#

Requirements:You need a machine that is running Linux or macOS.You need to have these tools installed:Python v3.7.x+GitGolang version 1.13+Pip used to install PyYAMLPyYAML v5.1.2makegcc compiler/linkerDocker (Required only for kubectl command reference)Your PATH environment variable must include the required build tools, such as the Go binary and python.You need to know how to create a pull request to a GitHub repository. This involves creating your own fork of the repository. For more information, see Work from a local clone.


# Auditing

AuditingKubernetes auditing provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Auditing allows cluster administrators to answer the following questions:what happened?when did it happen?who initiated it?on what did it happen?where was it observed?from where was it initiated?to where was it going?Audit records begin their lifecycle inside the kube-apiserver component. Each request on each stage of its execution generates an audit event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records. The current backend implementations include logs files and webhooks.Each request can be recorded with an associated stage. The defined stages are:RequestReceived - The stage for events generated as soon as the audit handler receives the request, and before it is delegated down the handler chain.ResponseStarted - Once the response headers are sent, but before the response body is sent. This stage is only generated for long-running requests (e.g. watch).ResponseComplete - The response body has been completed and no more bytes will be sent.Panic - Events generated when a panic occurred.Note:The configuration of an Audit Event configuration is different from the Event API object.The audit logging feature increases the memory consumption of the API server because some context required for auditing is stored for each request. Memory consumption depends on the audit logging configuration.Audit policyAudit policy defines rules about what events should be recorded and what data they should include. The audit policy object structure is defined in the audit.k8s.io API group. When an event is processed, it's compared against the list of rules in order. The first matching rule sets the audit level of the event. The defined audit levels are:None - don't log events that match this rule.Metadata - log events with metadata (requesting user, timestamp, resource, verb, etc.) but not request or response body.Request - log events with request metadata and body but not response body. This does not apply for non-resource requests.RequestResponse - log events with request metadata, request body and response body. This does not apply for non-resource requests.You can pass a file with the policy to kube-apiserver using the --audit-policy-file flag. If the flag is omitted, no events are logged. Note that the rules field must be provided in the audit policy file. A policy with no (0) rules is treated as illegal.Below is an example audit policy file:audit/audit-policy.yaml apiVersion: audit.k8s.io/v1 # This is required. kind: Policy # Don't generate audit events for all requests in RequestReceived stage. omitStages: - "RequestReceived" rules: # Log pod changes at RequestResponse level - level: RequestResponse resources: - group: "" # Resource "pods" doesn't match requests to any subresource of pods, # which is consistent with the RBAC policy. resources: ["pods"] # Log "pods/log", "pods/status" at Metadata level - level: Metadata resources: - group: "" resources: ["pods/log", "pods/status"] # Don't log requests to a configmap called "controller-leader" - level: None resources: - group: "" resources: ["configmaps"] resourceNames: ["controller-leader"] # Don't log watch requests by the "system:kube-proxy" on endpoints or services - level: None users: ["system:kube-proxy"] verbs: ["watch"] resources: - group: "" # core API group resources: ["endpoints", "services"] # Don't log authenticated requests to certain non-resource URL paths. - level: None userGroups: ["system:authenticated"] nonResourceURLs: - "/api*" # Wildcard matching. - "/version" # Log the request body of configmap changes in kube-system. - level: Request resources: - group: "" # core API group resources: ["configmaps"] # This rule only applies to resources in the "kube-system" namespace. # The empty string "" can be used to select non-namespaced resources. namespaces: ["kube-system"] # Log configmap and secret changes in all other namespaces at the Metadata level. - level: Metadata resources: - group: "" # core API group resources: ["secrets", "configmaps"] # Log all other resources in core and extensions at the Request level. - level: Request resources: - group: "" # core API group - group: "extensions" # Version of group should NOT be included. # A catch-all rule to log all other requests at the Metadata level. - level: Metadata # Long-running requests like watches that fall under this rule will not # generate an audit event in RequestReceived. omitStages: - "RequestReceived" You can use a minimal audit policy file to log all requests at the Metadata level:# Log all requests at the Metadata level. apiVersion: audit.k8s.io/v1 kind: Policy rules: - level: Metadata If you're crafting your own audit profile, you can use the audit profile for Google Container-Optimized OS as a starting point. You can check the configure-helper.sh script, which generates an audit policy file. You can see most of the audit policy file by looking directly at the script.You can also refer to the Policy configuration reference for details about the fields defined.Audit backendsAudit backends persist audit events to an external storage. Out of the box, the kube-apiserver provides two backends:Log backend, which writes events into the filesystemWebhook backend, which sends events to an external HTTP APIIn all cases, audit events follow a structure defined by the Kubernetes API in the audit.k8s.io API group.Note:In case of patches, request body is a JSON array with patch operations, not a JSON object with an appropriate Kubernetes API object. For example, the following request body is a valid patch request to /apis/batch/v1/namespaces/some-namespace/jobs/some-job-name:[ { "op": "replace", "path": "/spec/parallelism", "value": 0 }, { "op": "remove", "path": "/spec/template/spec/containers/0/terminationMessagePolicy" } ] Log backendThe log backend writes audit events to a file in JSONlines format. You can configure the log audit backend using the following kube-apiserver flags:--audit-log-path specifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend. - means standard out--audit-log-maxage defined the maximum number of days to retain old audit log files--audit-log-maxbackup defines the maximum number of audit log files to retain--audit-log-maxsize defines the maximum size in megabytes of the audit log file before it gets rotatedIf your cluster's control plane runs the kube-apiserver as a Pod, remember to mount the hostPath to the location of the policy file and log file, so that audit records are persisted. For example: - --audit-policy-file=/etc/kubernetes/audit-policy.yaml - --audit-log-path=/var/log/kubernetes/audit/audit.log then mount the volumes:... volumeMounts: - mountPath: /etc/kubernetes/audit-policy.yaml name: audit readOnly: true - mountPath: /var/log/kubernetes/audit/ name: audit-log readOnly: false and finally configure the hostPath:... volumes: - name: audit hostPath: path: /etc/kubernetes/audit-policy.yaml type: File - name: audit-log hostPath: path: /var/log/kubernetes/audit/ type: DirectoryOrCreate Webhook backendThe webhook audit backend sends audit events to a remote web API, which is assumed to be a form of the Kubernetes API, including means of authentication. You can configure a webhook audit backend using the following kube-apiserver flags:--audit-webhook-config-file specifies the path to a file with a webhook configuration. The webhook configuration is effectively a specialized kubeconfig.--audit-webhook-initial-backoff specifies the amount of time to wait after the first failed request before retrying. Subsequent requests are retried with exponential backoff.The webhook config file uses the kubeconfig format to specify the remote address of the service and credentials used to connect to it.Event batchingBoth log and webhook backends support batching. Below is a list of available flags specific to each backend. By default, batching and throttling are enabled for the webhook backend and disabled for the log backend.--audit-webhook-mode defines the buffering strategy. One of the following:batch - buffer events and asynchronously process them in batches. This is the default mode for the webhook backend.blocking - block API server responses on processing each individual event.blocking-strict - Same as blocking, but when there is a failure during audit logging at the RequestReceived stage, the whole request to the kube-apiserver fails.The following flags are used only in the batch mode:--audit-webhook-batch-buffer-size defines the number of events to buffer before batching. If the rate of incoming events overflows the buffer, events are dropped. The default value is 10000.--audit-webhook-batch-max-size defines the maximum number of events in one batch. The default value is 400.--audit-webhook-batch-max-wait defines the maximum amount of time to wait before unconditionally batching events in the queue. The default value is 30 seconds.--audit-webhook-batch-throttle-enable defines whether batching throttling is enabled. Throttling is enabled by default.--audit-webhook-batch-throttle-qps defines the maximum average number of batches generated per second. The default value is 10.--audit-webhook-batch-throttle-burst defines the maximum number of batches generated at the same moment if the allowed QPS was underutilized previously. The default value is 15.--audit-log-mode defines the buffering strategy. One of the following:batch - buffer events and asynchronously process them in batches. Batching is not recommended for the log backend.blocking - block API server responses on processing each individual event. This is the default mode for the log backend.blocking-strict - Same as blocking, but when there is a failure during audit logging at the RequestReceived stage, the whole request to the kube-apiserver fails.The following flags are used only in the batch mode (batching is disabled by default for the log backend, and when batching is disabled, all batching-related flags are ignored):--audit-log-batch-buffer-size defines the number of events to buffer before batching. If the rate of incoming events overflows the buffer, events are dropped.--audit-log-batch-max-size defines the maximum number of events in one batch.--audit-log-batch-max-wait defines the maximum amount of time to wait before unconditionally batching events in the queue.--audit-log-batch-throttle-enable defines whether batching throttling is enabled.--audit-log-batch-throttle-qps defines the maximum average number of batches generated per second.--audit-log-batch-throttle-burst defines the maximum number of batches generated at the same moment if the allowed QPS was underutilized previously.Parameter tuningParameters should be set to accommodate the load on the API server.For example, if kube-apiserver receives 100 requests each second, and each request is audited only on ResponseStarted and ResponseComplete stages, you should account for ≅200 audit events being generated each second. Assuming that there are up to 100 events in a batch, you should set throttling level at least 2 queries per second. Assuming that the backend can take up to 5 seconds to write events, you should set the buffer size to hold up to 5 seconds of events; that is: 10 batches, or 1000 events.In most cases however, the default parameters should be sufficient and you don't have to worry about setting them manually. You can look at the following Prometheus metrics exposed by kube-apiserver and in the logs to monitor the state of the auditing subsystem.apiserver_audit_event_total metric contains the total number of audit events exported.apiserver_audit_error_total metric contains the total number of events dropped due to an error during exporting.Log entry truncationBoth log and webhook backends support limiting the size of events that are logged. As an example, the following is the list of flags available for the log backend:audit-log-truncate-enabled whether event and batch truncating is enabled.audit-log-truncate-max-batch-size maximum size in bytes of the batch sent to the underlying backend.audit-log-truncate-max-event-size maximum size in bytes of the audit event sent to the underlying backend.By default truncate is disabled in both webhook and log, a cluster administrator should set audit-log-truncate-enabled or audit-webhook-truncate-enabled to enable the feature.What's nextLearn about Mutating webhook auditing annotations.Learn more about Event and the Policy resource types by reading the Audit configuration reference.


# HorizontalPodAutoscaler

HorizontalPodAutoscalerHorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.apiVersion: autoscaling/v2import "k8s.io/api/autoscaling/v2"HorizontalPodAutoscalerHorizontalPodAutoscaler is the configuration for a horizontal pod autoscaler, which automatically manages the replica count of any resource implementing the scale subresource based on the metrics specified.apiVersion: autoscaling/v2kind: HorizontalPodAutoscalermetadata (ObjectMeta)metadata is the standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (HorizontalPodAutoscalerSpec)spec is the specification for the behaviour of the autoscaler. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status.status (HorizontalPodAutoscalerStatus)status is the current information about the autoscaler.HorizontalPodAutoscalerSpecHorizontalPodAutoscalerSpec describes the desired functionality of the HorizontalPodAutoscaler.maxReplicas (int32), requiredmaxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up. It cannot be less that minReplicas.scaleTargetRef (CrossVersionObjectReference), requiredscaleTargetRef points to the target resource to scale, and is used to the pods for which metrics should be collected, as well as to actually change the replica count.CrossVersionObjectReference contains enough information to let you identify the referred resource.scaleTargetRef.kind (string), requiredkind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsscaleTargetRef.name (string), requiredname is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namesscaleTargetRef.apiVersion (string)apiVersion is the API version of the referentminReplicas (int32)minReplicas is the lower limit for the number of replicas to which the autoscaler can scale down. It defaults to 1 pod. minReplicas is allowed to be 0 if the alpha feature gate HPAScaleToZero is enabled and at least one Object or External metric is configured. Scaling is active as long as at least one metric value is available.behavior (HorizontalPodAutoscalerBehavior)behavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively). If not set, the default HPAScalingRules for scale up and scale down are used.HorizontalPodAutoscalerBehavior configures the scaling behavior of the target in both Up and Down directions (scaleUp and scaleDown fields respectively).behavior.scaleDown (HPAScalingRules)scaleDown is scaling policy for scaling Down. If not set, the default value is to allow to scale down to minReplicas pods, with a 300 second stabilization window (i.e., the highest recommendation for the last 300sec is used).*HPAScalingRules configures the scaling behavior for one direction via scaling Policy Rules and a configurable metric tolerance.Scaling Policy Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.The tolerance is applied to the metric values and prevents scaling too eagerly for small metric variations. (Note that setting a tolerance requires enabling the alpha HPAConfigurableTolerance feature gate.)*behavior.scaleDown.policies ([]HPAScalingPolicy)Atomic: will be replaced during a mergepolicies is a list of potential scaling polices which can be used during scaling. If not set, use the default values: - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window. - For scale down: allow all pods to be removed in a 15s window.HPAScalingPolicy is a single policy which must hold true for a specified past interval.behavior.scaleDown.policies.type (string), requiredtype is used to specify the scaling policy.behavior.scaleDown.policies.value (int32), requiredvalue contains the amount of change which is permitted by the policy. It must be greater than zerobehavior.scaleDown.policies.periodSeconds (int32), requiredperiodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).behavior.scaleDown.selectPolicy (string)selectPolicy is used to specify which policy should be used. If not set, the default value Max is used.behavior.scaleDown.stabilizationWindowSeconds (int32)stabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).behavior.scaleDown.tolerance (Quantity)tolerance is the tolerance on the ratio between the current and desired metric value under which no updates are made to the desired number of replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not set, the default cluster-wide tolerance is applied (by default 10%).For example, if autoscaling is configured with a memory consumption target of 100Mi, and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi.This is an alpha field and requires enabling the HPAConfigurableTolerance feature gate.behavior.scaleUp (HPAScalingRules)scaleUp is scaling policy for scaling Up. If not set, the default value is the higher of:increase no more than 4 pods per 60 secondsdouble the number of pods per 60 seconds No stabilization is used.*HPAScalingRules configures the scaling behavior for one direction via scaling Policy Rules and a configurable metric tolerance.Scaling Policy Rules are applied after calculating DesiredReplicas from metrics for the HPA. They can limit the scaling velocity by specifying scaling policies. They can prevent flapping by specifying the stabilization window, so that the number of replicas is not set instantly, instead, the safest value from the stabilization window is chosen.The tolerance is applied to the metric values and prevents scaling too eagerly for small metric variations. (Note that setting a tolerance requires enabling the alpha HPAConfigurableTolerance feature gate.)*behavior.scaleUp.policies ([]HPAScalingPolicy)Atomic: will be replaced during a mergepolicies is a list of potential scaling polices which can be used during scaling. If not set, use the default values: - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window. - For scale down: allow all pods to be removed in a 15s window.HPAScalingPolicy is a single policy which must hold true for a specified past interval.behavior.scaleUp.policies.type (string), requiredtype is used to specify the scaling policy.behavior.scaleUp.policies.value (int32), requiredvalue contains the amount of change which is permitted by the policy. It must be greater than zerobehavior.scaleUp.policies.periodSeconds (int32), requiredperiodSeconds specifies the window of time for which the policy should hold true. PeriodSeconds must be greater than zero and less than or equal to 1800 (30 min).behavior.scaleUp.selectPolicy (string)selectPolicy is used to specify which policy should be used. If not set, the default value Max is used.behavior.scaleUp.stabilizationWindowSeconds (int32)stabilizationWindowSeconds is the number of seconds for which past recommendations should be considered while scaling up or scaling down. StabilizationWindowSeconds must be greater than or equal to zero and less than or equal to 3600 (one hour). If not set, use the default values: - For scale up: 0 (i.e. no stabilization is done). - For scale down: 300 (i.e. the stabilization window is 300 seconds long).behavior.scaleUp.tolerance (Quantity)tolerance is the tolerance on the ratio between the current and desired metric value under which no updates are made to the desired number of replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not set, the default cluster-wide tolerance is applied (by default 10%).For example, if autoscaling is configured with a memory consumption target of 100Mi, and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be triggered when the actual consumption falls below 95Mi or exceeds 101Mi.This is an alpha field and requires enabling the HPAConfigurableTolerance feature gate.metrics ([]MetricSpec)Atomic: will be replaced during a mergemetrics contains the specifications for which to use to calculate the desired replica count (the maximum replica count across all metrics will be used). The desired replica count is calculated multiplying the ratio between the target value and the current value by the current number of pods. Ergo, metrics used must decrease as the pod count is increased, and vice-versa. See the individual metric source types for more information about how each type of metric must respond. If not set, the default metric will be set to 80% average CPU utilization.MetricSpec specifies how to scale based on a single metric (only type and one other matching field should be set at once).metrics.type (string), requiredtype is the type of metric source. It should be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each mapping to a matching field in the object.metrics.containerResource (ContainerResourceMetricSource)containerResource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod of the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.ContainerResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.metrics.containerResource.container (string), requiredcontainer is the name of the container in the pods of the scaling targetmetrics.containerResource.name (string), requiredname is the name of the resource in question.metrics.containerResource.target (MetricTarget), requiredtarget specifies the target value for the given metricMetricTarget defines the target value, average value, or average utilization of a specific metricmetrics.containerResource.target.type (string), requiredtype represents whether the metric type is Utilization, Value, or AverageValuemetrics.containerResource.target.averageUtilization (int32)averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source typemetrics.containerResource.target.averageValue (Quantity)averageValue is the target value of the average of the metric across all relevant pods (as a quantity)metrics.containerResource.target.value (Quantity)value is the target value of the metric (as a quantity).metrics.external (ExternalMetricSource)external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).ExternalMetricSource indicates how to scale on a metric not associated with any Kubernetes object (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).metrics.external.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metricmetrics.external.metric.name (string), requiredname is the name of the given metricmetrics.external.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.metrics.external.target (MetricTarget), requiredtarget specifies the target value for the given metricMetricTarget defines the target value, average value, or average utilization of a specific metricmetrics.external.target.type (string), requiredtype represents whether the metric type is Utilization, Value, or AverageValuemetrics.external.target.averageUtilization (int32)averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source typemetrics.external.target.averageValue (Quantity)averageValue is the target value of the average of the metric across all relevant pods (as a quantity)metrics.external.target.value (Quantity)value is the target value of the metric (as a quantity).metrics.object (ObjectMetricSource)object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).ObjectMetricSource indicates how to scale on a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).metrics.object.describedObject (CrossVersionObjectReference), requireddescribedObject specifies the descriptions of a object,such as kind,name apiVersionCrossVersionObjectReference contains enough information to let you identify the referred resource.metrics.object.describedObject.kind (string), requiredkind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsmetrics.object.describedObject.name (string), requiredname is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namesmetrics.object.describedObject.apiVersion (string)apiVersion is the API version of the referentmetrics.object.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metricmetrics.object.metric.name (string), requiredname is the name of the given metricmetrics.object.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.metrics.object.target (MetricTarget), requiredtarget specifies the target value for the given metricMetricTarget defines the target value, average value, or average utilization of a specific metricmetrics.object.target.type (string), requiredtype represents whether the metric type is Utilization, Value, or AverageValuemetrics.object.target.averageUtilization (int32)averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source typemetrics.object.target.averageValue (Quantity)averageValue is the target value of the average of the metric across all relevant pods (as a quantity)metrics.object.target.value (Quantity)value is the target value of the metric (as a quantity).metrics.pods (PodsMetricSource)pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.PodsMetricSource indicates how to scale on a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.metrics.pods.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metricmetrics.pods.metric.name (string), requiredname is the name of the given metricmetrics.pods.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.metrics.pods.target (MetricTarget), requiredtarget specifies the target value for the given metricMetricTarget defines the target value, average value, or average utilization of a specific metricmetrics.pods.target.type (string), requiredtype represents whether the metric type is Utilization, Value, or AverageValuemetrics.pods.target.averageUtilization (int32)averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source typemetrics.pods.target.averageValue (Quantity)averageValue is the target value of the average of the metric across all relevant pods (as a quantity)metrics.pods.target.value (Quantity)value is the target value of the metric (as a quantity).metrics.resource (ResourceMetricSource)resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.ResourceMetricSource indicates how to scale on a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). The values will be averaged together before being compared to the target. Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source. Only one "target" type should be set.metrics.resource.name (string), requiredname is the name of the resource in question.metrics.resource.target (MetricTarget), requiredtarget specifies the target value for the given metricMetricTarget defines the target value, average value, or average utilization of a specific metricmetrics.resource.target.type (string), requiredtype represents whether the metric type is Utilization, Value, or AverageValuemetrics.resource.target.averageUtilization (int32)averageUtilization is the target value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods. Currently only valid for Resource metric source typemetrics.resource.target.averageValue (Quantity)averageValue is the target value of the average of the metric across all relevant pods (as a quantity)metrics.resource.target.value (Quantity)value is the target value of the metric (as a quantity).HorizontalPodAutoscalerStatusHorizontalPodAutoscalerStatus describes the current status of a horizontal pod autoscaler.desiredReplicas (int32), requireddesiredReplicas is the desired number of replicas of pods managed by this autoscaler, as last calculated by the autoscaler.conditions ([]HorizontalPodAutoscalerCondition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeconditions is the set of conditions required for this autoscaler to scale its target, and indicates whether or not those conditions are met.HorizontalPodAutoscalerCondition describes the state of a HorizontalPodAutoscaler at a certain point.conditions.status (string), requiredstatus is the status of the condition (True, False, Unknown)conditions.type (string), requiredtype describes the current conditionconditions.lastTransitionTime (Time)lastTransitionTime is the last time the condition transitioned from one status to anotherTime is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string)message is a human-readable explanation containing details about the transitionconditions.reason (string)reason is the reason for the condition's last transition.currentMetrics ([]MetricStatus)Atomic: will be replaced during a mergecurrentMetrics is the last read state of the metrics used by this autoscaler.MetricStatus describes the last-read state of a single metric.currentMetrics.type (string), requiredtype is the type of metric source. It will be one of "ContainerResource", "External", "Object", "Pods" or "Resource", each corresponds to a matching field in the object.currentMetrics.containerResource (ContainerResourceMetricStatus)container resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.ContainerResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing a single container in each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.currentMetrics.containerResource.container (string), requiredcontainer is the name of the container in the pods of the scaling targetcurrentMetrics.containerResource.current (MetricValueStatus), requiredcurrent contains the current value for the given metricMetricValueStatus holds the current value for a metriccurrentMetrics.containerResource.current.averageUtilization (int32)currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.currentMetrics.containerResource.current.averageValue (Quantity)averageValue is the current value of the average of the metric across all relevant pods (as a quantity)currentMetrics.containerResource.current.value (Quantity)value is the current value of the metric (as a quantity).currentMetrics.containerResource.name (string), requiredname is the name of the resource in question.currentMetrics.external (ExternalMetricStatus)external refers to a global metric that is not associated with any Kubernetes object. It allows autoscaling based on information coming from components running outside of cluster (for example length of queue in cloud messaging service, or QPS from loadbalancer running outside of cluster).ExternalMetricStatus indicates the current value of a global metric not associated with any Kubernetes object.currentMetrics.external.current (MetricValueStatus), requiredcurrent contains the current value for the given metricMetricValueStatus holds the current value for a metriccurrentMetrics.external.current.averageUtilization (int32)currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.currentMetrics.external.current.averageValue (Quantity)averageValue is the current value of the average of the metric across all relevant pods (as a quantity)currentMetrics.external.current.value (Quantity)value is the current value of the metric (as a quantity).currentMetrics.external.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metriccurrentMetrics.external.metric.name (string), requiredname is the name of the given metriccurrentMetrics.external.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.currentMetrics.object (ObjectMetricStatus)object refers to a metric describing a single kubernetes object (for example, hits-per-second on an Ingress object).ObjectMetricStatus indicates the current value of a metric describing a kubernetes object (for example, hits-per-second on an Ingress object).currentMetrics.object.current (MetricValueStatus), requiredcurrent contains the current value for the given metricMetricValueStatus holds the current value for a metriccurrentMetrics.object.current.averageUtilization (int32)currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.currentMetrics.object.current.averageValue (Quantity)averageValue is the current value of the average of the metric across all relevant pods (as a quantity)currentMetrics.object.current.value (Quantity)value is the current value of the metric (as a quantity).currentMetrics.object.describedObject (CrossVersionObjectReference), requiredDescribedObject specifies the descriptions of a object,such as kind,name apiVersionCrossVersionObjectReference contains enough information to let you identify the referred resource.currentMetrics.object.describedObject.kind (string), requiredkind is the kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindscurrentMetrics.object.describedObject.name (string), requiredname is the name of the referent; More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#namescurrentMetrics.object.describedObject.apiVersion (string)apiVersion is the API version of the referentcurrentMetrics.object.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metriccurrentMetrics.object.metric.name (string), requiredname is the name of the given metriccurrentMetrics.object.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.currentMetrics.pods (PodsMetricStatus)pods refers to a metric describing each pod in the current scale target (for example, transactions-processed-per-second). The values will be averaged together before being compared to the target value.PodsMetricStatus indicates the current value of a metric describing each pod in the current scale target (for example, transactions-processed-per-second).currentMetrics.pods.current (MetricValueStatus), requiredcurrent contains the current value for the given metricMetricValueStatus holds the current value for a metriccurrentMetrics.pods.current.averageUtilization (int32)currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.currentMetrics.pods.current.averageValue (Quantity)averageValue is the current value of the average of the metric across all relevant pods (as a quantity)currentMetrics.pods.current.value (Quantity)value is the current value of the metric (as a quantity).currentMetrics.pods.metric (MetricIdentifier), requiredmetric identifies the target metric by name and selectorMetricIdentifier defines the name and optionally selector for a metriccurrentMetrics.pods.metric.name (string), requiredname is the name of the given metriccurrentMetrics.pods.metric.selector (LabelSelector)selector is the string-encoded form of a standard kubernetes label selector for the given metric When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping. When unset, just the metricName will be used to gather metrics.currentMetrics.resource (ResourceMetricStatus)resource refers to a resource metric (such as those specified in requests and limits) known to Kubernetes describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.ResourceMetricStatus indicates the current value of a resource metric known to Kubernetes, as specified in requests and limits, describing each pod in the current scale target (e.g. CPU or memory). Such metrics are built in to Kubernetes, and have special scaling options on top of those available to normal per-pod metrics using the "pods" source.currentMetrics.resource.current (MetricValueStatus), requiredcurrent contains the current value for the given metricMetricValueStatus holds the current value for a metriccurrentMetrics.resource.current.averageUtilization (int32)currentAverageUtilization is the current value of the average of the resource metric across all relevant pods, represented as a percentage of the requested value of the resource for the pods.currentMetrics.resource.current.averageValue (Quantity)averageValue is the current value of the average of the metric across all relevant pods (as a quantity)currentMetrics.resource.current.value (Quantity)value is the current value of the metric (as a quantity).currentMetrics.resource.name (string), requiredname is the name of the resource in question.currentReplicas (int32)currentReplicas is current number of replicas of pods managed by this autoscaler, as last seen by the autoscaler.lastScaleTime (Time)lastScaleTime is the last time the HorizontalPodAutoscaler scaled the number of pods, used by the autoscaler to control how often the number of pods is changed.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.observedGeneration (int64)observedGeneration is the most recent generation observed by this autoscaler.HorizontalPodAutoscalerListHorizontalPodAutoscalerList is a list of horizontal pod autoscaler objects.apiVersion: autoscaling/v2kind: HorizontalPodAutoscalerListmetadata (ListMeta)metadata is the standard list metadata.items ([]HorizontalPodAutoscaler), requireditems is the list of horizontal pod autoscaler objects.Operationsget read the specified HorizontalPodAutoscalerHTTP RequestGET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}Parametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK401: Unauthorizedget read status of the specified HorizontalPodAutoscalerHTTP RequestGET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/statusParametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK401: Unauthorizedlist list or watch objects of kind HorizontalPodAutoscalerHTTP RequestGET /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalersParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (HorizontalPodAutoscalerList): OK401: Unauthorizedlist list or watch objects of kind HorizontalPodAutoscalerHTTP RequestGET /apis/autoscaling/v2/horizontalpodautoscalersParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (HorizontalPodAutoscalerList): OK401: Unauthorizedcreate create a HorizontalPodAutoscalerHTTP RequestPOST /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalersParametersnamespace (in path): string, requirednamespacebody: HorizontalPodAutoscaler, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK201 (HorizontalPodAutoscaler): Created202 (HorizontalPodAutoscaler): Accepted401: Unauthorizedupdate replace the specified HorizontalPodAutoscalerHTTP RequestPUT /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}Parametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacebody: HorizontalPodAutoscaler, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK201 (HorizontalPodAutoscaler): Created401: Unauthorizedupdate replace status of the specified HorizontalPodAutoscalerHTTP RequestPUT /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/statusParametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacebody: HorizontalPodAutoscaler, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK201 (HorizontalPodAutoscaler): Created401: Unauthorizedpatch partially update the specified HorizontalPodAutoscalerHTTP RequestPATCH /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}Parametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK201 (HorizontalPodAutoscaler): Created401: Unauthorizedpatch partially update status of the specified HorizontalPodAutoscalerHTTP RequestPATCH /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}/statusParametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (HorizontalPodAutoscaler): OK201 (HorizontalPodAutoscaler): Created401: Unauthorizeddelete delete a HorizontalPodAutoscalerHTTP RequestDELETE /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalers/{name}Parametersname (in path): string, requiredname of the HorizontalPodAutoscalernamespace (in path): string, requirednamespacebody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of HorizontalPodAutoscalerHTTP RequestDELETE /apis/autoscaling/v2/namespaces/{namespace}/horizontalpodautoscalersParametersnamespace (in path): string, requirednamespacebody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# kubectl apply

kubectl applySynopsisApply a configuration to a resource by file name or stdin. The resource name must be specified. This resource will be created if it doesn't exist yet. To use 'apply', always create the resource initially with either 'apply' or 'create --save-config'.JSON and YAML formats are accepted.Alpha Disclaimer: the --prune functionality is not yet complete. Do not use unless you are aware of what the current state is. See https://issues.k8s.io/34274.kubectl apply (-f FILENAME | -k DIRECTORY) Examples # Apply the configuration in pod.json to a pod kubectl apply -f ./pod.json # Apply resources from a directory containing kustomization.yaml - e.g. dir/kustomization.yaml kubectl apply -k dir/ # Apply the JSON passed into stdin to a pod cat pod.json | kubectl apply -f - # Apply the configuration from all files that end with '.json' kubectl apply -f '*.json' # Note: --prune is still in Alpha # Apply the configuration in manifest.yaml that matches label app=nginx and delete all other resources that are not in the file and match label app=nginx kubectl apply --prune -f manifest.yaml -l app=nginx # Apply the configuration in manifest.yaml and delete all the other config maps that are not in the file kubectl apply --prune -f manifest.yaml --all --prune-allowlist=core/v1/ConfigMap Options--allSelect all resources in the namespace of the specified resource types.--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--cascade string[="background"] Default: "background"Must be "background", "orphan", or "foreground". Selects the deletion cascading strategy for the dependents (e.g. Pods created by a ReplicationController). Defaults to background.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-client-side-apply"Name of the manager used to track field ownership.-f, --filename stringsThe files that contain the configurations to apply.--forceIf true, immediately remove resources from API and bypass graceful deletion. Note that immediate deletion of some resources may result in inconsistency or data loss and requires confirmation.--force-conflictsIf true, server-side apply will force the changes against conflicts.--grace-period int Default: -1Period of time in seconds given to the resource to terminate gracefully. Ignored if negative. Set to 1 for immediate shutdown. Can only be set to 0 when --force is true (force deletion).-h, --helphelp for apply-k, --kustomize stringProcess a kustomization directory. This flag can't be used together with -f or -R.--openapi-patch Default: trueIf true, use openapi to calculate diff when the openapi presents and the resource can be found in the openapi spec. Otherwise, fall back to use baked-in types.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--overwrite Default: trueAutomatically resolve conflicts between the modified and live configuration by using values from the modified configuration--pruneAutomatically delete resource objects, that do not appear in the configs and are created by either apply or create --save-config. Should be used with either -l or --all.--prune-allowlist stringsOverwrite the default allowlist with <group/version/kind> for --prune-R, --recursiveProcess the directory used in -f, --filename recursively. Useful when you want to manage related manifests organized within the same directory.-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.--server-sideIf true, apply runs in the server instead of the client.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--subresource stringIf specified, apply will operate on the subresource of the requested object. Only allowed when using --server-side.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--timeout durationThe length of time to wait before giving up on a delete, zero means determine a timeout from the size of the object--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.--waitIf true, wait for resources to be gone before returning. This waits for finalizers.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl - kubectl controls the Kubernetes cluster managerkubectl apply edit-last-applied - Edit latest last-applied-configuration annotations of a resource/objectkubectl apply set-last-applied - Set the last-applied-configuration annotation on a live object to match the contents of a filekubectl apply view-last-applied - View the latest last-applied-configuration annotations of a resource/objectThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Resource Bin Packing

Resource Bin PackingIn the scheduling-plugin NodeResourcesFit of kube-scheduler, there are two scoring strategies that support the bin packing of resources: MostAllocated and RequestedToCapacityRatio.Enabling bin packing using MostAllocated strategyThe MostAllocated strategy scores the nodes based on the utilization of resources, favoring the ones with higher allocation. For each resource type, you can set a weight to modify its influence in the node score.To set the MostAllocated strategy for the NodeResourcesFit plugin, use a scheduler configuration similar to the following:apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration profiles: - pluginConfig: - args: scoringStrategy: resources: - name: cpu weight: 1 - name: memory weight: 1 - name: intel.com/foo weight: 3 - name: intel.com/bar weight: 3 type: MostAllocated name: NodeResourcesFit To learn more about other parameters and their default configuration, see the API documentation for NodeResourcesFitArgs.Enabling bin packing using RequestedToCapacityRatioThe RequestedToCapacityRatio strategy allows the users to specify the resources along with weights for each resource to score nodes based on the request to capacity ratio. This allows users to bin pack extended resources by using appropriate parameters to improve the utilization of scarce resources in large clusters. It favors nodes according to a configured function of the allocated resources. The behavior of the RequestedToCapacityRatio in the NodeResourcesFit score function can be controlled by the scoringStrategy field. Within the scoringStrategy field, you can configure two parameters: requestedToCapacityRatio and resources. The shape in the requestedToCapacityRatio parameter allows the user to tune the function as least requested or most requested based on utilization and score values. The resources parameter comprises both the name of the resource to be considered during scoring and its corresponding weight, which specifies the weight of each resource.Below is an example configuration that sets the bin packing behavior for extended resources intel.com/foo and intel.com/bar using the requestedToCapacityRatio field.apiVersion: kubescheduler.config.k8s.io/v1 kind: KubeSchedulerConfiguration profiles: - pluginConfig: - args: scoringStrategy: resources: - name: intel.com/foo weight: 3 - name: intel.com/bar weight: 3 requestedToCapacityRatio: shape: - utilization: 0 score: 0 - utilization: 100 score: 10 type: RequestedToCapacityRatio name: NodeResourcesFit Referencing the KubeSchedulerConfiguration file with the kube-scheduler flag --config=/path/to/config/file will pass the configuration to the scheduler.To learn more about other parameters and their default configuration, see the API documentation for NodeResourcesFitArgs.Tuning the score functionshape is used to specify the behavior of the RequestedToCapacityRatio function.shape: - utilization: 0 score: 0 - utilization: 100 score: 10 The above arguments give the node a score of 0 if utilization is 0% and 10 for utilization 100%, thus enabling bin packing behavior. To enable least requested the score value must be reversed as follows.shape: - utilization: 0 score: 10 - utilization: 100 score: 0 resources is an optional parameter which defaults to:resources: - name: cpu weight: 1 - name: memory weight: 1 It can be used to add extended resources as follows:resources: - name: intel.com/foo weight: 5 - name: cpu weight: 3 - name: memory weight: 1 The weight parameter is optional and is set to 1 if not specified. Also, the weight cannot be set to a negative value.Node scoring for capacity allocationThis section is intended for those who want to understand the internal details of this feature. Below is an example of how the node score is calculated for a given set of values.Requested resources:intel.com/foo : 2 memory: 256MB cpu: 2 Resource weights:intel.com/foo : 5 memory: 1 cpu: 3 FunctionShapePoint {{0, 0}, {100, 10}}Node 1 spec:Available: intel.com/foo: 4 memory: 1 GB cpu: 8 Used: intel.com/foo: 1 memory: 256MB cpu: 1 Node score:intel.com/foo = resourceScoringFunction((2+1),4) = (100 - ((4-3)*100/4) = (100 - 25) = 75 # requested + used = 75% * available = rawScoringFunction(75) = 7 # floor(75/10) memory = resourceScoringFunction((256+256),1024) = (100 -((1024-512)*100/1024)) = 50 # requested + used = 50% * available = rawScoringFunction(50) = 5 # floor(50/10) cpu = resourceScoringFunction((2+1),8) = (100 -((8-3)*100/8)) = 37.5 # requested + used = 37.5% * available = rawScoringFunction(37.5) = 3 # floor(37.5/10) NodeScore = ((7 * 5) + (5 * 1) + (3 * 3)) / (5 + 1 + 3) = 5 Node 2 spec:Available: intel.com/foo: 8 memory: 1GB cpu: 8 Used: intel.com/foo: 2 memory: 512MB cpu: 6 Node score:intel.com/foo = resourceScoringFunction((2+2),8) = (100 - ((8-4)*100/8) = (100 - 50) = 50 = rawScoringFunction(50) = 5 memory = resourceScoringFunction((256+512),1024) = (100 -((1024-768)*100/1024)) = 75 = rawScoringFunction(75) = 7 cpu = resourceScoringFunction((2+6),8) = (100 -((8-8)*100/8)) = 100 = rawScoringFunction(100) = 10 NodeScore = ((5 * 5) + (7 * 1) + (10 * 3)) / (5 + 1 + 3) = 7 What's nextRead more about the scheduling frameworkRead more about scheduler configuration


# Debug a StatefulSet

Debug a StatefulSetThis task shows you how to debug a StatefulSet.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.You should have a StatefulSet running that you want to investigate.Debugging a StatefulSetIn order to list all the pods which belong to a StatefulSet, which have a label app.kubernetes.io/name=MyApp set on them, you can use the following:kubectl get pods -l app.kubernetes.io/name=MyApp If you find that any Pods listed are in Unknown or Terminating state for an extended period of time, refer to the Deleting StatefulSet Pods task for instructions on how to deal with them. You can debug individual Pods in a StatefulSet using the Debugging Pods guide.What's nextLearn more about debugging an init-container.


# Control CPU Management Policies on the Node

Control CPU Management Policies on the NodeFEATURE STATE: Kubernetes v1.26 [stable]Kubernetes keeps many aspects of how pods execute on nodes abstracted from the user. This is by design. However, some workloads require stronger guarantees in terms of latency and/or performance in order to operate acceptably. The kubelet provides methods to enable more complex workload placement policies while keeping the abstraction free from explicit placement directives.For detailed information on resource management, please refer to the Resource Management for Pods and Containers documentation.For detailed information on how the kubelet implements resource management, please refer to the Node ResourceManagers documentation.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.26.To check the version, enter kubectl version.If you are running an older version of Kubernetes, please look at the documentation for the version you are actually running.Configuring CPU management policiesBy default, the kubelet uses CFS quota to enforce pod CPU limits. When the node runs many CPU-bound pods, the workload can move to different CPU cores depending on whether the pod is throttled and which CPU cores are available at scheduling time. Many workloads are not sensitive to this migration and thus work fine without any intervention.However, in workloads where CPU cache affinity and scheduling latency significantly affect workload performance, the kubelet allows alternative CPU management policies to determine some placement preferences on the node.Windows SupportFEATURE STATE: Kubernetes v1.32 [alpha] (enabled by default: false)CPU Manager support can be enabled on Windows by using the WindowsCPUAndMemoryAffinity feature gate and it requires support in the container runtime. Once the feature gate is enabled, follow the steps below to configure the CPU manager policy.ConfigurationThe CPU Manager policy is set with the --cpu-manager-policy kubelet flag or the cpuManagerPolicy field in KubeletConfiguration. There are two supported policies:none: the default policy.static: allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node.The CPU manager periodically writes resource updates through the CRI in order to reconcile in-memory CPU assignments with cgroupfs. The reconcile frequency is set through a new Kubelet configuration value --cpu-manager-reconcile-period. If not specified, it defaults to the same duration as --node-status-update-frequency.The behavior of the static policy can be fine-tuned using the --cpu-manager-policy-options flag. The flag takes a comma-separated list of key=value policy options. If you disable the CPUManagerPolicyOptions feature gate then you cannot fine-tune CPU manager policies. In that case, the CPU manager operates only using its default settings.In addition to the top-level CPUManagerPolicyOptions feature gate, the policy options are split into two groups: alpha quality (hidden by default) and beta quality (visible by default). The groups are guarded respectively by the CPUManagerPolicyAlphaOptions and CPUManagerPolicyBetaOptions feature gates. Diverging from the Kubernetes standard, these feature gates guard groups of options, because it would have been too cumbersome to add a feature gate for each individual option.Changing the CPU Manager PolicySince the CPU manager policy can only be applied when kubelet spawns new pods, simply changing from "none" to "static" won't apply to existing pods. So in order to properly change the CPU manager policy on a node, perform the following steps:Drain the node.Stop kubelet.Remove the old CPU manager state file. The path to this file is /var/lib/kubelet/cpu_manager_state by default. This clears the state maintained by the CPUManager so that the cpu-sets set up by the new policy won’t conflict with it.Edit the kubelet configuration to change the CPU manager policy to the desired value.Start kubelet.Repeat this process for every node that needs its CPU manager policy changed. Skipping this process will result in kubelet crashlooping with the following error:could not restore state from checkpoint: configured policy "static" differs from state checkpoint policy "none", please drain this node and delete the CPU manager checkpoint file "/var/lib/kubelet/cpu_manager_state" before restarting Kubelet Note:if the set of online CPUs changes on the node, the node must be drained and CPU manager manually reset by deleting the state file cpu_manager_state in the kubelet root directory.none policy configurationThis policy has no extra configuration items.static policy configurationThis policy manages a shared pool of CPUs that initially contains all CPUs in the node. The amount of exclusively allocatable CPUs is equal to the total number of CPUs in the node minus any CPU reservations by the kubelet --kube-reserved or --system-reserved options. From 1.17, the CPU reservation list can be specified explicitly by kubelet --reserved-cpus option. The explicit CPU list specified by --reserved-cpus takes precedence over the CPU reservation specified by --kube-reserved and --system-reserved. CPUs reserved by these options are taken, in integer quantity, from the initial shared pool in ascending order by physical core ID. This shared pool is the set of CPUs on which any containers in BestEffort and Burstable pods run. Containers in Guaranteed pods with fractional CPU requests also run on CPUs in the shared pool. Only containers that are both part of a Guaranteed pod and have integer CPU requests are assigned exclusive CPUs.Note:The kubelet requires a CPU reservation greater than zero be made using either --kube-reserved and/or --system-reserved or --reserved-cpus when the static policy is enabled. This is because zero CPU reservation would allow the shared pool to become empty.Static policy optionsYou can toggle groups of options on and off based upon their maturity level using the following feature gates:CPUManagerPolicyBetaOptions default enabled. Disable to hide beta-level options.CPUManagerPolicyAlphaOptions default disabled. Enable to show alpha-level options. You will still have to enable each option using the CPUManagerPolicyOptions kubelet option.The following policy options exist for the static CPUManager policy:full-pcpus-only (GA, visible by default) (1.33 or higher)distribute-cpus-across-numa (beta, visible by default) (1.33 or higher)align-by-socket (alpha, hidden by default) (1.25 or higher)distribute-cpus-across-cores (alpha, hidden by default) (1.31 or higher)strict-cpu-reservation (beta, visible by default) (1.32 or higher)prefer-align-cpus-by-uncorecache (beta, visible by default) (1.34 or higher)The full-pcpus-only option can be enabled by adding full-pcpus-only=true to the CPUManager policy options. Likewise, the distribute-cpus-across-numa option can be enabled by adding distribute-cpus-across-numa=true to the CPUManager policy options. When both are set, they are "additive" in the sense that CPUs will be distributed across NUMA nodes in chunks of full-pcpus rather than individual cores. The align-by-socket policy option can be enabled by adding align-by-socket=true to the CPUManager policy options. It is also additive to the full-pcpus-only and distribute-cpus-across-numa policy options.The distribute-cpus-across-cores option can be enabled by adding distribute-cpus-across-cores=true to the CPUManager policy options. It cannot be used with full-pcpus-only or distribute-cpus-across-numa policy options together at this moment.The strict-cpu-reservation option can be enabled by adding strict-cpu-reservation=true to the CPUManager policy options followed by removing the /var/lib/kubelet/cpu_manager_state file and restart kubelet.The prefer-align-cpus-by-uncorecache option can be enabled by adding the prefer-align-cpus-by-uncorecache to the CPUManager policy options. If incompatible options are used, the kubelet will fail to start with the error explained in the logs.For mode detail about the behavior of the individual options you can configure, please refer to the Node ResourceManagers documentation.


# Event

EventEvent is a report of an event somewhere in the cluster.apiVersion: events.k8s.io/v1import "k8s.io/api/events/v1"EventEvent is a report of an event somewhere in the cluster. It generally denotes some state change in the system. Events have a limited retention time and triggers and messages may evolve with time. Event consumers should not rely on the timing of an event with a given Reason reflecting a consistent underlying trigger, or the continued existence of events with that Reason. Events should be treated as informative, best-effort, supplemental data.apiVersion: events.k8s.io/v1kind: Eventmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataeventTime (MicroTime), requiredeventTime is the time when this Event was first observed. It is required.MicroTime is version of Time with microsecond level precision.action (string)action is what action was taken/failed regarding to the regarding object. It is machine-readable. This field cannot be empty for new Events and it can have at most 128 characters.deprecatedCount (int32)deprecatedCount is the deprecated field assuring backward compatibility with core.v1 Event type.deprecatedFirstTimestamp (Time)deprecatedFirstTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.deprecatedLastTimestamp (Time)deprecatedLastTimestamp is the deprecated field assuring backward compatibility with core.v1 Event type.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.deprecatedSource (EventSource)deprecatedSource is the deprecated field assuring backward compatibility with core.v1 Event type.EventSource contains information for an event.deprecatedSource.component (string)Component from which the event is generated.deprecatedSource.host (string)Node name on which the event is generated.note (string)note is a human-readable description of the status of this operation. Maximal length of the note is 1kB, but libraries should be prepared to handle values up to 64kB.reason (string)reason is why the action was taken. It is human-readable. This field cannot be empty for new Events and it can have at most 128 characters.regarding (ObjectReference)regarding contains the object this Event is about. In most cases it's an Object reporting controller implements, e.g. ReplicaSetController implements ReplicaSets and this event is emitted because it acts on some changes in a ReplicaSet object.related (ObjectReference)related is the optional secondary object for more complex actions. E.g. when regarding object triggers a creation or deletion of related object.reportingController (string)reportingController is the name of the controller that emitted this Event, e.g. kubernetes.io/kubelet. This field cannot be empty for new Events.reportingInstance (string)reportingInstance is the ID of the controller instance, e.g. kubelet-xyzf. This field cannot be empty for new Events and it can have at most 128 characters.series (EventSeries)series is data about the Event series this event represents or nil if it's a singleton Event.EventSeries contain information on series of events, i.e. thing that was/is happening continuously for some time. How often to update the EventSeries is up to the event reporters. The default event reporter in "k8s.io/client-go/tools/events/event_broadcaster.go" shows how this struct is updated on heartbeats and can guide customized reporter implementations.series.count (int32), requiredcount is the number of occurrences in this series up to the last heartbeat time.series.lastObservedTime (MicroTime), requiredlastObservedTime is the time when last Event from the series was seen before last heartbeat.MicroTime is version of Time with microsecond level precision.type (string)type is the type of this event (Normal, Warning), new types could be added in the future. It is machine-readable. This field cannot be empty for new Events.EventListEventList is a list of Event objects.apiVersion: events.k8s.io/v1kind: EventListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataitems ([]Event), requireditems is a list of schema objects.Operationsget read the specified EventHTTP RequestGET /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}Parametersname (in path): string, requiredname of the Eventnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Event): OK401: Unauthorizedlist list or watch objects of kind EventHTTP RequestGET /apis/events.k8s.io/v1/namespaces/{namespace}/eventsParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (EventList): OK401: Unauthorizedlist list or watch objects of kind EventHTTP RequestGET /apis/events.k8s.io/v1/eventsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (EventList): OK401: Unauthorizedcreate create an EventHTTP RequestPOST /apis/events.k8s.io/v1/namespaces/{namespace}/eventsParametersnamespace (in path): string, requirednamespacebody: Event, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Event): OK201 (Event): Created202 (Event): Accepted401: Unauthorizedupdate replace the specified EventHTTP RequestPUT /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}Parametersname (in path): string, requiredname of the Eventnamespace (in path): string, requirednamespacebody: Event, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Event): OK201 (Event): Created401: Unauthorizedpatch partially update the specified EventHTTP RequestPATCH /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}Parametersname (in path): string, requiredname of the Eventnamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Event): OK201 (Event): Created401: Unauthorizeddelete delete an EventHTTP RequestDELETE /apis/events.k8s.io/v1/namespaces/{namespace}/events/{name}Parametersname (in path): string, requiredname of the Eventnamespace (in path): string, requirednamespacebody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of EventHTTP RequestDELETE /apis/events.k8s.io/v1/namespaces/{namespace}/eventsParametersnamespace (in path): string, requirednamespacebody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# kubectl config set-context

kubectl config set-contextSynopsisSet a context entry in kubeconfig.Specifying a name that already exists will merge new fields on top of existing values for those fields.kubectl config set-context [NAME | --current] [--cluster=cluster_nickname] [--user=user_nickname] [--namespace=namespace] Examples # Set the user field on the gce context entry without touching other values kubectl config set-context gce --user=cluster-admin Options--cluster stringcluster for the context entry in kubeconfig--currentModify the current context-h, --helphelp for set-context--namespace stringnamespace for the context entry in kubeconfig--user stringuser for the context entry in kubeconfigParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl config - Modify kubeconfig filesThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Share a Cluster with Namespaces

Share a Cluster with NamespacesThis page shows how to view, work in, and delete namespaces. The page also shows how to use Kubernetes namespaces to subdivide your cluster.Before you beginHave an existing Kubernetes cluster.You have a basic understanding of Kubernetes Pods, Services, and Deployments.Viewing namespacesList the current namespaces in a cluster using:kubectl get namespaces NAME STATUS AGE default Active 11d kube-node-lease Active 11d kube-public Active 11d kube-system Active 11d Kubernetes starts with four initial namespaces:default The default namespace for objects with no other namespacekube-node-lease This namespace holds Lease objects associated with each node. Node leases allow the kubelet to send heartbeats so that the control plane can detect node failure.kube-public This namespace is created automatically and is readable by all users (including those not authenticated). This namespace is mostly reserved for cluster usage, in case that some resources should be visible and readable publicly throughout the whole cluster. The public aspect of this namespace is only a convention, not a requirement.kube-system The namespace for objects created by the Kubernetes systemYou can also get the summary of a specific namespace using:kubectl get namespaces <name> Or you can get detailed information with:kubectl describe namespaces <name> Name: default Labels: <none> Annotations: <none> Status: Active No resource quota. Resource Limits Type Resource Min Max Default ---- -------- --- --- --- Container cpu - - 100m Note that these details show both resource quota (if present) as well as resource limit ranges.Resource quota tracks aggregate usage of resources in the Namespace and allows cluster operators to define Hard resource usage limits that a Namespace may consume.A limit range defines min/max constraints on the amount of resources a single entity can consume in a Namespace.See Admission control: Limit RangeA namespace can be in one of two phases:Active the namespace is in useTerminating the namespace is being deleted, and can not be used for new objectsFor more details, see Namespace in the API reference.Creating a new namespaceNote:Avoid creating namespace with prefix kube-, since it is reserved for Kubernetes system namespaces.Create a new YAML file called my-namespace.yaml with the contents:apiVersion: v1 kind: Namespace metadata: name: <insert-namespace-name-here> Then run:kubectl create -f ./my-namespace.yaml Alternatively, you can create namespace using below command:kubectl create namespace <insert-namespace-name-here> The name of your namespace must be a valid DNS label.There's an optional field finalizers, which allows observables to purge resources whenever the namespace is deleted. Keep in mind that if you specify a nonexistent finalizer, the namespace will be created but will get stuck in the Terminating state if the user tries to delete it.More information on finalizers can be found in the namespace design doc.Deleting a namespaceDelete a namespace withkubectl delete namespaces <insert-some-namespace-name> Warning:This deletes everything under the namespace!This delete is asynchronous, so for a time you will see the namespace in the Terminating state.Subdividing your cluster using Kubernetes namespacesBy default, a Kubernetes cluster will instantiate a default namespace when provisioning the cluster to hold the default set of Pods, Services, and Deployments used by the cluster.Assuming you have a fresh cluster, you can introspect the available namespaces by doing the following:kubectl get namespaces NAME STATUS AGE default Active 13m Create new namespacesFor this exercise, we will create two additional Kubernetes namespaces to hold our content.In a scenario where an organization is using a shared Kubernetes cluster for development and production use cases:The development team would like to maintain a space in the cluster where they can get a view on the list of Pods, Services, and Deployments they use to build and run their application. In this space, Kubernetes resources come and go, and the restrictions on who can or cannot modify resources are relaxed to enable agile development.The operations team would like to maintain a space in the cluster where they can enforce strict procedures on who can or cannot manipulate the set of Pods, Services, and Deployments that run the production site.One pattern this organization could follow is to partition the Kubernetes cluster into two namespaces: development and production. Let's create two new namespaces to hold our work.Create the development namespace using kubectl:kubectl create -f https://k8s.io/examples/admin/namespace-dev.json And then let's create the production namespace using kubectl:kubectl create -f https://k8s.io/examples/admin/namespace-prod.json To be sure things are right, list all of the namespaces in our cluster.kubectl get namespaces --show-labels NAME STATUS AGE LABELS default Active 32m <none> development Active 29s name=development production Active 23s name=production Create pods in each namespaceA Kubernetes namespace provides the scope for Pods, Services, and Deployments in the cluster. Users interacting with one namespace do not see the content in another namespace. To demonstrate this, let's spin up a simple Deployment and Pods in the development namespace.kubectl create deployment snowflake \ --image=registry.k8s.io/serve_hostname \ -n=development --replicas=2 We have created a deployment whose replica size is 2 that is running the pod called snowflake with a basic container that serves the hostname.kubectl get deployment -n=development NAME READY UP-TO-DATE AVAILABLE AGE snowflake 2/2 2 2 2m kubectl get pods -l app=snowflake -n=development NAME READY STATUS RESTARTS AGE snowflake-3968820950-9dgr8 1/1 Running 0 2m snowflake-3968820950-vgc4n 1/1 Running 0 2m And this is great, developers are able to do what they want, and they do not have to worry about affecting content in the production namespace.Let's switch to the production namespace and show how resources in one namespace are hidden from the other. The production namespace should be empty, and the following commands should return nothing.kubectl get deployment -n=production kubectl get pods -n=production Production likes to run cattle, so let's create some cattle pods.kubectl create deployment cattle --image=registry.k8s.io/serve_hostname -n=production kubectl scale deployment cattle --replicas=5 -n=production kubectl get deployment -n=production NAME READY UP-TO-DATE AVAILABLE AGE cattle 5/5 5 5 10s kubectl get pods -l app=cattle -n=production NAME READY STATUS RESTARTS AGE cattle-2263376956-41xy6 1/1 Running 0 34s cattle-2263376956-kw466 1/1 Running 0 34s cattle-2263376956-n4v97 1/1 Running 0 34s cattle-2263376956-p5p3i 1/1 Running 0 34s cattle-2263376956-sxpth 1/1 Running 0 34s At this point, it should be clear that the resources users create in one namespace are hidden from the other namespace.As the policy support in Kubernetes evolves, we will extend this scenario to show how you can provide different authorization rules for each namespace.Understanding the motivation for using namespacesA single cluster should be able to satisfy the needs of multiple users or groups of users (henceforth in this document a user community).Kubernetes namespaces help different projects, teams, or customers to share a Kubernetes cluster.It does this by providing the following:A scope for names.A mechanism to attach authorization and policy to a subsection of the cluster.Use of multiple namespaces is optional.Each user community wants to be able to work in isolation from other communities. Each user community has its own:resources (pods, services, replication controllers, etc.)policies (who can or cannot perform actions in their community)constraints (this community is allowed this much quota, etc.)A cluster operator may create a Namespace for each unique user community.The Namespace provides a unique scope for:named resources (to avoid basic naming collisions)delegated management authority to trusted usersability to limit community resource consumptionUse cases include:As a cluster operator, I want to support multiple user communities on a single cluster.As a cluster operator, I want to delegate authority to partitions of the cluster to trusted users in those communities.As a cluster operator, I want to limit the amount of resources each community can consume in order to limit the impact to other communities using the cluster.As a cluster user, I want to interact with resources that are pertinent to my user community in isolation of what other user communities are doing on the cluster.Understanding namespaces and DNSWhen you create a Service, it creates a corresponding DNS entry. This entry is of the form <service-name>.<namespace-name>.svc.cluster.local, which means that if a container uses <service-name> it will resolve to the service which is local to a namespace. This is useful for using the same configuration across multiple namespaces such as Development, Staging and Production. If you want to reach across namespaces, you need to use the fully qualified domain name (FQDN).What's nextLearn more about setting the namespace preference.Learn more about setting the namespace for a requestSee namespaces design.