Extend the Kubernetes API with CustomResourceDefinitions

This page shows how to install a custom resource into the Kubernetes API by creating a CustomResourceDefinition.

Before you begin

You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:

Your Kubernetes server must be at or later than version 1.16. To check the version, enter kubectl version. If you are using an older version of Kubernetes that is still supported, switch to the documentation for that version to see advice that is relevant for your cluster.

Create a CustomResourceDefinition

When you create a new CustomResourceDefinition (CRD), the Kubernetes API Server creates a new RESTful resource path for each version you specify. The CRD can be either namespaced or cluster-scoped, as specified in the CRD’s scope field. As with existing built-in objects, deleting a namespace deletes all custom objects in that namespace. CustomResourceDefinitions themselves are non-namespaced and are available to all namespaces.

For example, if you save the following CustomResourceDefinition to resourcedefinition.yaml:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. # name must match the spec fields below, and be in the form: <plural>.<group>
  5. name: crontabs.stable.example.com
  6. spec:
  7. # group name to use for REST API: /apis/<group>/<version>
  8. group: stable.example.com
  9. # list of versions supported by this CustomResourceDefinition
  10. versions:
  11. - name: v1
  12. # Each version can be enabled/disabled by Served flag.
  13. served: true
  14. # One and only one version must be marked as the storage version.
  15. storage: true
  16. schema:
  17. openAPIV3Schema:
  18. type: object
  19. properties:
  20. spec:
  21. type: object
  22. properties:
  23. cronSpec:
  24. type: string
  25. image:
  26. type: string
  27. replicas:
  28. type: integer
  29. # either Namespaced or Cluster
  30. scope: Namespaced
  31. names:
  32. # plural name to be used in the URL: /apis/<group>/<version>/<plural>
  33. plural: crontabs
  34. # singular name to be used as an alias on the CLI and for display
  35. singular: crontab
  36. # kind is normally the CamelCased singular type. Your resource manifests use this.
  37. kind: CronTab
  38. # shortNames allow shorter string to match your resource on the CLI
  39. shortNames:
  40. - ct

and create it:

  1. kubectl apply -f resourcedefinition.yaml

Then a new namespaced RESTful API endpoint is created at:

  1. /apis/stable.example.com/v1/namespaces/*/crontabs/...

This endpoint URL can then be used to create and manage custom objects. The kind of these objects will be CronTab from the spec of the CustomResourceDefinition object you created above.

It might take a few seconds for the endpoint to be created. You can watch the Established condition of your CustomResourceDefinition to be true or watch the discovery information of the API server for your resource to show up.

Create custom objects

After the CustomResourceDefinition object has been created, you can create custom objects. Custom objects can contain custom fields. These fields can contain arbitrary JSON. In the following example, the cronSpec and image custom fields are set in a custom object of kind CronTab. The kind CronTab comes from the spec of the CustomResourceDefinition object you created above.

If you save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * * */5"
  7. image: my-awesome-cron-image

and create it:

  1. kubectl apply -f my-crontab.yaml

You can then manage your CronTab objects using kubectl. For example:

  1. kubectl get crontab

Should print a list like this:

  1. NAME AGE
  2. my-new-cron-object 6s

Resource names are not case-sensitive when using kubectl, and you can use either the singular or plural forms defined in the CRD, as well as any short names.

You can also view the raw YAML data:

  1. kubectl get ct -o yaml

You should see that it contains the custom cronSpec and image fields from the YAML you used to create it:

  1. apiVersion: v1
  2. items:
  3. - apiVersion: stable.example.com/v1
  4. kind: CronTab
  5. metadata:
  6. annotations:
  7. kubectl.kubernetes.io/last-applied-configuration: |
  8. {"apiVersion":"stable.example.com/v1","kind":"CronTab","metadata":{"annotations":{},"name":"my-new-cron-object","namespace":"default"},"spec":{"cronSpec":"* * * * */5","image":"my-awesome-cron-image"}}
  9. creationTimestamp: "2021-06-20T07:35:27Z"
  10. generation: 1
  11. name: my-new-cron-object
  12. namespace: default
  13. resourceVersion: "1326"
  14. uid: 9aab1d66-628e-41bb-a422-57b8b3b1f5a9
  15. spec:
  16. cronSpec: '* * * * */5'
  17. image: my-awesome-cron-image
  18. kind: List
  19. metadata:
  20. resourceVersion: ""
  21. selfLink: ""

Delete a CustomResourceDefinition

When you delete a CustomResourceDefinition, the server will uninstall the RESTful API endpoint and delete all custom objects stored in it.

  1. kubectl delete -f resourcedefinition.yaml
  2. kubectl get crontabs
  1. Error from server (NotFound): Unable to list {"stable.example.com" "v1" "crontabs"}: the server could not find the requested resource (get crontabs.stable.example.com)

If you later recreate the same CustomResourceDefinition, it will start out empty.

Specifying a structural schema

CustomResources store structured data in custom fields (alongside the built-in fields apiVersion, kind and metadata, which the API server validates implicitly). With OpenAPI v3.0 validation a schema can be specified, which is validated during creation and updates, compare below for details and limits of such a schema.

With apiextensions.k8s.io/v1 the definition of a structural schema is mandatory for CustomResourceDefinitions. In the beta version of CustomResourceDefinition, the structural schema was optional.

A structural schema is an OpenAPI v3.0 validation schema which:

  1. specifies a non-empty type (via type in OpenAPI) for the root, for each specified field of an object node (via properties or additionalProperties in OpenAPI) and for each item in an array node (via items in OpenAPI), with the exception of:
    • a node with x-kubernetes-int-or-string: true
    • a node with x-kubernetes-preserve-unknown-fields: true
  2. for each field in an object and each item in an array which is specified within any of allOf, anyOf, oneOf or not, the schema also specifies the field/item outside of those logical junctors (compare example 1 and 2).
  3. does not set description, type, default, additionalProperties, nullable within an allOf, anyOf, oneOf or not, with the exception of the two pattern for x-kubernetes-int-or-string: true (see below).
  4. if metadata is specified, then only restrictions on metadata.name and metadata.generateName are allowed.

Non-structural example 1:

  1. allOf:
  2. - properties:
  3. foo:
  4. ...

conflicts with rule 2. The following would be correct:

  1. properties:
  2. foo:
  3. ...
  4. allOf:
  5. - properties:
  6. foo:
  7. ...

Non-structural example 2:

  1. allOf:
  2. - items:
  3. properties:
  4. foo:
  5. ...

conflicts with rule 2. The following would be correct:

  1. items:
  2. properties:
  3. foo:
  4. ...
  5. allOf:
  6. - items:
  7. properties:
  8. foo:
  9. ...

Non-structural example 3:

  1. properties:
  2. foo:
  3. pattern: "abc"
  4. metadata:
  5. type: object
  6. properties:
  7. name:
  8. type: string
  9. pattern: "^a"
  10. finalizers:
  11. type: array
  12. items:
  13. type: string
  14. pattern: "my-finalizer"
  15. anyOf:
  16. - properties:
  17. bar:
  18. type: integer
  19. minimum: 42
  20. required: ["bar"]
  21. description: "foo bar object"

is not a structural schema because of the following violations:

  • the type at the root is missing (rule 1).
  • the type of foo is missing (rule 1).
  • bar inside of anyOf is not specified outside (rule 2).
  • bar‘s type is within anyOf (rule 3).
  • the description is set within anyOf (rule 3).
  • metadata.finalizers might not be restricted (rule 4).

In contrast, the following, corresponding schema is structural:

  1. type: object
  2. description: "foo bar object"
  3. properties:
  4. foo:
  5. type: string
  6. pattern: "abc"
  7. bar:
  8. type: integer
  9. metadata:
  10. type: object
  11. properties:
  12. name:
  13. type: string
  14. pattern: "^a"
  15. anyOf:
  16. - properties:
  17. bar:
  18. minimum: 42
  19. required: ["bar"]

Violations of the structural schema rules are reported in the NonStructural condition in the CustomResourceDefinition.

Field pruning

CustomResourceDefinitions store validated resource data in the cluster’s persistence store, etcd. As with native Kubernetes resources such as ConfigMap, if you specify a field that the API server does not recognize, the unknown field is pruned (removed) before being persisted.

Note:

CRDs converted from apiextensions.k8s.io/v1beta1 to apiextensions.k8s.io/v1 might lack structural schemas, and spec.preserveUnknownFields might be true.

For legacy CustomResourceDefinition objects created as apiextensions.k8s.io/v1beta1 with spec.preserveUnknownFields set to true, the following is also true:

  • Pruning is not enabled.
  • You can store arbitrary data.

For compatibility with apiextensions.k8s.io/v1, update your custom resource definitions to:

  1. Use a structural OpenAPI schema.
  2. Set spec.preserveUnknownFields to false.

If you save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * * */5"
  7. image: my-awesome-cron-image
  8. someRandomField: 42

and create it:

  1. kubectl create --validate=false -f my-crontab.yaml -o yaml

your output is similar to:

  1. apiVersion: stable.example.com/v1
  2. kind: CronTab
  3. metadata:
  4. creationTimestamp: 2017-05-31T12:56:35Z
  5. generation: 1
  6. name: my-new-cron-object
  7. namespace: default
  8. resourceVersion: "285"
  9. uid: 9423255b-4600-11e7-af6a-28d2447dc82b
  10. spec:
  11. cronSpec: '* * * * */5'
  12. image: my-awesome-cron-image

Notice that the field someRandomField was pruned.

This example turned off client-side validation to demonstrate the API server’s behavior, by adding the --validate=false command line option. Because the OpenAPI validation schemas are also published to clients, kubectl also checks for unknown fields and rejects those objects well before they would be sent to the API server.

Controlling pruning

By default, all unspecified fields for a custom resource, across all versions, are pruned. It is possible though to opt-out of that for specifc sub-trees of fields by adding x-kubernetes-preserve-unknown-fields: true in the structural OpenAPI v3 validation schema. For example:

  1. type: object
  2. properties:
  3. json:
  4. x-kubernetes-preserve-unknown-fields: true

The field json can store any JSON value, without anything being pruned.

You can also partially specify the permitted JSON; for example:

  1. type: object
  2. properties:
  3. json:
  4. x-kubernetes-preserve-unknown-fields: true
  5. type: object
  6. description: this is arbitrary JSON

With this, only object type values are allowed.

Pruning is enabled again for each specified property (or additionalProperties):

  1. type: object
  2. properties:
  3. json:
  4. x-kubernetes-preserve-unknown-fields: true
  5. type: object
  6. properties:
  7. spec:
  8. type: object
  9. properties:
  10. foo:
  11. type: string
  12. bar:
  13. type: string

With this, the value:

  1. json:
  2. spec:
  3. foo: abc
  4. bar: def
  5. something: x
  6. status:
  7. something: x

is pruned to:

  1. json:
  2. spec:
  3. foo: abc
  4. bar: def
  5. status:
  6. something: x

This means that the something field in the specified spec object is pruned, but everything outside is not.

IntOrString

Nodes in a schema with x-kubernetes-int-or-string: true are excluded from rule 1, such that the following is structural:

  1. type: object
  2. properties:
  3. foo:
  4. x-kubernetes-int-or-string: true

Also those nodes are partially excluded from rule 3 in the sense that the following two patterns are allowed (exactly those, without variations in order to additional fields):

  1. x-kubernetes-int-or-string: true
  2. anyOf:
  3. - type: integer
  4. - type: string
  5. ...

and

  1. x-kubernetes-int-or-string: true
  2. allOf:
  3. - anyOf:
  4. - type: integer
  5. - type: string
  6. - ... # zero or more
  7. ...

With one of those specification, both an integer and a string validate.

In Validation Schema Publishing, x-kubernetes-int-or-string: true is unfolded to one of the two patterns shown above.

RawExtension

RawExtensions (as in runtime.RawExtension defined in k8s.io/apimachinery) holds complete Kubernetes objects, i.e. with apiVersion and kind fields.

It is possible to specify those embedded objects (both completely without constraints or partially specified) by setting x-kubernetes-embedded-resource: true. For example:

  1. type: object
  2. properties:
  3. foo:
  4. x-kubernetes-embedded-resource: true
  5. x-kubernetes-preserve-unknown-fields: true

Here, the field foo holds a complete object, e.g.:

  1. foo:
  2. apiVersion: v1
  3. kind: Pod
  4. spec:
  5. ...

Because x-kubernetes-preserve-unknown-fields: true is specified alongside, nothing is pruned. The use of x-kubernetes-preserve-unknown-fields: true is optional though.

With x-kubernetes-embedded-resource: true, the apiVersion, kind and metadata are implicitly specified and validated.

Serving multiple versions of a CRD

See Custom resource definition versioning for more information about serving multiple versions of your CustomResourceDefinition and migrating your objects from one version to another.

Advanced topics

Finalizers

Finalizers allow controllers to implement asynchronous pre-delete hooks. Custom objects support finalizers similar to built-in objects.

You can add a finalizer to a custom object like this:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. finalizers:
  5. - stable.example.com/finalizer

Identifiers of custom finalizers consist of a domain name, a forward slash and the name of the finalizer. Any controller can add a finalizer to any object’s list of finalizers.

The first delete request on an object with finalizers sets a value for the metadata.deletionTimestamp field but does not delete it. Once this value is set, entries in the finalizers list can only be removed. While any finalizers remain it is also impossible to force the deletion of an object.

When the metadata.deletionTimestamp field is set, controllers watching the object execute any finalizers they handle and remove the finalizer from the list after they are done. It is the responsibility of each controller to remove its finalizer from the list.

The value of metadata.deletionGracePeriodSeconds controls the interval between polling updates.

Once the list of finalizers is empty, meaning all finalizers have been executed, the resource is deleted by Kubernetes.

Validation

Custom resources are validated via OpenAPI v3 schemas, by x-kubernetes-validations when the Validation Rules feature is enabled, and you can add additional validation using admission webhooks.

Additionally, the following restrictions are applied to the schema:

  • These fields cannot be set:
    • definitions,
    • dependencies,
    • deprecated,
    • discriminator,
    • id,
    • patternProperties,
    • readOnly,
    • writeOnly,
    • xml,
    • $ref.
  • The field uniqueItems cannot be set to true.
  • The field additionalProperties cannot be set to false.
  • The field additionalProperties is mutually exclusive with properties.

The x-kubernetes-validations extension can be used to validate custom resources using Common Expression Language (CEL) expressions when the Validation rules feature is enabled and the CustomResourceDefinition schema is a structural schema.

The default field can be set when the Defaulting feature is enabled, which is the case with apiextensions.k8s.io/v1 CustomResourceDefinitions. Defaulting is in GA since 1.17 (beta since 1.16 with the CustomResourceDefaulting feature gate enabled, which is the case automatically for many clusters for beta features).

Refer to the structural schemas section for other restrictions and CustomResourceDefinition features.

The schema is defined in the CustomResourceDefinition. In the following example, the CustomResourceDefinition applies the following validations on the custom object:

  • spec.cronSpec must be a string and must be of the form described by the regular expression.
  • spec.replicas must be an integer and must have a minimum value of 1 and a maximum value of 10.

Save the CustomResourceDefinition to resourcedefinition.yaml:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. name: crontabs.stable.example.com
  5. spec:
  6. group: stable.example.com
  7. versions:
  8. - name: v1
  9. served: true
  10. storage: true
  11. schema:
  12. # openAPIV3Schema is the schema for validating custom objects.
  13. openAPIV3Schema:
  14. type: object
  15. properties:
  16. spec:
  17. type: object
  18. properties:
  19. cronSpec:
  20. type: string
  21. pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$'
  22. image:
  23. type: string
  24. replicas:
  25. type: integer
  26. minimum: 1
  27. maximum: 10
  28. scope: Namespaced
  29. names:
  30. plural: crontabs
  31. singular: crontab
  32. kind: CronTab
  33. shortNames:
  34. - ct

and create it:

  1. kubectl apply -f resourcedefinition.yaml

A request to create a custom object of kind CronTab is rejected if there are invalid values in its fields. In the following example, the custom object contains fields with invalid values:

  • spec.cronSpec does not match the regular expression.
  • spec.replicas is greater than 10.

If you save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * *"
  7. image: my-awesome-cron-image
  8. replicas: 15

and attempt to create it:

  1. kubectl apply -f my-crontab.yaml

then you get an error:

  1. The CronTab "my-new-cron-object" is invalid: []: Invalid value: map[string]interface {}{"apiVersion":"stable.example.com/v1", "kind":"CronTab", "metadata":map[string]interface {}{"name":"my-new-cron-object", "namespace":"default", "deletionTimestamp":interface {}(nil), "deletionGracePeriodSeconds":(*int64)(nil), "creationTimestamp":"2017-09-05T05:20:07Z", "uid":"e14d79e7-91f9-11e7-a598-f0761cb232d1", "clusterName":""}, "spec":map[string]interface {}{"cronSpec":"* * * *", "image":"my-awesome-cron-image", "replicas":15}}:
  2. validation failure list:
  3. spec.cronSpec in body should match '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$'
  4. spec.replicas in body should be less than or equal to 10

If the fields contain valid values, the object creation request is accepted.

Save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * * */5"
  7. image: my-awesome-cron-image
  8. replicas: 5

And create it:

  1. kubectl apply -f my-crontab.yaml
  2. crontab "my-new-cron-object" created

Validation rules

FEATURE STATE: Kubernetes v1.23 [alpha]

Validation rules are in alpha since 1.23 and validate custom resources when the CustomResourceValidationExpressions feature gate is enabled. This feature is only available if the schema is a structural schema.

Validation rules use the Common Expression Language (CEL) to validate custom resource values. Validation rules are included in CustomResourceDefinition schemas using the x-kubernetes-validations extension.

The Rule is scoped to the location of the x-kubernetes-validations extension in the schema. And self variable in the CEL expression is bound to the scoped value.

All validation rules are scoped to the current object: no cross-object or stateful validation rules are supported.

For example:

  1. ...
  2. openAPIV3Schema:
  3. type: object
  4. properties:
  5. spec:
  6. type: object
  7. x-kubernetes-validations:
  8. - rule: "self.minReplicas <= self.replicas"
  9. message: "replicas should be greater than or equal to minReplicas."
  10. - rule: "self.replicas <= self.maxReplicas"
  11. message: "replicas should be smaller than or equal to maxReplicas."
  12. properties:
  13. ...
  14. minReplicas:
  15. type: integer
  16. replicas:
  17. type: integer
  18. maxReplicas:
  19. type: integer
  20. required:
  21. - minReplicas
  22. - replicas
  23. - maxReplicas

will reject a request to create this custom resource:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. minReplicas: 0
  7. replicas: 20
  8. maxReplicas: 10

with the response:

  1. The CronTab "my-new-cron-object" is invalid:
  2. * spec: Invalid value: map[string]interface {}{"maxReplicas":10, "minReplicas":0, "replicas":20}: replicas should be smaller than or equal to maxReplicas.

x-kubernetes-validations could have multiple rules.

The rule under x-kubernetes-validations represents the expression which will be evaluated by CEL.

The message represents the message displayed when validation fails. If message is unset, the above response would be:

  1. The CronTab "my-new-cron-object" is invalid:
  2. * spec: Invalid value: map[string]interface {}{"maxReplicas":10, "minReplicas":0, "replicas":20}: failed rule: self.replicas <= self.maxReplicas

Validation rules are compiled when CRDs are created/updated. The request of CRDs create/update will fail if compilation of validation rules fail. Compilation process includes type checking as well.

The compilation failure:

  • no_matching_overload: this function has no overload for the types of the arguments.

    e.g. Rule like self == true against a field of integer type will get error:

    1. Invalid value: apiextensions.ValidationRule{Rule:"self == true", Message:""}: compilation failed: ERROR: \<input>:1:6: found no matching overload for '_==_' applied to '(int, bool)'
  • no_such_field: does not contain the desired field.

    e.g. Rule like self.nonExistingField > 0 against a non-existing field will return the error:

    1. Invalid value: apiextensions.ValidationRule{Rule:"self.nonExistingField > 0", Message:""}: compilation failed: ERROR: \<input>:1:5: undefined field 'nonExistingField'
  • invalid argument: invalid argument to macros.

    e.g. Rule like has(self) will return error:

    1. Invalid value: apiextensions.ValidationRule{Rule:"has(self)", Message:""}: compilation failed: ERROR: <input>:1:4: invalid argument to has() macro

Validation Rules Examples:

RulePurpose
self.minReplicas <= self.replicas && self.replicas <= self.maxReplicasValidate that the three fields defining replicas are ordered appropriately
‘Available’ in self.stateCountsValidate that an entry with the ‘Available’ key exists in a map
(size(self.list1) == 0) != (size(self.list2) == 0)Validate that one of two lists is non-empty, but not both
!(‘MY_KEY’ in self.map1) || self[‘MY_KEY’].matches(‘^[a-zA-Z]$’)Validate the value of a map for a specific key, if it is in the map
self.envars.filter(e, e.name = ‘MY_ENV’).all(e, e.value.matches(‘^[a-zA-Z]$’)Validate the ‘value’ field of a listMap entry where key field ‘name’ is ‘MY_ENV’
has(self.expired) && self.created + self.ttl < self.expiredValidate that ‘expired’ date is after a ‘create’ date plus a ‘ttl’ duration
self.health.startsWith(‘ok’)Validate a ‘health’ string field has the prefix ‘ok’
self.widgets.exists(w, w.key == ‘x’ && w.foo < 10)Validate that the ‘foo’ property of a listMap item with a key ‘x’ is less than 10
type(self) == string ? self == ‘100%’ : self == 1000Validate an int-or-string field for both the the int and string cases
self.metadata.name.startsWith(self.prefix)Validate that an object’s name has the prefix of another field value
self.set1.all(e, !(e in self.set2))Validate that two listSets are disjoint
size(self.names) == size(self.details) && self.names.all(n, n in self.details)Validate the ‘details’ map is keyed by the items in the ‘names’ listSet

Xref: Supported evaluation on CEL

  • If the Rule is scoped to the root of a resource, it may make field selection into any fields declared in the OpenAPIv3 schema of the CRD as well as apiVersion, kind, metadata.name and metadata.generateName. This includes selection of fields in both the spec and status in the same expression:

    1. ...
    2. openAPIV3Schema:
    3. type: object
    4. x-kubernetes-validations:
    5. - rule: "self.status.availableReplicas >= self.spec.minReplicas"
    6. properties:
    7. spec:
    8. type: object
    9. properties:
    10. minReplicas:
    11. type: integer
    12. ...
    13. status:
    14. type: object
    15. properties:
    16. availableReplicas:
    17. type: integer
  • If the Rule is scoped to an object with properties, the accessible properties of the object are field selectable via self.field and field presence can be checked via has(self.field). Null valued fields are treated as absent fields in CEL expressions.

    1. ...
    2. openAPIV3Schema:
    3. type: object
    4. properties:
    5. spec:
    6. type: object
    7. x-kubernetes-validations:
    8. - rule: "has(self.foo)"
    9. properties:
    10. ...
    11. foo:
    12. type: integer
  • If the Rule is scoped to an object with additionalProperties (i.e. a map) the value of the map are accessible via self[mapKey], map containment can be checked via mapKey in self and all entries of the map are accessible via CEL macros and functions such as self.all(...).

    1. ...
    2. openAPIV3Schema:
    3. type: object
    4. properties:
    5. spec:
    6. type: object
    7. x-kubernetes-validations:
    8. - rule: "self['xyz'].foo > 0"
    9. additionalProperties:
    10. ...
    11. type: object
    12. properties:
    13. foo:
    14. type: integer
  • If the Rule is scoped to an array, the elements of the array are accessible via self[i] and also by macros and functions.

    1. ...
    2. openAPIV3Schema:
    3. type: object
    4. properties:
    5. ...
    6. foo:
    7. type: array
    8. x-kubernetes-validations:
    9. - rule: "size(self) == 1"
    10. items:
    11. type: string
  • If the Rule is scoped to a scalar, self is bound to the scalar value.

    1. ...
    2. openAPIV3Schema:
    3. type: object
    4. properties:
    5. spec:
    6. type: object
    7. properties:
    8. ...
    9. foo:
    10. type: integer
    11. x-kubernetes-validations:
    12. - rule: "self > 0"

Examples:

type of the field rule scoped toRule example
root objectself.status.actual <= self.spec.maxDesired
map of objectsself.components[‘Widget’].priority < 10
list of integersself.values.all(value, value >= 0 && value < 100)
stringself.startsWith(‘kube’)

The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object and from any x-kubernetes-embedded-resource annotated objects. No other metadata properties are accessible.

Unknown data preserved in custom resources via x-kubernetes-preserve-unknown-fields is not accessible in CEL expressions. This includes:

  • Unknown field values that are preserved by object schemas with x-kubernetes-preserve-unknown-fields.
  • Object properties where the property schema is of an “unknown type”. An “unknown type” is recursively defined as:
    • A schema with no type and x-kubernetes-preserve-unknown-fields set to true
    • An array where the items schema is of an “unknown type”
    • An object where the additionalProperties schema is of an “unknown type”

Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression:

escape sequenceproperty name equivalent
underscores
dot.
dash-
slash/
{keyword}__CEL RESERVED keyword

Note: CEL RESERVED keyword needs to match the exact property name to be escaped (e.g. int in the word sprint would not be escaped).

Examples on escaping:

property namerule with escaped property name
namespaceself.namespace > 0
x-propself.xdashprop > 0
redactdself.redactunderscores__d > 0
stringself.startsWith(‘kube’)

Equality on arrays with x-kubernetes-list-type of set or map ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:

  • set: X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.
  • map: X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order.

Here is the declarations type mapping between OpenAPIv3 and CEL type:

OpenAPIv3 typeCEL type
‘object’ with Propertiesobject / “message type”
‘object’ with AdditionalPropertiesmap
‘object’ with x-kubernetes-embedded-typeobject / “message type”, ‘apiVersion’, ‘kind’, ‘metadata.name’ and ‘metadata.generateName’ are implicitly included in schema
‘object’ with x-kubernetes-preserve-unknown-fieldsobject / “message type”, unknown fields are NOT accessible in CEL expression
x-kubernetes-int-or-stringdynamic object that is either an int or a string, type(value) can be used to check the type
‘arraylist
‘array’ with x-kubernetes-list-type=maplist with map based Equality & unique key guarantees
‘array’ with x-kubernetes-list-type=setlist with set based Equality & unique entry guarantees
‘boolean’boolean
‘number’ (all formats)double
‘integer’ (all formats)int (64)
‘null’null_type
‘string’string
‘string’ with format=byte (base64 encoded)bytes
‘string’ with format=datetimestamp (google.protobuf.Timestamp)
‘string’ with format=datetimetimestamp (google.protobuf.Timestamp)
‘string’ with format=durationduration (google.protobuf.Duration)

xref: CEL types, OpenAPI types, Kubernetes Structural Schemas.

Validation functions

Functions available include:

Transition rules

A rule that contains an expression referencing the identifier oldSelf is implicitly considered a transition rule. Transition rules allow schema authors to prevent certain transitions between two otherwise valid states. For example:

  1. type: string
  2. enum: ["low", "medium", "high"]
  3. x-kubernetes-validations:
  4. - rule: "!(self == 'high' && oldSelf == 'low') && !(self == 'low' && oldSelf == 'high')"
  5. message: cannot transition directly between 'low' and 'high'

Unlike other rules, transition rules apply only to operations meeting the following criteria:

  • The operation updates an existing object. Transition rules never apply to create operations.

  • Both an old and a new value exist. It remains possible to check if a value has been added or removed by placing a transition rule on the parent node. Transition rules are never applied to custom resource creation. When placed on an optional field, a transition rule will not apply to update operations that set or unset the field.

  • The path to the schema node being validated by a transition rule must resolve to a node that is comparable between the old object and the new object. For example, list items and their descendants (spec.foo[10].bar) can’t necessarily be correlated between an existing object and a later update to the same object.

Errors will be generated on CRD writes if a schema node contains a transition rule that can never be applied, e.g. “path: update rule rule cannot be set on schema because the schema or its parent schema is not mergeable”.

Transition rules are only allowed on correlatable portions of a schema. A portion of the schema is correlatable if all array parent schemas are of type x-kubernetes-list-type=map; any setor atomicarray parent schemas make it impossible to unambiguously correlate a self with oldSelf.

Here are some examples for transition rules:

Transition rules examples
Use CaseRule
Immutabilityself.foo == oldSelf.foo
Prevent modification/removal once assignedoldSelf != ‘bar’ || self == ‘bar’ or !has(oldSelf.field) || has(self.field)
Append-only setself.all(element, element in oldSelf)
If previous value was X, new value can only be A or B, not Y or ZoldSelf != ‘X’ || self in [‘A’, ‘B’]
Monotonic (non-decreasing) countersself >= oldSelf

Resource use by validation functions

When you create or update a CustomResourceDefinition that uses validation rules, the API server checks the likely impact of running those validation rules. If a rule is estimated to be prohibitively expensive to execute, the API server rejects the create or update operation, and returns an error message. A similar system is used at runtime that observes the actions the interpreter takes. If the interpreter executes too many instructions, execution of the rule will be halted, and an error will result. Each CustomResourceDefinition is also allowed a certain amount of resources to finish executing all of its validation rules. If the sum total of its rules are estimated at creation time to go over that limit, then a validation error will also occur.

You are unlikely to encounter issues with the resource budget for validation if you only specify rules that always take the same amount of time regardless of how large their input is. For example, a rule that asserts that self.foo == 1 does not by itself have any risk of rejection on validation resource budget groups. But if foo is a string and you define a validation rule self.foo.contains("someString"), that rule takes longer to execute depending on how long foo is. Another example would be if foo were an array, and you specified a validation rule self.foo.all(x, x > 5). The cost system always assumes the worst-case scenario if a limit on the length of foo is not given, and this will happen for anything that can be iterated over (lists, maps, etc.).

Because of this, it is considered best practice to put a limit via maxItems, maxProperties, and maxLength for anything that will be processed in a validation rule in order to prevent validation errors during cost estimation. For example, given this schema with one rule:

  1. openAPIV3Schema:
  2. type: object
  3. properties:
  4. foo:
  5. type: array
  6. items:
  7. type: string
  8. x-kubernetes-validations:
  9. - rule: "self.all(x, x.contains('a string'))"

then the API server rejects this rule on validation budget grounds with error:

  1. spec.validation.openAPIV3Schema.properties[spec].properties[foo].x-kubernetes-validations[0].rule: Forbidden:
  2. CEL rule exceeded budget by more than 100x (try simplifying the rule, or adding maxItems, maxProperties, and
  3. maxLength where arrays, maps, and strings are used)

The rejection happens because self.all implies calling contains() on every string in foo, which in turn will check the given string to see if it contains 'a string'. Without limits, this is a very expensive rule.

If you do not specify any validation limit, the estimated cost of this rule will exceed the per-rule cost limit. But if you add limits in the appropriate places, the rule will be allowed:

  1. openAPIV3Schema:
  2. type: object
  3. properties:
  4. foo:
  5. type: array
  6. maxItems: 25
  7. items:
  8. type: string
  9. maxLength: 10
  10. x-kubernetes-validations:
  11. - rule: "self.all(x, x.contains('a string'))"

The cost estimation system takes into account how many times the rule will be executed in addition to the estimated cost of the rule itself. For instance, the following rule will have the same estimated cost as the previous example (despite the rule now being defined on the individual array items):

  1. openAPIV3Schema:
  2. type: object
  3. properties:
  4. foo:
  5. type: array
  6. maxItems: 25
  7. items:
  8. type: string
  9. x-kubernetes-validations:
  10. - rule: "self.contains('a string'))"
  11. maxLength: 10

If a list inside of a list has a validation rule that uses self.all, that is significantly more expensive than a non-nested list with the same rule. A rule that would have been allowed on a non-nested list might need lower limits set on both nested lists in order to be allowed. For example, even without having limits set, the following rule is allowed:

  1. openAPIV3Schema:
  2. type: object
  3. properties:
  4. foo:
  5. type: array
  6. items:
  7. type: integer
  8. x-kubernetes-validations:
  9. - rule: "self.all(x, x == 5)"

But the same rule on the following schema (with a nested array added) produces a validation error:

  1. openAPIV3Schema:
  2. type: object
  3. properties:
  4. foo:
  5. type: array
  6. items:
  7. type: array
  8. items:
  9. type: integer
  10. x-kubernetes-validations:
  11. - rule: "self.all(x, x == 5)"

This is because each item of foo is itself an array, and each subarray in turn calls self.all. Avoid nested lists and maps if possible where validation rules are used.

Defaulting

Note: To use defaulting, your CustomResourceDefinition must use API version apiextensions.k8s.io/v1.

Defaulting allows to specify default values in the OpenAPI v3 validation schema:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. name: crontabs.stable.example.com
  5. spec:
  6. group: stable.example.com
  7. versions:
  8. - name: v1
  9. served: true
  10. storage: true
  11. schema:
  12. # openAPIV3Schema is the schema for validating custom objects.
  13. openAPIV3Schema:
  14. type: object
  15. properties:
  16. spec:
  17. type: object
  18. properties:
  19. cronSpec:
  20. type: string
  21. pattern: '^(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$'
  22. default: "5 0 * * *"
  23. image:
  24. type: string
  25. replicas:
  26. type: integer
  27. minimum: 1
  28. maximum: 10
  29. default: 1
  30. scope: Namespaced
  31. names:
  32. plural: crontabs
  33. singular: crontab
  34. kind: CronTab
  35. shortNames:
  36. - ct

With this both cronSpec and replicas are defaulted:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. image: my-awesome-cron-image

leads to

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "5 0 * * *"
  7. image: my-awesome-cron-image
  8. replicas: 1

Defaulting happens on the object

  • in the request to the API server using the request version defaults,
  • when reading from etcd using the storage version defaults,
  • after mutating admission plugins with non-empty patches using the admission webhook object version defaults.

Defaults applied when reading data from etcd are not automatically written back to etcd. An update request via the API is required to persist those defaults back into etcd.

Default values must be pruned (with the exception of defaults for metadata fields) and must validate against a provided schema.

Default values for metadata fields of x-kubernetes-embedded-resources: true nodes (or parts of a default value covering metadata) are not pruned during CustomResourceDefinition creation, but through the pruning step during handling of requests.

Defaulting and Nullable

New in 1.20: null values for fields that either don’t specify the nullable flag, or give it a false value, will be pruned before defaulting happens. If a default is present, it will be applied. When nullable is true, null values will be conserved and won’t be defaulted.

For example, given the OpenAPI schema below:

  1. type: object
  2. properties:
  3. spec:
  4. type: object
  5. properties:
  6. foo:
  7. type: string
  8. nullable: false
  9. default: "default"
  10. bar:
  11. type: string
  12. nullable: true
  13. baz:
  14. type: string

creating an object with null values for foo and bar and baz

  1. spec:
  2. foo: null
  3. bar: null
  4. baz: null

leads to

  1. spec:
  2. foo: "default"
  3. bar: null

with foo pruned and defaulted because the field is non-nullable, bar maintaining the null value due to nullable: true, and baz pruned because the field is non-nullable and has no default.

Publish Validation Schema in OpenAPI v2

CustomResourceDefinition OpenAPI v3 validation schemas which are structural and enable pruning are published as part of the OpenAPI v2 spec from Kubernetes API server.

The kubectl command-line tool consumes the published schema to perform client-side validation (kubectl create and kubectl apply), schema explanation (kubectl explain) on custom resources. The published schema can be consumed for other purposes as well, like client generation or documentation.

The OpenAPI v3 validation schema is converted to OpenAPI v2 schema, and show up in definitions and paths fields in the OpenAPI v2 spec.

The following modifications are applied during the conversion to keep backwards compatibility with kubectl in previous 1.13 version. These modifications prevent kubectl from being over-strict and rejecting valid OpenAPI schemas that it doesn’t understand. The conversion won’t modify the validation schema defined in CRD, and therefore won’t affect validation in the API server.

  1. The following fields are removed as they aren’t supported by OpenAPI v2 (in future versions OpenAPI v3 will be used without these restrictions)
    • The fields allOf, anyOf, oneOf and not are removed
  2. If nullable: true is set, we drop type, nullable, items and properties because OpenAPI v2 is not able to express nullable. To avoid kubectl to reject good objects, this is necessary.

Additional printer columns

The kubectl tool relies on server-side output formatting. Your cluster’s API server decides which columns are shown by the kubectl get command. You can customize these columns for a CustomResourceDefinition. The following example adds the Spec, Replicas, and Age columns.

Save the CustomResourceDefinition to resourcedefinition.yaml:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. name: crontabs.stable.example.com
  5. spec:
  6. group: stable.example.com
  7. scope: Namespaced
  8. names:
  9. plural: crontabs
  10. singular: crontab
  11. kind: CronTab
  12. shortNames:
  13. - ct
  14. versions:
  15. - name: v1
  16. served: true
  17. storage: true
  18. schema:
  19. openAPIV3Schema:
  20. type: object
  21. properties:
  22. spec:
  23. type: object
  24. properties:
  25. cronSpec:
  26. type: string
  27. image:
  28. type: string
  29. replicas:
  30. type: integer
  31. additionalPrinterColumns:
  32. - name: Spec
  33. type: string
  34. description: The cron spec defining the interval a CronJob is run
  35. jsonPath: .spec.cronSpec
  36. - name: Replicas
  37. type: integer
  38. description: The number of jobs launched by the CronJob
  39. jsonPath: .spec.replicas
  40. - name: Age
  41. type: date
  42. jsonPath: .metadata.creationTimestamp

Create the CustomResourceDefinition:

  1. kubectl apply -f resourcedefinition.yaml

Create an instance using the my-crontab.yaml from the previous section.

Invoke the server-side printing:

  1. kubectl get crontab my-new-cron-object

Notice the NAME, SPEC, REPLICAS, and AGE columns in the output:

  1. NAME SPEC REPLICAS AGE
  2. my-new-cron-object * * * * * 1 7s

Note: The NAME column is implicit and does not need to be defined in the CustomResourceDefinition.

Priority

Each column includes a priority field. Currently, the priority differentiates between columns shown in standard view or wide view (using the -o wide flag).

  • Columns with priority 0 are shown in standard view.
  • Columns with priority greater than 0 are shown only in wide view.

Type

A column’s type field can be any of the following (compare OpenAPI v3 data types):

  • integer – non-floating-point numbers
  • number – floating point numbers
  • string – strings
  • booleantrue or false
  • date – rendered differentially as time since this timestamp.

If the value inside a CustomResource does not match the type specified for the column, the value is omitted. Use CustomResource validation to ensure that the value types are correct.

Format

A column’s format field can be any of the following:

  • int32
  • int64
  • float
  • double
  • byte
  • date
  • date-time
  • password

The column’s format controls the style used when kubectl prints the value.

Subresources

Custom resources support /status and /scale subresources.

The status and scale subresources can be optionally enabled by defining them in the CustomResourceDefinition.

Status subresource

When the status subresource is enabled, the /status subresource for the custom resource is exposed.

  • The status and the spec stanzas are represented by the .status and .spec JSONPaths respectively inside of a custom resource.

  • PUT requests to the /status subresource take a custom resource object and ignore changes to anything except the status stanza.

  • PUT requests to the /status subresource only validate the status stanza of the custom resource.

  • PUT/POST/PATCH requests to the custom resource ignore changes to the status stanza.

  • The .metadata.generation value is incremented for all changes, except for changes to .metadata or .status.

  • Only the following constructs are allowed at the root of the CRD OpenAPI validation schema:

    • description
    • example
    • exclusiveMaximum
    • exclusiveMinimum
    • externalDocs
    • format
    • items
    • maximum
    • maxItems
    • maxLength
    • minimum
    • minItems
    • minLength
    • multipleOf
    • pattern
    • properties
    • required
    • title
    • type
    • uniqueItems

Scale subresource

When the scale subresource is enabled, the /scale subresource for the custom resource is exposed. The autoscaling/v1.Scale object is sent as the payload for /scale.

To enable the scale subresource, the following fields are defined in the CustomResourceDefinition.

  • specReplicasPath defines the JSONPath inside of a custom resource that corresponds to scale.spec.replicas.

    • It is a required value.
    • Only JSONPaths under .spec and with the dot notation are allowed.
    • If there is no value under the specReplicasPath in the custom resource, the /scale subresource will return an error on GET.
  • statusReplicasPath defines the JSONPath inside of a custom resource that corresponds to scale.status.replicas.

    • It is a required value.
    • Only JSONPaths under .status and with the dot notation are allowed.
    • If there is no value under the statusReplicasPath in the custom resource, the status replica value in the /scale subresource will default to 0.
  • labelSelectorPath defines the JSONPath inside of a custom resource that corresponds to Scale.Status.Selector.

    • It is an optional value.
    • It must be set to work with HPA.
    • Only JSONPaths under .status or .spec and with the dot notation are allowed.
    • If there is no value under the labelSelectorPath in the custom resource, the status selector value in the /scale subresource will default to the empty string.
    • The field pointed by this JSON path must be a string field (not a complex selector struct) which contains a serialized label selector in string form.

In the following example, both status and scale subresources are enabled.

Save the CustomResourceDefinition to resourcedefinition.yaml:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. name: crontabs.stable.example.com
  5. spec:
  6. group: stable.example.com
  7. versions:
  8. - name: v1
  9. served: true
  10. storage: true
  11. schema:
  12. openAPIV3Schema:
  13. type: object
  14. properties:
  15. spec:
  16. type: object
  17. properties:
  18. cronSpec:
  19. type: string
  20. image:
  21. type: string
  22. replicas:
  23. type: integer
  24. status:
  25. type: object
  26. properties:
  27. replicas:
  28. type: integer
  29. labelSelector:
  30. type: string
  31. # subresources describes the subresources for custom resources.
  32. subresources:
  33. # status enables the status subresource.
  34. status: {}
  35. # scale enables the scale subresource.
  36. scale:
  37. # specReplicasPath defines the JSONPath inside of a custom resource that corresponds to Scale.Spec.Replicas.
  38. specReplicasPath: .spec.replicas
  39. # statusReplicasPath defines the JSONPath inside of a custom resource that corresponds to Scale.Status.Replicas.
  40. statusReplicasPath: .status.replicas
  41. # labelSelectorPath defines the JSONPath inside of a custom resource that corresponds to Scale.Status.Selector.
  42. labelSelectorPath: .status.labelSelector
  43. scope: Namespaced
  44. names:
  45. plural: crontabs
  46. singular: crontab
  47. kind: CronTab
  48. shortNames:
  49. - ct

And create it:

  1. kubectl apply -f resourcedefinition.yaml

After the CustomResourceDefinition object has been created, you can create custom objects.

If you save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * * */5"
  7. image: my-awesome-cron-image
  8. replicas: 3

and create it:

  1. kubectl apply -f my-crontab.yaml

Then new namespaced RESTful API endpoints are created at:

  1. /apis/stable.example.com/v1/namespaces/*/crontabs/status

and

  1. /apis/stable.example.com/v1/namespaces/*/crontabs/scale

A custom resource can be scaled using the kubectl scale command. For example, the following command sets .spec.replicas of the custom resource created above to 5:

  1. kubectl scale --replicas=5 crontabs/my-new-cron-object
  2. crontabs "my-new-cron-object" scaled
  3. kubectl get crontabs my-new-cron-object -o jsonpath='{.spec.replicas}'
  4. 5

You can use a PodDisruptionBudget to protect custom resources that have the scale subresource enabled.

Categories

Categories is a list of grouped resources the custom resource belongs to (eg. all). You can use kubectl get <category-name> to list the resources belonging to the category.

The following example adds all in the list of categories in the CustomResourceDefinition and illustrates how to output the custom resource using kubectl get all.

Save the following CustomResourceDefinition to resourcedefinition.yaml:

  1. apiVersion: apiextensions.k8s.io/v1
  2. kind: CustomResourceDefinition
  3. metadata:
  4. name: crontabs.stable.example.com
  5. spec:
  6. group: stable.example.com
  7. versions:
  8. - name: v1
  9. served: true
  10. storage: true
  11. schema:
  12. openAPIV3Schema:
  13. type: object
  14. properties:
  15. spec:
  16. type: object
  17. properties:
  18. cronSpec:
  19. type: string
  20. image:
  21. type: string
  22. replicas:
  23. type: integer
  24. scope: Namespaced
  25. names:
  26. plural: crontabs
  27. singular: crontab
  28. kind: CronTab
  29. shortNames:
  30. - ct
  31. # categories is a list of grouped resources the custom resource belongs to.
  32. categories:
  33. - all

and create it:

  1. kubectl apply -f resourcedefinition.yaml

After the CustomResourceDefinition object has been created, you can create custom objects.

Save the following YAML to my-crontab.yaml:

  1. apiVersion: "stable.example.com/v1"
  2. kind: CronTab
  3. metadata:
  4. name: my-new-cron-object
  5. spec:
  6. cronSpec: "* * * * */5"
  7. image: my-awesome-cron-image

and create it:

  1. kubectl apply -f my-crontab.yaml

You can specify the category when using kubectl get:

  1. kubectl get all

and it will include the custom resources of kind CronTab:

  1. NAME AGE
  2. crontabs/my-new-cron-object 3s

What’s next