Building a Self-Updating Kubernetes Resource Crawler: Discovery API and Dynamic Client

Sun, 26 Jul 2026 09:00:00 -0500

Ask most engineers to export everything in a namespace and they reach for kubectl get all -o yaml. It feels comprehensive. It is not. The all category is a hardcoded shortlist inside kubectl, and it silently omits ConfigMaps, Secrets, PersistentVolumeClaims, Ingresses, NetworkPolicies, ServiceAccounts, RBAC bindings, and every Custom Resource an operator ever installed. Anything worth auditing is exactly the set all leaves out.

The correct approach is to ask the cluster what it can serve, then walk that list. The Kubernetes Discovery API enumerates every API group and resource the apiserver currently knows about, and the dynamic client lets you list any of them without compiling a single Go type. Composed together, they form a resource crawler that adapts to new CRDs the moment they are installed, with no code changes. A recent open source tool, k8s-ns-dump-dynamic, demonstrates the core loop in about 165 lines of Go and is a clean minimal example. This post builds that same crawler, then hardens it against the five ways the naive version fails in production: partial discovery, unbounded lists, swallowed permission errors, output that will not reapply, and client-side throttling.

Dynamic Client on Support Tools

Building a Self-Updating Kubernetes Resource Crawler: Discovery API and Dynamic Client