Kf requires Kubernetes and several other OSS projects to run. Some of the dependencies are satisfied with Google-managed services—for example, Google Kubernetes Engine (GKE) provides Kubernetes.
Dependencies
Get CRD details
Kf supports the kubectl
subcommand explain
. It allows you to list the fields in Kf CRDs to understand how to create Kf objects via automation instead of manually via the CLI. This command is designed to be used with Config Management to automate creation and management of resources like Spaces across many clusters. You can use this against any of the component kinds
below
.
In this example, we examine the kind
called space
in the spaces
CRD:
kubectl
explain
space.spec
The output looks similar to this:
$
kubectl
explain
space.spec
KIND:
Space
VERSION:
kf.dev/v1alpha1
RESOURCE:
spec
<Object>
DESCRIPTION:
SpaceSpec
contains
the
specification
for
a
space.
FIELDS:
buildConfig
<Object>
BuildConfig
contains
config
for
the
build
pipelines.
networkConfig
<Object>
NetworkConfig
contains
settings
for
the
space '
s
networking
environment.
runtimeConfig
<Object>
RuntimeConfig
contains
settings
for
the
app
runtime
environment.
Kf components
Kf installs several of its own Kubernetes custom resources
and controllers
.
The custom resources effectively serve as the Kf API and
are used by the kf
CLI to interact with the system. The controllers use
Kf's CRDs to orchestrate the other components in the
system.
You can view the CRDs installed and used by Kf by running the following command:
kubectl
api-resources
--api-group =
kf.dev
The output of that command is as follows:
NAME SHORTNAMES APIGROUP NAMESPACED KIND
apps kf.dev true App
builds kf.dev true Build
clusterservicebrokers kf.dev false ClusterServiceBroker
routes kf.dev true Route
servicebrokers kf.dev true ServiceBroker
serviceinstancebindings kf.dev true ServiceInstanceBinding
serviceinstances kf.dev true ServiceInstance
spaces kf.dev false Space
Apps
Apps represent a twelve-factor application deployed to Kubernetes. They encompass source code, configuration, and the current state of the application. Apps are responsible for reconciling:
- Kf Builds
- Kf Routes
- Kubernetes Deployments
- Kubernetes Services
- Kubernetes ServiceAccounts
- Kubernetes Secrets
You can list Apps using Kf or kubectl
:
kf appskubectl get apps -n space-name
Builds
Builds combine the source code and build configuration for Apps. They provision Tekton TaskRuns with the correct steps to actuate a Buildpack V2, Buildpack V3, or Dockerfile build.
You can list Builds using Kf or kubectl
:
kf buildskubectl get builds -n space-name
ClusterServiceBrokers
ClusterServiceBrokers hold the connection information necessary to extend
Kf with a service broker. They are responsible for
fetching the catalog of services the broker provides and displaying them in
the output of kf marketplace
.
You can list ClusterServiceBrokers using kubectl
:
kubectl
get
clusterservicebrokers
Routes
Routes are a high level structure that contain HTTP routing rules. They are responsible for reconciling Istio VirtualServices.
You can list Routes using Kf or kubectl
:
kf routeskubectl get routes -n space-name
ServiceBrokers
ServiceBrokers hold the connection information necessary to extend
Kf with a service broker. They are responsible for
fetching the catalog of services the broker provides and displaying them in
the output of kf marketplace
.
You can list ServiceBrokers using kubectl
:
kubectl
get
servicebrokers
-n
space-name
ServiceInstanceBinding
ServiceInstanceBindings hold the parameters to create a binding on a service broker and the credentials the broker returns for the binding. They are responsible for calling the bind API on the broker to bind the service.
You can list ServiceInstanceBindings using Kf or kubectl
:
kf bindingskubectl get serviceinstancebindings -n space-name
ServiceInstance
ServiceInstances hold the parameters to create a service on a service broker. They are responsible for calling the provision API on the broker to create the service.
You can list ServiceInstances using Kf or kubectl
:
kf serviceskubectl get serviceinstances -n space-name
Spaces
Spaces hold configuration information similar to Cloud Foundry organizations and spaces. They are responsible for:
- Creating the Kubernetes Namespace that other Kf resources are provisioned into.
- Creating Kubernetes NetworkPolicies to enforce network connection policies.
- Holding configuration and policy for Builds, Apps, and Routes.
You can list Spaces using Kf or kubectl
:
kf spaceskubectl get spaces
Kf RBAC / Permissions
The following sections list permissions for Kf and its components to have correct access at the cluster level. These permissions are required and enabled by default in Kf; do not attempt to disable them.
| Components | Namespace | Service Account |
|---|---|---|
controller
|
kf | controller |
subresource-apiserver
|
kf | controller |
webhook
|
kf | controller |
appdevexperience-operator
|
appdevexperience | appdevexperience-operator |
Note that the appdevexperience-operator
service account has the same set of
permissions as controller
. The operator is what deploys all Kf
components, including custom resource definitions and controllers.
RBAC for Kf service accounts
The following apiGroup
definitions detail which access control
permissions components in Kf have on which API groups and resources for both the controller
and appdevexperience-operator
service accounts.
-
apiGroups:
-
"authentication.k8s.io"
resources:
-
tokenreviews
verbs:
-
create
-
apiGroups:
-
"authorization.k8s.io"
resources:
-
subjectaccessreviews
verbs:
-
create
-
apiGroups:
-
""
resources:
-
pods
-
services
-
persistentvolumeclaims
-
persistentvolumes
-
endpoints
-
events
-
configmaps
-
secrets
verbs:
*
-
apiGroups:
-
""
resources:
-
services
-
services
/
status
verbs:
-
create
-
delete
-
get
-
list
-
watch
-
apiGroups:
-
"apps"
resources:
-
deployments
-
daemonsets
-
replicasets
-
statefulsets
verbs:
*
-
apiGroups:
-
"apps"
resources:
-
deployments
/
finalizers
verbs:
-
get
-
list
-
create
-
update
-
delete
-
patch
-
watch
-
apiGroups:
-
"rbac.authorization.k8s.io"
resources:
-
clusterroles
-
roles
-
clusterrolebindings
-
rolebindings
verbs:
-
create
-
delete
-
update
-
patch
-
escalate
-
get
-
list
-
deletecollection
-
bind
-
apiGroups:
-
"apiregistration.k8s.io"
resources:
-
apiservices
verbs:
-
update
-
patch
-
create
-
delete
-
get
-
list
-
apiGroups:
-
"pubsub.cloud.google.com"
resources:
-
topics
-
topics
/
status
verbs:
*
-
apiGroups:
-
""
resources:
-
namespaces
-
namespaces
/
finalizers
-
serviceaccounts
verbs:
-
get
-
list
-
create
-
update
-
watch
-
delete
-
patch
-
watch
-
apiGroups:
-
"autoscaling"
resources:
-
horizontalpodautoscalers
verbs:
-
create
-
delete
-
get
-
list
-
update
-
patch
-
watch
-
apiGroups:
-
"coordination.k8s.io"
resources:
-
leases
verbs:
*
-
apiGroups:
-
"batch"
resources:
-
jobs
-
cronjobs
verbs:
-
get
-
list
-
create
-
update
-
patch
-
delete
-
deletecollection
-
watch
-
apiGroups:
-
"messaging.cloud.google.com"
resources:
-
channels
verbs:
-
delete
-
apiGroups:
-
"pubsub.cloud.google.com"
resources:
-
pullsubscriptions
verbs:
-
delete
-
get
-
list
-
watch
-
create
-
update
-
patch
-
apiGroups:
-
"pubsub.cloud.google.com"
resources:
-
[
pullsubscriptions
/
status
verbs:
-
get
-
update
-
patch
-
apiGroups:
-
"events.cloud.google.com"
resources:
*
verbs:
*
-
apiGroups:
-
"keda.k8s.io"
resources:
*
verbs:
*
-
apiGroups:
-
"admissionregistration.k8s.io"
resources:
-
mutatingwebhookconfigurations
-
validatingwebhookconfigurations
verbs:
-
get
-
list
-
create
-
update
-
patch
-
delete
-
watch
-
apiGroups:
-
"extensions"
resources:
-
ingresses
-
ingresses
/
status
verbs:
*
-
apiGroups:
-
""
resources:
-
endpoints
/
restricted
verbs:
-
create
-
apiGroups:
-
"certificates.k8s.io"
resources:
-
certificatesigningrequests
-
certificatesigningrequests
/
approval
-
certificatesigningrequests
/
status
verbs:
-
update
-
create
-
get
-
delete
-
apiGroups:
-
"apiextensions.k8s.io"
resources:
-
customresourcedefinitions
verbs:
-
get
-
list
-
create
-
update
-
patch
-
delete
-
watch
-
apiGroups:
-
"networking.k8s.io"
resources:
-
networkpolicies
verbs:
-
get
-
list
-
create
-
update
-
patch
-
delete
-
deletecollection
-
watch
-
apiGroups:
-
""
resources:
-
nodes
verbs:
-
get
-
list
-
watch
-
update
-
patch
-
apiGroups:
-
""
resources:
-
nodes
/
status
verbs:
-
patch
The following table lists how the RBAC permissions are used in Kf, where:
- viewincludes the verbs: get, list, watch
- modifyincludes the verbs: create, update, delete, patch
| Permissions | Reasons |
|---|---|
Can view all secrets
|
Kf reconcilers need to read secrets for functionalities such as space creation and service instance binding. |
Can modify pods
|
Kf reconcilers need to modify pods for functionalities such as building/pushing Apps and Tasks. |
Can modify secrets
|
Kf reconcilers need to modify secrets for functionalities such as building/pushing Apps and Tasks and service instance binding. |
Can modify configmaps
|
Kf reconcilers need to modify configmaps for functionalities such as building/pushing Apps and Tasks. |
Can modify endpoints
|
Kf reconcilers need to modify endpoints for functionalities such as building/pushing Apps and route binding. |
Can modify services
|
Kf reconcilers need to modify pods for functionalities such as building/pushing Apps and route binding. |
Can modify events
|
Kf controller creates and emits events for the resources managed by Kf. |
Can modify serviceaccounts
|
Kf needs to modify service accounts for App deployments. |
Can modify endpoints/restricted
|
Kf needs to modify endpoints for App deployments. |
Can modify deployments
|
Kf needs to modify deployments for functionalities such as pushing Apps. |
Can modify mutatingwebhookconfiguration
|
Mutatingwebhookconfiguration is needed by Cloud Service Mesh, a Kf dependency, for admission webhooks. |
Can modify customresourcedefinitions customresourcedefinitions/status
|
Kf manages resources through Custom Resources such as Apps, Spaces and Builds. |
Can modify horizontalpodautoscalers
|
Kf supports autoscaling based on Horizontal Pod Autoscalers. |
Can modify namespace/finalizer
|
Kf needs to set owner reference of webhooks. |
Third-party libraries
Third-party library source code and licenses can be found in the /third_party
directory of any Kf container image.
You can also run kf third-party-licenses
to view the third-party licenses for
the version of the Kf CLI that you downloaded.
