Use Port Forwarding to Access Applications in a ClusterThis page shows how to use kubectl port-forward to connect to a MongoDB server running in a Kubernetes cluster. This type of connection can be useful for database debugging.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.10.To check the version, enter kubectl version.Install MongoDB Shell.Creating MongoDB deployment and serviceCreate a Deployment that runs MongoDB:kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-deployment.yaml The output of a successful command verifies that the deployment was created:deployment.apps/mongo created View the pod status to check that it is ready:kubectl get pods The output displays the pod created:NAME READY STATUS RESTARTS AGE mongo-75f59d57f4-4nd6q 1/1 Running 0 2m4s View the Deployment's status:kubectl get deployment The output displays that the Deployment was created:NAME READY UP-TO-DATE AVAILABLE AGE mongo 1/1 1 1 2m21s The Deployment automatically manages a ReplicaSet. View the ReplicaSet status using:kubectl get replicaset The output displays that the ReplicaSet was created:NAME DESIRED CURRENT READY AGE mongo-75f59d57f4 1 1 1 3m12s Create a Service to expose MongoDB on the network:kubectl apply -f https://k8s.io/examples/application/mongodb/mongo-service.yaml The output of a successful command verifies that the Service was created:service/mongo created Check the Service created:kubectl get service mongo The output displays the service created:NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE mongo ClusterIP 10.96.41.183 <none> 27017/TCP 11s Verify that the MongoDB server is running in the Pod, and listening on port 27017:# Change mongo-75f59d57f4-4nd6q to the name of the Pod kubectl get pod mongo-75f59d57f4-4nd6q --template='{{(index (index .spec.containers 0).ports 0).containerPort}}{{"\n"}}' The output displays the port for MongoDB in that Pod:27017 27017 is the official TCP port for MongoDB.Forward a local port to a port on the Podkubectl port-forward allows using resource name, such as a pod name, to select a matching pod to port forward to.# Change mongo-75f59d57f4-4nd6q to the name of the Pod kubectl port-forward mongo-75f59d57f4-4nd6q 28015:27017 which is the same askubectl port-forward pods/mongo-75f59d57f4-4nd6q 28015:27017 orkubectl port-forward deployment/mongo 28015:27017 orkubectl port-forward replicaset/mongo-75f59d57f4 28015:27017 orkubectl port-forward service/mongo 28015:27017 Any of the above commands works. The output is similar to this:Forwarding from 127.0.0.1:28015 -> 27017 Forwarding from [::1]:28015 -> 27017 Note:kubectl port-forward does not return. To continue with the exercises, you will need to open another terminal.Start the MongoDB command line interface:mongosh --port 28015 At the MongoDB command line prompt, enter the ping command:db.runCommand( { ping: 1 } ) A successful ping request returns:{ ok: 1 } Optionally let kubectl choose the local portIf you don't need a specific local port, you can let kubectl choose and allocate the local port and thus relieve you from having to manage local port conflicts, with the slightly simpler syntax:kubectl port-forward deployment/mongo :27017 The kubectl tool finds a local port number that is not in use (avoiding low ports numbers, because these might be used by other applications). The output is similar to:Forwarding from 127.0.0.1:63753 -> 27017 Forwarding from [::1]:63753 -> 27017 DiscussionConnections made to local port 28015 are forwarded to port 27017 of the Pod that is running the MongoDB server. With this connection in place, you can use your local workstation to debug the database that is running in the Pod.Note:kubectl port-forward is implemented for TCP ports only. The support for UDP protocol is tracked in issue 47862.What's nextLearn more about kubectl port-forward.


EndpointsEndpoints is a collection of endpoints that implement the actual service.apiVersion: v1import "k8s.io/api/core/v1"EndpointsEndpoints is a collection of endpoints that implement the actual service. Example:Name: "mysvc", Subsets: [ { Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}], Ports: [{"name": "a", "port": 8675}, {"name": "b", "port": 309}] }, { Addresses: [{"ip": "10.10.3.3"}], Ports: [{"name": "a", "port": 93}, {"name": "b", "port": 76}] }, ]Endpoints is a legacy API and does not contain information about all Service features. Use discoveryv1.EndpointSlice for complete information about Service endpoints.Deprecated: This API is deprecated in v1.33+. Use discoveryv1.EndpointSlice.apiVersion: v1kind: Endpointsmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadatasubsets ([]EndpointSubset)Atomic: will be replaced during a mergeThe set of all endpoints is the union of all subsets. Addresses are placed into subsets according to the IPs they share. A single address with multiple ports, some of which are ready and some of which are not (because they come from different containers) will result in the address being displayed in different subsets for the different ports. No address will appear in both Addresses and NotReadyAddresses in the same subset. Sets of addresses and ports that comprise a service.*EndpointSubset is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports. For example, given:{ Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}], Ports: [{"name": "a", "port": 8675}, {"name": "b", "port": 309}] }The resulting set of endpoints can be viewed as:a: [ 10.10.1.1:8675, 10.10.2.2:8675 ], b: [ 10.10.1.1:309, 10.10.2.2:309 ]Deprecated: This API is deprecated in v1.33+.*subsets.addresses ([]EndpointAddress)Atomic: will be replaced during a mergeIP addresses which offer the related ports that are marked as ready. These endpoints should be considered safe for load balancers and clients to utilize.EndpointAddress is a tuple that describes single IP address. Deprecated: This API is deprecated in v1.33+.subsets.addresses.ip (string), requiredThe IP of this endpoint. May not be loopback (127.0.0.0/8 or ::1), link-local (169.254.0.0/16 or fe80::/10), or link-local multicast (224.0.0.0/24 or ff02::/16).subsets.addresses.hostname (string)The Hostname of this endpointsubsets.addresses.nodeName (string)Optional: Node hosting this endpoint. This can be used to determine endpoints local to a node.subsets.addresses.targetRef (ObjectReference)Reference to object providing the endpoint.subsets.notReadyAddresses ([]EndpointAddress)Atomic: will be replaced during a mergeIP addresses which offer the related ports but are not currently marked as ready because they have not yet finished starting, have recently failed a readiness check, or have recently failed a liveness check.EndpointAddress is a tuple that describes single IP address. Deprecated: This API is deprecated in v1.33+.subsets.notReadyAddresses.ip (string), requiredThe IP of this endpoint. May not be loopback (127.0.0.0/8 or ::1), link-local (169.254.0.0/16 or fe80::/10), or link-local multicast (224.0.0.0/24 or ff02::/16).subsets.notReadyAddresses.hostname (string)The Hostname of this endpointsubsets.notReadyAddresses.nodeName (string)Optional: Node hosting this endpoint. This can be used to determine endpoints local to a node.subsets.notReadyAddresses.targetRef (ObjectReference)Reference to object providing the endpoint.subsets.ports ([]EndpointPort)Atomic: will be replaced during a mergePort numbers available on the related IP addresses.EndpointPort is a tuple that describes a single port. Deprecated: This API is deprecated in v1.33+.subsets.ports.port (int32), requiredThe port number of the endpoint.subsets.ports.protocol (string)The IP protocol for this port. Must be UDP, TCP, or SCTP. Default is TCP.subsets.ports.name (string)The name of this port. This must match the 'name' field in the corresponding ServicePort. Must be a DNS_LABEL. Optional only if one port is defined.subsets.ports.appProtocol (string)The application protocol for this port. This is used as a hint for implementations to offer richer behavior for protocols that they understand. This field follows standard Kubernetes label syntax. Valid values are either:Un-prefixed protocol names - reserved for IANA standard service names (as per RFC-6335 and https://www.iana.org/assignments/service-names).Kubernetes-defined prefixed names:'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior-'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455Other protocols should use implementation-defined prefixed names such as mycompany.com/my-custom-protocol.EndpointsListEndpointsList is a list of endpoints. Deprecated: This API is deprecated in v1.33+.apiVersion: v1kind: EndpointsListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]Endpoints), requiredList of endpoints.Operationsget read the specified EndpointsHTTP RequestGET /api/v1/namespaces/{namespace}/endpoints/{name}Parametersname (in path): string, requiredname of the Endpointsnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Endpoints): OK401: Unauthorizedlist list or watch objects of kind EndpointsHTTP RequestGET /api/v1/namespaces/{namespace}/endpointsParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (EndpointsList): OK401: Unauthorizedlist list or watch objects of kind EndpointsHTTP RequestGET /api/v1/endpointsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (EndpointsList): OK401: Unauthorizedcreate create EndpointsHTTP RequestPOST /api/v1/namespaces/{namespace}/endpointsParametersnamespace (in path): string, requirednamespacebody: Endpoints, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Endpoints): OK201 (Endpoints): Created202 (Endpoints): Accepted401: Unauthorizedupdate replace the specified EndpointsHTTP RequestPUT /api/v1/namespaces/{namespace}/endpoints/{name}Parametersname (in path): string, requiredname of the Endpointsnamespace (in path): string, requirednamespacebody: Endpoints, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (Endpoints): OK201 (Endpoints): Created401: Unauthorizedpatch partially update the specified EndpointsHTTP RequestPATCH /api/v1/namespaces/{namespace}/endpoints/{name}Parametersname (in path): string, requiredname of the Endpointsnamespace (in path): string, requirednamespacebody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (Endpoints): OK201 (Endpoints): Created401: Unauthorizeddelete delete EndpointsHTTP RequestDELETE /api/v1/namespaces/{namespace}/endpoints/{name}Parametersname (in path): string, requiredname of the Endpointsnamespace (in path): string, requirednamespacebody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of EndpointsHTTP RequestDELETE /api/v1/namespaces/{namespace}/endpointsParametersnamespace (in path): string, requirednamespacebody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

Endpoints


kubectl create service clusteripSynopsisCreate a ClusterIP service with the specified name.kubectl create service clusterip NAME [--tcp=<port>:<targetPort>] [--dry-run=server|client|none] Examples # Create a new ClusterIP service named my-cs kubectl create service clusterip my-cs --tcp=5678:8080 # Create a new ClusterIP service named my-cs (in headless mode) kubectl create service clusterip my-cs --clusterip="None" Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--clusterip stringAssign your own ClusterIP or set to 'None' for a 'headless' service (no loadbalancing).--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for clusterip-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl create service - Create a service using a specified subcommandThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

kubectl create service clusterip


Using kubectl to Create a DeploymentObjectivesLearn about application Deployments.Deploy your first app on Kubernetes with kubectl.Kubernetes DeploymentsA Deployment is responsible for creating and updating instances of your application.Note:This tutorial uses a container that requires the AMD64 architecture. If you are using minikube on a computer with a different CPU architecture, you could try using minikube with a driver that can emulate AMD64. For example, the Docker Desktop driver can do this.Once you have a running Kubernetes cluster, you can deploy your containerized applications on top of it. To do so, you create a Kubernetes Deployment. The Deployment instructs Kubernetes how to create and update instances of your application. Once you've created a Deployment, the Kubernetes control plane schedules the application instances included in that Deployment to run on individual Nodes in the cluster.Once the application instances are created, a Kubernetes Deployment controller continuously monitors those instances. If the Node hosting an instance goes down or is deleted, the Deployment controller replaces the instance with an instance on another Node in the cluster. This provides a self-healing mechanism to address machine failure or maintenance.In a pre-orchestration world, installation scripts would often be used to start applications, but they did not allow recovery from machine failure. By both creating your application instances and keeping them running across Nodes, Kubernetes Deployments provide a fundamentally different approach to application management.Deploying your first app on KubernetesApplications need to be packaged into one of the supported container formats in order to be deployed on Kubernetes.You can create and manage a Deployment by using the Kubernetes command line interface, kubectl. kubectl uses the Kubernetes API to interact with the cluster. In this module, you'll learn the most common kubectl commands needed to create Deployments that run your applications on a Kubernetes cluster.When you create a Deployment, you'll need to specify the container image for your application and the number of replicas that you want to run. You can change that information later by updating your Deployment; Module 5 and Module 6 of the bootcamp discuss how you can scale and update your Deployments.For your first Deployment, you'll use a hello-node application packaged in a Docker container that uses NGINX to echo back all the requests. (If you didn't already try creating a hello-node application and deploying it using a container, you can do that first by following the instructions from the Hello Minikube tutorial.)You will need to have installed kubectl as well. If you need to install it, visit install tools.Now that you know what Deployments are, let's deploy our first app!kubectl basicsThe common format of a kubectl command is: kubectl action resource.This performs the specified action (like create, describe or delete) on the specified resource (like node or deployment. You can use --help after the subcommand to get additional info about possible parameters (for example: kubectl get nodes --help).Check that kubectl is configured to talk to your cluster, by running the kubectl version command.Check that kubectl is installed and that you can see both the client and the server versions.To view the nodes in the cluster, run the kubectl get nodes command.You see the available nodes. Later, Kubernetes will choose where to deploy our application based on Node available resources.Deploy an appLet’s deploy our first app on Kubernetes with the kubectl create deployment command. We need to provide the deployment name and app image location (include the full repository url for images hosted outside Docker Hub).kubectl create deployment kubernetes-bootcamp --image=gcr.io/google-samples/kubernetes-bootcamp:v1 Great! You just deployed your first application by creating a deployment. This performed a few things for you:searched for a suitable node where an instance of the application could be run (we have only 1 available node)scheduled the application to run on that Nodeconfigured the cluster to reschedule the instance on a new Node when neededTo list your deployments use the kubectl get deployments command:kubectl get deployments We see that there is 1 deployment running a single instance of your app. The instance is running inside a container on your node.View the appPods that are running inside Kubernetes are running on a private, isolated network. By default they are visible from other pods and services within the same Kubernetes cluster, but not outside that network. When we use kubectl, we're interacting through an API endpoint to communicate with our application.We will cover other options on how to expose your application outside the Kubernetes cluster later, in Module 4. Also as a basic tutorial, we're not explaining what Pods are in any detail here, it will be covered in later topics.The kubectl proxy command can create a proxy that will forward communications into the cluster-wide, private network. The proxy can be terminated by pressing control-C and won't show any output while it's running.You need to open a second terminal window to run the proxy.kubectl proxy We now have a connection between our host (the terminal) and the Kubernetes cluster. The proxy enables direct access to the API from these terminals.You can see all those APIs hosted through the proxy endpoint. For example, we can query the version directly through the API using the curl command:curl http://localhost:8001/version Note:If port 8001 is not accessible, ensure that the kubectl proxy that you started above is running in the second terminal.The API server will automatically create an endpoint for each pod, based on the pod name, that is also accessible through the proxy.First we need to get the Pod name, and we'll store it in the environment variable POD_NAME.export POD_NAME=$(kubectl get pods -o go-template --template '{{range .items}}{{.metadata.name}}{{"\n"}}{{end}}') echo Name of the Pod: $POD_NAME You can access the Pod through the proxied API, by running:curl http://localhost:8001/api/v1/namespaces/default/pods/$POD_NAME:8080/proxy/ In order for the new Deployment to be accessible without using the proxy, a Service is required which will be explained in Module 4.What's nextTutorial Viewing Pods and Nodes.Learn more about Deployments.

Using kubectl to Create a Deployment


kubectl uncordonSynopsisMark node as schedulable.kubectl uncordon NODE Examples # Mark node "foo" as schedulable kubectl uncordon foo Options--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.-h, --helphelp for uncordon-l, --selector stringSelector (label query) to filter on, supports '=', '==', '!=', 'in', 'notin'.(e.g. -l key1=value1,key2=value2,key3 in (value3)). Matching objects must satisfy all of the specified label constraints.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificate stringPath to a client certificate file for TLS--client-key stringPath to a client key file for TLS--cluster stringThe name of the kubeconfig cluster to use--context stringThe name of the kubeconfig context to use--disable-compressionIf true, opt-out of response compression for all requests to the server--insecure-skip-tls-verifyIf true, the server's certificate will not be checked for validity. This will make your HTTPS connections insecure--kubeconfig stringPath to the kubeconfig file to use for CLI requests.--kuberc stringPath to the kuberc file to use for preferences. This can be disabled by exporting KUBECTL_KUBERC=false feature gate or turning off the feature KUBERC=off.--match-server-versionRequire server version to match client version-n, --namespace stringIf present, the namespace scope for this CLI request--password stringPassword for basic authentication to the API server--profile string Default: "none"Name of profile to capture. One of (none|cpu|heap|goroutine|threadcreate|block|mutex)--profile-output string Default: "profile.pprof"Name of the file to write the profile to--request-timeout string Default: "0"The length of time to wait before giving up on a single server request. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests.-s, --server stringThe address and port of the Kubernetes API server--storage-driver-buffer-duration duration Default: 1m0sWrites in the storage driver will be buffered for this duration, and committed to the non memory backends as a single transaction--storage-driver-db string Default: "cadvisor"database name--storage-driver-host string Default: "localhost:8086"database host:port--storage-driver-password string Default: "root"database password--storage-driver-secureuse secure connection with database--storage-driver-table string Default: "stats"table name--storage-driver-user string Default: "root"database username--tls-server-name stringServer name to use for server certificate validation. If it is not provided, the hostname used to contact the server is used--token stringBearer token for authentication to the API server--user stringThe name of the kubeconfig user to use--username stringUsername for basic authentication to the API server--version version[=true]--version, --version=raw prints version information and quits; --version=vX.Y.Z... sets the reported version--warnings-as-errorsTreat warnings received from the server as errors and exit with a non-zero exit codeSee Alsokubectl - kubectl controls the Kubernetes cluster managerThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

kubectl uncordon


Kubernetes Metrics ReferenceDetails of the metric data that Kubernetes components export.Metrics (v1.34)This page details the metrics that different Kubernetes components export. You can query the metrics endpoint for these components using an HTTP scrape, and fetch the current metrics data in Prometheus format.List of Stable Kubernetes MetricsStable metrics observe strict API contracts and no labels can be added or removed from stable metrics during their lifetime.apiserver_admission_controller_admission_duration_secondsAdmission controller latency histogram in seconds, identified by name and broken out for each operation and API resource and type (validate or admit).Stability Level:STABLEType: HistogramLabels:nameoperationrejectedtypeapiserver_admission_step_admission_duration_secondsAdmission sub-step latency histogram in seconds, broken out for each operation and API resource and step type (validate or admit).Stability Level:STABLEType: HistogramLabels:operationrejectedtypeapiserver_admission_webhook_admission_duration_secondsAdmission webhook latency histogram in seconds, identified by name and broken out for each operation and API resource and type (validate or admit).Stability Level:STABLEType: HistogramLabels:nameoperationrejectedtypeapiserver_current_inflight_requestsMaximal number of currently used inflight request limit of this apiserver per request kind in last second.Stability Level:STABLEType: GaugeLabels:request_kindapiserver_longrunning_requestsGauge of all active long-running apiserver requests broken out by verb, group, version, resource, scope and component. Not all requests are tracked this way.Stability Level:STABLEType: GaugeLabels:componentgroupresourcescopesubresourceverbversionapiserver_request_duration_secondsResponse latency distribution in seconds for each verb, dry run value, group, version, resource, subresource, scope and component.Stability Level:STABLEType: HistogramLabels:componentdry_rungroupresourcescopesubresourceverbversionapiserver_request_totalCounter of apiserver requests broken out for each verb, dry run value, group, version, resource, scope, component, and HTTP response code.Stability Level:STABLEType: CounterLabels:codecomponentdry_rungroupresourcescopesubresourceverbversionapiserver_requested_deprecated_apisGauge of deprecated APIs that have been requested, broken out by API group, version, resource, subresource, and removed_release.Stability Level:STABLEType: GaugeLabels:groupremoved_releaseresourcesubresourceversionapiserver_response_sizesResponse size distribution in bytes for each group, version, verb, resource, subresource, scope and component.Stability Level:STABLEType: HistogramLabels:componentgroupresourcescopesubresourceverbversionapiserver_storage_objects[DEPRECATED, consider using apiserver_resource_objects instead] Number of stored objects at the time of last check split by kind. In case of a fetching error, the value will be -1.Stability Level:STABLEType: GaugeLabels:resourceDeprecated Versions:1.34.0apiserver_storage_size_bytesSize of the storage database file physically allocated in bytes.Stability Level:STABLEType: CustomLabels:storage_cluster_idcontainer_cpu_usage_seconds_totalCumulative cpu time consumed by the container in core-secondsStability Level:STABLEType: CustomLabels:containerpodnamespacecontainer_memory_working_set_bytesCurrent working set of the container in bytesStability Level:STABLEType: CustomLabels:containerpodnamespacecontainer_start_time_secondsStart time of the container since unix epoch in secondsStability Level:STABLEType: CustomLabels:containerpodnamespacecronjob_controller_job_creation_skew_duration_secondsTime between when a cronjob is scheduled to be run, and when the corresponding job is createdStability Level:STABLEType: Histogramjob_controller_job_pods_finished_totalThe number of finished Pods that are fully trackedStability Level:STABLEType: CounterLabels:completion_moderesultjob_controller_job_sync_duration_secondsThe time it took to sync a jobStability Level:STABLEType: HistogramLabels:actioncompletion_moderesultjob_controller_job_syncs_totalThe number of job syncsStability Level:STABLEType: CounterLabels:actioncompletion_moderesultjob_controller_jobs_finished_totalThe number of finished jobsStability Level:STABLEType: CounterLabels:completion_modereasonresultkube_pod_resource_limitResources limit for workloads on the cluster, broken down by pod. This shows the resource usage the scheduler and kubelet expect per pod for resources along with the unit for the resource if any.Stability Level:STABLEType: CustomLabels:namespacepodnodeschedulerpriorityresourceunitkube_pod_resource_requestResources requested by workloads on the cluster, broken down by pod. This shows the resource usage the scheduler and kubelet expect per pod for resources along with the unit for the resource if any.Stability Level:STABLEType: CustomLabels:namespacepodnodeschedulerpriorityresourceunitkubernetes_healthcheckThis metric records the result of a single healthcheck.Stability Level:STABLEType: GaugeLabels:nametypekubernetes_healthchecks_totalThis metric records the results of all healthcheck.Stability Level:STABLEType: CounterLabels:namestatustypenode_collector_evictions_totalNumber of Node evictions that happened since current instance of NodeController started.Stability Level:STABLEType: CounterLabels:zonenode_cpu_usage_seconds_totalCumulative cpu time consumed by the node in core-secondsStability Level:STABLEType: Customnode_memory_working_set_bytesCurrent working set of the node in bytesStability Level:STABLEType: Custompod_cpu_usage_seconds_totalCumulative cpu time consumed by the pod in core-secondsStability Level:STABLEType: CustomLabels:podnamespacepod_memory_working_set_bytesCurrent working set of the pod in bytesStability Level:STABLEType: CustomLabels:podnamespaceresource_scrape_error1 if there was an error while getting container metrics, 0 otherwiseStability Level:STABLEType: Customscheduler_framework_extension_point_duration_secondsLatency for running all plugins of a specific extension point.Stability Level:STABLEType: HistogramLabels:extension_pointprofilestatusscheduler_pending_podsNumber of pending pods, by the queue type. 'active' means number of pods in activeQ; 'backoff' means number of pods in backoffQ; 'unschedulable' means number of pods in unschedulablePods that the scheduler attempted to schedule and failed; 'gated' is the number of unschedulable pods that the scheduler never attempted to schedule because they are gated.Stability Level:STABLEType: GaugeLabels:queuescheduler_pod_scheduling_attemptsNumber of attempts to successfully schedule a pod.Stability Level:STABLEType: Histogramscheduler_preemption_attempts_totalTotal preemption attempts in the cluster till nowStability Level:STABLEType: Counterscheduler_preemption_victimsNumber of selected preemption victimsStability Level:STABLEType: Histogramscheduler_queue_incoming_pods_totalNumber of pods added to scheduling queues by event and queue type.Stability Level:STABLEType: CounterLabels:eventqueuescheduler_schedule_attempts_totalNumber of attempts to schedule pods, by the result. 'unschedulable' means a pod could not be scheduled, while 'error' means an internal scheduler problem.Stability Level:STABLEType: CounterLabels:profileresultscheduler_scheduling_attempt_duration_secondsScheduling attempt latency in seconds (scheduling algorithm + binding)Stability Level:STABLEType: HistogramLabels:profileresultList of Beta Kubernetes MetricsBeta metrics observe a looser API contract than its stable counterparts. No labels can be removed from beta metrics during their lifetime, however, labels can be added while the metric is in the beta stage. This offers the assurance that beta metrics will honor existing dashboards and alerts, while allowing for amendments in the future.apiserver_authentication_config_controller_automatic_reload_last_timestamp_secondsTimestamp of the last automatic reload of authentication configuration split by status and apiserver identity.Stability Level:BETAType: GaugeLabels:apiserver_id_hashstatusapiserver_authentication_config_controller_automatic_reloads_totalTotal number of automatic reloads of authentication configuration split by status and apiserver identity.Stability Level:BETAType: CounterLabels:apiserver_id_hashstatusapiserver_authorization_config_controller_automatic_reload_last_timestamp_secondsTimestamp of the last automatic reload of authorization configuration split by status and apiserver identity.Stability Level:BETAType: GaugeLabels:apiserver_id_hashstatusapiserver_authorization_config_controller_automatic_reloads_totalTotal number of automatic reloads of authorization configuration split by status and apiserver identity.Stability Level:BETAType: CounterLabels:apiserver_id_hashstatusapiserver_cel_compilation_duration_secondsCEL compilation time in seconds.Stability Level:BETAType: Histogramapiserver_cel_evaluation_duration_secondsCEL evaluation time in seconds.Stability Level:BETAType: Histogramapiserver_flowcontrol_current_executing_requestsNumber of requests in initial (for a WATCH) or any (for a non-WATCH) execution stage in the API Priority and Fairness subsystemStability Level:BETAType: GaugeLabels:flow_schemapriority_levelapiserver_flowcontrol_current_executing_seatsConcurrency (number of seats) occupied by the currently executing (initial stage for a WATCH, any stage otherwise) requests in the API Priority and Fairness subsystemStability Level:BETAType: GaugeLabels:flow_schemapriority_levelapiserver_flowcontrol_current_inqueue_requestsNumber of requests currently pending in queues of the API Priority and Fairness subsystemStability Level:BETAType: GaugeLabels:flow_schemapriority_levelapiserver_flowcontrol_dispatched_requests_totalNumber of requests executed by API Priority and Fairness subsystemStability Level:BETAType: CounterLabels:flow_schemapriority_levelapiserver_flowcontrol_nominal_limit_seatsNominal number of execution seats configured for each priority levelStability Level:BETAType: GaugeLabels:priority_levelapiserver_flowcontrol_rejected_requests_totalNumber of requests rejected by API Priority and Fairness subsystemStability Level:BETAType: CounterLabels:flow_schemapriority_levelreasonapiserver_flowcontrol_request_wait_duration_secondsLength of time a request spent waiting in its queueStability Level:BETAType: HistogramLabels:executeflow_schemapriority_levelapiserver_validating_admission_policy_check_duration_secondsValidation admission latency for individual validation expressions in seconds, labeled by policy and further including binding and enforcement action taken.Stability Level:BETAType: HistogramLabels:enforcement_actionerror_typepolicypolicy_bindingapiserver_validating_admission_policy_check_totalValidation admission policy check total, labeled by policy and further identified by binding and enforcement action taken.Stability Level:BETAType: CounterLabels:enforcement_actionerror_typepolicypolicy_bindingapiserver_validation_declarative_validation_mismatch_totalNumber of times declarative validation results differed from handwritten validation results for core types.Stability Level:BETAType: Counterapiserver_validation_declarative_validation_panic_totalNumber of times declarative validation has panicked during validation.Stability Level:BETAType: Counterdisabled_metrics_totalThe count of disabled metrics.Stability Level:BETAType: Counterhidden_metrics_totalThe count of hidden metrics.Stability Level:BETAType: Counterkubernetes_feature_enabledThis metric records the data about the stage and enablement of a k8s feature.Stability Level:BETAType: GaugeLabels:namestageprober_probe_totalCumulative number of a liveness, readiness or startup probe for a container by result.Stability Level:BETAType: CounterLabels:containernamespacepodpod_uidprobe_typeresultregistered_metrics_totalThe count of registered metrics broken by stability level and deprecation version.Stability Level:BETAType: CounterLabels:deprecated_versionstability_levelscheduler_pod_scheduling_sli_duration_secondsE2e latency for a pod being scheduled, from the time the pod enters the scheduling queue and might involve multiple scheduling attempts.Stability Level:BETAType: HistogramLabels:attemptsList of Alpha Kubernetes MetricsAlpha metrics do not have any API guarantees. These metrics must be used at your own risk, subsequent versions of Kubernetes may remove these metrics altogether, or mutate the API in such a way that breaks existing dashboards and alerts.aggregator_discovery_aggregation_count_totalCounter of number of times discovery was aggregatedStability Level:ALPHAType: Counteraggregator_openapi_v2_regeneration_countCounter of OpenAPI v2 spec regeneration count broken down by causing APIService name and reason.Stability Level:ALPHAType: CounterLabels:apiservicereasonaggregator_openapi_v2_regeneration_durationGauge of OpenAPI v2 spec regeneration duration in seconds.Stability Level:ALPHAType: GaugeLabels:reasonaggregator_unavailable_apiserviceGauge of APIServices which are marked as unavailable broken down by APIService name.Stability Level:ALPHAType: CustomLabels:nameaggregator_unavailable_apiservice_totalCounter of APIServices which are marked as unavailable broken down by APIService name and reason.Stability Level:ALPHAType: CounterLabels:namereasonapiextensions_apiserver_validation_ratcheting_secondsTime for comparison of old to new for the purposes of CRDValidationRatcheting during an UPDATE in seconds.Stability Level:ALPHAType: Histogramapiextensions_openapi_v2_regeneration_countCounter of OpenAPI v2 spec regeneration count broken down by causing CRD name and reason.Stability Level:ALPHAType: CounterLabels:crdreasonapiextensions_openapi_v3_regeneration_countCounter of OpenAPI v3 spec regeneration count broken down by group, version, causing CRD and reason.Stability Level:ALPHAType: CounterLabels:crdgroupreasonversionapiserver_admission_match_condition_evaluation_errors_totalAdmission match condition evaluation errors count, identified by name of resource containing the match condition and broken out for each kind containing matchConditions (webhook or policy), operation and admission type (validate or admit).Stability Level:ALPHAType: CounterLabels:kindnameoperationtypeapiserver_admission_match_condition_evaluation_secondsAdmission match condition evaluation time in seconds, identified by name and broken out for each kind containing matchConditions (webhook or policy), operation and type (validate or admit).Stability Level:ALPHAType: HistogramLabels:kindnameoperationtypeapiserver_admission_match_condition_exclusions_totalAdmission match condition evaluation exclusions count, identified by name of resource containing the match condition and broken out for each kind containing matchConditions (webhook or policy), operation and admission type (validate or admit).Stability Level:ALPHAType: CounterLabels:kindnameoperationtypeapiserver_admission_step_admission_duration_seconds_summaryAdmission sub-step latency summary in seconds, broken out for each operation and API resource and step type (validate or admit).Stability Level:ALPHAType: SummaryLabels:operationrejectedtypeapiserver_admission_webhook_fail_open_countAdmission webhook fail open count, identified by name and broken out for each admission type (validating or admit).Stability Level:ALPHAType: CounterLabels:nametypeapiserver_admission_webhook_rejection_countAdmission webhook rejection count, identified by name and broken out for each admission type (validating or admit) and operation. Additional labels specify an error type (calling_webhook_error or apiserver_internal_error if an error occurred; no_error otherwise) and optionally a non-zero rejection code if the webhook rejects the request with an HTTP status code (honored by the apiserver when the code is greater or equal to 400). Codes greater than 600 are truncated to 600, to keep the metrics cardinality bounded.Stability Level:ALPHAType: CounterLabels:error_typenameoperationrejection_codetypeapiserver_admission_webhook_request_totalAdmission webhook request total, identified by name and broken out for each admission type (validating or admit) and operation. Additional labels specify whether the request was rejected or not and an HTTP status code. Codes greater than 600 are truncated to 600, to keep the metrics cardinality bounded.Stability Level:ALPHAType: CounterLabels:codenameoperationrejectedtypeapiserver_audit_error_totalCounter of audit events that failed to be audited properly. Plugin identifies the plugin affected by the error.Stability Level:ALPHAType: CounterLabels:pluginapiserver_audit_event_totalCounter of audit events generated and sent to the audit backend.Stability Level:ALPHAType: Counterapiserver_audit_level_totalCounter of policy levels for audit events (1 per request).Stability Level:ALPHAType: CounterLabels:levelapiserver_audit_requests_rejected_totalCounter of apiserver requests rejected due to an error in audit logging backend.Stability Level:ALPHAType: Counterapiserver_authentication_config_controller_last_config_infoInformation about the last applied authentication configuration with hash as label, split by apiserver identity.Stability Level:ALPHAType: CustomLabels:apiserver_id_hashhashapiserver_authentication_jwt_authenticator_latency_secondsLatency of jwt authentication operations in seconds. This is the time spent authenticating a token for cache miss only (i.e. when the token is not found in the cache).Stability Level:ALPHAType: HistogramLabels:jwt_issuer_hashresultapiserver_authorization_config_controller_last_config_infoInformation about the last applied authorization configuration with hash as label, split by apiserver identity.Stability Level:ALPHAType: CustomLabels:apiserver_id_hashhashapiserver_authorization_decisions_totalTotal number of terminal decisions made by an authorizer split by authorizer type, name, and decision.Stability Level:ALPHAType: CounterLabels:decisionnametypeapiserver_authorization_match_condition_evaluation_errors_totalTotal number of errors when an authorization webhook encounters a match condition error split by authorizer type and name.Stability Level:ALPHAType: CounterLabels:nametypeapiserver_authorization_match_condition_evaluation_secondsAuthorization match condition evaluation time in seconds, split by authorizer type and name.Stability Level:ALPHAType: HistogramLabels:nametypeapiserver_authorization_match_condition_exclusions_totalTotal number of exclusions when an authorization webhook is skipped because match conditions exclude it.Stability Level:ALPHAType: CounterLabels:nametypeapiserver_authorization_webhook_duration_secondsRequest latency in seconds.Stability Level:ALPHAType: HistogramLabels:nameresultapiserver_authorization_webhook_evaluations_fail_open_totalNoOpinion results due to webhook timeout or error.Stability Level:ALPHAType: CounterLabels:nameresultapiserver_authorization_webhook_evaluations_totalRound-trips to authorization webhooks.Stability Level:ALPHAType: CounterLabels:nameresultapiserver_cache_list_fetched_objects_totalNumber of objects read from watch cache in the course of serving a LIST requestStability Level:ALPHAType: CounterLabels:groupindexresourceapiserver_cache_list_returned_objects_totalNumber of objects returned for a LIST request from watch cacheStability Level:ALPHAType: CounterLabels:groupresourceapiserver_cache_list_totalNumber of LIST requests served from watch cacheStability Level:ALPHAType: CounterLabels:groupindexresourceapiserver_certificates_registry_csr_honored_duration_totalTotal number of issued CSRs with a requested duration that was honored, sliced by signer (only kubernetes.io signer names are specifically identified)Stability Level:ALPHAType: CounterLabels:signerNameapiserver_certificates_registry_csr_requested_duration_totalTotal number of issued CSRs with a requested duration, sliced by signer (only kubernetes.io signer names are specifically identified)Stability Level:ALPHAType: CounterLabels:signerNameapiserver_client_certificate_expiration_secondsDistribution of the remaining lifetime on the certificate used to authenticate a request.Stability Level:ALPHAType: Histogramapiserver_clusterip_repair_ip_errors_totalNumber of errors detected on clusterips by the repair loop broken down by type of error: leak, repair, full, outOfRange, duplicate, unknown, invalidStability Level:ALPHAType: CounterLabels:typeapiserver_clusterip_repair_reconcile_errors_totalNumber of reconciliation failures on the clusterip repair reconcile loopStability Level:ALPHAType: Counterapiserver_conversion_webhook_duration_secondsConversion webhook request latencyStability Level:ALPHAType: HistogramLabels:failure_typeresultapiserver_conversion_webhook_request_totalCounter for conversion webhook requests with success/failure and failure error typeStability Level:ALPHAType: CounterLabels:failure_typeresultapiserver_crd_conversion_webhook_duration_secondsCRD webhook conversion duration in secondsStability Level:ALPHAType: HistogramLabels:crd_namefrom_versionsucceededto_versionapiserver_current_inqueue_requestsMaximal number of queued requests in this apiserver per request kind in last second.Stability Level:ALPHAType: GaugeLabels:request_kindapiserver_delegated_authn_request_duration_secondsRequest latency in seconds. Broken down by status code.Stability Level:ALPHAType: HistogramLabels:codeapiserver_delegated_authn_request_totalNumber of HTTP requests partitioned by status code.Stability Level:ALPHAType: CounterLabels:codeapiserver_delegated_authz_request_duration_secondsRequest latency in seconds. Broken down by status code.Stability Level:ALPHAType: HistogramLabels:codeapiserver_delegated_authz_request_totalNumber of HTTP requests partitioned by status code.Stability Level:ALPHAType: CounterLabels:codeapiserver_egress_dialer_dial_duration_secondsDial latency histogram in seconds, labeled by the protocol (http-connect or grpc), transport (tcp or uds)Stability Level:ALPHAType: HistogramLabels:protocoltransportapiserver_egress_dialer_dial_failure_countDial failure count, labeled by the protocol (http-connect or grpc), transport (tcp or uds), and stage (connect or proxy). The stage indicates at which stage the dial failedStability Level:ALPHAType: CounterLabels:protocolstagetransportapiserver_egress_dialer_dial_start_totalDial starts, labeled by the protocol (http-connect or grpc) and transport (tcp or uds).Stability Level:ALPHAType: CounterLabels:protocoltransportapiserver_encryption_config_controller_automatic_reload_last_timestamp_secondsTimestamp of the last successful or failed automatic reload of encryption configuration split by apiserver identity.Stability Level:ALPHAType: GaugeLabels:apiserver_id_hashstatusapiserver_encryption_config_controller_automatic_reloads_totalTotal number of reload successes and failures of encryption configuration split by apiserver identity.Stability Level:ALPHAType: CounterLabels:apiserver_id_hashstatusapiserver_encryption_config_controller_last_config_infoInformation about the last applied encryption configuration with hash as label, split by apiserver identity.Stability Level:ALPHAType: CustomLabels:apiserver_id_hashhashapiserver_envelope_encryption_dek_cache_fill_percentPercent of the cache slots currently occupied by cached DEKs.Stability Level:ALPHAType: Gaugeapiserver_envelope_encryption_dek_cache_inter_arrival_time_secondsTime (in seconds) of inter arrival of transformation requests.Stability Level:ALPHAType: HistogramLabels:transformation_typeapiserver_envelope_encryption_dek_source_cache_sizeNumber of records in data encryption key (DEK) source cache. On a restart, this value is an approximation of the number of decrypt RPC calls the server will make to the KMS plugin.Stability Level:ALPHAType: GaugeLabels:provider_nameapiserver_envelope_encryption_invalid_key_id_from_status_totalNumber of times an invalid keyID is returned by the Status RPC call split by error.Stability Level:ALPHAType: CounterLabels:errorprovider_nameapiserver_envelope_encryption_key_id_hash_last_timestamp_secondsThe last time in seconds when a keyID was used.Stability Level:ALPHAType: GaugeLabels:apiserver_id_hashkey_id_hashprovider_nametransformation_typeapiserver_envelope_encryption_key_id_hash_status_last_timestamp_secondsThe last time in seconds when a keyID was returned by the Status RPC call.Stability Level:ALPHAType: GaugeLabels:apiserver_id_hashkey_id_hashprovider_nameapiserver_envelope_encryption_key_id_hash_totalNumber of times a keyID is used split by transformation type, provider, and apiserver identity.Stability Level:ALPHAType: CounterLabels:apiserver_id_hashkey_id_hashprovider_nametransformation_typeapiserver_envelope_encryption_kms_operations_latency_secondsKMS operation duration with gRPC error code status total.Stability Level:ALPHAType: HistogramLabels:grpc_status_codemethod_nameprovider_nameapiserver_externaljwt_fetch_keys_data_timestampUnix Timestamp in seconds of the last successful FetchKeys data_timestamp value returned by the external signerStability Level:ALPHAType: Gaugeapiserver_externaljwt_fetch_keys_request_totalTotal attempts at syncing supported JWKsStability Level:ALPHAType: CounterLabels:codeapiserver_externaljwt_fetch_keys_success_timestampUnix Timestamp in seconds of the last successful FetchKeys requestStability Level:ALPHAType: Gaugeapiserver_externaljwt_request_duration_secondsRequest duration and time for calls to external-jwt-signerStability Level:ALPHAType: HistogramLabels:codemethodapiserver_externaljwt_sign_request_totalTotal attempts at signing JWTStability Level:ALPHAType: CounterLabels:codeapiserver_flowcontrol_current_inqueue_seatsNumber of seats currently pending in queues of the API Priority and Fairness subsystemStability Level:ALPHAType: GaugeLabels:flow_schemapriority_levelapiserver_flowcontrol_current_limit_seatscurrent derived number of execution seats available to each priority levelStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_current_rR(time of last change)Stability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_demand_seatsObservations, at the end of every nanosecond, of (the number of seats each priority level could use) / (nominal number of seats for that level)Stability Level:ALPHAType: TimingRatioHistogramLabels:priority_levelapiserver_flowcontrol_demand_seats_averageTime-weighted average, over last adjustment period, of demand_seatsStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_demand_seats_high_watermarkHigh watermark, over last adjustment period, of demand_seatsStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_demand_seats_smoothedSmoothed seat demandsStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_demand_seats_stdevTime-weighted standard deviation, over last adjustment period, of demand_seatsStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_dispatch_rR(time of last dispatch)Stability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_epoch_advance_totalNumber of times the queueset's progress meter jumped backwardStability Level:ALPHAType: CounterLabels:priority_levelsuccessapiserver_flowcontrol_latest_sS(most recently dispatched request)Stability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_lower_limit_seatsConfigured lower bound on number of execution seats available to each priority levelStability Level:ALPHAType: GaugeLabels:priority_levelapiserver_flowcontrol_

Kubernetes Metrics Reference


Update API Objects in Place Using kubectl patchUse kubectl patch to update Kubernetes API objects in place. Do a strategic merge patch or a JSON merge patch.This task shows how to use kubectl patch to update an API object in place. The exercises in this task demonstrate a strategic merge patch and a JSON merge patch.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Use a strategic merge patch to update a DeploymentHere's the configuration file for a Deployment that has two replicas. Each replica is a Pod that has one container:application/deployment-patch.yaml apiVersion: apps/v1 kind: Deployment metadata: name: patch-demo spec: replicas: 2 selector: matchLabels: app: nginx template: metadata: labels: app: nginx spec: containers: - name: patch-demo-ctr image: nginx tolerations: - effect: NoSchedule key: dedicated value: test-team Create the Deployment:kubectl apply -f https://k8s.io/examples/application/deployment-patch.yaml View the Pods associated with your Deployment:kubectl get pods The output shows that the Deployment has two Pods. The 1/1 indicates that each Pod has one container:NAME READY STATUS RESTARTS AGE patch-demo-28633765-670qr 1/1 Running 0 23s patch-demo-28633765-j5qs3 1/1 Running 0 23s Make a note of the names of the running Pods. Later, you will see that these Pods get terminated and replaced by new ones.At this point, each Pod has one Container that runs the nginx image. Now suppose you want each Pod to have two containers: one that runs nginx and one that runs redis.Create a file named patch-file.yaml that has this content:spec: template: spec: containers: - name: patch-demo-ctr-2 image: redis Patch your Deployment:kubectl patch deployment patch-demo --patch-file patch-file.yaml View the patched Deployment:kubectl get deployment patch-demo --output yaml The output shows that the PodSpec in the Deployment has two Containers:containers: - image: redis imagePullPolicy: Always name: patch-demo-ctr-2 ... - image: nginx imagePullPolicy: Always name: patch-demo-ctr ... View the Pods associated with your patched Deployment:kubectl get pods The output shows that the running Pods have different names from the Pods that were running previously. The Deployment terminated the old Pods and created two new Pods that comply with the updated Deployment spec. The 2/2 indicates that each Pod has two Containers:NAME READY STATUS RESTARTS AGE patch-demo-1081991389-2wrn5 2/2 Running 0 1m patch-demo-1081991389-jmg7b 2/2 Running 0 1m Take a closer look at one of the patch-demo Pods:kubectl get pod <your-pod-name> --output yaml The output shows that the Pod has two Containers: one running nginx and one running redis:containers: - image: redis ... - image: nginx ... Notes on the strategic merge patchThe patch you did in the preceding exercise is called a strategic merge patch. Notice that the patch did not replace the containers list. Instead it added a new Container to the list. In other words, the list in the patch was merged with the existing list. This is not always what happens when you use a strategic merge patch on a list. In some cases, the list is replaced, not merged.With a strategic merge patch, a list is either replaced or merged depending on its patch strategy. The patch strategy is specified by the value of the patchStrategy key in a field tag in the Kubernetes source code. For example, the Containers field of PodSpec struct has a patchStrategy of merge:type PodSpec struct { ... Containers []Container `json:"containers" patchStrategy:"merge" patchMergeKey:"name" ...` ... } You can also see the patch strategy in the OpenApi spec:"io.k8s.api.core.v1.PodSpec": { ..., "containers": { "description": "List of containers belonging to the pod. ...." }, "x-kubernetes-patch-merge-key": "name", "x-kubernetes-patch-strategy": "merge" } And you can see the patch strategy in the Kubernetes API documentation.Create a file named patch-file-tolerations.yaml that has this content:spec: template: spec: tolerations: - effect: NoSchedule key: disktype value: ssd Patch your Deployment:kubectl patch deployment patch-demo --patch-file patch-file-tolerations.yaml View the patched Deployment:kubectl get deployment patch-demo --output yaml The output shows that the PodSpec in the Deployment has only one Toleration:tolerations: - effect: NoSchedule key: disktype value: ssd Notice that the tolerations list in the PodSpec was replaced, not merged. This is because the Tolerations field of PodSpec does not have a patchStrategy key in its field tag. So the strategic merge patch uses the default patch strategy, which is replace.type PodSpec struct { ... Tolerations []Toleration `json:"tolerations,omitempty" protobuf:"bytes,22,opt,name=tolerations"` ... } Use a JSON merge patch to update a DeploymentA strategic merge patch is different from a JSON merge patch. With a JSON merge patch, if you want to update a list, you have to specify the entire new list. And the new list completely replaces the existing list.The kubectl patch command has a type parameter that you can set to one of these values:Parameter valueMerge typejsonJSON Patch, RFC 6902mergeJSON Merge Patch, RFC 7386strategicStrategic merge patchFor a comparison of JSON patch and JSON merge patch, see JSON Patch and JSON Merge Patch.The default value for the type parameter is strategic. So in the preceding exercise, you did a strategic merge patch.Next, do a JSON merge patch on your same Deployment. Create a file named patch-file-2.yaml that has this content:spec: template: spec: containers: - name: patch-demo-ctr-3 image: gcr.io/google-samples/hello-app:2.0 In your patch command, set type to merge:kubectl patch deployment patch-demo --type merge --patch-file patch-file-2.yaml View the patched Deployment:kubectl get deployment patch-demo --output yaml The containers list that you specified in the patch has only one Container. The output shows that your list of one Container replaced the existing containers list.spec: containers: - image: gcr.io/google-samples/hello-app:2.0 ... name: patch-demo-ctr-3 List the running Pods:kubectl get pods In the output, you can see that the existing Pods were terminated, and new Pods were created. The 1/1 indicates that each new Pod is running only one Container.NAME READY STATUS RESTARTS AGE patch-demo-1307768864-69308 1/1 Running 0 1m patch-demo-1307768864-c86dc 1/1 Running 0 1m Use strategic merge patch to update a Deployment using the retainKeys strategyHere's the configuration file for a Deployment that uses the RollingUpdate strategy:application/deployment-retainkeys.yaml apiVersion: apps/v1 kind: Deployment metadata: name: retainkeys-demo spec: selector: matchLabels: app: nginx strategy: rollingUpdate: maxSurge: 30% template: metadata: labels: app: nginx spec: containers: - name: retainkeys-demo-ctr image: nginx Create the deployment:kubectl apply -f https://k8s.io/examples/application/deployment-retainkeys.yaml At this point, the deployment is created and is using the RollingUpdate strategy.Create a file named patch-file-no-retainkeys.yaml that has this content:spec: strategy: type: Recreate Patch your Deployment:kubectl patch deployment retainkeys-demo --type strategic --patch-file patch-file-no-retainkeys.yaml In the output, you can see that it is not possible to set type as Recreate when a value is defined for spec.strategy.rollingUpdate:The Deployment "retainkeys-demo" is invalid: spec.strategy.rollingUpdate: Forbidden: may not be specified when strategy `type` is 'Recreate' The way to remove the value for spec.strategy.rollingUpdate when updating the value for type is to use the retainKeys strategy for the strategic merge.Create another file named patch-file-retainkeys.yaml that has this content:spec: strategy: $retainKeys: - type type: Recreate With this patch, we indicate that we want to retain only the type key of the strategy object. Thus, the rollingUpdate will be removed during the patch operation.Patch your Deployment again with this new patch:kubectl patch deployment retainkeys-demo --type strategic --patch-file patch-file-retainkeys.yaml Examine the content of the Deployment:kubectl get deployment retainkeys-demo --output yaml The output shows that the strategy object in the Deployment does not contain the rollingUpdate key anymore:spec: strategy: type: Recreate template: Notes on the strategic merge patch using the retainKeys strategyThe patch you did in the preceding exercise is called a strategic merge patch with retainKeys strategy. This method introduces a new directive $retainKeys that has the following strategies:It contains a list of strings.All fields needing to be preserved must be present in the $retainKeys list.The fields that are present will be merged with live object.All of the missing fields will be cleared when patching.All fields in the $retainKeys list must be a superset or the same as the fields present in the patch.The retainKeys strategy does not work for all objects. It only works when the value of the patchStrategy key in a field tag in the Kubernetes source code contains retainKeys. For example, the Strategy field of the DeploymentSpec struct has a patchStrategy of retainKeys:type DeploymentSpec struct { ... // +patchStrategy=retainKeys Strategy DeploymentStrategy `json:"strategy,omitempty" patchStrategy:"retainKeys" ...` ... } You can also see the retainKeys strategy in the OpenApi spec:"io.k8s.api.apps.v1.DeploymentSpec": { ..., "strategy": { "$ref": "#/definitions/io.k8s.api.apps.v1.DeploymentStrategy", "description": "The deployment strategy to use to replace existing pods with new ones.", "x-kubernetes-patch-strategy": "retainKeys" }, .... } And you can see the retainKeys strategy in the Kubernetes API documentation.Alternate forms of the kubectl patch commandThe kubectl patch command takes YAML or JSON. It can take the patch as a file or directly on the command line.Create a file named patch-file.json that has this content:{ "spec": { "template": { "spec": { "containers": [ { "name": "patch-demo-ctr-2", "image": "redis" } ] } } } } The following commands are equivalent:kubectl patch deployment patch-demo --patch-file patch-file.yaml kubectl patch deployment patch-demo --patch 'spec:\n template:\n spec:\n containers:\n - name: patch-demo-ctr-2\n image: redis' kubectl patch deployment patch-demo --patch-file patch-file.json kubectl patch deployment patch-demo --patch '{"spec": {"template": {"spec": {"containers": [{"name": "patch-demo-ctr-2","image": "redis"}]}}}}' Update an object's replica count using kubectl patch with --subresourceThe flag --subresource=[subresource-name] is used with kubectl commands like get, patch, edit, apply and replace to fetch and update status, scale and resize subresource of the resources you specify. You can specify a subresource for any of the Kubernetes API resources (built-in and CRs) that have status, scale or resize subresource.For example, a Deployment has a status subresource and a scale subresource, so you can use kubectl to get or modify just the status subresource of a Deployment.Here's a manifest for a Deployment that has two replicas:application/deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: nginx-deployment spec: selector: matchLabels: app: nginx replicas: 2 # tells deployment to run 2 pods matching the template template: metadata: labels: app: nginx spec: containers: - name: nginx image: nginx:1.14.2 ports: - containerPort: 80 Create the Deployment:kubectl apply -f https://k8s.io/examples/application/deployment.yaml View the Pods associated with your Deployment:kubectl get pods -l app=nginx In the output, you can see that Deployment has two Pods. For example:NAME READY STATUS RESTARTS AGE nginx-deployment-7fb96c846b-22567 1/1 Running 0 47s nginx-deployment-7fb96c846b-mlgns 1/1 Running 0 47s Now, patch that Deployment with --subresource=[subresource-name] flag:kubectl patch deployment nginx-deployment --subresource='scale' --type='merge' -p '{"spec":{"replicas":3}}' The output is:scale.autoscaling/nginx-deployment patched View the Pods associated with your patched Deployment:kubectl get pods -l app=nginx In the output, you can see one new pod is created, so now you have 3 running pods.NAME READY STATUS RESTARTS AGE nginx-deployment-7fb96c846b-22567 1/1 Running 0 107s nginx-deployment-7fb96c846b-lxfr2 1/1 Running 0 14s nginx-deployment-7fb96c846b-mlgns 1/1 Running 0 107s View the patched Deployment:kubectl get deployment nginx-deployment -o yaml ... spec: replicas: 3 ... status: ... availableReplicas: 3 readyReplicas: 3 replicas: 3 Note:If you run kubectl patch and specify --subresource flag for resource that doesn't support that particular subresource, the API server returns a 404 Not Found error.SummaryIn this exercise, you used kubectl patch to change the live configuration of a Deployment object. You did not change the configuration file that you originally used to create the Deployment object. Other commands for updating API objects include kubectl annotate, kubectl edit, kubectl replace, kubectl scale, and kubectl apply.Note:Strategic merge patch is not supported for custom resources.What's nextKubernetes Object ManagementManaging Kubernetes Objects Using Imperative CommandsImperative Management of Kubernetes Objects Using Configuration FilesDeclarative Management of Kubernetes Objects Using Configuration Files