使用kubebuilder开发operator详解

命令式编程（Imperative）：详细的命令机器怎么（How）去处理一件事情以达到你想要的结果（What），比如代码详细实现过程。
声明式编程（ Declarative）：只告诉你想要的结果（What），机器自己摸索过程（How），比如sql查询结果。
简而言之：越接近现实的表达就越“声明式”，越接近于机器的执行过程就越“命令式”。

创建：kubectl create deployment nginx --image nginx 或者 kubectl create -f nginx.yaml
修改：kubectl replace -f nginx.yaml

创建：kubectl apply -f configs/   或者  kubectl apply -f nginx.yaml
修改：kubectl apply -f nginx.yaml

我们也可以使用以下命令查看有哪些api及其组成方式： kubectl get --raw /
{
  "paths": [
    "/api",
    "/api/v1",
    "/apis/apps",
    "/apis/apps/v1",
    "/apis/batch",
    "/apis/batch/v1",
    "/apis/batch/v1beta1",
    "/apis/apps.podsbook.com",
    "/apis/apps.podsbook.com/v1",
    ...
    "/healthz/etcd",
    "/livez",
    "/livez/ping",
    "/metrics",
    "/openapi/v2",
    "/readyz/etcd",
    "/version"
  ]
}

kubectl get --raw /apis/batch/v1 |jq .     
{
  "kind": "APIResourceList",
  "apiVersion": "v1",
  "groupVersion": "batch/v1",
  "resources": [
    {
      "name": "jobs",
      "singularName": "",
      "namespaced": true,
      "kind": "Job",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",
        "list",
        "patch",
        "update",
        "watch"
      ],
      "categories": [
        "all"
      ],
      "storageVersionHash": "mudhfqk/qZY="
    },
    {
      "name": "jobs/status",
      "singularName": "",
      "namespaced": true,
      "kind": "Job",
      "verbs": [
        "get",
        "patch",
        "update"
      ]
    }
  ]
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

kubectl api-resources
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
configmaps                        cm           v1                                     true         ConfigMap
endpoints                         ep           v1                                     true         Endpoints
events                            ev           v1                                     true         Event
namespaces                        ns           v1                                     false        Namespace
nodes                             no           v1                                     false        Node
pods                              po           v1                                     true         Pod
resourcequotas                    quota        v1                                     true         ResourceQuota
secrets                                        v1                                     true         Secret
services                          svc          v1                                     true         Service
apiservices                                    apiregistration.k8s.io/v1              false        APIService
daemonsets                        ds           apps/v1                                true         DaemonSet
deployments                       deploy       apps/v1                                true         Deployment
statefulsets                      sts          apps/v1                                true         StatefulSet
horizontalpodautoscalers          hpa          autoscaling/v1                         true         HorizontalPodAutoscaler
cronjobs                          cj           batch/v1beta1                          true         CronJob
jobs                                           batch/v1                               true         Job
nodes                                          metrics.k8s.io/v1beta1                 false        NodeMetrics
pods                                           metrics.k8s.io/v1beta1                 true         PodMetrics
ingresses                         ing          networking.k8s.io/v1                   true         Ingress
podsbook                                       apps.podsbook.com/v1                 true         Podsbook

apiVersion: apps.podsbook.com/v1
kind: Podsbook
metadata:
  name: podsbook-sample
spec:
  # TODO(user): Add fields here
  image: nginx:alpine
  replica: 2

git clone https://github.com.cnpmjs.org/kubernetes/client-go.git

├── discovery                   # DsicoveryClient客户端,用于发现k8s所支持GVR。
├── dynamic                     # DynamicClient客户端, 用于访问k8s Resources，也可以访问CRD。
├── informers                   # k8s中各种Resources的Informer机制的实现。
├── kubernetes                  # 对RestClient进行了封装，定义多种Client的客户端集合，俗称clientset。
├── listers                     # 提供对Resources的获取功能。对于Get()和List()而言，listers提供给二者的数据都是从缓存中读取的。
├── pkg
├── plugin                      # 提供第三方插件。
├── scale                       # 提供 ScaleClient 客户端，用于扩容或缩容 Deployment, Replicaset, Replication Controller 等资源对象。
├── tools                       # 实现client查询和缓存机制，以及定义诸如SharedInformer、Reflector、DealtFIFO和Indexer等常用工具。
├── transport                   # 提供安全的TCP连接，支持 HTTP Stream，某些操作需要在客户端和容器之间传输二进制流，例如 exec，attach 等操作。
└── util                        # 提供诸如WorkQueue、Certificate等常用方法。

1: RESTClient：这是最基础的客户端对象，仅对HTTPRequest进行了封装，实现RESTFul风格API，这个对象的使用并不方便，因为很多参数都要使用者来设置，于是client-go基于RESTClient又实现了三种新的客户端对象；
2: ClientSet：把Resource和Version也封装成方法了，一个资源是一个客户端，多个资源就对应了多个客户端，所以ClientSet就是多个客户端的集合了，不过ClientSet只能访问内置资源，访问不了自定义资源；
3: DynamicClient：是一种动态客户端，它可以动态的指定资源的组，版本和资源。因此它可以对任意 K8S 资源进行 RESTful 操作，包括自定义资源。它封装了 RESTClient。所以同样提供 RESTClient 的各种方法。该类型的官方例子:https://github.com/kubernetes/client-go/tree/master/examples/dynamic-create-update-delete-deployment。
4: DiscoveryClient：用于发现kubernetes的API Server支持的Group、Version、Resources等信息；

tree staging/src/k8s.io/api/apps/v1
staging/src/k8s.io/api/apps/v1
├── BUILD
├── doc.go
├── generated.pb.go
├── generated.proto
├── register.go
├── types.go                            
├── types_swagger_doc_generated.go
└── zz_generated.deepcopy.go

type Deployment struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

	// Specification of the desired behavior of the Deployment.
	// +optional
	Spec DeploymentSpec `json:"spec,omitempty" protobuf:"bytes,2,opt,name=spec"`

	// Most recently observed status of the Deployment.
	// +optional
	Status DeploymentStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
}

kubectl get deploy nginx-deployment -oyaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
 status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2021-07-07T02:05:45Z"
    lastUpdateTime: "2021-07-07T02:05:45Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2021-07-07T02:05:45Z"
    lastUpdateTime: "2021-07-07T03:15:20Z"
    message: ReplicaSet "nginx-dm-7fbcb74ddf" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  observedGeneration: 3
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

1. 首先初始化 Informer，Reflector 通过 List 接口获取所有的 Pod 对象
2. Reflector 拿到所有 Pod 后，将全部 Pod 放到 Store（本地缓存）中
3. 如果有人调用 Lister 的 List/Get 方法获取 Pod，那么 Lister 直接从 Store 中去拿数据
4. Informer 初始化完成后，Reflector 开始 Watch Pod 相关的事件
5. 此时如果我们删除 Pod1，那么 Reflector 会监听到这个事件，然后将这个事件发送到 DeltaFIFO 中
6. DeltaFIFO 首先先将这个事件存储在一个队列中，然后去操作 Store 中的数据，删除其中的 Pod
7. DeltaFIFO 然后 Pop 这个事件到事件处理器（资源事件处理器）中进行处理
8. LocalStore 会周期性地把所有的 Pod 信息重新放回 DeltaFIFO 中

1: 按需部署应用  
2: 获取/还原应用状态的备份  
3: 处理应用代码的升级以及相关改动。例如，数据库 schema 或额外的配置设置  
4: 发布一个 service，要求不支持 Kubernetes API 的应用也能发现它
5: 模拟整个或部分集群中的故障以测试其稳定性  
6: 在没有内部成员选举程序的情况下，为分布式应用选择首领角色  

wget https://github.com/kubernetes-sigs/kubebuilder/releases/download/v3.3.0/kubebuilder_linux_amd64
wget https://github.com/kubernetes-sigs/kind/releases/download/v0.12.0/kind-linux-amd64
curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"  | bash
mv kubebuilder_linux_amd64 /usr/local/bin/kubebuilder
mv kind-linux-amd64 /usr/local/bin/kind
export GOPROXY=https://proxy.golang.com.cn,direct

kind create cluster --name local --image kindest/node:v1.23.5
kind get kubeconfig --name local >~/.kube/config

mkdir podsbook
cd podsbook
kubebuilder init --domain podsbook.com --repo github.com/podsbook

Writing kustomize manifests for you to edit...
Writing scaffold for you to edit...
Get controller runtime:
$ go get sigs.k8s.io/controller-runtime@v0.11.0
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
Update dependencies:
$ go mod tidy
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
Next: define a resource with:
$ kubebuilder create api

tree
.
├── config
│   ├── default
│   │   ├── kustomization.yaml
│   │   ├── manager_auth_proxy_patch.yaml
│   │   └── manager_config_patch.yaml
│   ├── manager
│   │   ├── controller_manager_config.yaml
│   │   ├── kustomization.yaml
│   │   └── manager.yaml
│   ├── prometheus
│   │   ├── kustomization.yaml
│   │   └── monitor.yaml
│   └── rbac
│       ├── auth_proxy_client_clusterrole.yaml
│       ├── auth_proxy_role_binding.yaml
│       ├── auth_proxy_role.yaml
│       ├── auth_proxy_service.yaml
│       ├── kustomization.yaml
│       ├── leader_election_role_binding.yaml
│       ├── leader_election_role.yaml
│       ├── role_binding.yaml
│       └── service_account.yaml
├── Dockerfile
├── go.mod
├── go.sum
├── hack
│   └── boilerplate.go.txt
├── main.go
├── Makefile
└── PROJECT

6 directories, 24 files

Makefile：非常重要的工具，前文咱们也用过了，编译构建、部署、运行都会用到；
PROJECT：kubebuilder工程的元数据，在生成各种API的时候会用到这里面的信息；
config/default：基于kustomize制作的配置文件，为controller提供标准配置，也可以按需要去修改调整；
config/manager：一些和manager有关的细节配置，例如镜像的资源限制；
config/manager：一些和manager有关的细节配置，例如镜像的资源限制；
config/rbac：顾名思义，如果像限制operator在kubernetes中的操作权限，就要通过rbac来做精细的权限配置了，这里面就是权限配置的细节；

kubebuilder create api --group apps --version v1 --kind Podsbook

Create Resource [y/n]
y
Create Controller [y/n]
y
Writing kustomize manifests for you to edit...
Writing scaffold for you to edit...
api/v1/podsbook_types.go
controllers/podsbook_controller.go
Update dependencies:
$ go mod tidy
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
Running make:
$ make generate
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go: creating new go.mod: module tmp
Downloading sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go get: installing executables with 'go get' in module mode is deprecated.
	To adjust and download dependencies of the current module, use 'go get -d'.
	To install using requirements of the current module, use 'go install'.
	To install ignoring the current module, use 'go install' with a version,
	like 'go install example.com/cmd@latest'.
	For more information, see https://golang.org/doc/go-get-install-deprecation
	or run 'go help get' or 'go help install'.
go get: added github.com/fatih/color v1.12.0
go get: added github.com/go-logr/logr v1.2.0
go get: added github.com/gobuffalo/flect v0.2.3
go get: added github.com/gogo/protobuf v1.3.2
go get: added github.com/google/go-cmp v0.5.6
go get: added github.com/google/gofuzz v1.1.0
go get: added github.com/inconshreveable/mousetrap v1.0.0
go get: added github.com/json-iterator/go v1.1.12
go get: added github.com/mattn/go-colorable v0.1.8
go get: added github.com/mattn/go-isatty v0.0.12
go get: added github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
go get: added github.com/modern-go/reflect2 v1.0.2
go get: added github.com/spf13/cobra v1.2.1
go get: added github.com/spf13/pflag v1.0.5
go get: added golang.org/x/mod v0.4.2
go get: added golang.org/x/net v0.0.0-20210825183410-e898025ed96a
go get: added golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e
go get: added golang.org/x/bash v0.3.7
go get: added golang.org/x/tools v0.1.6-0.20210820212750-d4cc65f0b2ff
go get: added golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1
go get: added gopkg.in/inf.v0 v0.9.1
go get: added gopkg.in/yaml.v2 v2.4.0
go get: added gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b
go get: added k8s.io/api v0.23.0
go get: added k8s.io/apiextensions-apiserver v0.23.0
go get: added k8s.io/apimachinery v0.23.0
go get: added k8s.io/klog/v2 v2.30.0
go get: added k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b
go get: added sigs.k8s.io/controller-tools v0.8.0
go get: added sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6
go get: added sigs.k8s.io/structured-merge-diff/v4 v4.1.2
go get: added sigs.k8s.io/yaml v1.3.0
/tmp/podsbook/bin/controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..."
Next: implement your new API and generate the manifests (e.g. CRDs,CRs) with:
$ make manifests

.
├── api
│   └── v1
│       ├── groupversion_info.go
│       ├── podsbook_types.go
│       └── zz_generated.deepcopy.go
├── bin
│   └── controller-gen
├── config
│   ├── crd
│   │   ├── kustomization.yaml
│   │   ├── kustomizeconfig.yaml
│   │   └── patches
│   │       ├── cainjection_in_podsbooks.yaml
│   │       └── webhook_in_podsbooks.yaml
│   ├── default
│   │   ├── kustomization.yaml
│   │   ├── manager_auth_proxy_patch.yaml
│   │   └── manager_config_patch.yaml
│   ├── manager
│   │   ├── controller_manager_config.yaml
│   │   ├── kustomization.yaml
│   │   └── manager.yaml
│   ├── prometheus
│   │   ├── kustomization.yaml
│   │   └── monitor.yaml
│   ├── rbac
│   │   ├── auth_proxy_client_clusterrole.yaml
│   │   ├── auth_proxy_role_binding.yaml
│   │   ├── auth_proxy_role.yaml
│   │   ├── auth_proxy_service.yaml
│   │   ├── kustomization.yaml
│   │   ├── leader_election_role_binding.yaml
│   │   ├── leader_election_role.yaml
│   │   ├── podsbook_editor_role.yaml
│   │   ├── podsbook_viewer_role.yaml
│   │   ├── role_binding.yaml
│   │   └── service_account.yaml
│   └── samples
│       └── apps_v1_podsbook.yaml
├── controllers
│   ├── podsbook_controller.go
│   └── suite_test.go
├── Dockerfile
├── go.mod
├── go.sum
├── hack
│   └── boilerplate.go.txt
├── main.go
├── Makefile
└── PROJECT

13 directories, 37 files

/*
Copyright 2022.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package v1

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!
// NOTE: json tags are required.  Any new fields you add must have json tags for the fields to be serialized.

// PodsbookSpec defines the desired state of Podsbook
type PodsbookSpec struct {
	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
	// Important: Run "make" to regenerate code after modifying this file

	// Image,Replica is an example field of Podsbook. Edit podsbook_types.go to remove/update
	Image   *string `json:"image,omitempty"`
	Replica *int32  `json:"replica,omitempty"`
}

// PodsbookStatus defines the observed state of Podsbook
type PodsbookStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	RealReplica int32 `json:"realReplica,omitempty"`
}

//+kubebuilder:object:root=true
//+kubebuilder:subresource:status
//+kubebuilder:printcolumn:JSONPath=".status.realReplica",name=RealReplica,type=integer

// Podsbook is the Schema for the podsbooks API
type Podsbook struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   PodsbookSpec   `json:"spec,omitempty"`
	Status PodsbookStatus `json:"status,omitempty"`
}

//+kubebuilder:object:root=true

// PodsbookList contains a list of Podsbook
type PodsbookList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Podsbook `json:"items"`
}

func init() {
	SchemeBuilder.Register(&Podsbook{}, &PodsbookList{})
}

kubectl get deploy nginx-deployment -oyaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
 status:
  availableReplicas: 1
  conditions:
  - lastTransitionTime: "2021-07-07T02:05:45Z"
    lastUpdateTime: "2021-07-07T02:05:45Z"
    message: Deployment has minimum availability.
    reason: MinimumReplicasAvailable
    status: "True"
    type: Available
  - lastTransitionTime: "2021-07-07T02:05:45Z"
    lastUpdateTime: "2021-07-07T03:15:20Z"
    message: ReplicaSet "nginx-dm-7fbcb74ddf" has successfully progressed.
    reason: NewReplicaSetAvailable
    status: "True"
    type: Progressing
  observedGeneration: 3
  readyReplicas: 1
  replicas: 1
  updatedReplicas: 1

Replica ：定义为指针类型为了后续的webhook判断字段是否为空，int32是为了数据类型处理方便（kubebuilder接受三种数据类型：int32 ，int64 ， 整数）
Image ：用指针是因为在后续的webhook中用来判断字段是否为空时进行处理，从而阻止不规范的yaml创建导致deployment出现问题
在PodsbookStatus中定义一个字段，RealReplica，用来记录当前资源状态的副本数。
tag处有一个 "omitempty" 的值，意思是来标记一个字段在为空时应该从序列化中省略。

        ...
        spec:
            description: PodsbookSpec defines the desired state of Podsbook
            properties:
              image:
                description: Image,Replica is an example field of Podsbook. Edit podsbook_types.go
                  to remove/update
                type: string
              replica:
                format: int32
                type: integer
            type: object
          status:
            description: PodsbookStatus defines the observed state of Podsbook
            properties:
              realReplica:
                description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
                  of cluster Important: Run "make" to regenerate code after modifying
                  this file'
                format: int32
                type: integer
          ...

/*
Copyright 2022.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package controllers

import (
	"conbash"
	"k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/tools/record"
	"k8s.io/utils/pointer"

	"k8s.io/apimachinery/pkg/runtime"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/log"

	appsv1 "github.com/podsbook/api/v1"
	k8sappsv1 "k8s.io/api/apps/v1"
	k8scorev1 "k8s.io/api/core/v1"
)

// PodsbookReconciler reconciles a Podsbook object
type PodsbookReconciler struct {
	client.Client
	Scheme   *runtime.Scheme
	Recorder record.EventRecorder
}

//+kubebuilder:rbac:groups=apps.podsbook.com,resources=podsbooks,verbs=get;list;watch;create;update;patch;delete
//+kubebuilder:rbac:groups=apps.podsbook.com,resources=podsbooks/status,verbs=get;update;patch
//+kubebuilder:rbac:groups=apps.podsbook.com,resources=podsbooks/finalizers,verbs=update
//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete

// Reconcile is part of the main kubernetes reconciliation loop which aims to
// move the current state of the cluster closer to the desired state.
// TODO(user): Modify the Reconcile function to compare the state specified by
// the Podsbook object against the actual cluster state, and then
// perform operations to make the cluster state reflect the state specified by
// the user.
//
// For more details, check Reconcile and its Result here:
// - https://pkg.go.dev/sigs.k8s.io/controller-runtime@v0.11.0/pkg/reconcile
func (r *PodsbookReconciler) Reconcile(ctx conbash.Conbash, req ctrl.Request) (ctrl.Result, error) {
	log := log.FromConbash(ctx)
	podsbook := &appsv1.Podsbook{}
	deployment := &k8sappsv1.Deployment{}
	err := r.Get(ctx, req.NamespacedName, podsbook)
	if err != nil {
		return ctrl.Result{}, nil
	}
	err = r.Get(ctx, req.NamespacedName, deployment)
	if err != nil {
		if errors.IsNotFound(err) {
			log.Info("Deployment Not Found")
			err = r.CreateDeployment(ctx, podsbook)
			if err != nil {
				r.Recorder.Event(podsbook, k8scorev1.EventTypeWarning, "FailedCreateDeployment", err.Error())
				return ctrl.Result{}, err
			}
			podsbook.Status.RealReplica = *podsbook.Spec.Replica
			err = r.Update(ctx, podsbook)
			if err != nil {
				r.Recorder.Event(podsbook, k8scorev1.EventTypeWarning, "FailedUpdateStatus", err.Error())
				return ctrl.Result{}, err
			}
		}
		return ctrl.Result{}, err
	}
	//binding deployment to podsbook
	if err = ctrl.SetControllerReference(podsbook, deployment, r.Scheme); err != nil {
		return ctrl.Result{}, err
	}
	// TODO(user): your logic here

	return ctrl.Result{}, nil
}

// SetupWithManager sets up the controller with the Manager.
func (r *PodsbookReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&appsv1.Podsbook{}).
		Owns(&k8sappsv1.Deployment{}).
		Complete(r)
}

func (r *PodsbookReconciler) CreateDeployment(ctx conbash.Conbash, podsbook *appsv1.Podsbook) error {
	deployment := &k8sappsv1.Deployment{
		ObjectMeta: metav1.ObjectMeta{
			Namespace: podsbook.Namespace,
			Name:      podsbook.Name,
		},
		Spec: k8sappsv1.DeploymentSpec{
			Replicas: pointer.Int32Ptr(*podsbook.Spec.Replica),
			Selector: &metav1.LabelSelector{
				MatchLabels: map[string]string{
					"app": podsbook.Name,
				},
			},

			Template: k8scorev1.PodTemplateSpec{
				ObjectMeta: metav1.ObjectMeta{
					Labels: map[string]string{
						"app": podsbook.Name,
					},
				},
				Spec: k8scorev1.PodSpec{
					Containers: []k8scorev1.Container{
						{
							Name:            podsbook.Name,
							Image:           *podsbook.Spec.Image,
							ImagePullPolicy: "IfNotPresent",
							Ports: []k8scorev1.ContainerPort{
								{
									Name:          podsbook.Name,
									Protocol:      k8scorev1.ProtocolSCTP,
									ContainerPort: 80,
								},
							},
						},
					},
				},
			},
		},
	}
	err := r.Create(ctx, deployment)
	if err != nil {
		return err
	}
	return nil
}

apiVersion: apps.podsbook.com/v1
kind: Podsbook
metadata:
  name: podsbook-sample
spec:
  # TODO(user): Add fields here
  image: nginx:alpine
  replica: 2

make install

warning: GOPATH set to GOROOT (/usr/local/go) has no effect
/tmp/podsbook/bin/controller-gen rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go: creating new go.mod: module tmp
Downloading sigs.k8s.io/kustomize/kustomize/v3@v3.8.7
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go get: installing executables with 'go get' in module mode is deprecated.
	To adjust and download dependencies of the current module, use 'go get -d'.
	To install using requirements of the current module, use 'go install'.
	To install ignoring the current module, use 'go install' with a version,
	like 'go install example.com/cmd@latest'.
	For more information, see https://golang.org/doc/go-get-install-deprecation
	or run 'go help get' or 'go help install'.
go get: added cloud.google.com/go v0.38.0
...
go get: added sigs.k8s.io/yaml v1.2.0
/tmp/podsbook/bin/kustomize build config/crd | kubectl apply -f -
customresourcedefinition.apiextensions.k8s.io/podsbooks.apps.podsbook.com created

make run
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
/tmp/podsbook/bin/controller-gen rbac:roleName=manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
/tmp/podsbook/bin/controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..."
go fmt ./...
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go vet ./...
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
go run ./main.go
warning: GOPATH set to GOROOT (/usr/local/go) has no effect
1.6497616080913148e+09	INFO	controller-runtime.metrics	Metrics server is starting to listen	{"addr": ":8080"}
1.6497616080919867e+09	INFO	setup	starting manager
1.6497616080921605e+09	INFO	Starting server	{"path": "/metrics", "kind": "metrics", "addr": "[::]:8080"}
1.6497616080923102e+09	INFO	Starting server	{"kind": "health probe", "addr": "[::]:8081"}
1.649761608092541e+09	INFO	controller.podsbook	Starting EventSource	{"reconciler group": "apps.podsbook.com", "reconciler kind": "Podsbook", "source": "kind source: *v1.Podsbook"}
1.6497616080926483e+09	INFO	controller.podsbook	Starting EventSource	{"reconciler group": "apps.podsbook.com", "reconciler kind": "Podsbook", "source": "kind source: *v1.Deployment"}
1.649761608092733e+09	INFO	controller.podsbook	Starting Controller	{"reconciler group": "apps.podsbook.com", "reconciler kind": "Podsbook"}
1.6497616081937969e+09	INFO	controller.podsbook	Starting workers	{"reconciler group": "apps.podsbook.com", "reconciler kind": "Podsbook", "worker count": 1}

kubectl get deploy
NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
podsbook-sample                2/2     2            2           1m

kubectl get podsbook
NAME              REALREPLICA
podsbook-sample   2

kubectl get crd
NAME                                  CREATED AT
podsbooks.apps.podsbook.com           2022-04-12T09:54:48Z

MutatingAdmissionWebhook: 变更控制器可以根据被其接受的请求修改相关对象
ValidatingAdmissionWebhook: 准入控制器可以执行 “验证（Validating）” 和/或 “变更（Mutating）” 操作，准入控制器限制创建、删除、修改对象或连接到代理的请求，不限制读取对象的请求。
执行的顺序是先执行 MutatingAdmissionWebhook 再执行 ValidatingAdmissionWebhook，某些控制器既是变更准入控制器又是验证准入控制器。

kubebuilder create webhook --group apps --version v1 --kind Podsbook --defaulting --programmatic-validation

.
├── api
│   └── v1
│       ├── groupversion_info.go
│       ├── podsbook_types.go
│       ├── podsbook_webhook.go
│       ├── webhook_suite_test.go
│       └── zz_generated.deepcopy.go
├── bin
│   ├── controller-gen
│   └── kustomize
├── config
│   ├── certmanager
│   │   ├── certificate.yaml
│   │   ├── kustomization.yaml
│   │   └── kustomizeconfig.yaml
│   ├── crd
│   │   ├── bases
│   │   │   └── apps.podsbook.com_podsbooks.yaml
│   │   ├── kustomization.yaml
│   │   ├── kustomizeconfig.yaml
│   │   └── patches
│   │       ├── cainjection_in_podsbooks.yaml
│   │       └── webhook_in_podsbooks.yaml
│   ├── default
│   │   ├── kustomization.yaml
│   │   ├── manager_auth_proxy_patch.yaml
│   │   ├── manager_config_patch.yaml
│   │   ├── manager_webhook_patch.yaml
│   │   └── webhookcainjection_patch.yaml
│   ├── manager
│   │   ├── controller_manager_config.yaml
│   │   ├── kustomization.yaml
│   │   └── manager.yaml
│   ├── prometheus
│   │   ├── kustomization.yaml
│   │   └── monitor.yaml
│   ├── rbac
│   │   ├── auth_proxy_client_clusterrole.yaml
│   │   ├── auth_proxy_role_binding.yaml
│   │   ├── auth_proxy_role.yaml
│   │   ├── auth_proxy_service.yaml
│   │   ├── kustomization.yaml
│   │   ├── leader_election_role_binding.yaml
│   │   ├── leader_election_role.yaml
│   │   ├── podsbook_editor_role.yaml
│   │   ├── podsbook_viewer_role.yaml
│   │   ├── role_binding.yaml
│   │   ├── role.yaml
│   │   └── service_account.yaml
│   ├── samples
│   │   └── apps_v1_podsbook.yaml
│   └── webhook
│       ├── kustomization.yaml
│       ├── kustomizeconfig.yaml
│       └── service.yaml
├── controllers
│   ├── podsbook_controller.go
│   └── suite_test.go
├── Dockerfile
├── go.mod
├── go.sum
├── hack
│   └── boilerplate.go.txt
├── main.go
├── Makefile
└── PROJECT

16 directories, 50 files

# Adds namespace to all resources.
namespace: podsbook-system

# Value of this field is prepended to the
# names of all resources, e.g. a deployment named
# "wordpress" becomes "alices-wordpress".
# Note that it should also match with the prefix (bash before '-') of the namespace
# field above.
namePrefix: podsbook-

# Labels to add to all resources and selectors.
#commonLabels:
#  someName: someValue

bases:
- ../crd
- ../rbac
- ../manager
# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
# crd/kustomization.yaml
- ../webhook
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
- ../certmanager
# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
#- ../prometheus

patchesStrategicMerge:
# Protect the /metrics endpoint by putting it behind auth.
# If you want your controller-manager to expose the /metrics
# endpoint w/o any authn/z, please comment the following line.
- manager_auth_proxy_patch.yaml

# Mount the controller config file for loading manager configurations
# through a ComponentConfig type
#- manager_config_patch.yaml

# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
# crd/kustomization.yaml
- manager_webhook_patch.yaml

# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
# 'CERTMANAGER' needs to be enabled to use ca injection
- webhookcainjection_patch.yaml

# the following config is for teaching kustomize how to do var substitution
vars:
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
  objref:
    kind: Certificate
    group: cert-manager.io
    version: v1
    name: serving-cert # this name should match the one in certificate.yaml
  fieldref:
    fieldpath: metadata.namespace
- name: CERTIFICATE_NAME
  objref:
    kind: Certificate
    group: cert-manager.io
    version: v1
    name: serving-cert # this name should match the one in certificate.yaml
- name: SERVICE_NAMESPACE # namespace of the service
  objref:
    kind: Service
    version: v1
    name: webhook-service
  fieldref:
    fieldpath: metadata.namespace
- name: SERVICE_NAME
  objref:
    kind: Service
    version: v1
    name: webhook-service

func (r *Podsbook) Default() {
	podsbooklog.Info("default", "name", r.Name)
	if r.Spec.Replica == nil {
		podsbooklog.Info("The spec.replica is nil,Set default value to 2")
		r.Spec.Replica = pointer.Int32Ptr(2)
	}
	// TODO(user): fill in your defaulting logic.
}

func (r *Podsbook) ValidateVerification() error {
	var allErrs field.ErrorList
	if r.Spec.Image == nil {
		err := field.Invalid(field.NewPath("spec").Child("image"),
			r.Spec.Image,
			"The value cannot be empty, please check your value")
		allErrs = append(allErrs, err)
	}
	if len(allErrs) == 0 {
		return nil
	}
	return apierrors.NewInvalid(
		schema.GroupKind{Group: "apps.podsbook.com", Kind: "Podsbook"},
		r.Name, allErrs)
}

/*
Copyright 2022.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package v1

import (
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/runtime/schema"
	"k8s.io/apimachinery/pkg/util/validation/field"
	"k8s.io/utils/pointer"
	ctrl "sigs.k8s.io/controller-runtime"
	logf "sigs.k8s.io/controller-runtime/pkg/log"
	"sigs.k8s.io/controller-runtime/pkg/webhook"
)

// log is for logging in this package.
var podsbooklog = logf.Log.WithName("podsbook-resource")

func (r *Podsbook) SetupWebhookWithManager(mgr ctrl.Manager) error {
	return ctrl.NewWebhookManagedBy(mgr).
		For(r).
		Complete()
}

// TODO(user): EDIT THIS FILE!  THIS IS SCAFFOLDING FOR YOU TO OWN!

//+kubebuilder:webhook:path=/mutate-apps-podsbook-com-v1-podsbook,mutating=true,failurePolicy=fail,sideEffects=None,groups=apps.podsbook.com,resources=podsbooks,verbs=create;update,versions=v1,name=mpodsbook.kb.io,admissionReviewVersions=v1

var _ webhook.Defaulter = &Podsbook{}

// Default implements webhook.Defaulter so a webhook will be registered for the type
func (r *Podsbook) Default() {
	podsbooklog.Info("default", "name", r.Name)
	if r.Spec.Replica == nil {
		podsbooklog.Info("The spec.replica is nil,Set default value to 2")
		r.Spec.Replica = pointer.Int32Ptr(2)
	}
	// TODO(user): fill in your defaulting logic.
}

// TODO(user): change verbs to "verbs=create;update;delete" if you want to enable deletion validation.
//+kubebuilder:webhook:path=/validate-apps-podsbook-com-v1-podsbook,mutating=false,failurePolicy=fail,sideEffects=None,groups=apps.podsbook.com,resources=podsbooks,verbs=create;update,versions=v1,name=vpodsbook.kb.io,admissionReviewVersions=v1

var _ webhook.Validator = &Podsbook{}

// ValidateCreate implements webhook.Validator so a webhook will be registered for the type
func (r *Podsbook) ValidateCreate() error {
	podsbooklog.Info("validate create", "name", r.Name)

	// TODO(user): fill in your validation logic upon object creation.
	return r.ValidateVerification()
}

// ValidateUpdate implements webhook.Validator so a webhook will be registered for the type
func (r *Podsbook) ValidateUpdate(old runtime.Object) error {
	podsbooklog.Info("validate update", "name", r.Name)

	// TODO(user): fill in your validation logic upon object update.
	return r.ValidateVerification()
}

// ValidateDelete implements webhook.Validator so a webhook will be registered for the type
func (r *Podsbook) ValidateDelete() error {
	podsbooklog.Info("validate delete", "name", r.Name)

	// TODO(user): fill in your validation logic upon object deletion.
	return nil
}

func (r *Podsbook) ValidateVerification() error {
	var allErrs field.ErrorList
	if r.Spec.Image == nil {
		err := field.Invalid(field.NewPath("spec").Child("image"),
			r.Spec.Image,
			"The value cannot be empty, please check your value")
		allErrs = append(allErrs, err)
	}
	if len(allErrs) == 0 {
		return nil
	}
	return apierrors.NewInvalid(
		schema.GroupKind{Group: "apps.podsbook.com", Kind: "Podsbook"},
		r.Name, allErrs)
}

kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.8.0/cert-manager.yaml

kubectl get pods -ncert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-64d9bc8b74-fmxw6              1/1     Running   0          3m3s
cert-manager-cainjector-6db6b64d5f-42544   1/1     Running   0          3m3s
cert-manager-webhook-6c9dd55dc8-xpfrk      1/1     Running   0          3m3s