Free Online Course · Self-paced · Hands-on

Kubernetes Operator Tutorial - Build Production-Ready Operators

Free Kubernetes Operator course on CRDs, controller-runtime, and Go, Helm, and hybrid operators, with hands-on labs tested on Operator SDK 1.42 and kind.

  • 15 chapters
  • 45 lessons
  • ~20h
  • Intermediate to Advanced
  • Tested with Operator SDK 1.42.x
  • Updated Sep 2026
Start the course View syllabus
Kubernetes Operator Tutorial - Build Production-Ready Operators
By Last updated

About this course

This is a free, self-paced course on building Kubernetes Operators, from the reconcile loop and CRDs through production Go, Helm-based, and hybrid Operators. It uses the standard upstream stack of Operator SDK, Kubebuilder, and controller-runtime, and follows the current scaffold layout, which dropped the kube-rbac-proxy sidecar that older operator-sdk releases generated.

Every lesson runs on a local kind cluster, so you can create a cluster, break a reconciler, and delete it in a few minutes without a cloud account. The course also covers the work that turns a demo controller into something you can run for other people: tests with envtest and Ginkgo, metrics and tracing, RBAC scoping, and a release pipeline that ends with an OLM bundle.

If Operators are new to you, start with Operator Foundations and read through controller-runtime Internals before you write code. If you already have a working controller, go straight to performance tuning, Server-Side Apply, or the Helm-based Operator chapters.

What you'll learn

  • Explain the Operator pattern through desired state, the reconcile loop, design patterns, and capability levels
  • Design CRDs with OpenAPI and CEL validation, status conditions, and version upgrades through conversion webhooks
  • Write controllers with controller-runtime watches, predicates, finalizers, owner references, and Server-Side Apply
  • Tune reconcile concurrency, client QPS, and cache reads, and avoid reconcile loops that never settle
  • Run Operators in production with leader election, health probes, Prometheus metrics, OpenTelemetry tracing, and least-privilege RBAC
  • Build and test a Go Operator with Operator SDK, envtest, Ginkgo, Gomega, and kind
  • Ship releases through GitHub Actions and package them as OLM bundles for OperatorHub
  • Build Helm-based and hybrid Helm plus Go Operators, and migrate an existing chart without duplicate releases

Who this course is for

  • Go developers who want to automate day-two work for an application instead of writing runbooks
  • Platform engineers who maintain Helm charts and need drift correction and status reporting that a chart alone does not give
  • SREs who run third-party Operators and want to read, debug, and audit their controllers
  • CKA and CKAD holders ready to go from installing Operators to writing them

Prerequisites

  • Working Kubernetes knowledge, including Pods, Deployments, Services, kubectl, and YAML
  • Go for the controller-runtime and Go-based chapters; the Helm-based chapters need Helm chart experience instead
  • A Linux workstation with Docker, kubectl, and 8 GB RAM minimum (16 GB recommended) to run kind clusters
  • No cloud account, because clusters run locally on kind and images are pushed to the free ttl.sh registry

Versions and testing environment

Every command in this course was run on this stack

ComponentVersionNotes
Operator SDK 1.42.x Scaffolds the Go, Helm-based, and hybrid projects; Go projects use Kubebuilder go/v4 layouts
Go 1.26.x Go-based Operator, controller-runtime, and testing chapters
kind 0.31.x Local clusters on Docker 29.x; kind 0.31 defaults to the kindest/node v1.35.0 image
Helm 4.2.x Helm-based and hybrid Operator chapters, including the Helm v4 Go SDK
Rocky Linux 10.2 Workstation for every lesson; the install lesson also covers Ubuntu, Debian, and Fedora

Syllabus

15 chapters · 45 lessons · ~20h of reading

  1. 1 Operator Foundations 6 lessons · ~1h 35m
    1. Part 1 What is a Kubernetes Operator? 14 min read
    2. Part 2 Kubernetes Operator vs Controller vs CRD 12 min read
    3. Part 3 Desired state vs actual state (level-triggered model) 13 min read
    4. Part 4 The Kubernetes reconcile loop explained 18 min read
    5. Part 5 Operator design patterns - Singleton, Capability, Lifecycle, Auto-Pilot 19 min read
    6. Part 6 Operator capability levels I-V (maturity model) 19 min read
  2. 2 CRDs & API evolution 3 lessons · ~43 min
    1. Part 7 Kubernetes CRDs explained - a complete guide 16 min read
    2. Part 8 CEL validation in CRDs - practical rules for operator APIs 9 min read
    3. Part 9 CRD version upgrades and conversion webhooks 18 min read
  3. 3 Admission webhooks 1 lesson · ~21 min
    1. Part 10 Mutating and validating admission webhooks 21 min read
  4. 4 controller-runtime Internals 7 lessons · ~1h 51m
    1. Part 11 controller-runtime architecture - Manager, Cache, Informer, Workqueue 15 min read
    2. Part 12 Performance tuning - concurrency, client QPS, cache, predicates, APF 9 min read
    3. Part 13 Watches, events, and predicates 17 min read
    4. Part 14 Requeue, RequeueAfter, and error handling in controller-runtime 11 min read
    5. Part 15 Status subresource and conditions (KEP-1623) 21 min read
    6. Part 16 Finalizers - two-phase deletion and cleanup 23 min read
    7. Part 17 Owner references and garbage collection 15 min read
  5. 5 Reconciliation & apply 5 lessons · ~1h 28m
    1. Part 18 Multi-resource reconciliation - managing N child resources per CR 21 min read
    2. Part 19 Drift detection patterns - periodic resync vs spec diffing 17 min read
    3. Part 20 Server-Side Apply (SSA) in Kubernetes operators 27 min read
    4. Part 21 Avoid reconcile loop explosions - predicates, Owns, RequeueAfter 14 min read
    5. Part 22 Pause and resume patterns - spec, annotations, GitOps 9 min read
  6. 6 Troubleshooting 1 lesson · ~15 min
    1. Part 23 Debugging Operators - kubectl, logs, webhooks, SSA 15 min read
  7. 7 HA, health & metrics 4 lessons · ~1h 4m
    1. Part 24 Leader election - HA operators with lease locks 18 min read
    2. Part 25 Health and readiness probes (/healthz, /readyz) 19 min read
    3. Part 26 Prometheus metrics for operators 15 min read
    4. Part 27 OpenTelemetry tracing for controller-runtime operators 12 min read
  8. 8 Security & multi-tenancy 3 lessons · ~40 min
    1. Part 28 Operator RBAC - ClusterRole, kubebuilder markers, audit 16 min read
    2. Part 29 Hardening beyond RBAC - pod security, NetworkPolicy, supply chain 6 min read
    3. Part 30 Multi-tenant Operator patterns - per-namespace leases and listers 18 min read
  9. 9 Setup 1 lesson · ~19 min
    1. Part 31 Install Operator-SDK on Linux (Go, kubectl, Helm 4, kind, ttl.sh) 19 min read
  10. 10 Configuration 1 lesson · ~8 min
    1. Part 32 Configuration - flags, env vars, ConfigMap/Secret, live reload 8 min read
  11. 11 Go-Based Operators 4 lessons · ~1h 7m
    1. Part 33 Go Kubernetes Operator SDK tutorial - build a controller from scratch 18 min read
    2. Part 34 controller-runtime tutorial - status, finalizers, drift, webhooks 21 min read
    3. Part 35 Testing Kubernetes Operators with envtest, fake client, and kind 19 min read
    4. Part 36 Unit testing Reconcile with Ginkgo and Gomega - structure and assertions 9 min read
  12. 12 CI/CD 2 lessons · ~28 min
    1. Part 37 CI/CD with GitHub Actions - fmt, test, envtest, image, bundle 16 min read
    2. Part 38 Release pipeline - tag, image, staging smoke test, promotion, rollback 12 min read
  13. 13 OLM & OperatorHub 1 lesson · ~11 min
    1. Part 39 OLM bundles - package, ship, list on OperatorHub 11 min read
  14. 14 Helm-Based Operators 4 lessons · ~1h 29m
    1. Part 40 Helm-based Operator Part 1 - chart, CRD, watches.yaml 34 min read
    2. Part 41 Helm-based Operator Part 2 - lifecycle, drift, hooks, scope 32 min read
    3. Part 42 Migrate a Helm chart to a Helm-based operator - values, cutover, risks 9 min read
    4. Part 43 Helm-based Operator vs Flux vs Argo CD 14 min read
  15. 15 Hybrid Helm + Go Operators 2 lessons · ~1h 3m
    1. Part 44 Hybrid Operator Part 1 - build the foundation (Go + Helm v4 SDK) 36 min read
    2. Part 45 Hybrid Operator Part 2 - custom status, finalizer, drift, cross-CR 27 min read

Hands-on labs

6 guided builds you run yourself

  1. Build a Go Operator from scratch

    Scaffold a project, generate the CRD from Kubebuilder markers, write an idempotent Reconcile, and deploy it to kind.

  2. Validate a CRD with CEL rules

    Add cross-field, bounds, and immutability rules with clear error messages, without writing a webhook.

  3. Test an Operator with envtest and kind

    Cover the reconciler with fake client unit tests, envtest integration tests, and a kind smoke test.

  4. Package an Operator as an OLM bundle

    Generate and validate a bundle, run the scorecard, build a catalog image with opm, and install it through OLM on kind.

  5. Turn a Helm chart into an Operator

    Wrap a chart in a Helm-based Operator, map the custom resource spec to values, and tune watches.yaml.

  6. Build a hybrid Helm and Go Operator

    Embed a chart in a Go Operator and drive installs and upgrades through the Helm v4 SDK from your own Reconcile.

Where to go after this course

  • Operator SDK documentationThe upstream reference for the CLI and scaffolds. Check the release notes before you move past the SDK version tested here.
  • The Kubebuilder BookOperator SDK uses Kubebuilder for Go projects, so the book's controller and webhook chapters apply directly.
  • Go courseFill in Go gaps before the controller-runtime chapters, which assume you can read and write idiomatic Go.
  • CKS courseSupply chain and runtime security for the cluster your Operator runs in.

Frequently Asked Questions

What is the difference between Operator SDK and Kubebuilder?

For Go projects, very little. Operator SDK uses Kubebuilder under the hood, so both produce the same controller-runtime project layout, and the operator-sdk CLI works on a project that kubebuilder created. Operator SDK adds Helm and Ansible project types plus tooling for the Operator Lifecycle Manager, such as bundle generation and the scorecard. The Operator SDK FAQ notes that you can follow the Kubebuilder Book and swap kubebuilder for operator-sdk in its commands.

Do I need to know Go to build an Operator?

No. Operator SDK supports Go, Helm, and Ansible Operators. A Helm-based Operator wraps an existing chart and needs no Go at all, which is where the Helm-based chapters of this course start. Go gives you full control over reconcile logic, status, and finalizers, and the hybrid chapters show how to keep a chart while adding that control. Ansible Operators are not covered here.

When should I use a Helm-based Operator instead of a plain Helm chart?

A plain chart changes only when someone runs helm install or helm upgrade. A Helm-based Operator watches a custom resource, maps its spec to chart values, and runs the install, upgrade, or uninstall on every change to that resource. That gives your application its own Kubernetes API and lets other tools manage it by editing a resource. If you already deploy with Flux or Argo CD, read the comparison lesson first, because GitOps may already cover what you need.

Can I use Minikube instead of kind?

Yes. The controllers, CRDs, and manifests do not depend on the cluster tool. What changes is how your locally built images reach the cluster. The lessons push images to the ttl.sh registry, which any cluster with internet access can pull from, so the same steps work on Minikube. If you load images directly instead, use minikube image load where the lessons use kind load docker-image.

Is an Operator the right tool for my application?

Only if the application needs operational knowledge that Kubernetes does not already provide, such as ordered upgrades, backups, failover, or cleanup of external resources. If a Deployment, a chart, and an autoscaler already keep it healthy, an Operator adds code you have to maintain. The capability levels lesson is a good way to decide how far to take one.

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with 15+ years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive experience, he excels across development, DevOps, networking, and security, delivering robust and efficient solutions for diverse projects.

Expertise
  • Go (programming language)
  • Python (programming language)
  • DevOps
  • Computer Security
  • Cloud Computing
  • Kubernetes
  • Linux
  • Ansible (software)