kube

kube is the umbrella crate of the kube-rs project: a Rust client for the Kubernetes API modeled after client-go, paired with a controller runtime abstraction modeled after controller-runtime and a #[derive(CustomResource)] macro modeled after kubebuilder’s CRD generation. It bundles kube-client (the typed API client), kube-core (shared API machinery types), kube-runtime (watchers, reflectors, and the controller reconciliation loop), and kube-derive (the CRD derive macro) behind a single dependency and feature-flag surface.

The project is hosted as a CNCF Sandbox project and is the de facto standard for writing Kubernetes operators and controllers in Rust, comparable in role to client-go/controller-runtime in the Go ecosystem. It ships with rustls-based TLS by default (openssl is available as a legacy alternative) and is tested against a real range of supported Kubernetes API versions.

What You Get

• A typed Kubernetes API client (kube-client) covering CRUD, watch, patch, and subresource operations against any Kubernetes API version
• A controller runtime (kube-runtime) providing watchers, reflectors/stores, and a reconciliation-loop Controller abstraction for building operators
• A #[derive(CustomResource)] macro (kube-derive) that generates CRD schema and API types from a plain Rust struct
• Default rustls-based TLS (with an openssl-tls feature for legacy environments) and pluggable rustls crypto providers (ring or aws-lc-rs)
• Shared apimachinery-equivalent types (kube-core) for working with Kubernetes API concepts generically across resource kinds

Common Use Cases

• Writing a Kubernetes operator in Rust that watches custom resources and reconciles cluster state to match a desired spec
• Building CLI tools or automation scripts that need typed, async access to the Kubernetes API from Rust
• Defining and registering Custom Resource Definitions (CRDs) with generated OpenAPI schemas via the derive macro
• Implementing informer/reflector-style caching of cluster resources to reduce API server load in controllers

Under The Hood

Architecture The umbrella kube crate (this package) re-exports functionality from four sibling workspace crates: kube-core for shared apimachinery-style types and API concepts, kube-client for the actual HTTP-based typed client (config loading, request building, TLS), kube-runtime for the higher-level watcher/reflector/Controller reconciliation abstractions, and kube-derive for the CRD-generating proc macro — a layered design that mirrors Kubernetes’ own client-go (client) plus controller-runtime (reconciliation) split, letting consumers depend on just the client if they don’t need the controller runtime. Tech Stack Rust, MSRV 1.89, tested against Kubernetes v1.32 and above. Uses rustls (via rustls-tls, the default feature) with a choice of ring or aws-lc-rs crypto providers, with openssl-tls retained as an alternative for environments that require it. The workspace is managed via shared workspace.package fields across all five member crates. Code Quality 86 source files across the workspace’s src/ trees and 13 dedicated integration test files, plus a separate e2e/ directory for end-to-end tests against real clusters — a notably thorough setup for a project whose correctness depends heavily on matching real Kubernetes API server behavior. The project also holds a CNCF Best Practices badge and is a CNCF Sandbox project, both external signals of process maturity (security disclosure policy, governance) beyond the code itself. API Design The crate’s design deliberately tracks familiar prior art — client-go for the client shape and controller-runtime for the reconciliation loop — which flattens the learning curve for anyone coming from the Go Kubernetes ecosystem (the vast majority of Kubernetes tooling authors). The #[derive(CustomResource)] macro in particular collapses what is normally a large hand-written CRD YAML schema into a few macro attributes on a plain Rust struct, a significant ergonomics win over writing OpenAPI schemas by hand.