Kubernetes CRDs in the Central Registry

[rogpeppe]

This is a catch-all discussion for feedback about Kubernetes Custom Resource Definitions (CRDs), and in particular curated CRDs in the Central Registry. One example of such a CRD is cue.dev/x/kyverno/policy/v1.

We're looking for feedback on:

• whether the CRD package is useful for you
• what other CRDs would be useful for you to have available
• whether there are any paper-cuts or other hitches in using the CRDs
• anything else related to CRDs and CUE!

[mxey]

An easier way to convert the CRDs from the Kubernetes YAML manifests into CUE schema would be nice. Right now we do this semi-manually:

// run this:
// cue export --out yaml -e openapiSchemas > openapi_gen.yaml
// cue import -p kubecluster openapi_gen.yaml -f  -o openapi_gen.cue
openapiSchemas: {
	openapi: "3.0.0"
	info: {
		version: ""
		title:   "OpenAPI Schemas for CRDs"
	}
	components: schemas: {
		let crds = clusters.vagrant.objects.global.CustomResourceDefinition
		SealedSecret:         crds."sealedsecrets.bitnami.com".spec.versions[0].schema.openAPIV3Schema
		BGPConfiguration:     crds."bgpconfigurations.crd.projectcalico.org".spec.versions[0].schema.openAPIV3Schema
		BGPPeer:              crds."bgppeers.crd.projectcalico.org".spec.versions[0].schema.openAPIV3Schema
		IPPool:               crds."ippools.crd.projectcalico.org".spec.versions[0].schema.openAPIV3Schema
		TridentBackendConfig: crds."tridentbackendconfigs.trident.netapp.io".spec.versions[0].schema.openAPIV3Schema
		ClusterIssuer:        crds."clusterissuers.cert-manager.io".spec.versions[0].schema.openAPIV3Schema
		Issuer:               crds."issuers.cert-manager.io".spec.versions[0].schema.openAPIV3Schema
		Certificate:          crds."certificates.cert-manager.io".spec.versions[0].schema.openAPIV3Schema
		VolumeSnapshotClass:  crds."volumesnapshotclasses.snapshot.storage.k8s.io".spec.versions[0].schema.openAPIV3Schema
	}
}

The snippet also shows the CRDs that we are interested in:

• Calico
• Bitnami sealed secrets
• NetApp Trident
• cert-manager
• k8s volume snapshot

[anshuishere]

Hello,
I work for Ericsson and we're using Flux CD for GitOps internally.
We wish to generate flux CRs using cue objects.
Can we add https://github.com/fluxcd-community/flux2-schemas flux schemas to cue central registry?

[rogpeppe]

On further investigation, it looks like we should be able to consume the install.yaml file from the released artifacts, assuming that contains all the CRDs that are needed.

[rogpeppe]

@anshuishere Please try out cue.dev/x/crd/fluxcd.io and see if it meets your needs.

[anshuishere]

Big thanks! Will do!
Can you also help me with how did we create these modules? Are these commited somewhere in git and then a CI job publishes them here?

[myitcv]

Hi @anshuishere - the following guide might well prove useful:

https://cuelang.org/docs/tutorial/publishing-modules-to-the-central-registry/

Or if you want an alternative guide not specific to the Central Registry, please take a look at:

https://cuelang.org/docs/tutorial/working-with-a-custom-module-registry/

The curated modules and published in just the same way as any other module.

In terms of navigating the published Flux modules, the following Central Registry endpoint will help with exploration:

https://registry.cue.works/docs/cue.dev/x/crd/fluxcd.io

[rogpeppe]

Update: as a result of discussions with @mxey and others, we've made some changes to the published CRD namespace in the Central Registry.

Specifically, all CRDs in a given spec.group are now published to the same package, using the spec.names.kind value as the definition name. We are also publishing CRD modules under an umbrella crd namespace, and using full domain names as disambiguators. So, for example, where before we had cue.dev/x/kyverno/policy/v1.#Policy and cue.dev/x/kyverno/clusterpolicy/v1.#ClusterPolicy (in separate packages) we now have both #Policy and #ClusterPolicy in the package cue.dev/x/crd/kyverno.io/v1.

Thus far, we've published the following CRDs following this new pattern:

cue.dev/x/crd/bitnami.com/sealed-secrets
cue.dev/x/crd/cert-manager.io
cue.dev/x/crd/kyverno.io

@anshuishere I'd like to add the Flux schemas too, but it's non-trivial, as the schemas there are not well formed CRDs or JSON Schema documents, so don't fit the usual import mechanisms. We'll need to add some logic specifically to deal with this particular source, so might not happen right now.

[rogpeppe]

To keep this issue updated, we have so far published the following CRD modules to the Central Registry:

• cue.dev/x/crd/bitnami.com/sealed-secrets
• cue.dev/x/crd/cert-manager.io
• cue.dev/x/crd/fluxcd.io
• cue.dev/x/crd/k8s.io/storage
• cue.dev/x/crd/kyverno.io