Using kubernetes apiextensions.k8s.io with hnc.x-k8s.io

Question

Pulumi · Accepted Answer

Kubernetes has a concept of Custom Resource Definitions (CRD) which allows you to define your own "resources" that work just like the standard ones (like Pods, Services, etc.). These custom resources are no different from normal Kubernetes resources and can be created and managed using `kubectl` or any Kubernetes client library.

Hierarchical Namespaces (HNC) is an extension to Kubernetes that allows you to set up and manage a hierarchy of namespaces. It makes it easier to manage permissions and resources in a complex system with many nested namespaces. HNC is itself managed through a custom resource called a `SubnamespaceAnchor` within a parent namespace, which indicates that a child namespace is hierarchically under that parent.

To create a hierarchical namespace in Kubernetes, you would typically use the HNC by first installing its CRDs and controllers into your cluster, and then creating `SubnamespaceAnchor` resources in your parent namespaces.

Using Pulumi, you can automate this as part of your infrastructure as code. You'll first need to ensure that the HNC CRDs are installed in your cluster, which you can do by applying the manifest directly or by using Pulumi to create a `CustomResource`. After that, you can create `SubnamespaceAnchor` resources where needed.

Below is a Pulumi TypeScript program that would set up HNC in a cluster:

```typescript
import * as k8s from "@pulumi/kubernetes";

const hncCrdUrl = 'https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/latest/download/hnc-manager.yaml';

// Apply the Hierarchical Namespace Controller CRDs and necessary resources.
const hncCrd = new k8s.yaml.ConfigFile("hnc-crd", {
    file: hncCrdUrl,
});

// Now create a SubnamespaceAnchor custom resource as an example of hierarchical namespace.
const subnamespaceAnchor = new k8s.apiextensions.CustomResource("subnamespace-anchor", {
    apiVersion: "hnc.x-k8s.io/v1alpha2",
    kind: "SubnamespaceAnchor",
    metadata: {
        name: "child-namespace",
        namespace: "parent-namespace", // Replace with the actual parent namespace
    },
}, { dependsOn: hncCrd });

export const subnamespaceName = subnamespaceAnchor.metadata.name;
```

In the program above:

1. We first import the `@pulumi/kubernetes` package, which allows us to interact with Kubernetes resources.
2. We define a URL to the HNC CRD YAML file, which contains the definitions for the HNC and the various resources it uses.
3. We use Pulumi's `k8s.yaml.ConfigFile` resource to apply the contents of the HNC YAML file to our Kubernetes cluster. This will set up HNC just as if we'd used `kubectl apply` with the same file.
4. After ensuring that the HNC manager is deployed, we then create an instance of a `SubnamespaceAnchor` using the `k8s.apiextensions.CustomResource` class, specifying its API version, kind, name, and the parent namespace it should live in. This will effectively create a new child namespace under the specified parent.
5. Finally, we export the name of the subnamespace anchor for easy reference.

Note that you'll need to replace `"parent-namespace"` with the actual name of the namespace you want to be the parent. This program also assumes that your Pulumi setup has already been configured with a Kubernetes provider pointing at an existing cluster.

This is a straightforward way of managing hierarchical namespaces within Kubernetes using Pulumi. With this, you get the advantage of being able to version control your namespace hierarchy and handle it as part of your regular deployment pipeline.