MetalLB is a Kubernetes-native load balancer for bare-metal clusters. Two cooperating workloads implement the system: a cluster-scoped controller that allocates IP addresses from CRD-defined IPAddressPools and writes Service status updates, and a DaemonSet of speaker pods on each node that announce assigned IPs to the physical network. Announcement is either BGP (via a from-scratch native Go BGP stack, a deprecated FRR sidecar mode, or the newer FRR-K8s API that generates FRRConfiguration CRs) or Layer2 (ARP/NDP responders with memberlist-based fast failover detection and deterministic speaker election). All user configuration flows through CRDs — IPAddressPool, BGPPeer, BGPAdvertisement, L2Advertisement, Community, BFDProfile, and ConfigurationState — validated by admission webhooks, with a configmaptocrs tool migrating legacy ConfigMap configuration to the CRD model. The controller/speaker split, a listener abstraction that delivers config changes to protocol handlers, and a common bgp.Session interface across backends give the architecture a clean, modular shape.
The kubernetes/client-go repository is the official Go client library for interacting with Kubernetes clusters. It provides programmatic access to the Kubernetes API through typed clients, dynamic clients, discovery utilities, and controller-runtime tools like shared informers and workqueues. The library supports both imperative and declarative (server-side apply) interaction patterns, enabling applications to list, watch, create, update, and delete Kubernetes resources. Architecturally, the codebase is modular with clear separation of concerns: typed clients for specific API groups/versions, discovery for API exploration, dynamic client for unstructured objects, and tools/cache for controller patterns. Code generation (via client-gen, informer-gen, etc.) ensures API consistency while manual expansion interfaces allow custom extensions. Key utilities include clientcmd for kubeconfig handling, retry mechanisms, workqueues, and credential plugins. Primary data flows involve configuring a REST client (via clientcmd or in-cluster config), creating typed/dynamic clients for API operations, and using informers for efficient resource watching and caching. The library depends on core Kubernetes modules (k8s.io/api, k8s.io/apimachinery) and standard Go dependencies for authentication, logging, and utilities. It is actively maintained with recent commits, low technical drift due to synchronized API updates, and demonstrates strong reusability in patterns like shared informers and exponential backoff retry.
Kubebuilder is a CLI tool and library for scaffolding Kubernetes operator projects. It generates the complete project structure including Go controllers, webhooks, CRDs, RBAC, kustomize configurations, Helm charts, and CI/CD workflows. The tool implements a plugin architecture where built-in and external plugins handle specific scaffolding phases: project initialization, API/resource creation, webhook scaffolding, and configuration editing. The core scaffolding engine (pkg/machinery) uses templates with marker-based code injection and a filesystem abstraction to produce idempotent output. In production, a user runs `kubebuilder init` to bootstrap a project, then `kubebuilder create api` to add a custom resource and controller, and optionally `kubebuilder create webhook` for admission webhooks. The system relies on controller-runtime, controller-tools, kustomize, and the Go toolchain. The primary data flow is user input → CLI command → plugin chain → template rendering → file generation on disk. The PROJECT file (YAML) acts as the persistent configuration, tracked and versioned across scaffolding steps. The codebase demonstrates strong software engineering practices: clean separation of concerns with plugin interfaces, a generic scaffolding engine, comprehensive unit and end-to-end tests, and well-structured internal APIs. It is actively maintained with recent commits and a clear versioning strategy, though some alpha features (helm/v2alpha, alpha update) carry experimental risk.
Fission is a Kubernetes-native serverless framework (FaaS) that deploys and manages functions triggered by HTTP requests, message queues (Kafka, NATS, etc.), cron schedules, and Kubernetes events. The system is composed of multiple microservices: a router that proxies HTTP requests to function pods, an executor that manages warm-pool and per-function deployment backends, a builder that compiles function packages, a fetcher sidecar that materializes code into pods, and a storage service for archive management. All resources (Function, Environment, HTTPTrigger, Workflow, etc.) are defined as Kubernetes Custom Resource Definitions (CRDs) and reconciled by controller-runtime controllers. The architecture supports multi-tenant namespaces, canary deployments via FunctionAlias and CanaryConfig CRDs, a workflow engine with event sourcing, and a pluggable state store (memory, SQLite, Postgres) for durable queues and key-value storage. Internal service-to-service communication is authenticated via HMAC signing. Observability is built on OpenTelemetry (traces, metrics, logs) and Prometheus. The CLI tool (`fission`) provides full lifecycle management and a GitOps-friendly spec system. The codebase is RFC-driven with formal verification (TLA+ specs) for critical subsystems like the workflow event log and queue lease protocol.
Karpenter is a Kubernetes cluster autoscaler that provisions and manages compute capacity (nodes) for pods that cannot be scheduled. It operates as a controller-runtime-based operator, using Custom Resource Definitions (CRDs) like NodePool, NodeClaim, CapacityBuffer, and NodeOverlay to declaratively manage node lifecycle. The system continuously reconciles the desired state (unschedulable pods, disruption budgets, static replicas) with the actual cluster state, creating or deleting NodeClaims via a pluggable CloudProvider interface (with implementations for AWS, Azure, GCP, and a fake/KWOK provider for testing). Key entry points include the operator startup in `pkg/operator/operator.go`, the provisioning loop in `pkg/controllers/provisioning/provisioner.go`, and the disruption controller in `pkg/controllers/disruption/controller.go`. External dependencies are minimal: it requires a Kubernetes cluster with controller-runtime, Prometheus for metrics, and optional DRA (Dynamic Resource Allocation) support via a separate driver. The codebase is production-grade, with extensive unit and integration tests, performance benchmarks, and a well-defined event/metrics system.
Tilt is a local development orchestration tool for Kubernetes and Docker Compose microservice environments. The Go binary evaluates a Starlark-based Tiltfile, watches the filesystem, builds container images, applies changes to a cluster or docker-compose stack, streams logs, and presents state through both a terminal HUD and a React web UI. The architecture is a single CLI/daemon combining a controller-runtime-style apiserver with custom v1alpha1 resource types, a Redux-like central store with actions and reducers, engine subscribers that react to state changes, and reconcilers per resource type. Key entry points are cmd/tilt/main.go, internal/cli/* for command handling, internal/engine/upper.go for the main event loop, and internal/controllers/core/* for reconciliation. External dependencies include Docker daemons/buildx, Kubernetes API servers, docker-compose, git, and optional Tilt Cloud analytics/telemetry endpoints. The codebase is exceptionally large and well-tested, though it carries visible dual-paradigm debt: older store/engine patterns coexist with newer apiserver/controller patterns, and many feature flags are marked obsolete.
PGO (Crunchy Data Postgres Operator) is a production-grade Kubernetes operator that manages the full lifecycle of PostgreSQL clusters, including deployment, high availability via Patroni, backup/restore via pgBackRest, connection pooling via PgBouncer, monitoring via OpenTelemetry and pgMonitor, and a web UI via pgAdmin. The operator uses custom resource definitions (CRDs) for PostgresCluster, PGAdmin, and PGUpgrade, and reconciles desired state using controller-runtime with server-side apply. It manages StatefulSets, PVCs, Services, ConfigMaps, Secrets, Jobs, and RBAC across multiple namespaces. Architecturally, the operator is a single binary with multiple controllers (postgrescluster, standalone_pgadmin, pgupgrade) and sidecar containers for pgBackRest, PgBouncer, pgAdmin, and the OpenTelemetry collector. It uses feature gates to enable optional capabilities like volume snapshots, auto-grow volumes, and OpenTelemetry logging/metrics. The codebase is well-structured with distinct packages for naming conventions, PKI certificate management, PostgreSQL parameter management, and shell command construction. Extensive unit and e2e tests (using kuttl and chainsaw) cover most scenarios, including backup/restore, scaling, upgrades, and security contexts. Key external dependencies include controller-runtime, client-go, Patroni, pgBackRest, PgBouncer, pgAdmin, OpenTelemetry SDK, and pg_query_go for SQL parsing. The operator is deployed via Kustomize and supports multiple PostgreSQL versions (11-18) with PostGIS extensions.
CloudNativePG is a Kubernetes operator for managing PostgreSQL databases in production. It automates deployment, failover, scaling, backups, upgrades, and connection pooling (PgBouncer) through custom Kubernetes resources (CRDs) and reconciliation loops. The operator consists of two binaries: a manager that runs inside pods to manage PostgreSQL instances, and a kubectl plugin for administrative commands. The architecture is modular with separate reconcilers for clusters, instances, backups, roles, tablespaces, and replication slots. It includes a plugin system (CNPG-I) for extensibility via gRPC, a web server for health probes and metrics, and a Prometheus exporter for monitoring. The codebase is written in a non-standard Go dialect (using URL-like import paths, func keyword, and var type declarations), which may indicate a custom transpiler or DSL. Despite this, the project is production-grade with extensive unit and end-to-end tests, active maintenance, and support for multiple Kubernetes distributions (kind, k3d, OpenShift).
Metacontroller is a Kubernetes add-on that enables writing custom controllers as webhook scripts in any language, without needing to write a full Go controller. It provides two primary controller patterns: CompositeController (manages child resources from a parent) and DecoratorController (attaches additional resources to existing objects matched by selectors). The system is deployed as a cluster add-on via Helm or kustomize manifests, and it runs as a controller-manager binary that watches CompositeController and DecoratorController CRDs, then calls user-defined webhooks (sync, finalize, customize) to determine desired state. The architecture is built on dynamic Kubernetes clients, shared informers with custom indexing, and a webhook executor that supports TLS mutual auth, bearer/basic auth, ETag caching, and per-endpoint configuration. Key entry points include the main binary at pkg/cmd/metacontroller/main.go, the server bootstrap at pkg/server/server.go, and the controller reconciliation loops in pkg/controller/composite and pkg/controller/decorator. External dependencies are the Kubernetes API server, etcd (for integration tests), and user-provided webhook servers. The codebase is well-structured with extensive unit and integration tests, a Helm chart, CI/CD pipelines, and active maintenance with frequent releases.
OpenYurt is a Kubernetes-native edge computing platform implemented as multiple Go binaries. The codebase contains a set of operators, node agents, proxies, and CLIs rather than a single monolith. YurtHub is an edge-side reverse proxy that intercepts kubelet and other node traffic, applies pluggable filters, caches API responses on disk, multiplexes list/watch requests, and can serve from local cache when the cloud API server is unreachable (node autonomy). Yurt-Manager is a controller-runtime manager with about twenty controllers and webhooks for NodePool, YurtAppSet, YurtStaticSet, service topology, Raven gateway networking, hub leader election, load balancer sets, CSR approval, and EdgeX PlatformAdmin. YurtTunnel provides a secure tunnel for kubectl exec/logs and other traffic between cloud and edge nodes. Yurtadm is a CLI for bootstrapping, joining, and resetting nodes, and yurt-iot-dock bridges OpenYurt IoT CRDs to EdgeX Foundry.
This repository implements a Kubernetes Operator for managing MongoDB Atlas resources. It provides Custom Resource Definitions (CRDs) and controllers that reconcile user-defined specifications (projects, clusters, database users, network peering, backup schedules, private endpoints, search indexes, stream instances, federated authentication, etc.) against the MongoDB Atlas API. The operator supports both API key and OAuth (service account) authentication, multiple deployment modes (cluster-wide, namespaced, OpenShift), and features like dry-run validation, deletion protection, and independent sync periods for cross-project resources. Architecturally, the operator follows the standard kubebuilder/controller-runtime pattern with a manager that registers multiple reconcilers. It has a hand-written core for legacy CRDs (e.g., AtlasProject, AtlasDeployment) and a generated state-machine-based controller layer for newer CRDs (Group, Cluster, FlexCluster, DatabaseUser, IPAccessListEntry) using the crd2go/constate library. A translation layer converts between CRD specs and Atlas SDK DTOs, and indexers enable cross-resource watch triggers. Extensive unit, integration, and end-to-end tests (Ginkgo/Gomega) validate behavior against real Atlas environments. The codebase is professional-grade with clear separation of concerns, reusable utility packages (comparison, time, pointer, HTTP diff client, JSON slice merge for version compatibility), and mature CI/CD pipelines including Helm charts, OLM bundles, SBOM generation, and Red Hat certification scripts. While it is tightly coupled to MongoDB Atlas and not directly reusable as a library, the operator patterns—especially the dry-run transport, state-machine delegation, and version-compatible JSON merging—demonstrate non-obvious engineering skill applicable to other Kubernetes operators.