernetes API is a table of nouns (kinds). kubectl can only create, get and delete nouns that are in the table.
    • Ask for a Database anyway: Every object is addressed by group, version and kind. If the server has no entry for that exact triple, you get: no matches for kind X in version Y.

  2. Teaching it a new noun

    • A CRD adds a row to the table: A CRD is one row added to the API's table of nouns: group, version, names, scope, schema. No code runs, no API server restarts.
    • Create a custom resource
    • The Database exists. What is running?: A CRD without a controller is a filing cabinet. The API stores your object faithfully and nothing in the cluster reads it.
    • The schema guards the door

  3. A noun needs a controller

    • Install the operator: An operator is a CRD plus a controller. The controller is a normal pod that talks to the API server with a ServiceAccount, like any other client.
    • The operator reconciles: An operator runs one loop forever: read the custom resource, compare it with the real objects, create or change whatever differs.
    • Edit the custom resource: You edit the custom resource. The operator edits everything underneath. Hand-edit an object the operator owns and it will be put back.
    • Break it: the operator crashes
    • The operator comes back: While a controller is down, existing workloads keep running and new requests wait in etcd. Nothing is lost; nothing new happens.

  4. Finding what is installed

    • Discover what a cluster can do: api-resources tells you the noun and its apiVersion. explain tells you its fields. Together they are the manual for any cluster.
    • Drill: list a group's resources
    • Break it: delete the CRD: The CRD owns its objects. Delete the definition and every custom resource of that kind is deleted with it.
    • Put it back

  5. API versions expire

    • A manifest from 2021: A kind is served under specific versions. When a version is removed, a manifest that names it fails exactly like a kind that never existed.
    • Deprecated first, removed later: Deprecated means it works and warns. Removed means the server no longer answers for that version. Stored objects survive; stale manifests do not.
    • Ask the cluster what it serves: The server is the source of truth for API versions. kubectl api-versions lists what it serves; anything not on that list cannot be applied.
    • Fix the manifest
    • Drill: convert a manifest

  6. Recap & playground

    • Cheat sheet
    • Playground