Project: kube-rs (Orchestration & Management / Scheduling & Orchestration)
File: README.md

This directory contains a number of examples showcasing various capabilities of the `kube` crates. All examples can be executed with: ```sh cargo run --example $name ``` All examples enable logging via `RUST_LOG`. To enable deeper logging of the `kube` crates you can do: ```sh RUST_LOG=info,kube=debug cargo run --example $name ``` For a basic overview of how to use the `Api` try: ```sh cargo run --example job_api cargo run --example pod_api cargo run --example dynamic_api cargo run --example dynamic_jsonpath cargo run --example log_stream -- kafka-manager-7d4f4bd8dc-f6c44 ``` The `kubectl` light example supports `get`, `delete`, and `watch` on arbitrary resources: ```sh cargo run --example kubectl -- get nodes cargo run --example kubectl -- get pods -lapp.kubernetes.io/name=prometheus -n monitoring cargo run --example kubectl -- watch pods --all cargo run --example kubectl -- edit pod metrics-server-86cbb8457f-8fct5 cargo run --example kubectl -- delete pod metrics-server-86cbb8457f-8fct5 cargo run --example kubectl -- apply -f configmapgencontrollercrd.yaml ``` Supported flags are `-lLABELSELECTOR`, `-nNAMESPACE`, `--all`, and `-oyaml`. There are also two other examples that serve as simplistic analogues of `kubectl logs` and `kubectl events`: ```sh cargo run --example log_stream -- prometheus-promstack-kube-prometheus-prometheus-0 -c prometheus -f --since=3600 cargo run --example event_watcher -- --for=Pod/prometheus-promstack-kube-prometheus-prometheus-0 ``` Admission controllers are a bit of a special beast. They don't actually need `kubeclient` (unless you need to verify something with the api-server) or `kuberuntime` (unless you also build a complementing reconciler) because, by themselves, they simply get changes sent to them over `https`. You will need a webserver, certificates, and either your controller deployed behind a `Service`, or as we do here: running locally with a private ip that your `k3d` cluster can reach. ```sh export ADMISSIONPRIVATEIP=192.168.1.163 ./admission_setup.sh cargo run --example admission_controller & kubectl apply -f admission_ok.yaml # should succeed and add a label kubectl apply -f admission_reject.yaml # should fail ``` How deriving `CustomResource` works in practice, and how it interacts with the dependency. ```sh cargo run --example crd_api cargo run --example crd_derive cargo run --example crdderiveschema cargo run --example crdderiveno_schema --no-default-features --features=openssl-tls,latest ``` The last one opts out from the default `schema` feature from `kube-derive` (and thus the need for you to derive/impl `JsonSchema`). However: without the `schema` feature, it's left up to you to fill in a valid openapi v3 schema, as schemas are required for , and the generated crd will be rejected by the apiserver if it's missing. As the last example shows, you can do this directly without `schemars`. Note that these examples also contain tests for CI, and are invoked with the same parameters, but using `cargo test` rather than `cargo

These example watch a single resource and does some basic filtering on the watchevent stream: ```sh cargo run --example pod_watcher cargo run --example event_watcher cargo run --example multi_watcher cargo run --example node_watcher cargo run --example dynamic_watcher ``` The `node` and `pod` watcher also allows using via `WATCHLIST=1`: ```sh WATCHLIST=1 RUSTLOG=info,kube=debug cargo run --example podwatcher ``` Main example requires you creating the custom resource first: ```sh kubectl apply -f configmapgencontrollercrd.yaml cargo run --example configmapgen_controller & kubectl apply -f configmapgencontrollerobject.yaml ``` and the finalizer example (reconciles a labelled subset of configmaps): ```sh cargo run --example secret_syncer kubectl apply -f secretsyncerconfigmap.yaml kubectl delete -f secretsyncerconfigmap.yaml ``` the finalizer is resilient against controller downtime (try stopping the controller before deleting). These examples watch resources plus log from its queryable store: ```sh cargo run --example pod_reflector cargo run --example node_reflector cargo run --example secret_reflector cargo run --example crd_reflector ``` The `crd_reflector` will just await changes. You can run `kubectl apply -f crd-baz.yaml`, or `kubectl delete -f crd-baz.yaml -n default`, or `kubectl edit foos baz -n default` to verify that the events are being picked up. Disable default features and enable `openssl-tls`: ```sh cargo run --example pod_watcher --no-default-features --features=openssl-tls,latest,runtime ``` objects`. A `reflector` is a `watcher` with `Store` on `K`. It acts on all the `Event<K>` exposed by `watcher` to ensure that the state in the `Store` is as accurate as possible. ```rust let nodes: Api<Node> = Api::all(client); let lp = Config::default().labels("kubernetes.io/arch=amd64"); let (reader, writer) = reflector::store(); let rf = reflector(writer, watcher(nodes, lp)); ``` At this point you can listen to the `reflector` as if it was a `watcher`, but you can also query the `reader` at any point. A `Controller` is a `reflector` along with an arbitrary number of watchers that schedule events internally to send events through a reconciler: ```rust Controller::new(rootkindapi, Config::default()) .owns(childkindapi, Config::default()) .run(reconcile, error_policy, context) .for_each(|res| async move { match res { Ok(o) => info!("reconciled {:?}", o), Err(e) => warn!("reconcile failed: {}", Report::from(e)), } }) .await; ``` Here `reconcile` and `error_policy` refer to functions you define. The first will be called when the root or child elements change, and the second when the `reconciler` returns an `Err`. See the for how to write these. By default is used for TLS, but `openssl` is supported. To switch, turn off `default-features`, and enable the `openssl-tls` feature: ```toml [dependencies] kube = { version = "0.91.0", default-features = false, features = ["client", "openssl-tls"] } k8s-openapi = { version = "0.22.0", features = ["latest"] } ``` This will pull in `openssl` and `hyper-openssl`. If `default-features` is left enabled, you will pull in two TLS stacks, and the default will remain as `rustls`. Kube will work with , , and `alpine` (it's also possible to use alpine as a builder ). Apache 2.0 licensed. See LICENSE for details.