# Webhook Mode

Webhook ModeA WebHook is an HTTP callback: an HTTP POST that occurs when something happens; a simple event-notification via HTTP POST. A web application implementing WebHooks will POST a message to a URL when certain things happen.When specified, mode Webhook causes Kubernetes to query an outside REST service when determining user privileges.Configuration File FormatMode Webhook requires a file for HTTP configuration, specify by the --authorization-webhook-config-file=SOME_FILENAME flag.The configuration file uses the kubeconfig file format. Within the file "users" refers to the API Server webhook and "clusters" refers to the remote service.A configuration example which uses HTTPS client auth:# Kubernetes API version apiVersion: v1 # kind of the API object kind: Config # clusters refers to the remote service. clusters: - name: name-of-remote-authz-service cluster: # CA for verifying the remote service. certificate-authority: /path/to/ca.pem # URL of remote service to query. Must use 'https'. May not include parameters. server: https://authz.example.com/authorize # users refers to the API Server's webhook configuration. users: - name: name-of-api-server user: client-certificate: /path/to/cert.pem # cert for the webhook plugin to use client-key: /path/to/key.pem # key matching the cert # kubeconfig files require a context. Provide one for the API Server. current-context: webhook contexts: - context: cluster: name-of-remote-authz-service user: name-of-api-server name: webhook Request PayloadsWhen faced with an authorization decision, the API Server POSTs a JSON- serialized authorization.k8s.io/v1beta1 SubjectAccessReview object describing the action. This object contains fields describing the user attempting to make the request, and either details about the resource being accessed or requests attributes.Note that webhook API objects are subject to the same versioning compatibility rules as other Kubernetes API objects. Implementers should be aware of looser compatibility promises for beta objects and check the "apiVersion" field of the request to ensure correct deserialization. Additionally, the API Server must enable the authorization.k8s.io/v1beta1 API extensions group (--runtime-config=authorization.k8s.io/v1beta1=true).An example request body:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "namespace": "kittensandponies", "verb": "get", "group": "unicorn.example.org", "resource": "pods" }, "user": "jane", "group": [ "group1", "group2" ] } } The remote service is expected to fill the status field of the request and respond to either allow or disallow access. The response body's spec field is ignored and may be omitted. A permissive response would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": true } } For disallowing access there are two methods.The first method is preferred in most cases, and indicates the authorization webhook does not allow, or has "no opinion" about the request, but if other authorizers are configured, they are given a chance to allow the request. If there are no other authorizers, or none of them allow the request, the request is forbidden. The webhook would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": false, "reason": "user does not have read access to the namespace" } } The second method denies immediately, short-circuiting evaluation by other configured authorizers. This should only be used by webhooks that have detailed knowledge of the full authorizer configuration of the cluster. The webhook would return:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "status": { "allowed": false, "denied": true, "reason": "user does not have read access to the namespace" } } Access to non-resource paths are sent as:{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "nonResourceAttributes": { "path": "/debug", "verb": "get" }, "user": "jane", "group": [ "group1", "group2" ] } } FEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)When calling out to an authorization webhook, Kubernetes passes label and field selectors in the request to the authorization webhook. The authorization webhook can make authorization decisions informed by the scoped field and label selectors, if it wishes.The SubjectAccessReview API documentation gives guidelines for how these fields should be interpreted and handled by authorization webhooks, specifically using the parsed requirements rather than the raw selector strings, and how to handle unrecognized operators safely.{ "apiVersion": "authorization.k8s.io/v1beta1", "kind": "SubjectAccessReview", "spec": { "resourceAttributes": { "verb": "list", "group": "", "resource": "pods", "fieldSelector": { "requirements": [ {"key":"spec.nodeName", "operator":"In", "values":["mynode"]} ] }, "labelSelector": { "requirements": [ {"key":"example.com/mykey", "operator":"In", "values":["myvalue"]} ] } }, "user": "jane", "group": [ "group1", "group2" ] } } Non-resource paths include: /api, /apis, /metrics, /logs, /debug, /healthz, /livez, /openapi/v2, /readyz, and /version. Clients require access to /api, /api/*, /apis, /apis/*, and /version to discover what resources and versions are present on the server. Access to other non-resource paths can be disallowed without restricting access to the REST api.For further information, refer to the SubjectAccessReview API documentation and webhook.go implementation.


# Service

ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1import "k8s.io/api/core/v1"ServiceService is a named abstraction of software service (for example, mysql) consisting of local port (for example 3306) that the proxy listens on, and the selector that determines which pods will answer requests sent through the proxy.apiVersion: v1kind: Servicemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ServiceSpec)Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ServiceStatus)Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusServiceSpecServiceSpec describes the attributes that a user creates on a service.selector (map[string]string)Route service traffic to pods with label keys and values matching this selector. If empty or not present, the service is assumed to have an external process managing its endpoints, which Kubernetes will not modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. Ignored if type is ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/ports ([]ServicePort)Patch strategy: merge on key portMap: unique values on keys port, protocol will be kept during a mergeThe list of ports that are exposed by this service. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesServicePort contains information on service's port.ports.port (int32), requiredThe port that will be exposed by this service.ports.targetPort (IntOrString)Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-serviceIntOrString is a type that can hold an int32 or a string. When used in JSON or YAML marshalling and unmarshalling, it produces or consumes the inner type. This allows you to have, for example, a JSON field that can accept a name or number.ports.protocol (string)The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". Default is TCP.ports.name (string)The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have unique names. When considering the endpoints for a Service, this must match the 'name' field in the EndpointPort. Optional if only one ServicePort is defined on this service.ports.nodePort (int32)The port on each node on which this service is exposed when type is NodePort or LoadBalancer. Usually assigned by the system. If a value is specified, in-range, and not in use it will be used, otherwise the operation will fail. If not specified, a port will be allocated if this Service requires one. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type from NodePort to ClusterIP). More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeportports.appProtocol (string)The application protocol for this port. This is used as a hint for implementations to offer richer behavior for protocols that they understand. This field follows standard Kubernetes label syntax. Valid values are either:Un-prefixed protocol names - reserved for IANA standard service names (as per RFC-6335 and https://www.iana.org/assignments/service-names).Kubernetes-defined prefixed names:'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior-'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455Other protocols should use implementation-defined prefixed names such as mycompany.com/my-custom-protocol.type (string)type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. "ClusterIP" allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object or EndpointSlice objects. If clusterIP is "None", no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a virtual IP. "NodePort" builds on ClusterIP and allocates a port on every node which routes to the same endpoints as the clusterIP. "LoadBalancer" builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the same endpoints as the clusterIP. "ExternalName" aliases this service to the specified externalName. Several other fields do not apply to ExternalName services. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-typesipFamilies ([]string)Atomic: will be replaced during a mergeIPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. If this field is specified manually, the requested family is available in the cluster, and ipFamilyPolicy allows it, it will be used; otherwise creation of the service will fail. This field is conditionally mutable: it allows for adding or removing a secondary IP family, but it does not allow changing the primary IP family of the Service. Valid values are "IPv4" and "IPv6". This field only applies to Services of types ClusterIP, NodePort, and LoadBalancer, and does apply to "headless" services. This field will be wiped when updating a Service to type ExternalName.This field may hold a maximum of two entries (dual-stack families, in either order). These families must correspond to the values of the clusterIPs field, if specified. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field.ipFamilyPolicy (string)IPFamilyPolicy represents the dual-stack-ness requested or required by this Service. If there is no value provided, then this field will be set to SingleStack. Services can be "SingleStack" (a single IP family), "PreferDualStack" (two IP families on dual-stack configured clusters or a single IP family on single-stack clusters), or "RequireDualStack" (two IP families on dual-stack configured clusters, otherwise fail). The ipFamilies and clusterIPs fields depend on the value of this field. This field will be wiped when updating a service to type ExternalName.clusterIP (string)clusterIP is the IP address of the service and is usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be blank) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting this to "None" makes a "headless service" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesclusterIPs ([]string)Atomic: will be replaced during a mergeClusterIPs is a list of IP addresses assigned to this service, and are usually assigned randomly. If an address is specified manually, is in-range (as per system configuration), and is not in use, it will be allocated to the service; otherwise creation of the service will fail. This field may not be changed through updates unless the type field is also being changed to ExternalName (which requires this field to be empty) or the type field is being changed from ExternalName (in which case this field may optionally be specified, as describe above). Valid values are "None", empty string (""), or a valid IP address. Setting this to "None" makes a "headless service" (no virtual IP), which is useful when direct endpoint connections are preferred and proxying is not required. Only applies to types ClusterIP, NodePort, and LoadBalancer. If this field is specified when creating a Service of type ExternalName, creation will fail. This field will be wiped when updating a Service to type ExternalName. If this field is not specified, it will be initialized from the clusterIP field. If this field is specified, clients must ensure that clusterIPs[0] and clusterIP have the same value.This field may hold a maximum of two entries (dual-stack IPs, in either order). These IPs must correspond to the values of the ipFamilies field. Both clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesexternalIPs ([]string)Atomic: will be replaced during a mergeexternalIPs is a list of IP addresses for which nodes in the cluster will also accept traffic for this service. These IPs are not managed by Kubernetes. The user is responsible for ensuring that traffic arrives at a node with this IP. A common example is external load-balancers that are not part of the Kubernetes system.sessionAffinity (string)Supports "ClientIP" and "None". Used to maintain session affinity. Enable client IP based session affinity. Must be ClientIP or None. Defaults to None. More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxiesloadBalancerIP (string)Only applies to Service Type: LoadBalancer. This feature depends on whether the underlying cloud-provider supports specifying the loadBalancerIP when a load balancer is created. This field will be ignored if the cloud-provider does not support the feature. Deprecated: This field was under-specified and its meaning varies across implementations. Using it is non-portable and it may not support dual-stack. Users are encouraged to use implementation-specific annotations when available.loadBalancerSourceRanges ([]string)Atomic: will be replaced during a mergeIf specified and supported by the platform, this will restrict traffic through the cloud-provider load-balancer will be restricted to the specified client IPs. This field will be ignored if the cloud-provider does not support the feature." More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/loadBalancerClass (string)loadBalancerClass is the class of the load balancer implementation this Service belongs to. If specified, the value of this field must be a label-style identifier, with an optional prefix, e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load balancer implementation is used, today this is typically done through the cloud provider integration, but should apply for any default implementation. If set, it is assumed that a load balancer implementation is watching for Services with a matching class. Any default load balancer implementation (e.g. cloud providers) should ignore Services that set this field. This field can only be set when creating or updating a Service to type 'LoadBalancer'. Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type.externalName (string)externalName is the external reference that discovery mechanisms will return as an alias for this service (e.g. a DNS CNAME record). No proxying will be involved. Must be a lowercase RFC-1123 hostname (https://tools.ietf.org/html/rfc1123) and requires type to be "ExternalName".externalTrafficPolicy (string)externalTrafficPolicy describes how nodes distribute service traffic they receive on one of the Service's "externally-facing" addresses (NodePorts, ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure the service in a way that assumes that external load balancers will take care of balancing the service traffic between nodes, and so each node will deliver traffic only to the node-local endpoints of the service, without masquerading the client source IP. (Traffic mistakenly sent to a node with no endpoints will be dropped.) The default value, "Cluster", uses the standard behavior of routing to all endpoints evenly (possibly modified by topology and other features). Note that traffic sent to an External IP or LoadBalancer IP from within the cluster will always get "Cluster" semantics, but clients sending to a NodePort from within the cluster may need to take traffic policy into account when picking a node.internalTrafficPolicy (string)InternalTrafficPolicy describes how nodes distribute service traffic they receive on the ClusterIP. If set to "Local", the proxy will assume that pods only want to talk to endpoints of the service on the same node as the pod, dropping the traffic if there are no local endpoints. The default value, "Cluster", uses the standard behavior of routing to all endpoints evenly (possibly modified by topology and other features).healthCheckNodePort (int32)healthCheckNodePort specifies the healthcheck nodePort for the service. This only applies when type is set to LoadBalancer and externalTrafficPolicy is set to Local. If a value is specified, is in-range, and is not in use, it will be used. If not specified, a value will be automatically allocated. External systems (e.g. load-balancers) can use this port to determine if a given node holds endpoints for this service or not. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type). This field cannot be updated once set.publishNotReadyAddresses (boolean)publishNotReadyAddresses indicates that any agent which deals with endpoints for this Service should disregard any indications of ready/not-ready. The primary use case for setting this field is for a StatefulSet's Headless Service to propagate SRV DNS records for its Pods for the purpose of peer discovery. The Kubernetes controllers that generate Endpoints and EndpointSlice resources for Services interpret this to mean that all endpoints are considered "ready" even if the Pods themselves are not. Agents which consume only Kubernetes generated endpoints through the Endpoints or EndpointSlice resources can safely assume this behavior.sessionAffinityConfig (SessionAffinityConfig)sessionAffinityConfig contains the configurations of session affinity.SessionAffinityConfig represents the configurations of session affinity.sessionAffinityConfig.clientIP (ClientIPConfig)clientIP contains the configurations of Client IP based session affinity.ClientIPConfig represents the configurations of Client IP based session affinity.sessionAffinityConfig.clientIP.timeoutSeconds (int32)timeoutSeconds specifies the seconds of ClientIP type session sticky time. The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". Default value is 10800(for 3 hours).allocateLoadBalancerNodePorts (boolean)allocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for services with type LoadBalancer. Default is "true". It may be set to "false" if the cluster load-balancer does not rely on NodePorts. If the caller requests specific NodePorts (by specifying a value), those requests will be respected, regardless of this field. This field may only be set for services with type LoadBalancer and will be cleared if the type is changed to any other type.trafficDistribution (string)TrafficDistribution offers a way to express preferences for how traffic is distributed to Service endpoints. Implementations can use this field as a hint, but are not required to guarantee strict adherence. If the field is not set, the implementation will apply its default routing strategy. If set to "PreferClose", implementations should prioritize endpoints that are in the same zone.ServiceStatusServiceStatus represents the current status of a service.conditions ([]Condition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeCurrent service stateCondition contains details for one aspect of the current state of this API Resource.conditions.lastTransitionTime (Time), requiredlastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string), requiredmessage is a human readable message indicating details about the transition. This may be an empty string.conditions.reason (string), requiredreason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.conditions.status (string), requiredstatus of the condition, one of True, False, Unknown.conditions.type (string), requiredtype of condition in CamelCase or in foo.example.com/CamelCase.conditions.observedGeneration (int64)observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.loadBalancer (LoadBalancerStatus)LoadBalancer contains the current status of the load-balancer, if one is present.LoadBalancerStatus represents the status of a load-balancer.loadBalancer.ingress ([]LoadBalancerIngress)Atomic: will be replaced during a mergeIngress is a list containing ingress points for the load-balancer. Traffic intended for the service should be sent to these ingress points.LoadBalancerIngress represents the status of a load-balancer ingress point: traffic intended for the service should be sent to an ingress point.loadBalancer.ingress.hostname (string)Hostname is set for load-balancer ingress points that are DNS based (typically AWS load-balancers)loadBalancer.ingress.ip (string)IP is set for load-balancer ingress points that are IP based (typically GCE or OpenStack load-balancers)loadBalancer.ingress.ipMode (string)IPMode specifies how the load-balancer IP behaves, and may only be specified when the ip field is specified. Setting this to "VIP" indicates that traffic is delivered to the node with the destination set to the load-balancer's IP and port. Setting this to "Proxy" indicates that traffic is delivered to the node or pod with the destination set to the node's IP and node port or the pod's IP and port. Service implementations may use this information to adjust traffic routing.loadBalancer.ingress.ports ([]PortStatus)Atomic: will be replaced during a mergePorts is a list of records of service ports If used, every port defined in the service should have an entry in itPortStatus represents the error condition of a service portloadBalancer.ingress.ports.port (int32), requiredPort is the port number of the service port of which status is recorded hereloadBalancer.ingress.ports.protocol (string), requiredProtocol is the protocol of the service port of which status is recorded here The supported values are: "TCP", "UDP", "SCTP"loadBalancer.ingress.ports.error (string)Error is to record the problem with the service port The format of the error shall comply with the following rules: - built-in error values shall be specified in this file and those shall use CamelCase namescloud provider specific error values must have names that comply with the format foo.example.com/CamelCase.ServiceListServiceList holds a list of services.apiVersion: v1kind: ServiceListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Service), requiredList of servicesOperationsget read the specified ServiceHTTP RequestGET /api/v1/namespaces/{namespace}/services/{name}Parametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Service): OK401: Unauthorizedget read status of the specified ServiceHTTP RequestGET /api/v1/namespaces/{namespace}/services/{name}/statusParametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Service): OK401: Unauthorizedlist list or watch objects of kind ServiceHTTP RequestGET /api/v1/namespaces/{namespace}/servicesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ServiceList): OK401: Unauthorizedlist list or watch objects of kind ServiceHTTP RequestGET /api/v1/servicesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ServiceList): OK401: Unauthorizedcreate create a ServiceHTTP RequestPOST /api/v1/namespaces/{namespace}/servicesParametersnamespace (in path): string, requirednamespacebody: Service, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Service): OK201 (Service): Created202 (Service): Accepted401: Unauthorizedupdate replace the specified ServiceHTTP RequestPUT /api/v1/namespaces/{namespace}/services/{name}Parametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacebody: Service, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Service): OK201 (Service): Created401: Unauthorizedupdate replace status of the specified ServiceHTTP RequestPUT /api/v1/namespaces/{namespace}/services/{name}/statusParametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacebody: Service, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Service): OK201 (Service): Created401: Unauthorizedpatch partially update the specified ServiceHTTP RequestPATCH /api/v1/namespaces/{namespace}/services/{name}Parametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Service): OK201 (Service): Created401: Unauthorizedpatch partially update status of the specified ServiceHTTP RequestPATCH /api/v1/namespaces/{namespace}/services/{name}/statusParametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Service): OK201 (Service): Created401: Unauthorizeddelete delete a ServiceHTTP RequestDELETE /api/v1/namespaces/{namespace}/services/{name}Parametersname (in path): string, requiredname of the Servicenamespace (in path): string, requirednamespacebody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Service): OK202 (Service): Accepted401: Unauthorizeddeletecollection delete collection of ServiceHTTP RequestDELETE /api/v1/namespaces/{namespace}/servicesParametersnamespace (in path): string, requirednamespacebody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Contribute to Kubernetes

There are lots of ways to contribute to Kubernetes. You can work on designs for new features, you can document the code we already have, you can write for our blogs. There's more: you can implement those new features or fix bugs. You can help people join our contributor community, or support existing contributors.With all these different ways to make a difference to the project, we - Kubernetes - have made a dedicated website: https://k8s.dev/. You can go there to learn more about contributing to Kubernetes.If you specifically want to learn about contributing to the documentation or other parts of this website, read Contribute to Kubernetes documentation. If you specifically want to help with the official Kubernetes blogs, read Contributing to Kubernetes blogs.You can also read the CNCF page about contributing to Kubernetes.


# TokenRequest

TokenRequestTokenRequest requests a token for a given service account.apiVersion: authentication.k8s.io/v1import "k8s.io/api/authentication/v1"TokenRequestTokenRequest requests a token for a given service account.apiVersion: authentication.k8s.io/v1kind: TokenRequestmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (TokenRequestSpec), requiredSpec holds information about the request being evaluatedstatus (TokenRequestStatus)Status is filled in by the server and indicates whether the token can be authenticated.TokenRequestSpecTokenRequestSpec contains client provided parameters of a token request.audiences ([]string), requiredAtomic: will be replaced during a mergeAudiences are the intended audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.boundObjectRef (BoundObjectReference)BoundObjectRef is a reference to an object that the token will be bound to. The token will only be valid for as long as the bound object exists. NOTE: The API server's TokenReview endpoint will validate the BoundObjectRef, but other audiences may not. Keep ExpirationSeconds small if you want prompt revocation.BoundObjectReference is a reference to an object that a token is bound to.boundObjectRef.apiVersion (string)API version of the referent.boundObjectRef.kind (string)Kind of the referent. Valid kinds are 'Pod' and 'Secret'.boundObjectRef.name (string)Name of the referent.boundObjectRef.uid (string)UID of the referent.expirationSeconds (int64)ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.TokenRequestStatusTokenRequestStatus is the result of a token request.expirationTimestamp (Time), requiredExpirationTimestamp is the time of expiration of the returned token.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.token (string), requiredToken is the opaque bearer token.Operationscreate create token of a ServiceAccountHTTP RequestPOST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/tokenParametersname (in path): string, requiredname of the TokenRequestnamespace (in path): string, requirednamespacebody: TokenRequest, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (TokenRequest): OK201 (TokenRequest): Created202 (TokenRequest): Accepted401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# kubectl config delete-user

kubectl config delete-userSynopsisDelete the specified user from the kubeconfig.kubectl config delete-user NAME Examples # Delete the minikube user kubectl config delete-user minikube Options-h, --helphelp for delete-userParent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringuse a particular kubeconfig file--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl config - Modify kubeconfig filesThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Kubernetes Deprecation Policy

Kubernetes Deprecation PolicyThis document details the deprecation policy for various facets of the system.Kubernetes is a large system with many components and many contributors. As with any such software, the feature set naturally evolves over time, and sometimes a feature may need to be removed. This could include an API, a flag, or even an entire feature. To avoid breaking existing users, Kubernetes follows a deprecation policy for aspects of the system that are slated to be removed.Deprecating parts of the APISince Kubernetes is an API-driven system, the API has evolved over time to reflect the evolving understanding of the problem space. The Kubernetes API is actually a set of APIs, called "API groups", and each API group is independently versioned. API versions fall into 3 main tracks, each of which has different policies for deprecation:ExampleTrackv1GA (generally available, stable)v1beta1Beta (pre-release)v1alpha1Alpha (experimental)A given release of Kubernetes can support any number of API groups and any number of versions of each.The following rules govern the deprecation of elements of the API. This includes:REST resources (aka API objects)Fields of REST resourcesAnnotations on REST resources, including "beta" annotations but not including "alpha" annotations.Enumerated or constant valuesComponent config structuresThese rules are enforced between official releases, not between arbitrary commits to master or release branches.Rule #1: API elements may only be removed by incrementing the version of the API group.Once an API element has been added to an API group at a particular version, it can not be removed from that version or have its behavior significantly changed, regardless of track.Note:For historical reasons, there are 2 "monolithic" API groups - "core" (no group name) and "extensions". Resources will incrementally be moved from these legacy API groups into more domain-specific API groups.Rule #2: API objects must be able to round-trip between API versions in a given release without information loss, with the exception of whole REST resources that do not exist in some versions.For example, an object can be written as v1 and then read back as v2 and converted to v1, and the resulting v1 resource will be identical to the original. The representation in v2 might be different from v1, but the system knows how to convert between them in both directions. Additionally, any new field added in v2 must be able to round-trip to v1 and back, which means v1 might have to add an equivalent field or represent it as an annotation.Rule #3: An API version in a given track may not be deprecated in favor of a less stable API version.GA API versions can replace beta and alpha API versions.Beta API versions can replace earlier beta and alpha API versions, but may not replace GA API versions.Alpha API versions can replace earlier alpha API versions, but may not replace GA or beta API versions.Rule #4a: API lifetime is determined by the API stability levelGA API versions may be marked as deprecated, but must not be removed within a major version of KubernetesBeta API versions are deprecated no more than 9 months or 3 minor releases after introduction (whichever is longer), and are no longer served 9 months or 3 minor releases after deprecation (whichever is longer)Alpha API versions may be removed in any release without prior deprecation noticeThis ensures beta API support covers the maximum supported version skew of 2 releases, and that APIs don't stagnate on unstable beta versions, accumulating production usage that will be disrupted when support for the beta API ends.Note:There are no current plans for a major version revision of Kubernetes that removes GA APIs.Note:Until #52185 is resolved, no API versions that have been persisted to storage may be removed. Serving REST endpoints for those versions may be disabled (subject to the deprecation timelines in this document), but the API server must remain capable of decoding/converting previously persisted data from storage.Rule #4b: The "preferred" API version and the "storage version" for a given group may not advance until after a release has been made that supports both the new version and the previous versionUsers must be able to upgrade to a new release of Kubernetes and then roll back to a previous release, without converting anything to the new API version or suffering breakages (unless they explicitly used features only available in the newer version). This is particularly evident in the stored representation of objects.All of this is best illustrated by examples. Imagine a Kubernetes release, version X, which introduces a new API group. A new Kubernetes release is made every approximately 4 months (3 per year). The following table describes which API versions are supported in a series of subsequent releases.ReleaseAPI VersionsPreferred/Storage VersionNotesXv1alpha1v1alpha1X+1v1alpha2v1alpha2v1alpha1 is removed. See release notes for required actions.X+2v1beta1v1beta1v1alpha2 is removed. See release notes for required actions.X+3v1beta2, v1beta1 (deprecated)v1beta1v1beta1 is deprecated. See release notes for required actions.X+4v1beta2, v1beta1 (deprecated)v1beta2X+5v1, v1beta1 (deprecated), v1beta2 (deprecated)v1beta2v1beta2 is deprecated. See release notes for required actions.X+6v1, v1beta2 (deprecated)v1v1beta1 is removed. See release notes for required actions.X+7v1, v1beta2 (deprecated)v1X+8v2alpha1, v1v1v1beta2 is removed. See release notes for required actions.X+9v2alpha2, v1v1v2alpha1 is removed. See release notes for required actions.X+10v2beta1, v1v1v2alpha2 is removed. See release notes for required actions.X+11v2beta2, v2beta1 (deprecated), v1v1v2beta1 is deprecated. See release notes for required actions.X+12v2, v2beta2 (deprecated), v2beta1 (deprecated), v1 (deprecated)v1v2beta2 is deprecated. See release notes for required actions.v1 is deprecated in favor of v2, but will not be removedX+13v2, v2beta1 (deprecated), v2beta2 (deprecated), v1 (deprecated)v2X+14v2, v2beta2 (deprecated), v1 (deprecated)v2v2beta1 is removed. See release notes for required actions.X+15v2, v1 (deprecated)v2v2beta2 is removed. See release notes for required actions.REST resources (aka API objects)Consider a hypothetical REST resource named Widget, which was present in API v1 in the above timeline, and which needs to be deprecated. We document and announce the deprecation in sync with release X+1. The Widget resource still exists in API version v1 (deprecated) but not in v2alpha1. The Widget resource continues to exist and function in releases up to and including X+8. Only in release X+9, when API v1 has aged out, does the Widget resource cease to exist, and the behavior get removed.Starting in Kubernetes v1.19, making an API request to a deprecated REST API endpoint:Returns a Warning header (as defined in RFC7234, Section 5.5) in the API response.Adds a "k8s.io/deprecated":"true" annotation to the audit event recorded for the request.Sets an apiserver_requested_deprecated_apis gauge metric to 1 in the kube-apiserver process. The metric has labels for group, version, resource, subresource that can be joined to the apiserver_request_total metric, and a removed_release label that indicates the Kubernetes release in which the API will no longer be served. The following Prometheus query returns information about requests made to deprecated APIs which will be removed in v1.22:apiserver_requested_deprecated_apis{removed_release="1.22"} * on(group,version,resource,subresource) group_right() apiserver_request_total Fields of REST resourcesAs with whole REST resources, an individual field which was present in API v1 must exist and function until API v1 is removed. Unlike whole resources, the v2 APIs may choose a different representation for the field, as long as it can be round-tripped. For example a v1 field named "magnitude" which was deprecated might be named "deprecatedMagnitude" in API v2. When v1 is eventually removed, the deprecated field can be removed from v2.Enumerated or constant valuesAs with whole REST resources and fields thereof, a constant value which was supported in API v1 must exist and function until API v1 is removed.Component config structuresComponent configs are versioned and managed similar to REST resources.Future workOver time, Kubernetes will introduce more fine-grained API versions, at which point these rules will be adjusted as needed.Deprecating a flag or CLIThe Kubernetes system is comprised of several different programs cooperating. Sometimes, a Kubernetes release might remove flags or CLI commands (collectively "CLI elements") in these programs. The individual programs naturally sort into two main groups - user-facing and admin-facing programs, which vary slightly in their deprecation policies. Unless a flag is explicitly prefixed or documented as "alpha" or "beta", it is considered GA.CLI elements are effectively part of the API to the system, but since they are not versioned in the same way as the REST API, the rules for deprecation are as follows:Rule #5a: CLI elements of user-facing components (e.g. kubectl) must function after their announced deprecation for no less than:GA: 12 months or 2 releases (whichever is longer)Beta: 3 months or 1 release (whichever is longer)Alpha: 0 releasesRule #5b: CLI elements of admin-facing components (e.g. kubelet) must function after their announced deprecation for no less than:GA: 6 months or 1 release (whichever is longer)Beta: 3 months or 1 release (whichever is longer)Alpha: 0 releasesRule #5c: Command line interface (CLI) elements cannot be deprecated in favor of less stable CLI elementsSimilar to the Rule #3 for APIs, if an element of a command line interface is being replaced with an alternative implementation, such as by renaming an existing element, or by switching to use configuration sourced from a file instead of a command line argument, that recommended alternative must be of the same or higher stability level.Rule #6: Deprecated CLI elements must emit warnings (optionally disable) when used.Deprecating a feature or behaviorOccasionally a Kubernetes release needs to deprecate some feature or behavior of the system that is not controlled by the API or CLI. In this case, the rules for deprecation are as follows:Rule #7: Deprecated behaviors must function for no less than 1 year after their announced deprecation.If the feature or behavior is being replaced with an alternative implementation that requires work to adopt the change, there should be an effort to simplify the transition whenever possible. If an alternative implementation is under Kubernetes organization control, the following rules apply:Rule #8: The feature of behavior must not be deprecated in favor of an alternative implementation that is less stableFor example, a generally available feature cannot be deprecated in favor of a Beta replacement. The Kubernetes project does, however, encourage users to adopt and transitions to alternative implementations even before they reach the same maturity level. This is particularly important for exploring new use cases of a feature or getting an early


# Configure Memory and CPU Quotas for a Namespace

Configure Memory and CPU Quotas for a NamespaceDefine overall memory and CPU resource limits for a namespace.This page shows how to set quotas for the total amount memory and CPU that can be used by all Pods running in a namespace. You specify quotas in a ResourceQuota object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou must have access to create namespaces in your cluster.Each node in your cluster must have at least 1 GiB of memory.Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace quota-mem-cpu-example Create a ResourceQuotaHere is a manifest for an example ResourceQuota:admin/resource/quota-mem-cpu.yaml apiVersion: v1 kind: ResourceQuota metadata: name: mem-cpu-demo spec: hard: requests.cpu: "1" requests.memory: 1Gi limits.cpu: "2" limits.memory: 2Gi Create the ResourceQuota:kubectl apply -f https://k8s.io/examples/admin/resource/quota-mem-cpu.yaml --namespace=quota-mem-cpu-example View detailed information about the ResourceQuota:kubectl get resourcequota mem-cpu-demo --namespace=quota-mem-cpu-example --output=yaml The ResourceQuota places these requirements on the quota-mem-cpu-example namespace:For every Pod in the namespace, each container must have a memory request, memory limit, cpu request, and cpu limit.The memory request total for all Pods in that namespace must not exceed 1 GiB.The memory limit total for all Pods in that namespace must not exceed 2 GiB.The CPU request total for all Pods in that namespace must not exceed 1 cpu.The CPU limit total for all Pods in that namespace must not exceed 2 cpu.See meaning of CPU to learn what Kubernetes means by “1 CPU”.Create a PodHere is a manifest for an example Pod:admin/resource/quota-mem-cpu-pod.yaml apiVersion: v1 kind: Pod metadata: name: quota-mem-cpu-demo spec: containers: - name: quota-mem-cpu-demo-ctr image: nginx resources: limits: memory: "800Mi" cpu: "800m" requests: memory: "600Mi" cpu: "400m" Create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/quota-mem-cpu-pod.yaml --namespace=quota-mem-cpu-example Verify that the Pod is running and that its (only) container is healthy:kubectl get pod quota-mem-cpu-demo --namespace=quota-mem-cpu-example Once again, view detailed information about the ResourceQuota:kubectl get resourcequota mem-cpu-demo --namespace=quota-mem-cpu-example --output=yaml The output shows the quota along with how much of the quota has been used. You can see that the memory and CPU requests and limits for your Pod do not exceed the quota.status: hard: limits.cpu: "2" limits.memory: 2Gi requests.cpu: "1" requests.memory: 1Gi used: limits.cpu: 800m limits.memory: 800Mi requests.cpu: 400m requests.memory: 600Mi If you have the jq tool, you can also query (using JSONPath) for just the used values, and pretty-print that that of the output. For example:kubectl get resourcequota mem-cpu-demo --namespace=quota-mem-cpu-example -o jsonpath='{ .status.used }' | jq . Attempt to create a second PodHere is a manifest for a second Pod:admin/resource/quota-mem-cpu-pod-2.yaml apiVersion: v1 kind: Pod metadata: name: quota-mem-cpu-demo-2 spec: containers: - name: quota-mem-cpu-demo-2-ctr image: redis resources: limits: memory: "1Gi" cpu: "800m" requests: memory: "700Mi" cpu: "400m" In the manifest, you can see that the Pod has a memory request of 700 MiB. Notice that the sum of the used memory request and this new memory request exceeds the memory request quota: 600 MiB + 700 MiB > 1 GiB.Attempt to create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/quota-mem-cpu-pod-2.yaml --namespace=quota-mem-cpu-example The second Pod does not get created. The output shows that creating the second Pod would cause the memory request total to exceed the memory request quota.Error from server (Forbidden): error when creating "examples/admin/resource/quota-mem-cpu-pod-2.yaml": pods "quota-mem-cpu-demo-2" is forbidden: exceeded quota: mem-cpu-demo, requested: requests.memory=700Mi,used: requests.memory=600Mi, limited: requests.memory=1Gi DiscussionAs you have seen in this exercise, you can use a ResourceQuota to restrict the memory request total for all Pods running in a namespace. You can also restrict the totals for memory limit, cpu request, and cpu limit.Instead of managing total resource use within a namespace, you might want to restrict individual Pods, or the containers in those Pods. To achieve that kind of limiting, use a LimitRange.Clean upDelete your namespace:kubectl delete namespace quota-mem-cpu-example What's nextFor cluster administratorsConfigure Default Memory Requests and Limits for a NamespaceConfigure Default CPU Requests and Limits for a NamespaceConfigure Minimum and Maximum Memory Constraints for a NamespaceConfigure Minimum and Maximum CPU Constraints for a NamespaceConfigure a Pod Quota for a NamespaceConfigure Quotas for API ObjectsFor app developersAssign Memory Resources to Containers and PodsAssign CPU Resources to Containers and PodsAssign Pod-level CPU and memory resourcesConfigure Quality of Service for Pods


# Node

NodeNode is a worker node in Kubernetes.apiVersion: v1import "k8s.io/api/core/v1"NodeNode is a worker node in Kubernetes. Each node will have a unique identifier in the cache (i.e. in etcd).apiVersion: v1kind: Nodemetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (NodeSpec)Spec defines the behavior of a node. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (NodeStatus)Most recently observed status of the node. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusNodeSpecNodeSpec describes the attributes that a node is created with.configSource (NodeConfigSource)Deprecated: Previously used to specify the source of the node's configuration for the DynamicKubeletConfig feature. This feature is removed.NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22configSource.configMap (ConfigMapNodeConfigSource)ConfigMap is a reference to a Node's ConfigMapConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configurationconfigSource.configMap.kubeletConfigKey (string), requiredKubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.configSource.configMap.name (string), requiredName is the metadata.name of the referenced ConfigMap. This field is required in all cases.configSource.configMap.namespace (string), requiredNamespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.configSource.configMap.resourceVersion (string)ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.configSource.configMap.uid (string)UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.externalID (string)Deprecated. Not all kubelets will set this field. Remove field after 1.13. see: https://issues.k8s.io/61966podCIDR (string)PodCIDR represents the pod IP range assigned to the node.podCIDRs ([]string)Set: unique values will be kept during a mergepodCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for each of IPv4 and IPv6.providerID (string)ID of the node assigned by the cloud provider in the format: <ProviderName>://<ProviderSpecificNodeID>taints ([]Taint)Atomic: will be replaced during a mergeIf specified, the node's taints.The node this Taint is attached to has the "effect" on any pod that does not tolerate the Taint.taints.effect (string), requiredRequired. The effect of the taint on pods that do not tolerate the taint. Valid effects are NoSchedule, PreferNoSchedule and NoExecute.taints.key (string), requiredRequired. The taint key to be applied to a node.taints.timeAdded (Time)TimeAdded represents the time at which the taint was added.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.taints.value (string)The taint value corresponding to the taint key.unschedulable (boolean)Unschedulable controls node schedulability of new pods. By default, node is schedulable. More info: https://kubernetes.io/docs/concepts/nodes/node/#manual-node-administrationNodeStatusNodeStatus is information about the current status of a node.addresses ([]NodeAddress)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeList of addresses reachable to the node. Queried from cloud provider, if available. More info: https://kubernetes.io/docs/reference/node/node-status/#addresses Note: This field is declared as mergeable, but the merge key is not sufficiently unique, which can cause data corruption when it is merged. Callers should instead use a full-replacement patch. See https://pr.k8s.io/79391 for an example. Consumers should assume that addresses can change during the lifetime of a Node. However, there are some exceptions where this may not be possible, such as Pods that inherit a Node's address in its own status or consumers of the downward API (status.hostIP).NodeAddress contains information for the node's address.addresses.address (string), requiredThe node address.addresses.type (string), requiredNode address type, one of Hostname, ExternalIP or InternalIP.allocatable (map[string]Quantity)Allocatable represents the resources of a node that are available for scheduling. Defaults to Capacity.capacity (map[string]Quantity)Capacity represents the total resources of a node. More info: https://kubernetes.io/docs/reference/node/node-status/#capacityconditions ([]NodeCondition)Patch strategy: merge on key typeMap: unique values on key type will be kept during a mergeConditions is an array of current observed node conditions. More info: https://kubernetes.io/docs/reference/node/node-status/#conditionNodeCondition contains condition information for a node.conditions.status (string), requiredStatus of the condition, one of True, False, Unknown.conditions.type (string), requiredType of node condition.conditions.lastHeartbeatTime (Time)Last time we got an update on a given condition.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.lastTransitionTime (Time)Last time the condition transit from one status to another.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.conditions.message (string)Human readable message indicating details about last transition.conditions.reason (string)(brief) reason for the condition's last transition.config (NodeConfigStatus)Status of the config assigned to the node via the dynamic Kubelet config feature.NodeConfigStatus describes the status of the config assigned by Node.Spec.ConfigSource.config.active (NodeConfigSource)Active reports the checkpointed config the node is actively using. Active will represent either the current version of the Assigned config, or the current LastKnownGood config, depending on whether attempting to use the Assigned config results in an error.NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22config.active.configMap (ConfigMapNodeConfigSource)ConfigMap is a reference to a Node's ConfigMapConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configurationconfig.active.configMap.kubeletConfigKey (string), requiredKubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.config.active.configMap.name (string), requiredName is the metadata.name of the referenced ConfigMap. This field is required in all cases.config.active.configMap.namespace (string), requiredNamespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.config.active.configMap.resourceVersion (string)ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.config.active.configMap.uid (string)UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.config.assigned (NodeConfigSource)Assigned reports the checkpointed config the node will try to use. When Node.Spec.ConfigSource is updated, the node checkpoints the associated config payload to local disk, along with a record indicating intended config. The node refers to this record to choose its config checkpoint, and reports this record in Assigned. Assigned only updates in the status after the record has been checkpointed to disk. When the Kubelet is restarted, it tries to make the Assigned config the Active config by loading and validating the checkpointed payload identified by Assigned.NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22config.assigned.configMap (ConfigMapNodeConfigSource)ConfigMap is a reference to a Node's ConfigMapConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configurationconfig.assigned.configMap.kubeletConfigKey (string), requiredKubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.config.assigned.configMap.name (string), requiredName is the metadata.name of the referenced ConfigMap. This field is required in all cases.config.assigned.configMap.namespace (string), requiredNamespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.config.assigned.configMap.resourceVersion (string)ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.config.assigned.configMap.uid (string)UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.config.error (string)Error describes any problems reconciling the Spec.ConfigSource to the Active config. Errors may occur, for example, attempting to checkpoint Spec.ConfigSource to the local Assigned record, attempting to checkpoint the payload associated with Spec.ConfigSource, attempting to load or validate the Assigned config, etc. Errors may occur at different points while syncing config. Earlier errors (e.g. download or checkpointing errors) will not result in a rollback to LastKnownGood, and may resolve across Kubelet retries. Later errors (e.g. loading or validating a checkpointed config) will result in a rollback to LastKnownGood. In the latter case, it is usually possible to resolve the error by fixing the config assigned in Spec.ConfigSource. You can find additional information for debugging by searching the error message in the Kubelet log. Error is a human-readable description of the error state; machines can check whether or not Error is empty, but should not rely on the stability of the Error text across Kubelet versions.config.lastKnownGood (NodeConfigSource)LastKnownGood reports the checkpointed config the node will fall back to when it encounters an error attempting to use the Assigned config. The Assigned config becomes the LastKnownGood config when the node determines that the Assigned config is stable and correct. This is currently implemented as a 10-minute soak period starting when the local record of Assigned config is updated. If the Assigned config is Active at the end of this period, it becomes the LastKnownGood. Note that if Spec.ConfigSource is reset to nil (use local defaults), the LastKnownGood is also immediately reset to nil, because the local default config is always assumed good. You should not make assumptions about the node's method of determining config stability and correctness, as this may change or become configurable in the future.NodeConfigSource specifies a source of node configuration. Exactly one subfield (excluding metadata) must be non-nil. This API is deprecated since 1.22config.lastKnownGood.configMap (ConfigMapNodeConfigSource)ConfigMap is a reference to a Node's ConfigMapConfigMapNodeConfigSource contains the information to reference a ConfigMap as a config source for the Node. This API is deprecated since 1.22: https://git.k8s.io/enhancements/keps/sig-node/281-dynamic-kubelet-configurationconfig.lastKnownGood.configMap.kubeletConfigKey (string), requiredKubeletConfigKey declares which key of the referenced ConfigMap corresponds to the KubeletConfiguration structure This field is required in all cases.config.lastKnownGood.configMap.name (string), requiredName is the metadata.name of the referenced ConfigMap. This field is required in all cases.config.lastKnownGood.configMap.namespace (string), requiredNamespace is the metadata.namespace of the referenced ConfigMap. This field is required in all cases.config.lastKnownGood.configMap.resourceVersion (string)ResourceVersion is the metadata.ResourceVersion of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.config.lastKnownGood.configMap.uid (string)UID is the metadata.UID of the referenced ConfigMap. This field is forbidden in Node.Spec, and required in Node.Status.daemonEndpoints (NodeDaemonEndpoints)Endpoints of daemons running on the Node.NodeDaemonEndpoints lists ports opened by daemons running on the Node.daemonEndpoints.kubeletEndpoint (DaemonEndpoint)Endpoint on which Kubelet is listening.DaemonEndpoint contains information about a single Daemon endpoint.daemonEndpoints.kubeletEndpoint.Port (int32), requiredPort number of the given endpoint.features (NodeFeatures)Features describes the set of features implemented by the CRI implementation.NodeFeatures describes the set of features implemented by the CRI implementation. The features contained in the NodeFeatures should depend only on the cri implementation independent of runtime handlers.features.supplementalGroupsPolicy (boolean)SupplementalGroupsPolicy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.images ([]ContainerImage)Atomic: will be replaced during a mergeList of container images on this nodeDescribe a container imageimages.names ([]string)Atomic: will be replaced during a mergeNames by which this image is known. e.g. ["kubernetes.example/hyperkube:v1.0.7", "cloud-vendor.registry.example/cloud-vendor/hyperkube:v1.0.7"]images.sizeBytes (int64)The size of the image in bytes.nodeInfo (NodeSystemInfo)Set of ids/uuids to uniquely identify the node. More info: https://kubernetes.io/docs/reference/node/node-status/#infoNodeSystemInfo is a set of ids/uuids to uniquely identify the node.nodeInfo.architecture (string), requiredThe Architecture reported by the nodenodeInfo.bootID (string), requiredBoot ID reported by the node.nodeInfo.containerRuntimeVersion (string), requiredContainerRuntime Version reported by the node through runtime remote API (e.g. containerd://1.4.2).nodeInfo.kernelVersion (string), requiredKernel Version reported by the node from 'uname -r' (e.g. 3.16.0-0.bpo.4-amd64).nodeInfo.kubeProxyVersion (string), requiredDeprecated: KubeProxy Version reported by the node.nodeInfo.kubeletVersion (string), requiredKubelet Version reported by the node.nodeInfo.machineID (string), requiredMachineID reported by the node. For unique machine identification in the cluster this field is preferred. Learn more from man(5) machine-id: http://man7.org/linux/man-pages/man5/machine-id.5.htmlnodeInfo.operatingSystem (string), requiredThe Operating System reported by the nodenodeInfo.osImage (string), requiredOS Image reported by the node from /etc/os-release (e.g. Debian GNU/Linux 7 (wheezy)).nodeInfo.systemUUID (string), requiredSystemUUID reported by the node. For unique machine identification MachineID is preferred. This field is specific to Red Hat hosts https://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuidnodeInfo.swap (NodeSwapStatus)Swap Info reported by the node.NodeSwapStatus represents swap memory information.nodeInfo.swap.capacity (int64)Total amount of swap memory in bytes.phase (string)NodePhase is the recently observed lifecycle phase of the node. More info: https://kubernetes.io/docs/concepts/nodes/node/#phase The field is never populated, and now is deprecated.runtimeHandlers ([]NodeRuntimeHandler)Atomic: will be replaced during a mergeThe available runtime handlers.NodeRuntimeHandler is a set of runtime handler information.runtimeHandlers.features (NodeRuntimeHandlerFeatures)Supported features.NodeRuntimeHandlerFeatures is a set of features implemented by the runtime handler.runtimeHandlers.features.recursiveReadOnlyMounts (boolean)RecursiveReadOnlyMounts is set to true if the runtime handler supports RecursiveReadOnlyMounts.runtimeHandlers.features.userNamespaces (boolean)UserNamespaces is set to true if the runtime handler supports UserNamespaces, including for volumes.runtimeHandlers.name (string)Runtime handler name. Empty for the default runtime handler.volumesAttached ([]AttachedVolume)Atomic: will be replaced during a mergeList of volumes that are attached to the node.AttachedVolume describes a volume attached to a nodevolumesAttached.devicePath (string), requiredDevicePath represents the device path where the volume should be availablevolumesAttached.name (string), requiredName of the attached volumevolumesInUse ([]string)Atomic: will be replaced during a mergeList of attachable volumes in use (mounted) by the node.NodeListNodeList is the whole list of all Nodes which have been registered with master.apiVersion: v1kind: NodeListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Node), requiredList of nodesOperationsget read the specified NodeHTTP RequestGET /api/v1/nodes/{name}Parametersname (in path): string, requiredname of the Nodepretty (in query): stringprettyResponse200 (Node): OK401: Unauthorizedget read status of the specified NodeHTTP RequestGET /api/v1/nodes/{name}/statusParametersname (in path): string, requiredname of the Nodepretty (in query): stringprettyResponse200 (Node): OK401: Unauthorizedlist list or watch objects of kind NodeHTTP RequestGET /api/v1/nodesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (NodeList): OK401: Unauthorizedcreate create a NodeHTTP RequestPOST /api/v1/nodesParametersbody: Node, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Node): OK201 (Node): Created202 (Node): Accepted401: Unauthorizedupdate replace the specified NodeHTTP RequestPUT /api/v1/nodes/{name}Parametersname (in path): string, requiredname of the Nodebody: Node, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Node): OK201 (Node): Created401: Unauthorizedupdate replace status of the specified NodeHTTP RequestPUT /api/v1/nodes/{name}/statusParametersname (in path): string, requiredname of the Nodebody: Node, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Node): OK201 (Node): Created401: Unauthorizedpatch partially update the specified NodeHTTP RequestPATCH /api/v1/nodes/{name}Parametersname (in path): string, requiredname of the Nodebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Node): OK201 (Node): Created401: Unauthorizedpatch partially update status of the specified NodeHTTP RequestPATCH /api/v1/nodes/{name}/statusParametersname (in path): string, requiredname of the Nodebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Node): OK201 (Node): Created401: Unauthorizeddelete delete a NodeHTTP RequestDELETE /api/v1/nodes/{name}Parametersname (in path): string, requiredname of the Nodebody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of NodeHTTP RequestDELETE /api/v1/nodesParametersbody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# LocalSubjectAccessReview

LocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.apiVersion: authorization.k8s.io/v1import "k8s.io/api/authorization/v1"LocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace. Having a namespace scoped resource makes it much easier to grant namespace scoped policy that includes permissions checking.apiVersion: authorization.k8s.io/v1kind: LocalSubjectAccessReviewmetadata (ObjectMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (SubjectAccessReviewSpec), requiredSpec holds information about the request being evaluated. spec.namespace must be equal to the namespace you made the request against. If empty, it is defaulted.status (SubjectAccessReviewStatus)Status is filled in by the server and indicates whether the request is allowed or notOperationscreate create a LocalSubjectAccessReviewHTTP RequestPOST /apis/authorization.k8s.io/v1/namespaces/{namespace}/localsubjectaccessreviewsParametersnamespace (in path): string, requirednamespacebody: LocalSubjectAccessReview, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (LocalSubjectAccessReview): OK201 (LocalSubjectAccessReview): Created202 (LocalSubjectAccessReview): Accepted401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Accessing Clusters

Accessing ClustersThis topic discusses multiple ways to interact with clusters.Accessing for the first time with kubectlWhen accessing the Kubernetes API for the first time, we suggest using the Kubernetes CLI, kubectl.To access a cluster, you need to know the location of the cluster and have credentials to access it. Typically, this is automatically set-up when you work through a Getting started guide, or someone else set up the cluster and provided you with credentials and a location.Check the location and credentials that kubectl knows about with this command:kubectl config view Many of the examples provide an introduction to using kubectl, and complete documentation is found in the kubectl reference.Directly accessing the REST APIKubectl handles locating and authenticating to the apiserver. If you want to directly access the REST API with an http client like curl or wget, or a browser, there are several ways to locate and authenticate:Run kubectl in proxy mode.Recommended approach.Uses stored apiserver location.Verifies identity of apiserver using self-signed cert. No MITM possible.Authenticates to apiserver.In future, may do intelligent client-side load-balancing and failover.Provide the location and credentials directly to the http client.Alternate approach.Works with some types of client code that are confused by using a proxy.Need to import a root cert into your browser to protect against MITM.Using kubectl proxyThe following command runs kubectl in a mode where it acts as a reverse proxy. It handles locating the apiserver and authenticating. Run it like this:kubectl proxy --port=8080 See kubectl proxy for more details.Then you can explore the API with curl, wget, or a browser, replacing localhost with [::1] for IPv6, like so:curl http://localhost:8080/api/ The output is similar to this:{ "kind": "APIVersions", "versions": [ "v1" ], "serverAddressByClientCIDRs": [ { "clientCIDR": "0.0.0.0/0", "serverAddress": "10.0.1.149:443" } ] } Without kubectl proxyUse kubectl apply and kubectl describe secret... to create a token for the default service account with grep/cut:First, create the Secret, requesting a token for the default ServiceAccount:kubectl apply -f - <<EOF apiVersion: v1 kind: Secret metadata: name: default-token annotations: kubernetes.io/service-account.name: default type: kubernetes.io/service-account-token EOF


# Configure a Pod Quota for a Namespace

Configure a Pod Quota for a NamespaceRestrict how many Pods you can create within a namespace.This page shows how to set a quota for the total number of Pods that can run in a Namespace. You specify quotas in a ResourceQuota object.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou must have access to create namespaces in your cluster.Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace quota-pod-example Create a ResourceQuotaHere is an example manifest for a ResourceQuota:admin/resource/quota-pod.yaml apiVersion: v1 kind: ResourceQuota metadata: name: pod-demo spec: hard: pods: "2" Create the ResourceQuota:kubectl apply -f https://k8s.io/examples/admin/resource/quota-pod.yaml --namespace=quota-pod-example View detailed information about the ResourceQuota:kubectl get resourcequota pod-demo --namespace=quota-pod-example --output=yaml The output shows that the namespace has a quota of two Pods, and that currently there are no Pods; that is, none of the quota is used.spec: hard: pods: "2" status: hard: pods: "2" used: pods: "0" Here is an example manifest for a Deployment:admin/resource/quota-pod-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: pod-quota-demo spec: selector: matchLabels: purpose: quota-demo replicas: 3 template: metadata: labels: purpose: quota-demo spec: containers: - name: pod-quota-demo image: nginx In that manifest, replicas: 3 tells Kubernetes to attempt to create three new Pods, all running the same application.Create the Deployment:kubectl apply -f https://k8s.io/examples/admin/resource/quota-pod-deployment.yaml --namespace=quota-pod-example View detailed information about the Deployment:kubectl get deployment pod-quota-demo --namespace=quota-pod-example --output=yaml The output shows that even though the Deployment specifies three replicas, only two Pods were created because of the quota you defined earlier:spec: ... replicas: 3 ... status: availableReplicas: 2 ... lastUpdateTime: 2021-04-02T20:57:05Z message: 'unable to create pods: pods "pod-quota-demo-1650323038-" is forbidden: exceeded quota: pod-demo, requested: pods=1, used: pods=2, limited: pods=2' Choice of resourceIn this task you have defined a ResourceQuota that limited the total number of Pods, but you could also limit the total number of other kinds of object. For example, you might decide to limit how many CronJobs that can live in a single namespace.Clean upDelete your namespace:kubectl delete namespace quota-pod-example What's nextFor cluster administratorsConfigure Default Memory Requests and Limits for a NamespaceConfigure Default CPU Requests and Limits for a NamespaceConfigure Minimum and Maximum Memory Constraints for a NamespaceConfigure Minimum and Maximum CPU Constraints for a NamespaceConfigure Memory and CPU Quotas for a NamespaceConfigure Quotas for API ObjectsFor app developersAssign Memory Resources to Containers and PodsAssign CPU Resources to Containers and PodsAssign Pod-level CPU and memory resourcesConfigure Quality of Service for Pods


# Config and Storage Resources

Config and Storage ResourcesConfigMapConfigMap holds configuration data for pods to consume.SecretSecret holds secret data of a certain type.CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.CSINodeCSINode holds information about all CSI drivers installed on a node.CSIStorageCapacityCSIStorageCapacity stores the result of one CSI GetCapacity call.PersistentVolumeClaimPersistentVolumeClaim is a user's request for and claim to a persistent volume.PersistentVolumePersistentVolume (PV) is a storage resource provisioned by an administrator.StorageClassStorageClass describes the parameters for a class of storage for which PersistentVolumes can be dynamically provisioned.StorageVersionMigration v1alpha1StorageVersionMigration represents a migration of stored data to the latest storage version.VolumeVolume represents a named volume in a pod that may be accessed by any container in the pod.VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttributesClassVolumeAttributesClass represents a specification of mutable volume attributes defined by the CSI driver.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


# Advertise Extended Resources for a Node

Advertise Extended Resources for a NodeThis page shows how to specify extended resources for a Node. Extended resources allow cluster administrators to advertise node-level resources that would otherwise be unknown to Kubernetes.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Get the names of your Nodeskubectl get nodes Choose one of your Nodes to use for this exercise.Advertise a new extended resource on one of your NodesTo advertise a new extended resource on a Node, send an HTTP PATCH request to the Kubernetes API server. For example, suppose one of your Nodes has four dongles attached. Here's an example of a PATCH request that advertises four dongle resources for your Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4" } ] Note that Kubernetes does not need to know what a dongle is or what a dongle is for. The preceding PATCH request tells Kubernetes that your Node has four things that you call dongles.Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "add", "path": "/status/capacity/example.com~1dongle", "value": "4"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Note:In the preceding request, ~1 is the encoding for the character / in the patch path. The operation path value in JSON-Patch is interpreted as a JSON-Pointer. For more details, see IETF RFC 6901, section 3.The output shows that the Node has a capacity of 4 dongles:"capacity": { "cpu": "2", "memory": "2049008Ki", "example.com/dongle": "4", Describe your Node:kubectl describe node <your-node-name> Once again, the output shows the dongle resource:Capacity: cpu: 2 memory: 2049008Ki example.com/dongle: 4 Now, application developers can create Pods that request a certain number of dongles. See Assign Extended Resources to a Container.DiscussionExtended resources are similar to memory and CPU resources. For example, just as a Node has a certain amount of memory and CPU to be shared by all components running on the Node, it can have a certain number of dongles to be shared by all components running on the Node. And just as application developers can create Pods that request a certain amount of memory and CPU, they can create Pods that request a certain number of dongles.Extended resources are opaque to Kubernetes; Kubernetes does not know anything about what they are. Kubernetes knows only that a Node has a certain number of them. Extended resources must be advertised in integer amounts. For example, a Node can advertise four dongles, but not 4.5 dongles.Storage exampleSuppose a Node has 800 GiB of a special kind of disk storage. You could create a name for the special storage, say example.com/special-storage. Then you could advertise it in chunks of a certain size, say 100 GiB. In that case, your Node would advertise that it has eight resources of type example.com/special-storage.Capacity: ... example.com/special-storage: 8 If you want to allow arbitrary requests for special storage, you could advertise special storage in chunks of size 1 byte. In that case, you would advertise 800Gi resources of type example.com/special-storage.Capacity: ... example.com/special-storage: 800Gi Then a Container could request any number of bytes of special storage, up to 800Gi.Clean upHere is a PATCH request that removes the dongle advertisement from a Node.PATCH /api/v1/nodes/<your-node-name>/status HTTP/1.1 Accept: application/json Content-Type: application/json-patch+json Host: k8s-master:8080 [ { "op": "remove", "path": "/status/capacity/example.com~1dongle", } ] Start a proxy, so that you can easily send requests to the Kubernetes API server:kubectl proxy In another command window, send the HTTP PATCH request. Replace <your-node-name> with the name of your Node:curl --header "Content-Type: application/json-patch+json" \ --request PATCH \ --data '[{"op": "remove", "path": "/status/capacity/example.com~1dongle"}]' \ http://localhost:8001/api/v1/nodes/<your-node-name>/status Verify that the dongle advertisement has been removed:kubectl describe node <your-node-name> | grep dongle (you should not see any output)What's nextFor application developersAssign Extended Resources to a ContainerExtended Resource allocation by DRAFor cluster administratorsConfigure Minimum and Maximum Memory Constraints for a NamespaceConfigure Minimum and Maximum CPU Constraints for a NamespaceExtended Resource allocation by DRA


# kubectl auth whoami

kubectl auth whoamiSynopsisExperimental: Check who you are and your attributes (groups, extra). This command is helpful to get yourself aware of the current user attributes, especially when dynamic authentication, e.g., token webhook, auth proxy, or OIDC provider, is enabled in the Kubernetes cluster. kubectl auth whoami Examples # Get your subject attributes kubectl auth whoami # Get your subject attributes in JSON format kubectl auth whoami -o json Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.-h, --helphelp for whoami-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl auth - Inspect authorizationThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.