Kubernetes operators
without the infrastructure.
Reconciliation as a runtime service. Security as a runtime service. Intent Delivery as a runtime service. Declare operator behavior — or keep your existing Reconcile function — and the runtime handles the rest.
apiVersion: orkestra.orkspace.io/v1
kind: Katalog
metadata:
name: hello-website
spec:
crds:
website:
crdFile: my-website.yaml
operatorBox:
onCreate:
deployments:
- image: "{{ .spec.image }}"
replicas: "{{ .spec.replicas }}"
reconcile: true// Your Reconcile method: completely untouched.
// Same signature. Same body. Same r.Get, r.Status().Update().
func (r *WebAppReconciler) Reconcile(
ctx context.Context,
req ctrl.Request,
) (ctrl.Result, error) {
// ... your logic, unchanged ...
return ctrl.Result{}, nil
}
// Two lines replace SetupWithManager, Scheme, and main.go.
// Orkestra provides everything else.
func NewWebAppReconciler(kube kubeclient.Interface) domain.Reconciler {
return domain.ReconcilerFrom(&WebAppReconciler{
Client: kubeclient.ToClient(kube),
})
}Start fresh or bring what you have
Every Kubernetes operator carries reconciliation infrastructure, security infrastructure, and intent delivery infrastructure. Orkestra absorbs all three — whether you are writing a new operator or migrating an existing one.
Declare. The runtime does the rest.
Write a Katalog. No informers, no workqueues, no leader election, no admission webhook server, no RBAC hand-authoring, no main.go. Every CRD in a Katalog gets a complete, isolated operator — dedicated informer, queue, worker pool, drift correction, health API, Prometheus metrics, and a Control Center entry.
- No Go required — pure YAML for most operators
- Go when you need it — hooks and constructors for custom logic
-
Intent delivery built in —
serve.enabled: trueopens your operator to any caller without Kubernetes knowledge
// Before: SetupWithManager, Scheme, main.go,
// informer setup, leader election lease,
// health endpoints, RBAC ClusterRoles,
// admission webhook server + TLS...
// After: two lines. Reconcile is untouched.
func NewWebAppReconciler(
kube kubeclient.Interface,
) domain.Reconciler {
return domain.ReconcilerFrom(
&WebAppReconciler{
Client: kubeclient.ToClient(kube),
},
)
}
// Or: ork migrate ./controller/webapp_controller.go# The developer knows their vocabulary.
# The gateway knows the CRD.
# Neither has to learn the other's language.
target: app
name: payments-api
repository: myorg/payments-api
environment: staging
team: paymentsControl Center — one dashboard for every Orkestra runtime
The moment you run ork run, a live dashboard starts on port 8081 — showing every CRD, worker, queue depth, and reconcile event in real time. No extra setup.
Multi-runtime aggregation
Monitor every Orkestra instance — across clusters, namespaces, or environments — from a single Control Center.
Per-CRD drill-down
Click any CRD to see worker pool depth, queue pressure, admission stats, version conversion metrics, and live CR instances.
Zero configuration
Control Center is built into the ork CLI. Launch it with ork control — no additional binary or Helm chart needed.
Live production visibility
See a running Control Center connected to a live Orkestra cluster — watch real operators, real CRs, real events.
Three kinds of infrastructure. Gone.
Everything normally surrounding Reconcile() — the cost of entry — is now the runtime's job.
Reconciliation infrastructure
Informers, workqueues, worker pools, leader election, retries, backoff, finalizers, status patching, panic recovery — declared in a Katalog, managed by the runtime. Per-CRD. Isolated.
Katalog schemaSecurity infrastructure
Admission webhooks, validation rules, mutation rules, RBAC — declared in the Katalog. No webhook server to write. No TLS to manage. ork generate rbac derives ClusterRoles automatically.
Intent delivery infrastructure
serve.enabled: true opens any operator to callers who don't know Kubernetes. No apiVersion. No kind. No YAML. The gateway builds the CR, routes fields, translates values, and stamps provenance.
Drift correction
Mark any managed resource with reconcile: true — Orkestra detects and corrects configuration drift on every reconcile cycle. No manual enforcement code.
Migration from controller-runtime
Your Reconcile method stays completely unchanged. Two lines in a constructor wire it into Orkestra. ork migrate injects the constructor automatically and scaffolds the full operator project.
OCI distribution
Package operators as OCI artifacts. Publish with quality gates baked in — simulate status, e2e status, intent status. Distribute via any OCI registry or discover via Artifact Hub.
Orkestra RegistryFrom operator to running in three steps
Declare or migrate
Write a Katalog to declare new operator behavior — or run ork migrate against an existing controller-runtime file. Either way, the reconciliation, security, and delivery infrastructure is declared, not written.
Run the Orkestra CLI
ork run
Orkestra registers the CRD, starts the controller, and launches Control Center automatically. No cluster? ork run --dev provisions one.
The runtime manages everything
Apply a CR and watch Orkestra reconcile child resources, emit events, update status, enforce admission rules, correct drift, and expose health and metrics — all from your declaration.