Custom Resource Definitions and the Operator Pattern — How Every Add-On Actually Works

You have installed nine controllers across this series — cert-manager, the Prometheus Operator, Argo CD, Sealed Secrets, the VPA — and each one taught Kubernetes a new kind of object the core API never shipped: Certificate, Application, SealedSecret. The mechanism is always the same two halves: a CustomResourceDefinition that teaches the API server a new noun, and a controller (the operator) that watches those objects and reconciles the world toward them. Today you define your own CRD, apply a custom resource against it, and write a real reconciling controller in a few lines of shell — so the entire pattern the Kubernetes ecosystem is built on stops being magic.