[CNCF LFX Proposal] KubeEdge Modernize KubeEdge Controllers and Admission Webhooks

### CNCF Project

KubeEdge

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Modernize KubeEdge Controllers and Admission Webhooks

### Program Description

## Description

KubeEdge currently uses separate implementation and deployment models for cloud-side controllers and admission webhooks. The controller manager already uses controller-runtime and reconciliation, while admission remains an independent command, HTTP server, Deployment, Service, and manually registered webhook configuration.

Modern Kubebuilder and controller-runtime projects can run reconciliation controllers and admission webhooks through the same Manager, sharing lifecycle, client, scheme, cache, logging, health checks, leader election, metrics, certificates, and deployment management.

This project will modernize the KubeEdge controller framework by upgrading the Go and Kubebuilder-related toolchain, aligning controller-runtime and controller-tools with KubeEdge's Kubernetes dependencies, migrating existing admission handlers to controller-runtime webhooks, and consolidating controller and admission capabilities into one controller manager component. It will also add automated vulnerability checks and improve toolchain version consistency.

## Expected Outcome

* Audit the current Go, Kubernetes, controller-runtime, controller-tools, code-generation, controller manager, and admission implementations.
* Select compatible Go, controller-runtime, controller-tools, and Kubebuilder-related versions.
* Submit a design proposal covering architecture, migration, compatibility, certificates, deployment changes, and rollback.
* Align Go versions across `go.mod`, builder images, Dockerfiles, build scripts, GitHub Actions, and documentation.
* Upgrade controller-runtime, controller-tools, `controller-gen`, and `setup-envtest`.
* Integrate the webhook server into the existing controller-runtime Manager.
* Migrate validating and mutating handlers to controller-runtime admission handlers or Kubebuilder-style validators and defaulters.
* Share Manager lifecycle, scheme, client, cache, logging, health checks, metrics, and leader election.
* Replace manual webhook registration with declarative or generated webhook configurations.
* Preserve admission behavior for Device, DeviceModel, Rule, RuleEndpoint, NodeUpgradeJob, and offline migration workloads.
* Consolidate the separate admission command, Deployment, Service, RBAC, configuration, and certificate handling after feature parity is verified.
* Regenerate and verify CRDs, RBAC, webhook manifests, and generated API code.
* Add unit tests, envtest integration tests, and end-to-end tests.
* Integrate `govulncheck` or an equivalent Go vulnerability check.
* Validate AMD64 and ARM64 builds and generated-file consistency.
* Update installation, upgrade, development, and troubleshooting documentation.

### Technologies

Go, Kubernetes, KubeEdge, KubeBuilder, controller-runtime, controller-tools, Admission Webhooks, Custom Resource Definitions, GitHub Actions, Docker, Linux

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

_No response_

### Mentors

Chuanhao Jin | @DoisLONG | 15221580643@163.com | chuanhao
Willard Hu | @WillardHu | wei.hu@daocloud.io | WillardHu

### Upstream Issue URL

https://github.com/kubeedge/kubeedge/issues/7105

### Application Prerequisites

- [x] Resume
- [x] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [ ] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

_No response_

### Custom Prerequisite Description

_No response_

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - KubeEdge: Modernize KubeEdge Controllers and Admission Webhooks (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/104f564b-8f94-436b-b52e-8915ff290ef9)

Start by reading the upstream KubeEdge issue and auditing go.mod, Dockerfiles, build scripts, GitHub Actions, the controller manager, and admission implementations. Map current controller and webhook deployment, certificate, CRD, RBAC, and generated-code workflows before writing the design proposal. Done means compatible toolchain versions, a unified manager with preserved admission behavior, regenerated artifacts, vulnerability checks, multi-architecture validation, tests, and updated documentation.

Written by the indexing model from the issue text.