Operators & Controllers

Operators are how you turn "install + babysit a piece of stateful infra" into "kubectl apply -f mydb.yaml and the operator handles the rest."

Operator frameworks (build your own)

★ Operator SDK (Operator Framework / CNCF) — Go / Helm / Ansible operator scaffolding. Default for Go operators.
★ Kubebuilder — sibling project; Go-only; what most CNCF operators are built on.
KubeOps (.NET), Java Operator SDK — non-Go SDKs.
kopf (Python) — Python operator framework; great for sysadmin-style automation.
Crossplane — operator-shaped, but for provisioning external infra from k8s CRDs (AWS / GCP / Azure resources).

★ cert-manager — automatic TLS certs from Let's Encrypt or your own CA. Universal.
★ External Secrets Operator — sync secrets from Vault / AWS Secrets Manager / Doppler / etc. into k8s Secrets.
★ External DNS — auto-create DNS records for ingresses / services.
★ CloudNativePG — Postgres operator; the default for Postgres on k8s in 2026.
Crunchy Postgres Operator / Zalando Postgres Operator / Percona Postgres Operator — alternatives.
Percona XtraDB Operator / Vitess Operator — MySQL.
MongoDB Community / Enterprise Operator — Mongo.
Redis Operator (Spotahome / OT-Container-Kit) — Redis HA.
Strimzi — Kafka.
Elastic Cloud on Kubernetes (ECK) — Elasticsearch.
OpenSearch Operator — OpenSearch.
Kyverno / OPA Gatekeeper — policy engines (technically operators).
Argo CD / Flux — GitOps controllers.
Velero — backup / restore.
Tekton — pipelines as CRDs.
Knative — serverless on k8s.
KEDA — event-driven autoscaling (scale on Kafka lag, SQS depth, etc.).
Prometheus Operator — manages Prometheus / Alertmanager / ServiceMonitors.

OperatorHub.io — CNCF catalog; search and install.
ArtifactHub — broader; charts + operators.
Cluster API providers — for cluster-lifecycle operators (CAPA, CAPG, CAPV…).

OLM — install / upgrade / dependency management for operators; required in OpenShift, optional elsewhere. Use it in regulated environments.

★ Use a real operator for stateful workloads (Postgres, Kafka, ES). Hand-rolled StatefulSets become a maintenance trap.
Read the operator's CRD docs carefully. Operators differ in their reconciliation guarantees and upgrade paths.
Operators upgrade themselves; CRDs upgrade with care. Pin versions; test upgrades in staging.
One operator per concern. Don't run two Postgres operators side-by-side.
Watch the operator's namespace permissions. Cluster-wide RBAC is common but means the blast radius is the cluster.

You have a complex internal pattern (provision tenant DB + create app + register DNS) you do dozens of times. Worth automating.
You want a clean kubectl apply UX for an internal service.
You don't need it for "deploy this app" — that's what Helm + ArgoCD already do.