cloudnative wiki

L09 — Advanced

3 min read

L09 — Advanced

How Kubernetes is built, and how to extend it. After this level, the platform stops being a black box — you understand what runs in your cluster, why, and how to write your own controllers if you need to.

What you’ll understand after this level

  • The controller pattern in depth — informers, work queues, the reconcile loop
  • Custom Resources (CRDs) — extending the Kubernetes API with your own object types
  • Operators — controllers that manage CRs and encode operational knowledge
  • Finalizers — async cleanup hooks for objects that own external resources
  • Garbage collection — owner references, cascading deletion, orphan/background policies
  • Admission controllers and webhooks — reject / mutate objects at admission time
  • The pause container — what /pause does and why every pod has one
  • IPVS vs iptables for kube-proxy
  • The aggregation layer — running auxiliary API servers alongside the core one
  • etcd’s role, and what etcdctl does
  • Scheduler extenders — when built-in scheduling primitives aren’t enough

Notes in this level

NoteStatusWhat’s in it
Operators✅What an operator is, the operator pattern, examples, Operator SDK
Custom Controllers✅Writing a controller — informers, work queues, reconcile loop
CRDs✅Extending the API with your own object types, schema validation, versions, CEL
Admission Controllers & Webhooks✅Built-in admission chain, mutating/validating webhooks, OPA Gatekeeper, Kyverno
Finalizers✅Async cleanup, common pitfalls, the deletion lifecycle
Garbage Collection✅Owner references, foreground vs background deletion, TTL controller
Aggregation Layer✅Running additional API servers behind the kube-apiserver, APIService, auth delegation
IPVS✅kube-proxy IPVS mode vs iptables, deprecation in v1.35+, nftables successor
Pause Container✅The /pause process holding the pod’s network namespace and PID 1 reaping
etcd✅The cluster’s source of truth, backups, defrag, encryption at rest, disaster recovery
Scheduler Extenders✅Out-of-process webhooks that influence scheduling, when to use them

Suggested reading order

  1. Operators — what you’re aiming to understand
  2. CRDs — the API extension mechanism
  3. Garbage Collection → Finalizers — controller patterns you’ll see everywhere
  4. Admission Controllers & Webhooks — the other half of “policy”
  5. Custom Controllers — write your own reconcile loop
  6. etcd — the storage layer, when you need to operate the cluster
  7. Aggregation Layer + Scheduler Extenders — advanced extension points
  8. Pause Container + IPVS — reference notes, read as you need them

Where to go next

If you’ve made it from L00 to L09, you have the same conceptual model the Kubernetes docs and source code use. From here, the natural next stops are:

Graph View

Backlinks