Explains Kubernetes controllers versus operators, where controllers run reconcile loops and operators add application domain knowledge via custom resources to manage complex lifecycle and automation.
Confusion often comes from two engineers using different words for what looks like the same thing:One says, “We need a controller.”
Another replies, “We need an operator.”Both can be partly correct, but the distinction matters before you design or build anything. This guide explains what a controller does, how an operator extends that mechanism, and when to choose one over the other.Think of a controller like a home thermostat. You set a desired temperature, the thermostat reads the actual room temperature, and it kicks on the A/C to close the gap.
At its core, a Kubernetes controller implements an observe-and-fix loop: it constantly watches a resource, compares the actual cluster state to the desired state expressed in YAML, and acts when they don’t match.
Example: the built-in Deployment controller inspects the desired replica count in a Deployment and makes sure that exact number of Pods exist. These built-in controllers are intentionally generic: they need not understand whether your workload is a distributed database or a static website. Their job is to reconcile state (e.g., replica count, pod status, etc.) until actual state matches desired state.
An operator uses the same controller mechanism but adds application-specific domain knowledge. For example, cert-manager understands X.509 certificates: you create a Certificate custom resource, and cert-manager’s controller knows how to request a certificate from a CA, renew it before expiry, and store it in a Secret.For an application operator, the domain knowledge includes the application’s topology, lifecycle rules, and recovery procedures. A user might declare a custom resource like this:
kind: WebAppspec: image: nginx replicas: 3
The operator’s controller translates that WebApp CR into the appropriate Kubernetes resources (Deployment, Service, ConfigMap, etc.) and manages them according to the application’s rules: upgrades, backups, scaling semantics, and failure recovery.
Quick rule:
A controller is the mechanism — the reconcile loop that observes, compares, and acts.
An operator is a controller that embodies domain or application knowledge, typically exposing that knowledge via a Custom Resource Definition (CRD).
Therefore: every operator is a controller, but not every controller is an operator.
Summary: Controllers provide the generic reconcile loop. Operators add domain-specific logic and APIs (CRDs) to manage complex application lifecycle and behavior.
