Operator Framework questions
kick things off here.
1. Compatibility
Terminology wise, checking this is still the canonical definition from
a concept point of view?
https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
I know there are several tools which help build operators
(kubebuilder, KUDO, kopf etc.), I wanted to ask about compatibility.
From a developers point of view these are all different obviously, but
what about from an end users perspective?
2. Relationship to Operator Hub
Chris also mentioned the intent to move the Operator Hub to CNCF in
https://github.com/cncf/toc/pull/303. Do you see that being under the
Operator Framework project, or under a standalone project? I think
that's interesting given the generic nature of Operators (as I
understand them above) and the Operator Framework as a specific tool.
For instance, can a kopf operator be added to Operator Hub today?
3. Relationship to Helm
As Helm is a fairly well established CNCF project, I'd be interested
in the relationship between the Operator Framework and Helm. How
involved are the Helm maintainers in the integration with the Operator
Framework?
Regarding the Operator Hub point as well. One thing I feel we should
strive to avoid plays out in my mind like:
User: Where do I find applications I can install on my Kubernetes cluster?
Helpful internet person (HIP): Why type of applications are you using?
User: ?
HIP: Helm or Operators?
User: ?
HIP: Never-mind, do to Helm Hub and Operator Hub
User: Thanks! I presume these come from two different organisations?
HIP: Oh, no, both are CNCF projects
I know their are benefits to different tools and approaches under the
CNCF banner, but when it comes to generic descriptions (Applications!)
and end user distribution it's probably worth a conversation between
multiple projects.
Thanks
Gareth
--
Gareth Rushgrove
@garethr
devopsweekly.com
garethr.dev
Thanks for the presentation, I had a few questions and thought I'd
kick things off here.
1. Compatibility
Terminology wise, checking this is still the canonical definition from
a concept point of view?
https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
I know there are several tools which help build operators
(kubebuilder, KUDO, kopf etc.), I wanted to ask about compatibility.
From a developers point of view these are all different obviously, but
what about from an end users perspective?
2. Relationship to Operator Hub
Chris also mentioned the intent to move the Operator Hub to CNCF in
https://github.com/cncf/toc/pull/303. Do you see that being under the
Operator Framework project, or under a standalone project? I think
that's interesting given the generic nature of Operators (as I
understand them above) and the Operator Framework as a specific tool.
For instance, can a kopf operator be added to Operator Hub today?
3. Relationship to Helm
As Helm is a fairly well established CNCF project, I'd be interested
in the relationship between the Operator Framework and Helm. How
involved are the Helm maintainers in the integration with the Operator
Framework?
Regarding the Operator Hub point as well. One thing I feel we should
strive to avoid plays out in my mind like:
User: Where do I find applications I can install on my Kubernetes cluster?
Helpful internet person (HIP): Why type of applications are you using?
User: ?
HIP: Helm or Operators?
User: ?
HIP: Never-mind, do to Helm Hub and Operator Hub
User: Thanks! I presume these come from two different organisations?
HIP: Oh, no, both are CNCF projects
I know their are benefits to different tools and approaches under the
CNCF banner, but when it comes to generic descriptions (Applications!)
and end user distribution it's probably worth a conversation between
multiple projects.
Thanks
Gareth
--
Gareth Rushgrove
@garethr
devopsweekly.com
garethr.dev
Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
Hi Gareth,sorry for the late reply - responding inline. Thanks for the questions - keep them coming!On Wed, Oct 9, 2019 at 6:22 PM Gareth Rushgrove <gareth@...> wrote:Thanks for the presentation, I had a few questions and thought I'd
kick things off here.
1. Compatibility
Terminology wise, checking this is still the canonical definition from
a concept point of view?
https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
I know there are several tools which help build operators
(kubebuilder, KUDO, kopf etc.), I wanted to ask about compatibility.
From a developers point of view these are all different obviously, but
what about from an end users perspective?
I think this definition is still valid. An Operator is a custom controller with its own CRDs serving as the user interface (exceptions exist).The Framework is designed to be open to the way the Operator itself is built. The packaging format and OLM don't depend on the SDK.However there is of course good integration between the SDK and OLM.
2. Relationship to Operator Hub
Chris also mentioned the intent to move the Operator Hub to CNCF in
https://github.com/cncf/toc/pull/303. Do you see that being under the
Operator Framework project, or under a standalone project? I think
that's interesting given the generic nature of Operators (as I
understand them above) and the Operator Framework as a specific tool.
For instance, can a kopf operator be added to Operator Hub today?
It is under the Framework: https://github.com/operator-framework/operatorhub.ioAnd yes, a kopf operator, or a kubebuilder operator, or KUDO or something entirely custom can be added to this. They enabling part is the packaging format that drives the indexing and visual display.
3. Relationship to Helm
As Helm is a fairly well established CNCF project, I'd be interested
in the relationship between the Operator Framework and Helm. How
involved are the Helm maintainers in the integration with the Operator
Framework?
The Operator SDK project maintainers collaborate with the Helm maintainers, primarily on the Helm-based Operator pattern the SDK provides.Helm in general focusses on Day 1 operations: bundle & install using an external tool. Operators include that and put emphasis on Day 2 operations: orchestrated updates, complex re-configuration without re-deploying from scratch, backup / restore, failover / failback, etc with kubectl. Helm serves stateless applications very well, that can be entirely maintained using the built-in functionality in k8s. Operators serve those too but provide an evolution to templating package manifests by extending the built-in k8s functionality, thus enabling k8s to run stateful applications and advanced, distributed systems.Regarding the Operator Hub point as well. One thing I feel we should
strive to avoid plays out in my mind like:
User: Where do I find applications I can install on my Kubernetes cluster?
Helpful internet person (HIP): Why type of applications are you using?
User: ?
HIP: Helm or Operators?
User: ?
HIP: Never-mind, do to Helm Hub and Operator Hub
User: Thanks! I presume these come from two different organisations?
HIP: Oh, no, both are CNCF projectsI get this sentiment. I think it's important to point out that Operators and Applications are different concepts. I'd like to think of Operators as managed service providers to get managed instances of applications. So the question a user would be asking instead: do I want to enable my cluster to serve me that application and manage it or do I want to run it myself?
I know their are benefits to different tools and approaches under the
CNCF banner, but when it comes to generic descriptions (Applications!)
and end user distribution it's probably worth a conversation between
multiple projects.Yes, agreed!
Thanks
Gareth
--
Gareth Rushgrove
@garethr
devopsweekly.com
garethr.dev
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
On Fri, 11 Oct 2019 at 13:08, Daniel Messer <dmesser@...> wrote:Hi Gareth,sorry for the late reply - responding inline. Thanks for the questions - keep them coming!On Wed, Oct 9, 2019 at 6:22 PM Gareth Rushgrove <gareth@...> wrote:Thanks for the presentation, I had a few questions and thought I'd
kick things off here.
1. Compatibility
Terminology wise, checking this is still the canonical definition from
a concept point of view?
https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
I know there are several tools which help build operators
(kubebuilder, KUDO, kopf etc.), I wanted to ask about compatibility.
From a developers point of view these are all different obviously, but
what about from an end users perspective?
I think this definition is still valid. An Operator is a custom controller with its own CRDs serving as the user interface (exceptions exist).The Framework is designed to be open to the way the Operator itself is built. The packaging format and OLM don't depend on the SDK.However there is of course good integration between the SDK and OLM.
2. Relationship to Operator Hub
Chris also mentioned the intent to move the Operator Hub to CNCF in
https://github.com/cncf/toc/pull/303. Do you see that being under the
Operator Framework project, or under a standalone project? I think
that's interesting given the generic nature of Operators (as I
understand them above) and the Operator Framework as a specific tool.
For instance, can a kopf operator be added to Operator Hub today?
It is under the Framework: https://github.com/operator-framework/operatorhub.ioAnd yes, a kopf operator, or a kubebuilder operator, or KUDO or something entirely custom can be added to this. They enabling part is the packaging format that drives the indexing and visual display.Are there any examples of non-operator-framework operators on Operator Hub today?
3. Relationship to Helm
As Helm is a fairly well established CNCF project, I'd be interested
in the relationship between the Operator Framework and Helm. How
involved are the Helm maintainers in the integration with the Operator
Framework?
The Operator SDK project maintainers collaborate with the Helm maintainers, primarily on the Helm-based Operator pattern the SDK provides.Helm in general focusses on Day 1 operations: bundle & install using an external tool. Operators include that and put emphasis on Day 2 operations: orchestrated updates, complex re-configuration without re-deploying from scratch, backup / restore, failover / failback, etc with kubectl. Helm serves stateless applications very well, that can be entirely maintained using the built-in functionality in k8s. Operators serve those too but provide an evolution to templating package manifests by extending the built-in k8s functionality, thus enabling k8s to run stateful applications and advanced, distributed systems.Regarding the Operator Hub point as well. One thing I feel we should
strive to avoid plays out in my mind like:
User: Where do I find applications I can install on my Kubernetes cluster?
Helpful internet person (HIP): Why type of applications are you using?
User: ?
HIP: Helm or Operators?
User: ?
HIP: Never-mind, do to Helm Hub and Operator Hub
User: Thanks! I presume these come from two different organisations?
HIP: Oh, no, both are CNCF projectsI get this sentiment. I think it's important to point out that Operators and Applications are different concepts. I'd like to think of Operators as managed service providers to get managed instances of applications. So the question a user would be asking instead: do I want to enable my cluster to serve me that application and manage it or do I want to run it myself?Thanks for the answers.I think it's fine for producers of applications to appreciate those technical different concerns, but nearly no end user is doing to ask such a complex question - they just want to run (say) MySQL.
I definitely think it would be good to talk about application stores in general in the SIG, and include folks from Helm and other operator developer tooling. I'd love to hear from maintainers of Helm and other operator tools what they think.Gareth
I know their are benefits to different tools and approaches under the
CNCF banner, but when it comes to generic descriptions (Applications!)
and end user distribution it's probably worth a conversation between
multiple projects.Yes, agreed!
Thanks
Gareth
--
Gareth Rushgrove
@garethr
devopsweekly.com
garethr.dev
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
--
Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
On Sat, Oct 12, 2019 at 11:24 AM Gareth Rushgrove <gareth@...> wrote:On Fri, 11 Oct 2019 at 13:08, Daniel Messer <dmesser@...> wrote:Hi Gareth,sorry for the late reply - responding inline. Thanks for the questions - keep them coming!On Wed, Oct 9, 2019 at 6:22 PM Gareth Rushgrove <gareth@...> wrote:Thanks for the presentation, I had a few questions and thought I'd
kick things off here.
1. Compatibility
Terminology wise, checking this is still the canonical definition from
a concept point of view?
https://kubernetes.io/docs/concepts/extend-kubernetes/operator/
I know there are several tools which help build operators
(kubebuilder, KUDO, kopf etc.), I wanted to ask about compatibility.
From a developers point of view these are all different obviously, but
what about from an end users perspective?
I think this definition is still valid. An Operator is a custom controller with its own CRDs serving as the user interface (exceptions exist).The Framework is designed to be open to the way the Operator itself is built. The packaging format and OLM don't depend on the SDK.However there is of course good integration between the SDK and OLM.
2. Relationship to Operator Hub
Chris also mentioned the intent to move the Operator Hub to CNCF in
https://github.com/cncf/toc/pull/303. Do you see that being under the
Operator Framework project, or under a standalone project? I think
that's interesting given the generic nature of Operators (as I
understand them above) and the Operator Framework as a specific tool.
For instance, can a kopf operator be added to Operator Hub today?
It is under the Framework: https://github.com/operator-framework/operatorhub.ioAnd yes, a kopf operator, or a kubebuilder operator, or KUDO or something entirely custom can be added to this. They enabling part is the packaging format that drives the indexing and visual display.Are there any examples of non-operator-framework operators on Operator Hub today?There are lots of Operators that are not written with the SDK there. Every Operator on OperatorHub.io however is packaged for OLM to enable the visual display, versioning and install instructions.Examples are Strimzi Kafka, Synposys, AWS Service Operator or Spark.
3. Relationship to Helm
As Helm is a fairly well established CNCF project, I'd be interested
in the relationship between the Operator Framework and Helm. How
involved are the Helm maintainers in the integration with the Operator
Framework?
The Operator SDK project maintainers collaborate with the Helm maintainers, primarily on the Helm-based Operator pattern the SDK provides.Helm in general focusses on Day 1 operations: bundle & install using an external tool. Operators include that and put emphasis on Day 2 operations: orchestrated updates, complex re-configuration without re-deploying from scratch, backup / restore, failover / failback, etc with kubectl. Helm serves stateless applications very well, that can be entirely maintained using the built-in functionality in k8s. Operators serve those too but provide an evolution to templating package manifests by extending the built-in k8s functionality, thus enabling k8s to run stateful applications and advanced, distributed systems.Regarding the Operator Hub point as well. One thing I feel we should
strive to avoid plays out in my mind like:
User: Where do I find applications I can install on my Kubernetes cluster?
Helpful internet person (HIP): Why type of applications are you using?
User: ?
HIP: Helm or Operators?
User: ?
HIP: Never-mind, do to Helm Hub and Operator Hub
User: Thanks! I presume these come from two different organisations?
HIP: Oh, no, both are CNCF projectsI get this sentiment. I think it's important to point out that Operators and Applications are different concepts. I'd like to think of Operators as managed service providers to get managed instances of applications. So the question a user would be asking instead: do I want to enable my cluster to serve me that application and manage it or do I want to run it myself?Thanks for the answers.I think it's fine for producers of applications to appreciate those technical different concerns, but nearly no end user is doing to ask such a complex question - they just want to run (say) MySQL.I think there are nuances here. For a development environment that may be true, but for someone who's responsible for running a production workload based on MySQL it's going to make a big difference whether they end up being responsible for the entire database lifecycle or can defer that to a piece of software or a service.
I definitely think it would be good to talk about application stores in general in the SIG, and include folks from Helm and other operator developer tooling. I'd love to hear from maintainers of Helm and other operator tools what they think.Gareth
I know their are benefits to different tools and approaches under the
CNCF banner, but when it comes to generic descriptions (Applications!)
and end user distribution it's probably worth a conversation between
multiple projects.Yes, agreed!
Thanks
Gareth
--
Gareth Rushgrove
@garethr
devopsweekly.com
garethr.dev
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
----Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
Note this isn't about the Operator SDK, but given the Operator Hub isI agree that tying the Operator SDK and Operator Hub together is
in scope of the Operator Framework, it appears to be the framework
submitted to the TOC https://github.com/cncf/toc/pull/303.
counterproductive. Is there a reason why they cannot be separated?
In my mind, *how* a k8s application is built (Operator SDK) is a
different thing than *where* that application is published (Operator
Hub).
Best,
-jay
On Mon, 2019-10-14 at 10:17 +0100, Gareth Rushgrove wrote:
> Note this isn't about the Operator SDK, but given the Operator Hub is
> in scope of the Operator Framework, it appears to be the framework
> submitted to the TOC https://github.com/cncf/toc/pull/303.
I agree that tying the Operator SDK and Operator Hub together is
counterproductive. Is there a reason why they cannot be separated?
In my mind, *how* a k8s application is built (Operator SDK) is a
different thing than *where* that application is published (Operator
Hub).
Best,
-jay
Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
I presume OLM is Operator Lifecycle Manager?
Agree with that Jay. The connection comes more from the OLM side since this is where the metadata format is defined that drives the OperatorHub.io index.
https://github.com/operator-framework/operator-lifecycle-manager
This sounds like OperatorHub requires Operators to use OLM?
Are there any examples, or is it possible, for a Kudo (or other
operator tooling) to use OLM?
I agree with Jay, separating how apps are build from where they are
published would appear important here, otherwise we're going to have
them coupled and we'll have one app store per toolkit before we know
it.
Gareth
On Mon, Oct 14, 2019 at 4:18 PM Jay Pipes <jaypipes@...> wrote:
On Mon, 2019-10-14 at 10:17 +0100, Gareth Rushgrove wrote:Note this isn't about the Operator SDK, but given the Operator Hub isI agree that tying the Operator SDK and Operator Hub together is
in scope of the Operator Framework, it appears to be the framework
submitted to the TOC https://github.com/cncf/toc/pull/303.
counterproductive. Is there a reason why they cannot be separated?
In my mind, *how* a k8s application is built (Operator SDK) is a
different thing than *where* that application is published (Operator
Hub).
Best,
-jay
--
Daniel Messer
He / Him / His
Product Manager OpenShift
Red Hat GmbH
Wankelstrasse 5
70563 Stuttgart
dmesser@...
--
Gareth Rushgrove
@garethr
garethr.dev
devopsweekly.com
Helm in general focusses on Day 1 operations: bundle & install using an external tool. Operators include that and put emphasis on Day 2 operations: orchestrated updates, complex re-configuration without re-deploying from scratch, backup / restore, failover / failback, etc with kubectl. Helm serves stateless applications very well, that can be entirely maintained using the built-in functionality in k8s. Operators serve those too but provide an evolution to templating package manifests by extending the built-in k8s functionality, thus enabling k8s to run stateful applications and advanced, distributed systems.
a1. I want to install MySQLa2. Visits application store from CNCFa3. Oh, there are several optionsa4. Reads tradeoffsa5 Installs
On Mon, 14 Oct 2019 at 16:36, Daniel Messer <dmesser@...> wrote:>> Agree with that Jay. The connection comes more from the OLM side since this is where the metadata format is defined that drives the OperatorHub.io index.>I presume OLM is Operator Lifecycle Manager?https://github.com/operator-framework/operator-lifecycle-managerThis sounds like OperatorHub requires Operators to use OLM?Are there any examples, or is it possible, for a Kudo (or otheroperator tooling) to use OLM?I agree with Jay, separating how apps are build from where they arepublished would appear important here, otherwise we're going to havethem coupled and we'll have one app store per toolkit before we knowit.Gareth>> On Mon, Oct 14, 2019 at 4:18 PM Jay Pipes <jaypipes@...> wrote:>>>> On Mon, 2019-10-14 at 10:17 +0100, Gareth Rushgrove wrote:>> > Note this isn't about the Operator SDK, but given the Operator Hub is>> > in scope of the Operator Framework, it appears to be the framework>> > submitted to the TOC https://github.com/cncf/toc/pull/303.>>>> I agree that tying the Operator SDK and Operator Hub together is>> counterproductive. Is there a reason why they cannot be separated?>>>> In my mind, *how* a k8s application is built (Operator SDK) is a>> different thing than *where* that application is published (Operator>> Hub).>>>> Best,>> -jay>>>>> -->> Daniel Messer>> He / Him / His>> Product Manager OpenShift>> Red Hat GmbH>> Wankelstrasse 5>> 70563 Stuttgart>> dmesser@...--Gareth Rushgrove@garethrgarethr.devdevopsweekly.com
On Mon, 14 Oct 2019 at 16:36, Daniel Messer <dmesser@...> wrote:
>
> Agree with that Jay. The connection comes more from the OLM side since this is where the metadata format is defined that drives the OperatorHub.io index.
>
I presume OLM is Operator Lifecycle Manager?
https://github.com/operator-framework/operator-lifecycle-manager
This sounds like OperatorHub requires Operators to use OLM?
Are there any examples, or is it possible, for a Kudo (or other
operator tooling) to use OLM?
I agree with Jay, separating how apps are build from where they are
published would appear important here, otherwise we're going to have
them coupled and we'll have one app store per toolkit before we know
it.
Michael Hrivnak
Principal Software Engineer, RHCERed Hat
The "app store" is merely theAgreed. This is why I think separating the method of discovery and
discovery mechanism; how many different tools will a cluster owner
want to be involved in managing and upgrading the workloads on their
cluster? Different cluster owners will have different tolerances, but
many will want to standardize on one mechanism for controlling what
versions of software are running in their cluster.
lifecycle management from the operator-sdk is critical.
Perhaps a developer would like to use the operator-sdk to develop their
Operator, but provide a non-OLM way of packaging that code. Decoupling
the SDK from the method of packaging and managing the code that is
produced by the SDK seems to enable that, no?
Best,
-jay
On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:
> The "app store" is merely the
> discovery mechanism; how many different tools will a cluster owner
> want to be involved in managing and upgrading the workloads on their
> cluster? Different cluster owners will have different tolerances, but
> many will want to standardize on one mechanism for controlling what
> versions of software are running in their cluster.
Agreed. This is why I think separating the method of discovery and
lifecycle management from the operator-sdk is critical.
Perhaps a developer would like to use the operator-sdk to develop their
Operator, but provide a non-OLM way of packaging that code. Decoupling
the SDK from the method of packaging and managing the code that is
produced by the SDK seems to enable that, no?
Michael Hrivnak
Principal Software Engineer, RHCERed Hat
OLM is a package manager for operators
On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.
When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available.
There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?
On Tue, Oct 15, 2019 at 1:39 AM Matt Farina <matt@...> wrote:Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?Such as dependent Operators: in order to drive developers to work towards API (as they do with Kubernetes) it would be nice to express a dependency on another Operators' CRDs, not the Operator itself.Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available. Since these users are usually not cluster-admins, there should be a safe way to do that without these privileges.Operators also support the concept of watching N namespaces while being installed in a different namespace. This is a configuration that prevents privilege escalation where you'd normally just be able to hijack the potentially very privileged ServiceAccount that got deployed in your namespace. This configuration needs to be expressed in some standardized way.OLM also comes with a first-class concept of automatic over-the-air updates of Operators in the background as part of regularly updated catalogs. This is due to long-lived nature of Operator workloads themselves.Hope this sheds some lights of the intentions of OLM. It is a package manager as well, but primarily it provides the additional guardrails needed in order to deploy, discovery and run Operators from a central point on cluster. I think it's worth pursuing designs where the packaging format of helm can be re-used, though. The use case is different though, since Operators are not regular applications but behave more like kernel extensions.When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
------------------------------------------------------------------From:Matt Farina <matt@...>Sent At:2019 Oct. 15 (Tue.) 07:36To:Daniel Messer <dmesser@...>; cncf-sig-app-delivery <cncf-sig-app-delivery@...>Subject:Re: [cncf-sig-app-delivery] Operator Framework questionsDaniel, thanks for the added color. I have more questions...Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available.This and some of the other comments sounds similar to a service catalog along with elements of OLM (e.g., the metering and chargeback operators). I'm curious how much of the service catalog ideals are tied to all of this.If you don't mind, I'd like to look at a couple examples that's are different.WordPress is an all to common example so I'll use that. Let's say someone is operating a WorPress as a service site. A customer comes along to their UI and signs up for a new site. Their web app tells an operator in Kubernetes to create a new site. When that site is ready it's shared with the new customer. The lifecycle of this WordPress site is managed by the operator while the UI, billing, and other elements are handled by customer facing applications.For a second example, what if someone needs just one instance of an application but they want that instance to be fully managed. That includes failure handling that is usually encoded in a run book.How would these examples fit with the Operator SDK and OLM?There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?The the details documented on this anywhere? I would love to read them. For example, let's assume you have two of these WordPress operators/controllers running in a cluster. They are namespace scoped and do not overlap. How do you handle the CRD being cluster scoped? How do upgrades of the CRD work to make sure it works for all operators/controllers? Or, are some assumptions made that situations like this will not occur?If you have some time I would appreciate digging into these forms of situations. This is in part because people need guidance on working with CRDs and some of that falls into Kubernetes SIG Apps domain where I spend some of my time.Thanks,Matt FarinaOn Tue, Oct 15, 2019, at 5:39 AM, Daniel Messer wrote:On Tue, Oct 15, 2019 at 1:39 AM Matt Farina <matt@...> wrote:Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?Such as dependent Operators: in order to drive developers to work towards API (as they do with Kubernetes) it would be nice to express a dependency on another Operators' CRDs, not the Operator itself.Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available. Since these users are usually not cluster-admins, there should be a safe way to do that without these privileges.Operators also support the concept of watching N namespaces while being installed in a different namespace. This is a configuration that prevents privilege escalation where you'd normally just be able to hijack the potentially very privileged ServiceAccount that got deployed in your namespace. This configuration needs to be expressed in some standardized way.OLM also comes with a first-class concept of automatic over-the-air updates of Operators in the background as part of regularly updated catalogs. This is due to long-lived nature of Operator workloads themselves.Hope this sheds some lights of the intentions of OLM. It is a package manager as well, but primarily it provides the additional guardrails needed in order to deploy, discovery and run Operators from a central point on cluster. I think it's worth pursuing designs where the packaging format of helm can be re-used, though. The use case is different though, since Operators are not regular applications but behave more like kernel extensions.When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
Daniel, thanks for the added color. I have more questions...Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available.This and some of the other comments sounds similar to a service catalog along with elements of OLM (e.g., the metering and chargeback operators). I'm curious how much of the service catalog ideals are tied to all of this.If you don't mind, I'd like to look at a couple examples that's are different.WordPress is an all to common example so I'll use that. Let's say someone is operating a WorPress as a service site. A customer comes along to their UI and signs up for a new site. Their web app tells an operator in Kubernetes to create a new site. When that site is ready it's shared with the new customer. The lifecycle of this WordPress site is managed by the operator while the UI, billing, and other elements are handled by customer facing applications.For a second example, what if someone needs just one instance of an application but they want that instance to be fully managed. That includes failure handling that is usually encoded in a run book.How would these examples fit with the Operator SDK and OLM?There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?The the details documented on this anywhere? I would love to read them. For example, let's assume you have two of these WordPress operators/controllers running in a cluster. They are namespace scoped and do not overlap. How do you handle the CRD being cluster scoped? How do upgrades of the CRD work to make sure it works for all operators/controllers? Or, are some assumptions made that situations like this will not occur?If you have some time I would appreciate digging into these forms of situations. This is in part because people need guidance on working with CRDs and some of that falls into Kubernetes SIG Apps domain where I spend some of my time.Thanks,Matt FarinaOn Tue, Oct 15, 2019, at 5:39 AM, Daniel Messer wrote:On Tue, Oct 15, 2019 at 1:39 AM Matt Farina <matt@...> wrote:Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?Such as dependent Operators: in order to drive developers to work towards API (as they do with Kubernetes) it would be nice to express a dependency on another Operators' CRDs, not the Operator itself.Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available. Since these users are usually not cluster-admins, there should be a safe way to do that without these privileges.Operators also support the concept of watching N namespaces while being installed in a different namespace. This is a configuration that prevents privilege escalation where you'd normally just be able to hijack the potentially very privileged ServiceAccount that got deployed in your namespace. This configuration needs to be expressed in some standardized way.OLM also comes with a first-class concept of automatic over-the-air updates of Operators in the background as part of regularly updated catalogs. This is due to long-lived nature of Operator workloads themselves.Hope this sheds some lights of the intentions of OLM. It is a package manager as well, but primarily it provides the additional guardrails needed in order to deploy, discovery and run Operators from a central point on cluster. I think it's worth pursuing designs where the packaging format of helm can be re-used, though. The use case is different though, since Operators are not regular applications but behave more like kernel extensions.When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
HI Matt,So interesting that you bring up the service catalog. Do we have a feel for the service catalog usage? One thing about it is that the API is built off of CFF rather than Kube, so there is a fundamental difference there. Also, I assume we want to shepherd more projects in this space (besides Helm) to negate the possibility of it being a king maker, right?Just trying to understand when doing a comparison if that is meant to just highlight intentional differences to give further choices or to say we already have something that works and we don't need something else.Thanks,ErinOn Tue, Oct 15, 2019 at 8:33 AM Matt Farina <matt@...> wrote:Daniel, thanks for the added color. I have more questions...Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available.This and some of the other comments sounds similar to a service catalog along with elements of OLM (e.g., the metering and chargeback operators). I'm curious how much of the service catalog ideals are tied to all of this.If you don't mind, I'd like to look at a couple examples that's are different.WordPress is an all to common example so I'll use that. Let's say someone is operating a WorPress as a service site. A customer comes along to their UI and signs up for a new site. Their web app tells an operator in Kubernetes to create a new site. When that site is ready it's shared with the new customer. The lifecycle of this WordPress site is managed by the operator while the UI, billing, and other elements are handled by customer facing applications.For a second example, what if someone needs just one instance of an application but they want that instance to be fully managed. That includes failure handling that is usually encoded in a run book.How would these examples fit with the Operator SDK and OLM?There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?The the details documented on this anywhere? I would love to read them. For example, let's assume you have two of these WordPress operators/controllers running in a cluster. They are namespace scoped and do not overlap. How do you handle the CRD being cluster scoped? How do upgrades of the CRD work to make sure it works for all operators/controllers? Or, are some assumptions made that situations like this will not occur?If you have some time I would appreciate digging into these forms of situations. This is in part because people need guidance on working with CRDs and some of that falls into Kubernetes SIG Apps domain where I spend some of my time.Thanks,Matt FarinaOn Tue, Oct 15, 2019, at 5:39 AM, Daniel Messer wrote:On Tue, Oct 15, 2019 at 1:39 AM Matt Farina <matt@...> wrote:Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?Such as dependent Operators: in order to drive developers to work towards API (as they do with Kubernetes) it would be nice to express a dependency on another Operators' CRDs, not the Operator itself.Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available. Since these users are usually not cluster-admins, there should be a safe way to do that without these privileges.Operators also support the concept of watching N namespaces while being installed in a different namespace. This is a configuration that prevents privilege escalation where you'd normally just be able to hijack the potentially very privileged ServiceAccount that got deployed in your namespace. This configuration needs to be expressed in some standardized way.OLM also comes with a first-class concept of automatic over-the-air updates of Operators in the background as part of regularly updated catalogs. This is due to long-lived nature of Operator workloads themselves.Hope this sheds some lights of the intentions of OLM. It is a package manager as well, but primarily it provides the additional guardrails needed in order to deploy, discovery and run Operators from a central point on cluster. I think it's worth pursuing designs where the packaging format of helm can be re-used, though. The use case is different though, since Operators are not regular applications but behave more like kernel extensions.When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
Erin,I apologize for the confusion from my language. I was more interested in the concept of a service catalog rather than the specific Kubernetes implementation. The major public clouds have services that you can signup for with their API. It's the same idea.I've seen operators that are used for purposes other than those for a service catalog like service. I've also explored the idea of CRDs and operators for use as a method to build a service catalog like service. So much so that there is a KEP somewhere about it.I'm curious about the support for the different types of use cases from the Operator SDK, OLM, and the supporting tooling that's proposed to go into the CNCF. Is the Operator SDK + tools driving solely towards that service catalog style use case or are there more use cases it's going for?I could be misreading into what OLM does which is why I'm asking.Thanks,Matt FarinaOn Wed, Oct 16, 2019, at 2:40 PM, Erin Boyd wrote:HI Matt,So interesting that you bring up the service catalog. Do we have a feel for the service catalog usage? One thing about it is that the API is built off of CFF rather than Kube, so there is a fundamental difference there. Also, I assume we want to shepherd more projects in this space (besides Helm) to negate the possibility of it being a king maker, right?Just trying to understand when doing a comparison if that is meant to just highlight intentional differences to give further choices or to say we already have something that works and we don't need something else.Thanks,ErinOn Tue, Oct 15, 2019 at 8:33 AM Matt Farina <matt@...> wrote:Daniel, thanks for the added color. I have more questions...Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available.This and some of the other comments sounds similar to a service catalog along with elements of OLM (e.g., the metering and chargeback operators). I'm curious how much of the service catalog ideals are tied to all of this.If you don't mind, I'd like to look at a couple examples that's are different.WordPress is an all to common example so I'll use that. Let's say someone is operating a WorPress as a service site. A customer comes along to their UI and signs up for a new site. Their web app tells an operator in Kubernetes to create a new site. When that site is ready it's shared with the new customer. The lifecycle of this WordPress site is managed by the operator while the UI, billing, and other elements are handled by customer facing applications.For a second example, what if someone needs just one instance of an application but they want that instance to be fully managed. That includes failure handling that is usually encoded in a run book.How would these examples fit with the Operator SDK and OLM?There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?The the details documented on this anywhere? I would love to read them. For example, let's assume you have two of these WordPress operators/controllers running in a cluster. They are namespace scoped and do not overlap. How do you handle the CRD being cluster scoped? How do upgrades of the CRD work to make sure it works for all operators/controllers? Or, are some assumptions made that situations like this will not occur?If you have some time I would appreciate digging into these forms of situations. This is in part because people need guidance on working with CRDs and some of that falls into Kubernetes SIG Apps domain where I spend some of my time.Thanks,Matt FarinaOn Tue, Oct 15, 2019, at 5:39 AM, Daniel Messer wrote:On Tue, Oct 15, 2019 at 1:39 AM Matt Farina <matt@...> wrote:Please excuse my ignorance on some of this software. I have a number of questions now that I'm starting to look around.OLM is a package manager for operatorsOut of curiosity, why create another package manager? What features are missing from Helm? If some feature was missing I'd love to talk about it to learn the context and assumptions around it.There are a bunch of Operator lifecycle aspects, mainly around CRDs, that OLM takes care of so you don't have to. E.g. what happens when you attempt to install an Operator and there is already a CRD on cluster installed - is it safe to proceed? Is there maybe another Operator already present owning these CRDs? How would you discover this relationship?What happens when a CRD gets an update, e.g. in a new version of a CRD or a versioned CRD? Does this break existing workloads?Such as dependent Operators: in order to drive developers to work towards API (as they do with Kubernetes) it would be nice to express a dependency on another Operators' CRDs, not the Operator itself.Operators are meant to be used by end user to drive value - so there needs to be an on-cluster mechanism to discover which Operators with which services are available. Since these users are usually not cluster-admins, there should be a safe way to do that without these privileges.Operators also support the concept of watching N namespaces while being installed in a different namespace. This is a configuration that prevents privilege escalation where you'd normally just be able to hijack the potentially very privileged ServiceAccount that got deployed in your namespace. This configuration needs to be expressed in some standardized way.OLM also comes with a first-class concept of automatic over-the-air updates of Operators in the background as part of regularly updated catalogs. This is due to long-lived nature of Operator workloads themselves.Hope this sheds some lights of the intentions of OLM. It is a package manager as well, but primarily it provides the additional guardrails needed in order to deploy, discovery and run Operators from a central point on cluster. I think it's worth pursuing designs where the packaging format of helm can be re-used, though. The use case is different though, since Operators are not regular applications but behave more like kernel extensions.When I start to look at OLM I see things like Install Plans and Subscriptions. This looks a lot like Kubernetes Service Catalog. Is there any kind of write-up comparing the two?You can do a lot with operators. If OLM has a lot of similarities to Service Catalog and has a bit of that intent in mind, what about the use cases aren't related to the service catalog type setup?Should I ask these questions over on the TOC issue instead?Thanks,MattOn Mon, Oct 14, 2019, at 6:03 PM, Michael Hrivnak wrote:On Mon, Oct 14, 2019 at 4:50 PM Jay Pipes <jaypipes@...> wrote:On Mon, 2019-10-14 at 16:41 -0400, Michael Hrivnak wrote:> The "app store" is merely the> discovery mechanism; how many different tools will a cluster owner> want to be involved in managing and upgrading the workloads on their> cluster? Different cluster owners will have different tolerances, but> many will want to standardize on one mechanism for controlling what> versions of software are running in their cluster.Agreed. This is why I think separating the method of discovery andlifecycle management from the operator-sdk is critical.Creating an operator and creating its packaging are at least logically separate, even if one tool can do both things. When you create an operator with operator-sdk, it does not have any packaging unless you explicitly run "operator-sdk olm-catalog gen-csv" with some arguments. Adding OLM packaging is optional and does not happen by default.Perhaps a developer would like to use the operator-sdk to develop theirOperator, but provide a non-OLM way of packaging that code. Decouplingthe SDK from the method of packaging and managing the code that isproduced by the SDK seems to enable that, no?This is already easy to do. To start, after you've made an operator with operator-sdk, you can install it manually by running "kubectl create -f" on a few of the manifests that operator-sdk creates for you. They just contain the CRD, RBAC resources, and a Deployment. You could then turn those manifests into a helm chart that installs your operator, or use any other tool you choose.--Michael Hrivnak
Principal Software Engineer, RHCERed Hat
--Daniel Messer
He / Him / His
Product Manager OpenShift
Wankelstrasse 5
70563 Stuttgart
--