Kubernetes Provider
Relevant source files
The following files were used as context for generating this wiki page:
The Kubernetes Provider is a specialized module within Cloud Custodian (c7n) that implements policy-based management for Kubernetes clusters. It allows you to define rules in YAML format to manage, secure, and optimize resources like Pods, Services, and RBAC components.
The provider functions as a rules engine that queries the Kubernetes API, evaluates resources against user-defined filters, and executes specific actions. It integrates with the standard Cloud Custodian CLI while providing a dedicated tool, c7n-kube, for Kubernetes-specific operations.
Sources: tools/c7n_kube/pyproject.toml:1-25, README.md:1-40
Core Components and Dependencies
The Kubernetes Provider relies on the standard Python kubernetes client to interact with the API server. It also uses jsonpatch for resource modification and the core c7n library for policy evaluation logic.
Dependency Specification
| Package | Version Requirement | Purpose |
|---|---|---|
c7n | Current Workspace Version | Core policy engine and base classes |
kubernetes | >=10.0.1 | Official Python client for Kubernetes API |
jsonpatch | <2.0, >=1.32 | Applying modifications to resource manifests |
Sources: tools/c7n_kube/pyproject.toml:7-11
Command Line Interface (CLI)
The provider registers a specific entry point for command-line interaction.
- Command:
c7n-kube - Function: Executes the
climethod inc7n_kube.cli.
Sources: tools/c7n_kube/pyproject.toml:22-23
Policy Execution Workflow
Policy execution follows a structured path from loading configuration files to performing actions on live resources. The engine validates the YAML structure, filters resources based on criteria, and executes state changes.
This diagram shows the high-level logic flow where the provider translates YAML policies into Kubernetes API calls and modifications.
Sources: c7n/commands.py:43-120, README.md:118-140
Supported Resource Types
The provider manages standard Kubernetes resources and discovers custom resources. Data is typically retrieved via GET requests to specific API groups like rbac.authorization.k8s.io or apiextensions.k8s.io.
Standard and Custom Resources
- Core Resources: Pods, Services, ConfigMaps, Secrets, Namespaces, Nodes.
- RBAC: ClusterRoles, Roles, RoleBindings.
- Custom Resources: Discovers and interacts with
CustomResourceDefinitions(CRDs) such as KarpenterNodePools.
Sources: tools/c7n_kube/tests/data/flights/ClusterRoleTest.test_cluster_role_query.yaml:1-50, tools/c7n_kube/tests/data/flights/TestCustomResourceDiscovery.test_resources_discovers_and_tags_real_crd_instances.yaml:1-30
Documentation and Schema Generation
Cloud Custodian uses a documentation generator to produce reference pages for every provider. The docgen utility resolves resource definitions and renders Sphinx-compatible RST files.
This sequence explains how the system automatically documents the Kubernetes provider's specific vocabulary of filters and actions.
Sources: tools/c7n_sphinxext/c7n_sphinxext/docgen.py:165-210
Resource Querying and Testing
The provider utilizes a "flight data" pattern for testing, which involves recording real Kubernetes API interactions into YAML or JSON files. This allows developers to replay API responses without a live cluster.
API Response Structure
When querying resources, the provider receives standard Kubernetes list objects. For example, a ClusterRoleList contains metadata and an items array detailing rules and aggregation settings.
{
"kind": "ClusterRoleList",
"apiVersion": "rbac.authorization.k8s.io/v1",
"metadata": { "resourceVersion": "1155964" },
"items": [
{
"metadata": { "name": "admin", "uid": "f58560b4..." },
"rules": [
{ "verbs": ["create", "delete"], "apiGroups": ["cert-manager.io"], "resources": ["certificates"] }
]
}
]
}
Sources: tools/c7n_kube/tests/data/flights/ClusterRoleTest.test_cluster_role_query.yaml:10-40
Policy Validation and Deprecation
The custodian validate command checks policy files for structural correctness against the provider's schema. It also identifies deprecated usage of filters or actions, providing footnotes for migration.
- Syntax Check: Ensures valid YAML formatting.
- Schema Validation: Verifies that resources, filters, and actions exist and use correct parameters.
- Deprecation Reporting: Flags outdated policy elements and suggests alternatives.
Sources: c7n/commands.py:180-250
The Kubernetes Provider enables consistent governance across containerized environments by treating Kubernetes infrastructure as code. Through its integration with the core Cloud Custodian engine, it provides a unified interface for managing cloud-native resources alongside traditional cloud services.