Blog guidelinesThese guidelines cover the main Kubernetes blog and the Kubernetes contributor blog.All blog content must also adhere to the overall policy in the content guide.Before you beginMake sure you are familiar with the introduction sections of contributing to Kubernetes blogs, not just to learn about the two official blogs and the differences between them, but also to get an overview of the process.Original contentThe Kubernetes project accepts original content only, in English.Note:The Kubernetes project cannot accept content for the blog if it has already been submitted or published outside of the Kubernetes project.The official blogs are not available as a medium to repurpose existing content from any third party as new content.This restriction even carries across to promoting other Linux Foundation and CNCF projects. Many CNCF projects have their own blog. These are often a better choice for posts about a specific project, even if that other project is designed specifically to work with Kubernetes (or with Linux, etc).Relevant contentArticles must contain content that applies broadly to the Kubernetes community. For example, a submission should focus on upstream Kubernetes as opposed to vendor-specific configurations. For articles submitted to the main blog that are not mirror articles, hyperlinks in the article should commonly be to the official Kubernetes documentation. When making external references, links should be diverse - for example, a submission shouldn't contain only links back to a single company's blog.The official Kubernetes blogs are not the place for vendor pitches or for articles that promote a specific solution from outside Kubernetes.Sometimes this is a delicate balance. You can ask in Slack (#sig-docs-blog) for guidance on whether a post is appropriate for the Kubernetes blog and / or contributor blog - don't hesitate to reach out.The content guide applies unconditionally to blog articles and the PRs that add them. Bear in mind that some restrictions in the guide state that they are only relevant to documentation; those marked restrictions don't apply to blog articles.LocalizationThe website is localized into many languages; English is the “upstream” for all the other localizations. Even if you speak another language and would be happy to provide a localization, that should be in a separate pull request (see languages per PR).Copyright and reuseYou must write original content and you must have permission to license that content to the Cloud Native Computing Foundation (so that the Kubernetes project can legally publish it). This means that not only is direct plagiarism forbidden, you cannot write a blog article if you don't have permission to meet the CNCF copyright license conditions (for example, if your employer has a policy about intellectual property that restricts what you are allowed to do).The license for the blog allows commercial use of the content for commercial purposes, but not the other way around.Special interest groups and working groupsTopics related to participation in or results of Kubernetes SIG activities are always on topic (see the work in the Contributor Comms Team for support on these posts).The project typically mirrors these articles to both blogs.National restrictions on contentThe Kubernetes website has an Internet Content Provider (ICP) licence from the government of China. Although it's unlikely to be a problem, Kubernetes cannot publish articles that would be blocked by the Chinese government's official filtering of internet content.Blog-specific content guidanceAs well as the general style guide, blog articles should (not must) align to the blog-specific style recommendations.The remainder of this page is additional guidance; these are not strict rules that articles must follow, but reviewers are likely to (and should) ask for edits to articles that are obviously not aligned with the recommendations here.Diagrams and illustrationsFor illustrations - including diagrams or charts - use the figure shortcode where feasible. You should set an alt attribute for accessibility.Use vector images for illustrations, technical diagrams and similar graphics; SVG format is recommended as a strong preference.Articles that use raster images for illustrations are more difficult to maintain and in some cases the blog team may ask authors to revise the article before it could be published.TimelessnessBlog posts should aim to be future proofGiven the development velocity of the project, SIG Docs prefers timeless writing: content that won't require updates to stay accurate for the reader.It can be a better choice to add a tutorial or update official documentation than to write a high level overview as a blog post.Consider concentrating the long technical content as a call to action of the blog post, and focus on the problem space or why readers should care.Content examplesHere are some examples of content that is appropriate for the main Kubernetes blog:Announcements about new Kubernetes capabilitiesExplanations of how to achieve an outcome using Kubernetes; for example, tell us about your low-toil improvement on the basic idea of a rolling deployComparisons of several different software options that have a link to Kubernetes and cloud native. It's OK to have a link to one of these options so long as you fully disclose your conflict of interest / relationship.Stories about problems or incidents, and how you resolved themArticles discussing building a cloud native platform for specific use casesYour opinion about the good or bad points about KubernetesAnnouncements and stories about non-core Kubernetes, such as the Gateway APIPost-release announcements and updatesMessages about important Kubernetes security vulnerabilitiesKubernetes projects updatesTutorials and walkthroughsThought leadership around Kubernetes and cloud nativeThe components of Kubernetes are purposely modular, so writing about existing integration points like CNI and CSI are on topic. Provided you don't write a vendor pitch, you can also write about what is on the other end of these integrations.Here are some examples of content that is appropriate for the Kubernetes contributor blog:articles about how to test your change to Kubernetes codecontent around non-code contributiondiscussions about alpha features where the design is still under discussion"Meet the team" articles about working groups, special interest groups, etc.a guide about how to write secure code that will become part of Kubernetes itselfarticles about maintainer summits and the outcome of those summitsExamples of content that wouldn't be acceptedHowever, the project will not publish:vendor pitchesan article you've published elsewhere, even if only to your own low-traffic bloglarge chunks of example source code with only a minimal explanationupdates about an external project that works with our relies on Kubernetes (put those on the external project's own blog)articles about using Kubernetes with a specific cloud providerarticles that criticise specific people, groups of people, or businessesarticles that have important technical mistakes or misleading details (for example: if you recommend turning off an important security control in production clusters, because it can be inconvenient, the Kubernetes project is likely to reject the article).

Blog guidelines


Shutdown of interactive tutorialsThe interactive tutorials previously on this website have been shut down.Kubernetes is grateful to O'Reilly and Katacoda for many years of helping people take their first steps in learning Kubernetes.The shutdown followed O'Reilly Media's 2019 acquisition of Katacoda.The tutorials ceased to function after the 31st of March, 2023. You are seeing this notice because this particular page has not yet been updated following that shutdown.Docs smoke test pageThis page serves two purposes:Demonstrate how the Kubernetes documentation uses MarkdownProvide a "smoke test" document we can use to test HTML, CSS, and template changes that affect the overall documentation.Heading levelsThe above heading is an H2. The page title renders as an H1. The following sections show H3 - H6.### H3 This is in an H3 section. #### H4 This is in an H4 section. ##### H5 This is in an H5 section. ###### H6 This is in an H6 section. Produces:H3This is in an H3 section.H4This is in an H4 section.H5This is in an H5 section.H6This is in an H6 section.Inline elementsInline elements show up within the text of paragraph, list item, admonition, or other block-level element.Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.Inline text stylesYou can use different text styles in markdown like:- **bold** - _italic_ - ***bold italic*** - ~~strikethrough~~ - underline - _underline italic_ - **underline bold** - ***underline bold italic*** - `monospace text` - **`monospace bold`** Produces:bolditalicbold italicstrikethroughunderlineunderline italicunderline boldunderline bold italicmonospace textmonospace boldListsMarkdown doesn't have strict rules about how to process lists. When we moved from Jekyll to Hugo, we broke some lists. To fix them, keep the following in mind:Make sure you indent sub-list items 2 spaces.To end a list and start another, you need an HTML comment block on a new line between the lists, flush with the left-hand border. The first list won't end otherwise, no matter how many blank lines you put between it and the second.Bullet listsYou can add a bullet list in markdown like:- This is a list item. * This is another list item in the same list. - You can mix `-` and `*`. - To make a sub-item, indent two spaces. - This is a sub-sub-item. Indent two more spaces. - Another sub-item. Produces:This is a list item.This is another list item in the same list.You can mix - and *.To make a sub-item, indent two spaces.This is a sub-sub-item. Indent two more spaces.Another sub-item.Also,This is a new list. With Hugo, you need to use a HTML comment to separate two consecutive lists. The HTML comment needs to be at the left margin.Bullet lists can have paragraphs or block elements within them.Indent the content to be the same as the first line of the bullet point. This paragraph and the code block line up with the first B in Bullet above.ls -l And a sub-list after some block-level contentA bullet list item can contain a numbered list.Numbered sub-list item 1Numbered sub-list item 2Numbered listsThis is a list item.This is another list item in the same list. The number you use in Markdown does not necessarily correlate to the number in the final output. By convention, we keep them in sync.Note:For single-digit numbered lists, using two spaces after the period makes interior block-level content line up better along tab-stops.This is a new list. With Hugo, you need to use an HTML comment to separate two consecutive lists. The HTML comment needs to be at the left margin.Numbered lists can have paragraphs or block elements within them.Indent the content to be the same as the first line of the bullet point. This paragraph and the code block line up with the N in Numbered above.ls -l And a sub-list after some block-level content. This is at the same "level" as the paragraph and code block above, despite being indented more.Tab listsTab lists can be used to conditionally display content, e.g., when multiple options must be documented that require distinct instructions or context.Please select an option.Tabs may also nest formatting styles.Ordered(Or unordered)Listsecho 'Tab lists may contain code blocks!' Header within a tab listNested header tags may also be included.Warning:Headers within tab lists will not appear in the Table of Contents.ChecklistsChecklists are technically bullet lists, but the bullets are suppressed by CSS. This is a checklist item This is a selected checklist itemCode blocksYou can create code blocks two different ways by surrounding the code block with three back-tick characters on lines before and after the code block. Only use back-ticks (code fences) for code blocks. This allows you to specify the language of the enclosed code, which enables syntax highlighting. It is also more predictable than using indentation.this is a code block created by back-ticks The back-tick method has some advantages.It works nearly every time.It is more compact when viewing the source code.It allows you to specify what language the code block is in, for syntax highlighting.It has a definite ending. Sometimes, the indentation method breaks with languages where spacing is significant, like Python or YAML.To specify the language for the code block, put it directly after the first grouping of back-ticks:ls -l Common languages used in Kubernetes documentation code blocks include:bash / shell (both work the same)gojsonyamlxmlnone (disables syntax highlighting for the block)Code blocks containing Hugo shortcodesTo show raw Hugo shortcodes as in the above example and prevent Hugo from interpreting them, use C-style comments directly after the < and before the > characters. The following example illustrates this (view the Markdown source for this page).{{< alert color="warning" >}}This is a warning.{{< /alert >}} LinksTo format a link, put the link text inside square brackets, followed by the link target in parentheses.[Link to Kubernetes.io](https://kubernetes.io/) or[Relative link to Kubernetes.io](/)You can also use HTML, but it is not preferred. For example, Link to Kubernetes.io.ImagesTo format an image, use similar syntax to links, but add a leading ! character. The square brackets contain the image's alt text. Try to always use alt text so that people using screen readers can get some benefit from the image.![pencil icon](/images/pencil.png) Produces:To specify extended attributes, such as width, title, caption, etc, use the figure shortcode, which is preferred to using a HTML  tag. Also, if you need the image to also be a hyperlink, use the link attribute, rather than wrapping the whole figure in Markdown link syntax as shown below.Pencil iconAn image used to illustrate the figure shortcodeEven if you choose not to use the figure shortcode, an image can also be a link. This time the pencil icon links to the Kubernetes website. Outer square brackets enclose the entire image tag, and the link target is in the parentheses at the end.[![pencil icon](/images/pencil.png)](https://kubernetes.io) Produces:You can also use HTML for images, but it is not preferred. Produces:TablesSimple tables have one row per line, and columns are separated by | characters. The header is separated from the body by cells containing nothing but at least three - characters. For ease of maintenance, try to keep all the cell separators even, even if you heed to use extra space.Heading cell 1Heading cell 2Body cell 1Body cell 2The header is optional. Any text separated by | will render as a table.Markdown tables have a hard time with block-level elements within cells, such as list items, code blocks, or multiple paragraphs. For complex or very wide tables, use HTML instead.

 Heading cell 1	 Heading cell 2

 Body cell 1	 Body cell 2

 Produces:Heading cell 1Heading cell 2Body cell 1Body cell 2Visualizations with MermaidYou can use Mermaid JS visualizations. The Mermaid JS version is specified in /layouts/partials/head.html{{< mermaid >}} graph TD; A-->B; A-->C; B-->D; C-->D; {{</ mermaid >}} Produces:graph TD; A-->B; A-->C; B-->D; C-->D;JavaScript must be enabled to view this content{{< mermaid >}} sequenceDiagram Alice ->> Bob: Hello Bob, how are you? Bob-->>John: How about you John? Bob--x Alice: I am good thanks! Bob-x John: I am good thanks! Note right of John: Bob thinks a long
long time, so long
that the text does
not fit on a row. Bob-->Alice: Checking with John... Alice->John: Yes... John, how are you? {{</ mermaid >}} Produces:sequenceDiagram Alice ->> Bob: Hello Bob, how are you? Bob-->>John: How about you John? Bob--x Alice: I am good thanks! Bob-x John: I am good thanks! Note right of John: Bob thinks a longlong time, so longthat the text doesnot fit on a row. Bob-->Alice: Checking with John... Alice->John: Yes... John, how are you?JavaScript must be enabled to view this contentYou can check more examples from the official docs.Sidebars and AdmonitionsSidebars and admonitions provide ways to add visual importance to text. Use them sparingly.SidebarsA sidebar offsets text visually, but without the visual prominence of admonitions.This is a sidebar.You can have paragraphs and block-level elements within a sidebar.You can even have code blocks.sudo dmesg AdmonitionsAdmonitions (notes, warnings, etc) use Hugo shortcodes.Note:Notes catch the reader's attention without a sense of urgency.You can have multiple paragraphs and block-level elements inside an admonition.You can also add tables to organize and highlight key information.Header 1Header 2Header 3Data 1Data AInfo XData 2Data BInfo YCaution:The reader should proceed with caution.Warning:Warnings point out something that could cause harm if ignored.IncludesTo add shortcodes to includes.Note:You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesKatacoda Embedded Live Environment

Docs smoke test page


Adding Windows worker nodesFEATURE STATE: Kubernetes v1.18 [beta]This page explains how to add Windows worker nodes to a kubeadm cluster.Before you beginA running Windows Server 2022 (or higher) instance with administrative access.A running kubeadm cluster created by kubeadm init and following the steps in the document Creating a cluster with kubeadm.Adding Windows worker nodesNote:To facilitate the addition of Windows worker nodes to a cluster, PowerShell scripts from the repository https://sigs.k8s.io/sig-windows-tools are used.Do the following for each machine:Open a PowerShell session on the machine.Make sure you are Administrator or a privileged user.Then proceed with the steps outlined below.Install containerdNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.To install containerd, first run the following command:curl.exe -LO https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/hostprocess/Install-Containerd.ps1 Then run the following command, but first replace CONTAINERD_VERSION with a recent release from the containerd repository. The version must not have a v prefix. For example, use 1.7.22 instead of v1.7.22:.\Install-Containerd.ps1 -ContainerDVersion CONTAINERD_VERSION Adjust any other parameters for Install-Containerd.ps1 such as netAdapterName as you need them.Set skipHypervisorSupportCheck if your machine does not support Hyper-V and cannot host Hyper-V isolated containers.If you change the Install-Containerd.ps1 optional parameters CNIBinPath and/or CNIConfigPath you will need to configure the installed Windows CNI plugin with matching values.Install kubeadm and kubeletRun the following commands to install kubeadm and the kubelet:curl.exe -LO https://raw.githubusercontent.com/kubernetes-sigs/sig-windows-tools/master/hostprocess/PrepareNode.ps1 .\PrepareNode.ps1 -KubernetesVersion v1.34 Adjust the parameter KubernetesVersion of PrepareNode.ps1 if needed.Run kubeadm joinRun the command that was output by kubeadm init. For example:kubeadm join --token <token> <control-plane-host>:<control-plane-port> --discovery-token-ca-cert-hash sha256:<hash> Additional information about kubeadm joinNote:To specify an IPv6 tuple for <control-plane-host>:<control-plane-port>, IPv6 address must be enclosed in square brackets, for example: [2001:db8::101]:2073.If you do not have the token, you can get it by running the following command on the control plane node:# Run this on a control plane node sudo kubeadm token list The output is similar to this:TOKEN TTL EXPIRES USAGES DESCRIPTION EXTRA GROUPS 8ewj1p.9r9hcjoqgajrj4gi 23h 2018-06-12T02:51:28Z authentication, The default bootstrap system: signing token generated by bootstrappers: 'kubeadm init'. kubeadm: default-node-token By default, node join tokens expire after 24 hours. If you are joining a node to the cluster after the current token has expired, you can create a new token by running the following command on the control plane node:# Run this on a control plane node sudo kubeadm token create The output is similar to this:5didvk.d09sbcov8ph2amjw If you don't have the value of --discovery-token-ca-cert-hash, you can get it by running the following commands on the control plane node:sudo cat /etc/kubernetes/pki/ca.crt | openssl x509 -pubkey | openssl rsa -pubin -outform der 2>/dev/null | \ openssl dgst -sha256 -hex | sed 's/^.* //' The output is similar to:8cb2de97839780a412b93877f8507ad6c94f73add17d5d7058e91741c9d5ec78 The output of the kubeadm join command should look something like:[preflight] Running pre-flight checks ... (log output of join workflow) ... Node join complete: * Certificate signing request sent to control-plane and response received. * Kubelet informed of new secure connection details. Run 'kubectl get nodes' on control-plane to see this machine join. A few seconds later, you should notice this node in the output from kubectl get nodes. (for example, run kubectl on a control plane node).Network configurationCNI setup on clusters mixed with Linux and Windows nodes requires more steps than just running kubectl apply on a manifest file. Additionally, the CNI plugin running on control plane nodes must be prepared to support the CNI plugin running on Windows worker nodes.Note: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.Only a few CNI plugins currently support Windows. Below you can find individual setup instructions for them:FlannelCalicoInstall kubectl for Windows (optional)See Install and Set Up kubectl on Windows.What's nextSee how to add Linux worker nodes.Items on this page refer to third party products or projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. See the CNCF website guidelines for more details.You should read the content guide before proposing a change that adds an extra third-party link.

Adding Windows worker nodes


Feature GatesThis page contains an overview of the various feature gates an administrator can specify on different Kubernetes components.See feature stages for an explanation of the stages for a feature.OverviewFeature gates are a set of key=value pairs that describe Kubernetes features. You can turn these features on or off using the --feature-gates command line flag on each Kubernetes component.Each Kubernetes component lets you enable or disable a set of feature gates that are relevant to that component. Use -h flag to see a full set of feature gates for all components. To set feature gates for a component, such as kubelet, use the --feature-gates flag assigned to a list of feature pairs:--feature-gates=...,GracefulNodeShutdown=true The following tables are a summary of the feature gates that you can set on different Kubernetes components.The "Since" column contains the Kubernetes release when a feature is introduced or its release stage is changed.The "Until" column, if not empty, contains the last Kubernetes release in which you can still use a feature gate.If a feature is in the Alpha or Beta state, you can find the feature listed in the Alpha/Beta feature gate table.If a feature is stable you can find all stages for that feature listed in the Graduated/Deprecated feature gate table.The Graduated/Deprecated feature gate table also lists deprecated and withdrawn features.Note:For a reference to old feature gates that are removed, please refer to feature gates removed.Feature gates for Alpha or Beta featuresFeature gates for features in Alpha or Beta statesFeatureDefaultStageSinceUntilAllowParsingUserUIDFromCertAuthfalseAlpha1.33–AllowUnsafeMalformedObjectDeletionfalseAlpha1.32–APIResponseCompressionfalseAlpha1.71.15APIResponseCompressiontrueBeta1.16–APIServerIdentityfalseAlpha1.201.25APIServerIdentitytrueBeta1.26–APIServingWithRoutinefalseAlpha1.30–CBORServingAndStoragefalseAlpha1.32–ClearingNominatedNodeNameAfterBindingfalseAlpha1.341.34CloudControllerManagerWebhookfalseAlpha1.27–ClusterTrustBundlefalseAlpha1.271.32ClusterTrustBundlefalseBeta1.33–ClusterTrustBundleProjectionfalseAlpha1.291.32ClusterTrustBundleProjectionfalseBeta1.33–ComponentFlagzfalseAlpha1.32–ComponentSLIsfalseAlpha1.261.26ComponentSLIstrueBeta1.27–ComponentStatuszfalseAlpha1.32–ConcurrentWatchObjectDecodefalseBeta1.31–ConsistentListFromCachefalseAlpha1.281.30ConsistentListFromCachetrueBeta1.31–ContainerCheckpointfalseAlpha1.251.29ContainerCheckpointtrueBeta1.30–ContainerRestartRulesfalseAlpha1.34–ContainerStopSignalsfalseAlpha1.33–ContextualLoggingfalseAlpha1.24–ContextualLoggingtrueBeta1.30–CoordinatedLeaderElectionfalseAlpha1.311.32CoordinatedLeaderElectionfalseBeta1.33–CPUManagerPolicyAlphaOptionsfalseAlpha1.23–CPUManagerPolicyBetaOptionstrueBeta1.23–CrossNamespaceVolumeDataSourcefalseAlpha1.26–CSIVolumeHealthfalseAlpha1.21–CustomCPUCFSQuotaPeriodfalseAlpha1.12–DeclarativeValidationtrueBeta1.33–DeclarativeValidationTakeoverfalseBeta1.33–DeploymentReplicaSetTerminatingReplicasfalseAlpha1.33–DisableAllocatorDualWritefalseAlpha1.311.32DisableAllocatorDualWritefalseBeta1.33–DRAAdminAccessfalseAlpha1.321.33DRAAdminAccesstrueBeta1.34–DRAConsumableCapacityfalseAlpha1.34–DRADeviceBindingConditionsfalseAlpha1.34–DRADeviceTaintsfalseAlpha1.33–DRAExtendedResourcefalseAlpha1.34–DRAPartitionableDevicesfalseAlpha1.33–DRAPrioritizedListfalseAlpha1.33–DRAPrioritizedListtrueBeta1.34–DRAResourceClaimDeviceStatusfalseAlpha1.321.32DRAResourceClaimDeviceStatustrueBeta1.33–EnvFilesfalseAlpha1.34–EventedPLEGfalseAlpha1.26–ExternalServiceAccountTokenSignerfalseAlpha1.321.33ExternalServiceAccountTokenSignertrueBeta1.34–GracefulNodeShutdownfalseAlpha1.201.20GracefulNodeShutdowntrueBeta1.21–GracefulNodeShutdownBasedOnPodPriorityfalseAlpha1.231.23GracefulNodeShutdownBasedOnPodPrioritytrueBeta1.24–HostnameOverridefalseAlpha1.34–HPAConfigurableTolerancefalseAlpha1.33–HPAScaleToZerofalseAlpha1.16–ImageMaximumGCAgefalseAlpha1.291.29ImageMaximumGCAgetrueBeta1.30–ImageVolumefalseAlpha1.311.32ImageVolumefalseBeta1.33–InformerResourceVersionfalseAlpha1.30–InPlacePodVerticalScalingfalseAlpha1.271.32InPlacePodVerticalScalingtrueBeta1.33–InPlacePodVerticalScalingExclusiveCPUsfalseAlpha1.32–InTreePluginPortworxUnregisterfalseAlpha1.23–JobManagedByfalseAlpha1.301.31JobManagedBytrueBeta1.32–KubeletCrashLoopBackOffMaxfalseAlpha1.32–KubeletEnsureSecretPulledImagesfalseAlpha1.33–KubeletFineGrainedAuthzfalseAlpha1.321.32KubeletFineGrainedAuthztrueBeta1.33–KubeletInUserNamespacefalseAlpha1.22–KubeletPodResourcesDynamicResourcesfalseAlpha1.271.33KubeletPodResourcesDynamicResourcestrueBeta1.34–KubeletPodResourcesGetfalseAlpha1.271.33KubeletPodResourcesGettrueBeta1.34–KubeletPSIfalseAlpha1.331.33KubeletPSItrueBeta1.34–KubeletSeparateDiskGCfalseAlpha1.291.30KubeletSeparateDiskGCtrueBeta1.31–KubeletServiceAccountTokenForCredentialProvidersfalseAlpha1.331.33KubeletServiceAccountTokenForCredentialProviderstrueBeta1.34–ListFromCacheSnapshotfalseAlpha1.33–LocalStorageCapacityIsolationFSQuotaMonitoringfalseAlpha1.151.30LocalStorageCapacityIsolationFSQuotaMonitoringfalseBeta1.31–LoggingAlphaOptionsfalseAlpha1.24–LoggingBetaOptionstrueBeta1.24–MatchLabelKeysInPodTopologySpreadfalseAlpha1.251.26MatchLabelKeysInPodTopologySpreadtrueBeta1.27–MatchLabelKeysInPodTopologySpreadSelectorMergetrueBeta1.34–MaxUnavailableStatefulSetfalseAlpha1.24–MemoryQoSfalseAlpha1.22–MutableCSINodeAllocatableCountfalseAlpha1.331.33MutableCSINodeAllocatableCountfalseBeta1.34–MutatingAdmissionPolicyfalseAlpha1.301.33MutatingAdmissionPolicyfalseBeta1.34–NodeLogQueryfalseAlpha1.271.29NodeLogQueryfalseBeta1.30–NodeSwapfalseAlpha1.221.27NodeSwapfalseBeta1.281.29NodeSwaptrueBeta1.30–NominatedNodeNameForExpectationfalseAlpha1.341.34OpenAPIEnumsfalseAlpha1.231.23OpenAPIEnumstrueBeta1.24–PodAndContainerStatsFromCRIfalseAlpha1.23–PodCertificateRequestfalseAlpha1.34–PodDeletionCostfalseAlpha1.211.21PodDeletionCosttrueBeta1.22–PodLevelResourcesfalseAlpha1.321.33PodLevelResourcestrueBeta1.34–PodLogsQuerySplitStreamsfalseAlpha1.32–PodObservedGenerationTrackingfalseAlpha1.331.33PodObservedGenerationTrackingtrueBeta1.34–PodReadyToStartContainersConditionfalseAlpha1.281.28PodReadyToStartContainersConditiontrueBeta1.29–PodTopologyLabelsAdmissionfalseAlpha1.33–PortForwardWebsocketsfalseAlpha1.301.30PortForwardWebsocketstrueBeta1.31–PreferSameTrafficDistributionfalseAlpha1.331.33PreferSameTrafficDistributiontrueBeta1.34–ProcMountTypefalseAlpha1.121.30ProcMountTypefalseBeta1.311.32ProcMountTypetrueBeta1.33–QOSReservedfalseAlpha1.11–ReduceDefaultCrashLoopBackOffDecayfalseAlpha1.33–RelaxedDNSSearchValidationfalseAlpha1.321.32RelaxedDNSSearchValidationtrueBeta1.33–RelaxedServiceNameValidationfalseAlpha1.34–ReloadKubeletServerCertificateFiletrueBeta1.31–RemoteRequestHeaderUIDfalseAlpha1.32–ResilientWatchCacheInitializationtrueBeta1.31–ResourceHealthStatusfalseAlpha1.31–RotateKubeletServerCertificatefalseAlpha1.71.11RotateKubeletServerCertificatetrueBeta1.12–RuntimeClassInImageCriApifalseAlpha1.29–SchedulerAsyncAPICallstrueBeta1.34–SchedulerAsyncPreemptionfalseAlpha1.321.32SchedulerAsyncPreemptiontrueBeta1.33–SchedulerPopFromBackoffQtrueBeta1.33–SELinuxChangePolicyfalseAlpha1.321.32SELinuxChangePolicytrueBeta1.33–SELinuxMountfalseAlpha1.301.32SELinuxMountfalseBeta1.33–SELinuxMountReadWriteOncePodfalseAlpha1.251.26SELinuxMountReadWriteOncePodfalseBeta1.271.27SELinuxMountReadWriteOncePodtrueBeta1.28–ServiceAcccountNodeAudienceRestrictionfalseBeta1.321.32ServiceAcccountNodeAudienceRestrictiontrueBeta1.33–StorageCapacityScoringfalseAlpha1.33–StorageVersionAPIfalseAlpha1.20–StorageVersionHashfalseAlpha1.141.14StorageVersionHashtrueBeta1.15–StorageVersionMigratorfalseAlpha1.30–StreamingCollectionEncodingToJSONtrueAlpha1.33–StreamingCollectionEncodingToProtobuftrueAlpha1.33–StrictIPCIDRValidationfalseAlpha1.33–StructuredAuthenticationConfigurationEgressSelectortrueBeta1.34–SupplementalGroupsPolicyfalseAlpha1.311.32SupplementalGroupsPolicytrueBeta1.33–SystemdWatchdogtrueBeta1.32–TopologyManagerPolicyAlphaOptionsfalseAlpha1.26–TopologyManagerPolicyBetaOptionsfalseBeta1.261.27TopologyManagerPolicyBetaOptionstrueBeta1.28–TranslateStreamCloseWebsocketRequestsfalseAlpha1.291.29TranslateStreamCloseWebsocketRequeststrueBeta1.30–UnauthenticatedHTTP2DOSMitigationfalseBeta1.281.28UnauthenticatedHTTP2DOSMitigationtrueBeta1.29–UnknownVersionInteroperabilityProxyfalseAlpha1.28–UserNamespacesPodSecurityStandardsfalseAlpha1.29–UserNamespacesSupportfalseAlpha1.281.29UserNamespacesSupportfalseBeta1.301.32UserNamespacesSupporttrueBeta1.33–WatchCacheInitializationPostStartHookfalseBeta1.31–WatchListfalseAlpha1.271.31WatchListtrueBeta1.321.32WatchListfalseBeta1.331.33WatchListtrueBeta1.34–WatchListClientfalseBeta1.30–WindowsCPUAndMemoryAffinityfalseAlpha1.32–WindowsGracefulNodeShutdownfalseAlpha1.321.33WindowsGracefulNodeShutdowntrueBeta1.34–Feature gates for graduated or deprecated featuresFeature Gates for Graduated or Deprecated FeaturesFeatureDefaultStageSinceUntilAllowDNSOnlyNodeCSRfalseDeprecated1.31–AllowInsecureKubeletCertificateSigningRequestsfalseDeprecated1.31–AllowServiceLBStatusOnNonLBfalseDeprecated1.29–AnonymousAuthConfigurableEndpointsfalseAlpha1.311.31AnonymousAuthConfigurableEndpointstrueBeta1.321.33AnonymousAuthConfigurableEndpointstrueGA1.34–AnyVolumeDataSourcefalseAlpha1.181.23AnyVolumeDataSourcetrueBeta1.241.32AnyVolumeDataSourcetrueGA1.33–APIServerTracingfalseAlpha1.221.26APIServerTracingtrueBeta1.271.33APIServerTracingtrueGA1.34–AuthorizeNodeWithSelectorsfalseAlpha1.311.31AuthorizeNodeWithSelectorstrueBeta1.321.33AuthorizeNodeWithSelectorstrueGA1.34–AuthorizeWithSelectorsfalseAlpha1.311.31AuthorizeWithSelectorstrueBeta1.321.33AuthorizeWithSelectorstrueGA1.34–BtreeWatchCachetrueBeta1.321.32BtreeWatchCachetrueGA1.33–CPUManagerPolicyOptionsfalseAlpha1.221.22CPUManagerPolicyOptionstrueBeta1.231.32CPUManagerPolicyOptionstrueGA1.33–CRDValidationRatchetingfalseAlpha1.281.29CRDValidationRatchetingtrueBeta1.301.32CRDValidationRatchetingtrueGA1.33–CronJobsScheduledAnnotationtrueBeta1.281.31CronJobsScheduledAnnotationtrueGA1.32–CSIMigrationPortworxfalseAlpha1.231.24CSIMigrationPortworxfalseBeta1.251.30CSIMigrationPortworxtrueBeta1.311.32CSIMigrationPortworxtrueGA1.33–CustomResourceFieldSelectorsfalseAlpha1.301.30CustomResourceFieldSelectorstrueBeta1.311.31CustomResourceFieldSelectorstrueGA1.32–DisableNodeKubeProxyVersionfalseAlpha1.291.30DisableNodeKubeProxyVersiontrueBeta1.31.01.31.0DisableNodeKubeProxyVersionfalseDeprecated1.31.1–DisableNodeKubeProxyVersionfalseDeprecated1.321.32DisableNodeKubeProxyVersiontrueDeprecated1.33–DynamicResourceAllocationfalseAlpha1.301.31DynamicResourceAllocationfalseBeta1.321.33DynamicResourceAllocationtrueGA1.34–ElasticIndexedJobtrueBeta1.271.30ElasticIndexedJobtrueGA1.31–ExecProbeTimeouttrueGA1.20–HonorPVReclaimPolicyfalseAlpha1.231.30HonorPVReclaimPolicytrueBeta1.311.32HonorPVReclaimPolicytrueGA1.33–InPlacePodVerticalScalingAllocatedStatusfalseAlpha1.321.32InPlacePodVerticalScalingAllocatedStatusfalseDeprecated1.33–JobBackoffLimitPerIndexfalseAlpha1.281.28JobBackoffLimitPerIndextrueBeta1.291.32JobBackoffLimitPerIndextrueGA1.33–JobPodReplacementPolicyfalseAlpha1.281.28JobPodReplacementPolicytrueBeta1.291.33JobPodReplacementPolicytrueGA1.34–JobSuccessPolicyfalseAlpha1.301.30JobSuccessPolicytrueBeta1.311.32JobSuccessPolicytrueGA1.33–KMSv1trueDeprecated1.281.28KMSv1falseDeprecated1.29–KubeletCgroupDriverFromCRIfalseAlpha1.281.30KubeletCgroupDriverFromCRItrueBeta1.31–KubeletCgroupDriverFromCRItrueGA1.34–KubeletTracingfalseAlpha1.251.26KubeletTracingtrueBeta1.271.33KubeletTracingtrueGA1.34–LoadBalancerIPModefalseAlpha1.291.30LoadBalancerIPModetrueBeta1.301.31LoadBalancerIPModetrueGA1.32–LogarithmicScaleDownfalseAlpha1.211.21LogarithmicScaleDowntrueBeta1.221.30LogarithmicScaleDowntrueGA1.31–MatchLabelKeysInPodAffinityfalseAlpha1.291.30MatchLabelKeysInPodAffinitytrueBeta1.311.32MatchLabelKeysInPodAffinitytrueGA1.33–MemoryManagerfalseAlpha1.211.21MemoryManagertrueBeta1.221.31MemoryManagertrueGA1.32–MultiCIDRServiceAllocatorfalseAlpha1.271.30MultiCIDRServiceAllocatorfalseBeta1.311.32MultiCIDRServiceAllocatortrueGA1.33–NFTablesProxyModefalseAlpha1.291.30NFTablesProxyModetrueBeta1.311.32NFTablesProxyModetrueGA1.33–NodeInclusionPolicyInPodTopologySpreadfalseAlpha1.251.25NodeInclusionPolicyInPodTopologySpreadtrueBeta1.261.32NodeInclusionPolicyInPodTopologySpreadtrueGA1.33–OrderedNamespaceDeletionfalseBeta1.301.32OrderedNamespaceDeletiontrueBeta1.331.33OrderedNamespaceDeletiontrueGA1.34–PodIndexLabeltrueBeta1.281.31PodIndexLabeltrueGA1.32–PodLifecycleSleepActionfalseAlpha1.291.29PodLifecycleSleepActiontrueBeta1.301.33PodLifecycleSleepActiontrueGA1.34–PodLifecycleSleepActionAllowZerofalseAlpha1.321.32PodLifecycleSleepActionAllowZerotrueBeta1.331.33PodLifecycleSleepActionAllowZerotrueGA1.34–PodSchedulingReadinessfalseAlpha1.261.26PodSchedulingReadinesstrueBeta1.271.29PodSchedulingReadinesstrueGA1.30–RecoverVolumeExpansionFailurefalseAlpha1.231.31RecoverVolumeExpansionFailuretrueBeta1.321.33RecoverVolumeExpansionFailuretrueGA1.34–RecursiveReadOnlyMountsfalseAlpha1.301.30RecursiveReadOnlyMountstrueBeta1.311.32RecursiveReadOnlyMountstrueGA1.33–RelaxedEnvironmentVariableValidationfalseAlpha1.301.31RelaxedEnvironmentVariableValidationtrueBeta1.321.33RelaxedEnvironmentVariableValidationtrueGA1.34–RetryGenerateNamefalseAlpha1.301.30RetryGenerateNametrueBeta1.311.31RetryGenerateNametrueGA1.32–SchedulerQueueingHintstrueBeta1.281.28SchedulerQueueingHintsfalseBeta1.291.31SchedulerQueueingHintstrueBeta1.321.33SchedulerQueueingHintstrueGA1.34–SeparateCacheWatchRPCtrueBeta1.281.32SeparateCacheWatchRPCfalseDeprecated1.33–SeparateTaintEvictionControllertrueBeta1.291.33SeparateTaintEvictionControllertrueGA1.34–ServiceAccountTokenJTIfalseAlpha1.291.29ServiceAccountTokenJTItrueBeta1.301.31ServiceAccountTokenJTItrueGA1.32–ServiceAccountTokenNodeBindingfalseAlpha1.291.30ServiceAccountTokenNodeBindingtrueBeta1.311.32ServiceAccountTokenNodeBindingtrueGA1.33–ServiceAccountTokenNodeBindingValidationfalseAlpha1.291.29ServiceAccountTokenNodeBindingValidationtrueBeta1.301.31ServiceAccountTokenNodeBindingValidationtrueGA1.32–ServiceAccountTokenPodNodeInfofalseAlpha1.291.29ServiceAccountTokenPodNodeInfotrueBeta1.301.31ServiceAccountTokenPodNodeInfotrueGA1.32–ServiceTrafficDistributionfalseAlpha1.301.30ServiceTrafficDistributiontrueBeta1.311.32ServiceTrafficDistributiontrueGA1.33–SidecarContainersfalseAlpha1.281.28SidecarContainerstrueBeta1.291.32SidecarContainerstrueGA1.33–SizeMemoryBackedVolumesfalseAlpha1.201.21SizeMemoryBackedVolumestrueBeta1.221.31SizeMemoryBackedVolumestrueGA1.32–StatefulSetAutoDeletePVCfalseAlpha1.231.26StatefulSetAutoDeletePVCtrueBeta1.271.31StatefulSetAutoDeletePVCtrueGA1.32–StatefulSetStartOrdinalfalseAlpha1.261.26StatefulSetStartOrdinaltrueBeta1.271.30StatefulSetStartOrdinaltrueGA1.31–StorageNamespaceIndextrueBeta1.301.32StorageNamespaceIndextrueDeprecated1.33–StrictCostEnforcementForVAPfalseBeta1.301.31StrictCostEnforcementForVAPtrueGA1.32–StrictCostEnforcementForWebhooksfalseBeta1.311.31StrictCostEnforcementForWebhookstrueGA1.32–StructuredAuthenticationConfigurationfalseAlpha1.291.29StructuredAuthenticationConfigurationtrueBeta1.301.33StructuredAuthenticationConfigurationtrueGA1.34–StructuredAuthorizationConfigurationfalseAlpha1.291.29StructuredAuthorizationConfigurationtrueBeta1.301.31StructuredAuthorizationConfigurationtrueGA1.32–TopologyAwareHintsfalseAlpha1.211.22TopologyAwareHintsfalseBeta1.231.23TopologyAwareHintstrueBeta1.241.32TopologyAwareHintstrueGA1.33–TopologyManagerPolicyOptionsfalseAlpha1.261.27TopologyManagerPolicyOptionstrueBeta1.281.31TopologyManagerPolicyOptionstrueGA1.32–VolumeAttributesClassfalseAlpha1.291.30VolumeAttributesClassfalseBeta1.311.33VolumeAttributesClasstrueGA1.34–WatchFromStorageWithoutResourceVersionfalseBeta1.301.32WatchFromStorageWithoutResourceVersionfalseDeprecated1.33–WindowsHostNetworktrueAlpha1.261.32WindowsHostNetworkfalseDeprecated1.33–WinDSRfalseAlpha1.141.32WinDSRtrueBeta1.331.33WinDSRtrueGA1.34–WinOverlayfalseAlpha1.141.19WinOverlaytrueBeta1.201.33WinOverlaytrueGA1.34–Using a featureFeature stagesA feature can be in Alpha, Beta or GA stage. An Alpha feature means:Disabled by default.Might be buggy. Enabling the feature may expose bugs.Support for feature may be dropped at any time without notice.The API may change in incompatible ways in a later software release without notice.Recommended for use only in short-lived testing clusters, due to increased risk of bugs and lack of long-term support.A Beta feature means:Usually enabled by default. Beta API groups are disabled by default.The feature is well tested. Enabling the feature is considered safe.Support for the overall feature will not be dropped, though details may change.The schema and/or semantics of objects may change in incompatible ways in a subsequent beta or stable release. When this happens, we will provide instructions for migrating to the next version. This may require deleting, editing, and re-creating API objects. The editing process may require some thought. This may require downtime for applications that rely on the feature.Recommended for only non-business-critical uses because of potential for incompatible changes in subsequent releases. If you have multiple clusters that can be upgraded independently, you may be able to relax this restriction.Note:Please do try Beta features and give

Feature Gates


Hello MinikubeThis tutorial shows you how to run a sample app on Kubernetes using minikube. The tutorial provides a container image that uses NGINX to echo back all the requests.ObjectivesDeploy a sample application to minikube.Run the app.View application logs.Before you beginThis tutorial assumes that you have already set up minikube. See Step 1 in minikube start for installation instructions.Note:Only execute the instructions in Step 1, Installation. The rest is covered on this page.You also need to install kubectl. See Install tools for installation instructions.Create a minikube clusterminikube start Open the DashboardOpen the Kubernetes dashboard. You can do this two different ways:Open a new terminal, and run:# Start a new terminal, and leave this running. minikube dashboard Now, switch back to the terminal where you ran minikube start.Note:The dashboard command enables the dashboard add-on and opens the proxy in the default web browser. You can create Kubernetes resources on the dashboard such as Deployment and Service.To find out how to avoid directly invoking the browser from the terminal and get a URL for the web dashboard, see the "URL copy and paste" tab.By default, the dashboard is only accessible from within the internal Kubernetes virtual network. The dashboard command creates a temporary proxy to make the dashboard accessible from outside the Kubernetes virtual network.To stop the proxy, run Ctrl+C to exit the process. After the command exits, the dashboard remains running in the Kubernetes cluster. You can run the dashboard command again to create another proxy to access the dashboard.If you don't want minikube to open a web browser for you, run the dashboard subcommand with the --url flag. minikube outputs a URL that you can open in the browser you prefer.Open a new terminal, and run:# Start a new terminal, and leave this running. minikube dashboard --url Now, you can use this URL and switch back to the terminal where you ran minikube start.Create a DeploymentA Kubernetes Pod is a group of one or more Containers, tied together for the purposes of administration and networking. The Pod in this tutorial has only one Container. A Kubernetes Deployment checks on the health of your Pod and restarts the Pod's Container if it terminates. Deployments are the recommended way to manage the creation and scaling of Pods.Use the kubectl create command to create a Deployment that manages a Pod. The Pod runs a Container based on the provided Docker image.# Run a test container image that includes a webserver kubectl create deployment hello-node --image=registry.k8s.io/e2e-test-images/agnhost:2.53 -- /agnhost netexec --http-port=8080 View the Deployment:kubectl get deployments The output is similar to:NAME READY UP-TO-DATE AVAILABLE AGE hello-node 1/1 1 1 1m (It may take some time for the pod to become available. If you see "0/1", try again in a few seconds.)View the Pod:kubectl get pods The output is similar to:NAME READY STATUS RESTARTS AGE hello-node-5f76cf6ccf-br9b5 1/1 Running 0 1m View cluster events:kubectl get events View the kubectl configuration:kubectl config view View application logs for a container in a pod (replace pod name with the one you got from kubectl get pods).Note:Replace hello-node-5f76cf6ccf-br9b5 in the kubectl logs command with the name of the pod from the kubectl get pods command output.kubectl logs hello-node-5f76cf6ccf-br9b5 The output is similar to:I0911 09:19:26.677397 1 log.go:195] Started HTTP server on port 8080 I0911 09:19:26.677586 1 log.go:195] Started UDP server on port 8081 Note:For more information about kubectl commands, see the kubectl overview.Create a ServiceBy default, the Pod is only accessible by its internal IP address within the Kubernetes cluster. To make the hello-node Container accessible from outside the Kubernetes virtual network, you have to expose the Pod as a Kubernetes Service.Warning:The agnhost container has a /shell endpoint, which is useful for debugging, but dangerous to expose to the public internet. Do not run this on an internet-facing cluster, or a production cluster.Expose the Pod to the public internet using the kubectl expose command:kubectl expose deployment hello-node --type=LoadBalancer --port=8080 The --type=LoadBalancer flag indicates that you want to expose your Service outside of the cluster.The application code inside the test image only listens on TCP port 8080. If you used kubectl expose to expose a different port, clients could not connect to that other port.View the Service you created:kubectl get services The output is similar to:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE hello-node LoadBalancer 10.108.144.78 <pending> 8080:30369/TCP 21s kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 23m On cloud providers that support load balancers, an external IP address would be provisioned to access the Service. On minikube, the LoadBalancer type makes the Service accessible through the minikube service command.Run the following command:minikube service hello-node This opens up a browser window that serves your app and shows the app's response.Enable addonsThe minikube tool includes a set of built-in addons that can be enabled, disabled and opened in the local Kubernetes environment.List the currently supported addons:minikube addons list The output is similar to:addon-manager: enabled dashboard: enabled default-storageclass: enabled efk: disabled freshpod: disabled gvisor: disabled helm-tiller: disabled ingress: disabled ingress-dns: disabled logviewer: disabled metrics-server: disabled nvidia-driver-installer: disabled nvidia-gpu-device-plugin: disabled registry: disabled registry-creds: disabled storage-provisioner: enabled storage-provisioner-gluster: disabled Enable an addon, for example, metrics-server:minikube addons enable metrics-server The output is similar to:The 'metrics-server' addon is enabled View the Pod and Service you created by installing that addon:kubectl get pod,svc -n kube-system The output is similar to:NAME READY STATUS RESTARTS AGE pod/coredns-5644d7b6d9-mh9ll 1/1 Running 0 34m pod/coredns-5644d7b6d9-pqd2t 1/1 Running 0 34m pod/metrics-server-67fb648c5 1/1 Running 0 26s pod/etcd-minikube 1/1 Running 0 34m pod/influxdb-grafana-b29w8 2/2 Running 0 26s pod/kube-addon-manager-minikube 1/1 Running 0 34m pod/kube-apiserver-minikube 1/1 Running 0 34m pod/kube-controller-manager-minikube 1/1 Running 0 34m pod/kube-proxy-rnlps 1/1 Running 0 34m pod/kube-scheduler-minikube 1/1 Running 0 34m pod/storage-provisioner 1/1 Running 0 34m NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/metrics-server ClusterIP 10.96.241.45 <none> 80/TCP 26s service/kube-dns ClusterIP 10.96.0.10 <none> 53/UDP,53/TCP 34m service/monitoring-grafana NodePort 10.99.24.54 <none> 80:30002/TCP 26s service/monitoring-influxdb ClusterIP 10.111.169.94 <none> 8083/TCP,8086/TCP 26s Check the output from metrics-server:kubectl top pods The output is similar to:NAME CPU(cores) MEMORY(bytes) hello-node-ccf4b9788-4jn97 1m 6Mi If you see the following message, wait, and try again:error: Metrics API not available Disable metrics-server:minikube addons disable metrics-server The output is similar to:metrics-server was successfully disabled Clean upNow you can clean up the resources you created in your cluster:kubectl delete service hello-node kubectl delete deployment hello-node Stop the Minikube clusterminikube stop Optionally, delete the Minikube VM:# Optional minikube delete If you want to use minikube again to learn more about Kubernetes, you don't need to delete it.ConclusionThis page covered the basic aspects to get a minikube cluster up and running. You are now ready to deploy applications.What's nextTutorial to deploy your first app on Kubernetes with kubectl.Learn more about Deployment objects.Learn more about Deploying applications.Learn more about Service objects.

Hello Minikube


MutatingAdmissionPolicy v1beta1MutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.apiVersion: admissionregistration.k8s.io/v1beta1import "k8s.io/api/admissionregistration/v1beta1"MutatingAdmissionPolicyMutatingAdmissionPolicy describes the definition of an admission mutation policy that mutates the object coming into admission chain.apiVersion: admissionregistration.k8s.io/v1beta1kind: MutatingAdmissionPolicymetadata (ObjectMeta)Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.spec (MutatingAdmissionPolicySpec)Specification of the desired behavior of the MutatingAdmissionPolicy.MutatingAdmissionPolicySpec is the specification of the desired behavior of the admission policy.spec.failurePolicy (string)failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.A policy is invalid if paramKind refers to a non-existent Kind. A binding is invalid if paramRef.name refers to a non-existent resource.failurePolicy does not define how validations that evaluate to false are handled.Allowed values are Ignore or Fail. Defaults to Fail.spec.matchConditions ([]MatchCondition)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergematchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the matchConstraints. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.The exact matching logic is (in order):If ANY matchCondition evaluates to FALSE, the policy is skipped.If ALL matchConditions evaluate to TRUE, the policy is evaluated.If any matchCondition evaluates to an error (but none are FALSE):If failurePolicy=Fail, reject the requestIf failurePolicy=Ignore, the policy is skippedMatchCondition represents a condition which must be fulfilled for a request to be sent to a webhook.spec.matchConditions.expression (string), requiredExpression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/Required.spec.matchConditions.name (string), requiredName is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')Required.spec.matchConstraints (MatchResources)matchConstraints specifies what resources this policy is designed to validate. The MutatingAdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API MutatingAdmissionPolicy cannot match MutatingAdmissionPolicy and MutatingAdmissionPolicyBinding. The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT. Required.MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)spec.matchConstraints.excludeResourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchConstraints.excludeResourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchConstraints.excludeResourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchConstraints.excludeResourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.matchConstraints.matchPolicy (string)matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.Defaults to "Equivalent"spec.matchConstraints.namespaceSelector (LabelSelector)NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.Default to the empty LabelSelector, which matches everything.spec.matchConstraints.objectSelector (LabelSelector)ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.spec.matchConstraints.resourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchConstraints.resourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchConstraints.resourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchConstraints.resourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.mutations ([]Mutation)Atomic: will be replaced during a mergemutations contain operations to perform on matching objects. mutations may not be empty; a minimum of one mutation is required. mutations are evaluated in order, and are reinvoked according to the reinvocationPolicy. The mutations of a policy are invoked for each binding of this policy and reinvocation of mutations occurs on a per binding basis.Mutation specifies the CEL expression which is used to apply the Mutation.spec.mutations.patchType (string), requiredpatchType indicates the patch strategy used. Allowed values are "ApplyConfiguration" and "JSONPatch". Required.spec.mutations.applyConfiguration (ApplyConfiguration)applyConfiguration defines the desired configuration values of an object. The configuration is applied to the admission object using structured merge diff. A CEL expression is used to create apply configuration.ApplyConfiguration defines the desired configuration values of an object.spec.mutations.applyConfiguration.expression (string)expression will be evaluated by CEL to create an apply configuration. ref: https://github.com/google/cel-specApply configurations are declared in CEL using object initialization. For example, this CEL expression returns an apply configuration to set a single field:Object{ spec: Object.spec{ serviceAccountName: "example" } } Apply configurations may not modify atomic structs, maps or arrays due to the risk of accidental deletion of values not included in the apply configuration.CEL expressions have access to the object types needed to create apply configurations:'Object' - CEL type of the resource object. - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec') - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Required.spec.mutations.jsonPatch (JSONPatch)jsonPatch defines a JSON patch operation to perform a mutation to the object. A CEL expression is used to create the JSON patch.JSONPatch defines a JSON Patch.spec.mutations.jsonPatch.expression (string)expression will be evaluated by CEL to create a JSON patch. ref: https://github.com/google/cel-specexpression must return an array of JSONPatch values.For example, this CEL expression returns a JSON patch to conditionally modify a value: [ JSONPatch{op: "test", path: "/spec/example", value: "Red"}, JSONPatch{op: "replace", path: "/spec/example", value: "Green"} ] To define an object for the patch value, use Object types. For example: [ JSONPatch{ op: "add", path: "/spec/selector", value: Object.spec.selector{matchLabels: {"environment": "test"}} } ] To use strings containing '/' and '~' as JSONPatch path keys, use "jsonpatch.escapeKey". For example: [ JSONPatch{ op: "add", path: "/metadata/labels/" + jsonpatch.escapeKey("example.com/environment"), value: "test" }, ] CEL expressions have access to the types needed to create JSON patches and objects:'JSONPatch' - CEL type of JSON Patch operations. JSONPatch has the fields 'op', 'from', 'path' and 'value'. See JSON patch for more details. The 'value' field may be set to any of: string, integer, array, map or object. If set, the 'path' and 'from' fields must be set to a JSON pointer string, where the 'jsonpatch.escapeKey()' CEL function may be used to escape path keys containing '/' and '~'.'Object' - CEL type of the resource object. - 'Object.<fieldName>' - CEL type of object field (such as 'Object.spec') - 'Object.<fieldName1>.<fieldName2>...<fieldNameN>` - CEL type of nested field (such as 'Object.spec.containers')CEL expressions have access to the contents of the API request, organized into CEL variables as well as some other useful variables:'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.CEL expressions have access to Kubernetes CEL function libraries as well as:'jsonpatch.escapeKey' - Performs JSONPatch key escaping. '~' and '/' are escaped as '~0' and `~1' respectively).Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Required.spec.paramKind (ParamKind)paramKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If paramKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in MutatingAdmissionPolicyBinding, the params variable will be null.ParamKind is a tuple of Group Kind and Version.spec.paramKind.apiVersion (string)APIVersion is the API group version the resources belong to. In format of "group/version". Required.spec.paramKind.kind (string)Kind is the API kind the resources belong to. Required.spec.reinvocationPolicy (string)reinvocationPolicy indicates whether mutations may be called multiple times per MutatingAdmissionPolicyBinding as part of a single admission evaluation. Allowed values are "Never" and "IfNeeded".Never: These mutations will not be called more than once per binding in a single admission evaluation.IfNeeded: These mutations may be invoked more than once per binding for a single admission request and there is no guarantee of order with respect to other admission plugins, admission webhooks, bindings of this policy and admission policies. Mutations are only reinvoked when mutations change the object after this mutation is invoked. Required.spec.variables ([]Variable)Atomic: will be replaced during a mergevariables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except matchConditions because matchConditions are evaluated before the rest of the policy.The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, variables must be sorted by the order of first appearance and acyclic.Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.spec.variables.expression (string), requiredExpression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.spec.variables.name (string), requiredName is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.fooMutatingAdmissionPolicyBindingMutatingAdmissionPolicyBinding binds the MutatingAdmissionPolicy with parametrized resources. MutatingAdmissionPolicyBinding and the optional parameter resource together define how cluster administrators configure policies for clusters.For a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding. Each evaluation is constrained by a runtime cost budget.Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.apiVersion (string)APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourceskind (string)Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsmetadata (ObjectMeta)Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.spec (MutatingAdmissionPolicyBindingSpec)Specification of the desired behavior of the MutatingAdmissionPolicyBinding.MutatingAdmissionPolicyBindingSpec is the specification of the MutatingAdmissionPolicyBinding.spec.matchResources (MatchResources)matchResources limits what resources match this binding and may be mutated by it. Note that if matchResources matches a resource, the resource must also match a policy's matchConstraints and matchConditions before the resource may be mutated. When matchResources is unset, it does not constrain resource matching, and only the policy's matchConstraints and matchConditions must match for the resource to be mutated. Additionally, matchResources.resourceRules are optional and do not constraint matching when unset. Note that this is differs from MutatingAdmissionPolicy matchConstraints, where resourceRules are required. The CREATE, UPDATE and CONNECT operations are allowed. The DELETE operation may not be matched. '*' matches CREATE, UPDATE and CONNECT.MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)spec.matchResources.excludeResourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchResources.excludeResourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchResources.excludeResourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchResources.excludeResourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.matchResources.matchPolicy (string)matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.Defaults to "Equivalent"spec.matchResources.namespaceSelector (LabelSelector)NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.Default to the empty LabelSelector, which matches everything.spec.matchResources.objectSelector (LabelSelector)ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.spec.matchResources.resourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchResources.resourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchResources.resourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchResources.resourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.paramRef (ParamRef)paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in spec.ParamKind of the bound MutatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the MutatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.spec.paramRef.name (string)name is the name of the resource being referenced.One of name or selector must be set, but name and selector are mutually exclusive properties. If one is set, the other must be unset.A single parameter used for all admission requests can be configured by setting the name field, leaving selector blank, and setting namespace if paramKind is namespace-scoped.spec.paramRef.namespace (string)namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both name and selector fields.A per-namespace parameter may be used by specifying a namespace-scoped paramKind in the policy and leaving this field empty.If paramKind is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.If paramKind is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.spec.paramRef.parameterNotFoundAction (string)parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to Allow, then no matched parameters will be treated as successful validation by the binding. If set to Deny, then no matched parameters will be subject to the failurePolicy of the policy.Allowed values are Allow or DenyRequiredspec.paramRef.selector (LabelSelector)selector can be used to match multiple param objects based on their labels. Supply selector: {} to match all resources of the ParamKind.If multiple params are found, they are all evaluated with the policy expressions and the results are ANDed together.One of name or selector must be set, but name and selector are mutually exclusive properties. If one is set, the other must be unset.spec.policyName (string)policyName references a MutatingAdmissionPolicy name which the MutatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.MutatingAdmissionPolicyListMutatingAdmissionPolicyList is a list of MutatingAdmissionPolicy.items ([]MutatingAdmissionPolicy), requiredList of ValidatingAdmissionPolicy.apiVersion (string)APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourceskind (string)Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsOperationsget read the specified MutatingAdmissionPolicyHTTP RequestGET /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpolicies/{name}Parametersname (in path): string, requiredname of the MutatingAdmissionPolicypretty (in query): stringprettyResponse200 (MutatingAdmissionPolicy): OK401: Unauthorizedlist list or watch objects of kind MutatingAdmissionPolicyHTTP RequestGET /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpoliciesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (MutatingAdmissionPolicyList): OK401: Unauthorizedcreate create a MutatingAdmissionPolicyHTTP RequestPOST /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpoliciesParametersbody: MutatingAdmissionPolicy, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (MutatingAdmissionPolicy): OK201 (MutatingAdmissionPolicy): Created202 (MutatingAdmissionPolicy): Accepted401: Unauthorizedupdate replace the specified MutatingAdmissionPolicyHTTP RequestPUT /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpolicies/{name}Parametersname (in path): string, requiredname of the MutatingAdmissionPolicybody: MutatingAdmissionPolicy, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (MutatingAdmissionPolicy): OK201 (MutatingAdmissionPolicy): Created401: Unauthorizedpatch partially update the specified MutatingAdmissionPolicyHTTP RequestPATCH /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpolicies/{name}Parametersname (in path): string, requiredname of the MutatingAdmissionPolicybody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (MutatingAdmissionPolicy): OK201 (MutatingAdmissionPolicy): Created401: Unauthorizeddelete delete a MutatingAdmissionPolicyHTTP RequestDELETE /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpolicies/{name}Parametersname (in path): string, requiredname of the MutatingAdmissionPolicybody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of MutatingAdmissionPolicyHTTP RequestDELETE /apis/admissionregistration.k8s.io/v1beta1/mutatingadmissionpoliciesParametersbody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

MutatingAdmissionPolicy v1beta1


kubectl create deploymentSynopsisCreate a deployment with the specified name.kubectl create deployment NAME --image=image -- [COMMAND] [args...] Examples # Create a deployment named my-dep that runs the busybox image kubectl create deployment my-dep --image=busybox # Create a deployment with a command kubectl create deployment my-dep --image=busybox -- date # Create a deployment named my-dep that runs the nginx image with 3 replicas kubectl create deployment my-dep --image=nginx --replicas=3 # Create a deployment named my-dep that runs the busybox image and expose port 5701 kubectl create deployment my-dep --image=busybox --port=5701 # Create a deployment named my-dep that runs multiple containers kubectl create deployment my-dep --image=busybox:latest --image=ubuntu:latest --image=nginx Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for deployment--image stringsImage names to run. A deployment can have multiple images set for multi-container pod.-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--port int32 Default: -1The containerPort that this deployment exposes.-r, --replicas int32 Default: 1Number of replicas to create. Default is 1.--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl create - Create a resource from a file or from stdinThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

kubectl create deployment