Course outline

01 · Platform Engineering Fundamentals

02 · Developer Portal & Software Catalog

03 · Self-Service Platform API & CLI

04 · Policy as Code & Security Guardrails

05 · Observability & Developer Experience Metrics

06 · Advanced Topics & Future of Platform Engineering

Stage 7 · Master

Self-Service Platform API & CLI

Kubernetes Controllers for Platform

Build controllers with controller-runtime: reconcile loops, finalizers, status conditions, and webhook validation.

9 min readPlatform Engineering & Developer ExperienceMaster

Controller Pattern

Kubernetes controllers implement the control loop: observe actual state, compare to desired state, take action to converge. Platform controllers manage custom resources (Service, Database, Environment) and orchestrate infrastructure.

Gocustom-resource-definition-(crd).go

72 linesLn 1, Col 1Go

CRD defines the Service resource: spec (desired state), status (observed state), validation, and naming.

Reconcile Loop

Goservice-controller-reconcile.go

107 linesLn 1, Col 1Go

Reconcile loop: fetch → validate → build desired → create/update → update status → requeue. Handles deletion, finalizers, drift detection.

Finalizers

Finalizers prevent resource deletion until cleanup completes. Platform resources (databases, DNS, certificates) need explicit cleanup.

Godelete-reconciliation-with-finalizer.go

27 linesLn 1, Col 1Go

Finalizer ensures cleanup runs before resource is removed from etcd. On failure, requeue with error.

Status Conditions

Kubernetes-style conditions provide structured, machine-readable status. Each condition has: type, status (True/False/Unknown), reason, message, lastTransitionTime.

Condition Type	When True	When False	Reason Examples
Provisioned	Infrastructure created	Not yet created / failed	Provisioned, ProvisionFailed
PolicyCompliant	Passes all policies	Policy violation	PolicyViolation, PolicyUpdated
Deployed	ArgoCD synced & healthy	Sync failed / degraded	Deployed, SyncFailed, Degraded
Ready	All conditions True	Any condition False	Ready, NotReady
DeletionFailed	Cleanup failed	Cleanup succeeded	DeletionFailed, Deleted

Admission Webhooks

Validating webhooks reject invalid resources at admission time. Mutating webhooks can set defaults. Both run before controller sees the resource.

Govalidating-webhook.go

61 linesLn 1, Col 1Go

Validating webhook checks capabilities, resource limits, team existence before resource is persisted.

Testing Controllers

Unit tests: Test reconcile logic with fake client (controller-runtime/pkg/client/fake)
Integration tests: envtest (spins up real API server + etcd in memory)
Webhook tests: Test admission.Decoder with valid/invalid objects
E2E tests: Kind cluster, deploy CRD + controller, create resources, assert state
Chaos tests: Kill controller mid-reconcile, verify idempotency and finalizer cleanup

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.