ValidatingAdmissionPolicyBindingValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources.apiVersion: admissionregistration.k8s.io/v1import "k8s.io/api/admissionregistration/v1"ValidatingAdmissionPolicyBindingValidatingAdmissionPolicyBinding binds the ValidatingAdmissionPolicy with paramerized resources. ValidatingAdmissionPolicyBinding and parameter CRDs together define how cluster administrators configure policies for clusters.For a given admission request, each binding will cause its policy to be evaluated N times, where N is 1 for policies/bindings that don't use params, otherwise N is the number of parameters selected by the binding.The CEL expressions of a policy must have a computed CEL cost below the maximum CEL budget. Each evaluation of the policy is given an independent CEL cost budget. Adding/removing policies, bindings, or params can not affect whether a given (policy, binding, param) combination is within its own CEL budget.apiVersion: admissionregistration.k8s.io/v1kind: ValidatingAdmissionPolicyBindingmetadata (ObjectMeta)Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.spec (ValidatingAdmissionPolicyBindingSpec)Specification of the desired behavior of the ValidatingAdmissionPolicyBinding.ValidatingAdmissionPolicyBindingSpec is the specification of the ValidatingAdmissionPolicyBinding.spec.matchResources (MatchResources)MatchResources declares what resources match this binding and will be validated by it. Note that this is intersected with the policy's matchConstraints, so only requests that are matched by the policy can be selected by this. If this is unset, all resources matched by the policy are validated by this binding When resourceRules is unset, it does not constrain resource matching. If a resource is matched by the other fields of this object, it will be validated. Note that this is differs from ValidatingAdmissionPolicy matchConstraints, where resourceRules are required.MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)spec.matchResources.excludeResourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchResources.excludeResourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchResources.excludeResourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchResources.excludeResourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchResources.excludeResourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.matchResources.matchPolicy (string)matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.Defaults to "Equivalent"spec.matchResources.namespaceSelector (LabelSelector)NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.Default to the empty LabelSelector, which matches everything.spec.matchResources.objectSelector (LabelSelector)ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.spec.matchResources.resourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchResources.resourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchResources.resourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchResources.resourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchResources.resourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.paramRef (ParamRef)paramRef specifies the parameter resource used to configure the admission control policy. It should point to a resource of the type specified in ParamKind of the bound ValidatingAdmissionPolicy. If the policy specifies a ParamKind and the resource referred to by ParamRef does not exist, this binding is considered mis-configured and the FailurePolicy of the ValidatingAdmissionPolicy applied. If the policy does not specify a ParamKind then this field is ignored, and the rules are evaluated without a param.ParamRef describes how to locate the params to be used as input to expressions of rules applied by a policy binding.spec.paramRef.name (string)name is the name of the resource being referenced.One of name or selector must be set, but name and selector are mutually exclusive properties. If one is set, the other must be unset.A single parameter used for all admission requests can be configured by setting the name field, leaving selector blank, and setting namespace if paramKind is namespace-scoped.spec.paramRef.namespace (string)namespace is the namespace of the referenced resource. Allows limiting the search for params to a specific namespace. Applies to both name and selector fields.A per-namespace parameter may be used by specifying a namespace-scoped paramKind in the policy and leaving this field empty.If paramKind is cluster-scoped, this field MUST be unset. Setting this field results in a configuration error.If paramKind is namespace-scoped, the namespace of the object being evaluated for admission will be used when this field is left unset. Take care that if this is left empty the binding must not match any cluster-scoped resources, which will result in an error.spec.paramRef.parameterNotFoundAction (string)parameterNotFoundAction controls the behavior of the binding when the resource exists, and name or selector is valid, but there are no parameters matched by the binding. If the value is set to Allow, then no matched parameters will be treated as successful validation by the binding. If set to Deny, then no matched parameters will be subject to the failurePolicy of the policy.Allowed values are Allow or DenyRequiredspec.paramRef.selector (LabelSelector)selector can be used to match multiple param objects based on their labels. Supply selector: {} to match all resources of the ParamKind.If multiple params are found, they are all evaluated with the policy expressions and the results are ANDed together.One of name or selector must be set, but name and selector are mutually exclusive properties. If one is set, the other must be unset.spec.policyName (string)PolicyName references a ValidatingAdmissionPolicy name which the ValidatingAdmissionPolicyBinding binds to. If the referenced resource does not exist, this binding is considered invalid and will be ignored Required.spec.validationActions ([]string)Set: unique values will be kept during a mergevalidationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced. If a validation evaluates to false it is always enforced according to these actions.Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according to these actions only if the FailurePolicy is set to Fail, otherwise the failures are ignored. This includes compilation errors, runtime errors and misconfigurations of the policy.validationActions is declared as a set of action values. Order does not matter. validationActions may not contain duplicates of the same action.The supported actions values are:"Deny" specifies that a validation failure results in a denied request."Warn" specifies that a validation failure is reported to the request client in HTTP Warning headers, with a warning code of 299. Warnings can be sent both for allowed or denied admission responses."Audit" specifies that a validation failure is included in the published audit event for the request. The audit event will contain a validation.policy.admission.k8s.io/validation_failure audit annotation with a value containing the details of the validation failures, formatted as a JSON list of objects, each with the following fields: - message: The validation failure message string - policy: The resource name of the ValidatingAdmissionPolicy - binding: The resource name of the ValidatingAdmissionPolicyBinding - expressionIndex: The index of the failed validations in the ValidatingAdmissionPolicy - validationActions: The enforcement actions enacted for the validation failure Example audit annotation: "validation.policy.admission.k8s.io/validation_failure": "[{\"message\": \"Invalid value\", {\"policy\": \"policy.example.com\", {\"binding\": \"policybinding.example.com\", {\"expressionIndex\": \"1\", {\"validationActions\": [\"Audit\"]}]"Clients should expect to handle additional values by ignoring any values not recognized."Deny" and "Warn" may not be used together since this combination needlessly duplicates the validation failure both in the API response body and the HTTP warning headers.Required.ValidatingAdmissionPolicyValidatingAdmissionPolicy describes the definition of an admission validation policy that accepts or rejects an object without changing it.apiVersion (string)APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourceskind (string)Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsmetadata (ObjectMeta)Standard object metadata; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata.spec (ValidatingAdmissionPolicySpec)Specification of the desired behavior of the ValidatingAdmissionPolicy.ValidatingAdmissionPolicySpec is the specification of the desired behavior of the AdmissionPolicy.spec.auditAnnotations ([]AuditAnnotation)Atomic: will be replaced during a mergeauditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. validations and auditAnnotations may not both be empty; a least one of validations or auditAnnotations is required.AuditAnnotation describes how to produce an audit annotation for an API request.spec.auditAnnotations.key (string), requiredkey specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name ([A-Za-z0-9][-A-Za-z0-9_.]*) no more than 63 bytes in length.The key is combined with the resource name of the ValidatingAdmissionPolicy to construct an audit annotation key: "{ValidatingAdmissionPolicy name}/{key}".If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy and the same audit annotation key, the annotation key will be identical. In this case, the first annotation written with the key will be included in the audit event and all subsequent annotations with the same key will be discarded.Required.spec.auditAnnotations.valueExpression (string), requiredvalueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value. If the expression evaluates to a string, the audit annotation is included with the string value. If the expression evaluates to null or empty string the audit annotation will be omitted. The valueExpression may be no longer than 5kb in length. If the result of the valueExpression is more than 10kb in length, it will be truncated to 10kb.If multiple ValidatingAdmissionPolicyBinding resources match an API request, then the valueExpression will be evaluated for each binding. All unique values produced by the valueExpressions will be joined together in a comma-separated list.Required.spec.failurePolicy (string)failurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or mis-configured policy definitions or bindings.A policy is invalid if spec.paramKind refers to a non-existent Kind. A binding is invalid if spec.paramRef.name refers to a non-existent resource.failurePolicy does not define how validations that evaluate to false are handled.When failurePolicy is set to Fail, ValidatingAdmissionPolicyBinding validationActions define how failures are enforced.Allowed values are Ignore or Fail. Defaults to Fail.spec.matchConditions ([]MatchCondition)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeMatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules, namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests. There are a maximum of 64 match conditions allowed.If a parameter object is provided, it can be accessed via the params handle in the same manner as validation expressions.The exact matching logic is (in order):If ANY matchCondition evaluates to FALSE, the policy is skipped.If ALL matchConditions evaluate to TRUE, the policy is evaluated.If any matchCondition evaluates to an error (but none are FALSE):If failurePolicy=Fail, reject the requestIf failurePolicy=Ignore, the policy is skippedMatchCondition represents a condition which must by fulfilled for a request to be sent to a webhook.spec.matchConditions.expression (string), requiredExpression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:'object' - The object from the incoming request. The value is null for DELETE requests. 'oldObject' - The existing object. The value is null for CREATE requests. 'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest). 'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz 'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource. Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/Required.spec.matchConditions.name (string), requiredName is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes. A good name should be descriptive of the associated expression. Name must be a qualified name consisting of alphanumeric characters, '-', '' or '.', and must start and end with an alphanumeric character (e.g. 'MyName', or 'my.name', or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')Required.spec.matchConstraints (MatchResources)MatchConstraints specifies what resources this policy is designed to validate. The AdmissionPolicy cares about a request if it matches all Constraints. However, in order to prevent clusters from being put into an unstable state that cannot be recovered from via the API ValidatingAdmissionPolicy cannot match ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding. Required.MatchResources decides whether to run the admission control policy on an object based on whether it meets the match criteria. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)spec.matchConstraints.excludeResourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules (if a resource matches both, it is excluded)NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchConstraints.excludeResourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchConstraints.excludeResourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchConstraints.excludeResourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchConstraints.excludeResourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.matchConstraints.matchPolicy (string)matchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are "Exact" or "Equivalent".Exact: match a request only if it exactly matches a specified rule. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, but "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the ValidatingAdmissionPolicy.Equivalent: match a request if modifies a resource listed in rules, even via another API group or version. For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1, and "rules" only included apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"], a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the ValidatingAdmissionPolicy.Defaults to "Equivalent"spec.matchConstraints.namespaceSelector (LabelSelector)NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. If the object itself is a namespace, the matching is performed on object.metadata.labels. If the object is another cluster scoped resource, it never skips the policy.For example, to run the webhook on any objects whose namespace is not associated with "runlevel" of "0" or "1"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "runlevel", "operator": "NotIn", "values": [ "0", "1" ] } ] }If instead you want to only run the policy on any objects whose namespace is associated with the "environment" of "prod" or "staging"; you will set the selector as follows: "namespaceSelector": { "matchExpressions": [ { "key": "environment", "operator": "In", "values": [ "prod", "staging" ] } ] }See https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ for more examples of label selectors.Default to the empty LabelSelector, which matches everything.spec.matchConstraints.objectSelector (LabelSelector)ObjectSelector decides whether to run the validation based on if the object has matching labels. objectSelector is evaluated against both the oldObject and newObject that would be sent to the cel validation, and is considered to match if either object matches the selector. A null object (oldObject in the case of create, or newObject in the case of delete) or an object that cannot have labels (like a DeploymentRollback or a PodProxyOptions object) is not considered to match. Use the object selector only if the webhook is opt-in, because end users may skip the admission webhook by setting the labels. Default to the empty LabelSelector, which matches everything.spec.matchConstraints.resourceRules ([]NamedRuleWithOperations)Atomic: will be replaced during a mergeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule.NamedRuleWithOperations is a tuple of Operations and Resources with ResourceNames.spec.matchConstraints.resourceRules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the API groups the resources belong to. '' is all groups. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.apiVersions ([]string)Atomic: will be replaced during a mergeAPIVersions is the API versions the resources belong to. '' is all versions. If '' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.operations ([]string)Atomic: will be replaced during a mergeOperations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added. If '*' is present, the length of the slice must be one. Required.spec.matchConstraints.resourceRules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.spec.matchConstraints.resourceRules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to.For example: 'pods' means pods. 'pods/log' means the log subresource of pods. '' means all resources, but not subresources. 'pods/' means all subresources of pods. '/scale' means all scale subresources. '/*' means all resources and their subresources.If wildcard is present, the validation rule will ensure resources do not overlap with each other.Depending on the enclosing object, subresources might not be allowed. Required.spec.matchConstraints.resourceRules.scope (string)scope specifies the scope of this rule. Valid values are "Cluster", "Namespaced", and "" "Cluster" means that only cluster-scoped resources will match this rule. Namespace API objects are cluster-scoped. "Namespaced" means that only namespaced resources will match this rule. "" means that there are no scope restrictions. Subresources match the scope of their parent resource. Default is "*".spec.paramKind (ParamKind)ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy and the param CEL variable will not be provided to validation expressions. If ParamKind refers to a non-existent kind, this policy definition is mis-configured and the FailurePolicy is applied. If paramKind is specified but paramRef is unset in ValidatingAdmissionPolicyBinding, the params variable will be null.ParamKind is a tuple of Group Kind and Version.spec.paramKind.apiVersion (string)APIVersion is the API group version the resources belong to. In format of "group/version". Required.spec.paramKind.kind (string)Kind is the API kind the resources belong to. Required.spec.validations ([]Validation)Atomic: will be replaced during a mergeValidations contain CEL expressions which is used to apply the validation. Validations and AuditAnnotations may not both be empty; a minimum of one Validations or AuditAnnotations is required.Validation specifies the CEL expression which is used to apply the validation.spec.validations.expression (string), requiredExpression represents the expression which will be evaluated by CEL. ref: https://github.com/google/cel-spec CEL expressions have access to the contents of the API request/response, organized into CEL variables as well as some other useful variables:'object' - The object from the incoming request. The value is null for DELETE requests. - 'oldObject' - The existing object. The value is null for CREATE requests. - 'request' - Attributes of the API request(ref). - 'params' - Parameter resource referred to by the policy binding being evaluated. Only populated if the policy has a ParamKind. - 'namespaceObject' - The namespace object that the incoming object belongs to. The value is null for cluster-scoped resources. - 'variables' - Map of composited variables, from its name to its lazily evaluated value. For example, a variable named 'foo' can be accessed as 'variables.foo'.'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request. See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the request resource.The apiVersion, kind, metadata.name and metadata.generateName are always accessible from the root of the object. No other metadata properties are accessible.Only property names of the form [a-zA-Z_.-/][a-zA-Z0-9_.-/]* are accessible. Accessible property names are escaped according to the following rules when accessed in the expression: - '' escapes to 'underscores' - '.' escapes to 'dot' - '-' escapes to 'dash' - '/' escapes to 'slash' - Property names that exactly match a CEL RESERVED keyword escape to '{keyword}__'. The keywords are: "true", "false", "null", "in", "as", "break", "const", "continue", "else", "for", "function", "if", "import", "let", "loop", "package", "namespace", "return". Examples:Expression accessing a property named "namespace": {"Expression": "object.namespace > 0"}Expression accessing a property named "x-prop": {"Expression": "object.x__dash__prop > 0"}Expression accessing a property named "redact__d": {"Expression": "object.redact__underscores__d > 0"}Equality on arrays with list type of 'set' or 'map' ignores element order, i.e. [1, 2] == [2, 1]. Concatenation on arrays with x-kubernetes-list-type use the semantics of the list type:'set': X + Y performs a union where the array positions of all elements in X are preserved and non-intersecting elements in Y are appended, retaining their partial order.'map': X + Y performs a merge where the array positions of all keys in X are preserved but the values are overwritten by values in Y when the key sets of X and Y intersect. Elements in Y with non-intersecting keys are appended, retaining their partial order. Required.spec.validations.message (string)Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks. The message must not contain line breaks. If unset, the message is "failed rule: {Rule}". e.g. "must be a URL with the host matching spec.host" If the Expression contains line breaks. Message is required. The message must not contain line breaks. If unset, the message is "failed Expression: {Expression}".spec.validations.messageExpression (string)messageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails. Since messageExpression is used as a failure message, it must evaluate to a string. If both message and messageExpression are present on a validation, then messageExpression will be used if validation fails. If messageExpression results in a runtime error, the runtime error is logged, and the validation failure message is produced as if the messageExpression field were unset. If messageExpression evaluates to an empty string, a string with only spaces, or a string that contains line breaks, then the validation failure message will also be produced as if the messageExpression field were unset, and the fact that messageExpression produced an empty string/string with only spaces/string with line breaks will be logged. messageExpression has access to all the same variables as the expression except for 'authorizer' and 'authorizer.requestResource'. Example: "object.x must be less than max ("+string(params.max)+")"spec.validations.reason (string)Reason represents a machine-readable description of why this validation failed. If this is the first validation in the list to fail, this reason, as well as the corresponding HTTP response code, are used in the HTTP response to the client. The currently supported reasons are: "Unauthorized", "Forbidden", "Invalid", "RequestEntityTooLarge". If not set, StatusReasonInvalid is used in the response to the client.spec.variables ([]Variable)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeVariables contain definitions of variables that can be used in composition of other expressions. Each variable is defined as a named CEL expression. The variables defined here will be available under variables in other expressions of the policy except MatchConditions because MatchConditions are evaluated before the rest of the policy.The expression of a variable can refer to other variables defined earlier in the list but not those after. Thus, Variables must be sorted by the order of first appearance and acyclic.Variable is the definition of a variable that is used for composition. A variable is defined as a named expression.spec.variables.expression (string), requiredExpression is the expression that will be evaluated as the value of the variable. The CEL expression has access to the same identifiers as the CEL expressions in Validation.spec.variables.name (string), requiredName is the name of the variable. The name must be a valid CEL identifier and unique among all variables. The variable can be accessed in other expressions through variables For example, if name is "foo", the variable will be available as variables.foostatus (ValidatingAdmissionPolicyStatus)The status of the ValidatingAdmissionPolicy, including warnings that are useful to determine if the policy behaves in the expected way. Populated by the system. Read-only.ValidatingAdmissionPolicyStatus represents the status of an admission validation policy.status.conditions ([]Condition)Map: unique values on key type will be kept during a mergeThe conditions represent the latest available observations of a policy's current state.Condition contains details for one aspect of the current state of this API Resource.status.conditions.lastTransitionTime (Time), requiredlastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.status.conditions.message (string), requiredmessage is a human readable message indicating details about the transition. This may be an empty string.status.conditions.reason (string), requiredreason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.status.conditions.status (string), requiredstatus of the condition, one of True, False, Unknown.status.conditions.type (string), requiredtype of condition in CamelCase or in foo.example.com/CamelCase.status.conditions.observedGeneration (int64)observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.status.observedGeneration (int64)The generation observed by the controller.status.typeChecking (TypeChecking)The results of type checking for each expression. Presence of this field indicates the completion of the type checking.TypeChecking contains results of type checking the expressions in the ValidatingAdmissionPolicystatus.typeChecking.expressionWarnings ([]ExpressionWarning)Atomic: will be replaced during a mergeThe type checking warnings for each expression.ExpressionWarning is a warning information that targets a specific expression.status.typeChecking.expressionWarnings.fieldRef (string), requiredThe path to the field that refers the expression. For example, the reference to the expression of the first item of validations is "spec.validations[0].expression"status.typeChecking.expressionWarnings.warning (string), requiredThe content of type checking information in a human-readable form. Each line of the warning contains the type that the expression is checked against, followed by the type check error from the compiler.ValidatingAdmissionPolicyBindingListValidatingAdmissionPolicyBindingList is a list of ValidatingAdmissionPolicyBinding.items ([]ValidatingAdmissionPolicyBinding), requiredList of PolicyBinding.apiVersion (string)APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resourceskind (string)Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsOperationsget read the specified ValidatingAdmissionPolicyBindingHTTP RequestGET /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindings/{name}Parametersname (in path): string, requiredname of the ValidatingAdmissionPolicyBindingpretty (in query): stringprettyResponse200 (ValidatingAdmissionPolicyBinding): OK401: Unauthorizedlist list or watch objects of kind ValidatingAdmissionPolicyBindingHTTP RequestGET /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindingsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ValidatingAdmissionPolicyBindingList): OK401: Unauthorizedcreate create a ValidatingAdmissionPolicyBindingHTTP RequestPOST /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindingsParametersbody: ValidatingAdmissionPolicyBinding, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (ValidatingAdmissionPolicyBinding): OK201 (ValidatingAdmissionPolicyBinding): Created202 (ValidatingAdmissionPolicyBinding): Accepted401: Unauthorizedupdate replace the specified ValidatingAdmissionPolicyBindingHTTP RequestPUT /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindings/{name}Parametersname (in path): string, requiredname of the ValidatingAdmissionPolicyBindingbody: ValidatingAdmissionPolicyBinding, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (ValidatingAdmissionPolicyBinding): OK201 (ValidatingAdmissionPolicyBinding): Created401: Unauthorizedpatch partially update the specified ValidatingAdmissionPolicyBindingHTTP RequestPATCH /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindings/{name}Parametersname (in path): string, requiredname of the ValidatingAdmissionPolicyBindingbody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (ValidatingAdmissionPolicyBinding): OK201 (ValidatingAdmissionPolicyBinding): Created401: Unauthorizeddelete delete a ValidatingAdmissionPolicyBindingHTTP RequestDELETE /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindings/{name}Parametersname (in path): string, requiredname of the ValidatingAdmissionPolicyBindingbody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (Status): OK202 (Status): Accepted401: Unauthorizeddeletecollection delete collection of ValidatingAdmissionPolicyBindingHTTP RequestDELETE /apis/admissionregistration.k8s.io/v1/validatingadmissionpolicybindingsParametersbody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

ValidatingAdmissionPolicyBinding


This is the multi-page printable view of this section. Click here to print.Return to the regular view of this page.SecurityConcepts for keeping your cloud-native workload secure.1: Cloud Native Security and Kubernetes2: Pod Security Standards3: Pod Security Admission4: Service Accounts5: Pod Security Policies6: Security For Linux Nodes7: Security For Windows Nodes8: Controlling Access to the Kubernetes API9: Role Based Access Control Good Practices10: Good practices for Kubernetes Secrets11: Multi-tenancy12: Hardening Guide - Authentication Mechanisms13: Hardening Guide - Scheduler Configuration14: Kubernetes API Server Bypass Risks15: Linux kernel security constraints for Pods and containers16: Security Checklist17: Application Security ChecklistThis section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read Cloud Native Security and Kubernetes for the broader context about how to secure your cluster and the applications that you're running on it.Kubernetes security mechanismsKubernetes includes several APIs and security controls, as well as ways to define policies that can form part of how you manage information security.Control plane protectionA key security mechanism for any Kubernetes cluster is to control access to the Kubernetes API.Kubernetes expects you to configure and use TLS to provide data encryption in transit within the control plane, and between the control plane and its clients. You can also enable encryption at rest for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.SecretsThe Secret API provides basic protection for configuration values that require confidentiality.Workload protectionEnforce Pod security standards to ensure that Pods and their containers are isolated appropriately. You can also use RuntimeClasses to define custom isolation if you need it.Network policies let you control network traffic between Pods, or between Pods and the network outside your cluster.You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.Admission controlAdmission controllers are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see Admission Webhook Good Practices.AuditingKubernetes audit logging provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Cloud provider securityNote: Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information.If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:Cloud provider securityIaaS ProviderLinkAlibaba Cloudhttps://www.alibabacloud.com/trust-centerAmazon Web Serviceshttps://aws.amazon.com/securityGoogle Cloud Platformhttps://cloud.google.com/securityHuawei Cloudhttps://www.huaweicloud.com/intl/en-us/securecenter/overallsafetyIBM Cloudhttps://www.ibm.com/cloud/securityMicrosoft Azurehttps://docs.microsoft.com/en-us/azure/security/azure-securityOracle Cloud Infrastructurehttps://www.oracle.com/securityTencent Cloudhttps://www.tencentcloud.com/solutions/data-security-and-information-protectionVMware vSpherehttps://www.vmware.com/solutions/security/hardening-guidesPoliciesYou can define security policies using Kubernetes-native mechanisms, such as NetworkPolicy (declarative control over network packet filtering) or ValidatingAdmissionPolicy (declarative restrictions on what changes someone can make using the Kubernetes API).However, you can also rely on policy implementations from the wider ecosystem around Kubernetes. Kubernetes provides extension mechanisms to let those ecosystem projects implement their own policy controls on source code review, container image approval, API access controls, networking, and more.For more information about policy mechanisms and Kubernetes, read Policies.What's

Security


Post-release communicationsThe Kubernetes Release Comms team (part of SIG Release) looks after release announcements, which go onto the main project blog.After each release, the Release Comms team take over the main blog for a period and publish a series of additional articles to explain or announce changes related to that release. These additional articles are termed post-release comms.Opting in to post-release commsDuring a release cycle, as a contributor, you can opt in to post-release comms about an upcoming change to Kubernetes.To opt in you open a draft, placeholder pull request (PR) against k/website. Initially, this can be an empty commit. Mention the KEP issue or other Kubernetes improvement issue in the description of your placeholder PR.When you open the draft pull request, you open it against main as the base branch and not against the dev-1.35 branch. This is different from the process for upcoming release changes and new features.You should also leave a comment on the related kubernetes/enhancements issue with a link to the PR to notify the Release Comms team managing this release. Your comment helps the team see that the change needs announcing and that your SIG has opted in.As well as the above, you should ideally contact the Release Comms team via Slack (channel #release-comms) to let them know that you have done this and would like to opt in.Preparing the article contentYou should follow the usual article submission process to turn your placeholder PR into something ready for review. However, for post-release comms, you may not have a writing buddy; instead, the Release Comms team may assign a member of the team to help guide what you're doing.You should squash the commits in your pull request; if you're not sure how to, it's absolutely OK to ask Release Comms or the blog team for help.Provided that your article is flagged as a draft (draft: true) in the front matter, the PR can merge at any time during the release cycle.PublicationAhead of the actual release, the Release Comms team check what content is ready (if it's not ready by the deadline, and you didn't get an exception, then the announcement won't be included). They build a schedule for the articles that will go out and open new pull requests to turn those articles from draft to published.Caution:All these pull requests to actually publish post-release articles must be held (Prow command /hold) until the release has actually happened.The blog team approvers still provide final sign off on promoting the content from draft to accepted for publication. Ahead of release day, the PR (or PRs) for publishing these announcements should have LGTM (“looks good to me”) and approved labels, along with the do-not-merge/hold label to ensure the PR doesn't merge too early.Release Comms / the Release Team can then unhold that PR (or set of PRs) as soon as the website Git repository is unfrozen after the actual release.On the day each article is scheduled to publish, automation triggers a website build and that article becomes visible.

Post-release communications


Translate a Docker Compose File to Kubernetes ResourcesWhat's Kompose? It's a conversion tool for all things compose (namely Docker Compose) to container orchestrators (Kubernetes or OpenShift).More information can be found on the Kompose website at https://kompose.io/.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Install KomposeWe have multiple ways to install Kompose. Our preferred method is downloading the binary from the latest GitHub release.Kompose is released via GitHub on a three-week cycle, you can see all current releases on the GitHub release page.# Linux curl -L https://github.com/kubernetes/kompose/releases/download/v1.34.0/kompose-linux-amd64 -o kompose # macOS curl -L https://github.com/kubernetes/kompose/releases/download/v1.34.0/kompose-darwin-amd64 -o kompose # Windows curl -L https://github.com/kubernetes/kompose/releases/download/v1.34.0/kompose-windows-amd64.exe -o kompose.exe chmod +x kompose sudo mv ./kompose /usr/local/bin/kompose Alternatively, you can download the tarball.Installing using go get pulls from the master branch with the latest development changes.go get -u github.com/kubernetes/kompose On macOS you can install the latest release via Homebrew:brew install kompose Use KomposeIn a few steps, we'll take you from Docker Compose to Kubernetes. All you need is an existing docker-compose.yml file.Go to the directory containing your docker-compose.yml file. If you don't have one, test using this one. services: redis-leader: container_name: redis-leader image: redis ports: - "6379" redis-replica: container_name: redis-replica image: redis ports: - "6379" command: redis-server --replicaof redis-leader 6379 --dir /tmp web: container_name: web image: quay.io/kompose/web ports: - "8080:8080" environment: - GET_HOSTS_FROM=dns labels: kompose.service.type: LoadBalancer To convert the docker-compose.yml file to files that you can use with kubectl, run kompose convert and then kubectl apply -f <output file>.kompose convert The output is similar to:INFO Kubernetes file "redis-leader-service.yaml" created INFO Kubernetes file "redis-replica-service.yaml" created INFO Kubernetes file "web-tcp-service.yaml" created INFO Kubernetes file "redis-leader-deployment.yaml" created INFO Kubernetes file "redis-replica-deployment.yaml" created INFO Kubernetes file "web-deployment.yaml" created kubectl apply -f web-tcp-service.yaml,redis-leader-service.yaml,redis-replica-service.yaml,web-deployment.yaml,redis-leader-deployment.yaml,redis-replica-deployment.yaml The output is similar to:deployment.apps/redis-leader created deployment.apps/redis-replica created deployment.apps/web created service/redis-leader created service/redis-replica created service/web-tcp created Your deployments are running in Kubernetes.Access your application.If you're already using minikube for your development process:minikube service web-tcp Otherwise, let's look up what IP your service is using!kubectl describe svc web-tcp Name: web-tcp Namespace: default Labels: io.kompose.service=web-tcp Annotations: kompose.cmd: kompose convert kompose.service.type: LoadBalancer kompose.version: 1.33.0 (3ce457399) Selector: io.kompose.service=web Type: LoadBalancer IP Family Policy: SingleStack IP Families: IPv4 IP: 10.102.30.3 IPs: 10.102.30.3 Port: 8080 8080/TCP TargetPort: 8080/TCP NodePort: 8080 31624/TCP Endpoints: 10.244.0.5:8080 Session Affinity: None External Traffic Policy: Cluster Events: <none> If you're using a cloud provider, your IP will be listed next to LoadBalancer Ingress.curl http://192.0.2.89 Clean-up.After you are finished testing out the example application deployment, simply run the following command in your shell to delete the resources used.kubectl delete -f web-tcp-service.yaml,redis-leader-service.yaml,redis-replica-service.yaml,web-deployment.yaml,redis-leader-deployment.yaml,redis-replica-deployment.yaml User GuideCLIkompose convertDocumentationAlternative ConversionsLabelsRestartDocker Compose VersionsKompose has support for two providers: OpenShift and Kubernetes. You can choose a targeted provider using global option --provider. If no provider is specified, Kubernetes is set by default.kompose convertKompose supports conversion of V1, V2, and V3 Docker Compose files into Kubernetes and OpenShift objects.Kubernetes kompose convert examplekompose --file docker-voting.yml convert WARN Unsupported key networks - ignoring WARN Unsupported key build - ignoring INFO Kubernetes file "worker-svc.yaml" created INFO Kubernetes file "db-svc.yaml" created INFO Kubernetes file "redis-svc.yaml" created INFO Kubernetes file "result-svc.yaml" created INFO Kubernetes file "vote-svc.yaml" created INFO Kubernetes file "redis-deployment.yaml" created INFO Kubernetes file "result-deployment.yaml" created INFO Kubernetes file "vote-deployment.yaml" created INFO Kubernetes file "worker-deployment.yaml" created INFO Kubernetes file "db-deployment.yaml" created ls db-deployment.yaml docker-compose.yml docker-gitlab.yml redis-deployment.yaml result-deployment.yaml vote-deployment.yaml worker-deployment.yaml db-svc.yaml docker-voting.yml redis-svc.yaml result-svc.yaml vote-svc.yaml worker-svc.yaml You can also provide multiple docker-compose files at the same time:kompose -f docker-compose.yml -f docker-guestbook.yml convert INFO Kubernetes file "frontend-service.yaml" created INFO Kubernetes file "mlbparks-service.yaml" created INFO Kubernetes file "mongodb-service.yaml" created INFO Kubernetes file "redis-master-service.yaml" created INFO Kubernetes file "redis-slave-service.yaml" created INFO Kubernetes file "frontend-deployment.yaml" created INFO Kubernetes file "mlbparks-deployment.yaml" created INFO Kubernetes file "mongodb-deployment.yaml" created INFO Kubernetes file "mongodb-claim0-persistentvolumeclaim.yaml" created INFO Kubernetes file "redis-master-deployment.yaml" created INFO Kubernetes file "redis-slave-deployment.yaml" created ls mlbparks-deployment.yaml mongodb-service.yaml redis-slave-service.jsonmlbparks-service.yaml frontend-deployment.yaml mongodb-claim0-persistentvolumeclaim.yaml redis-master-service.yaml frontend-service.yaml mongodb-deployment.yaml redis-slave-deployment.yaml redis-master-deployment.yaml When multiple docker-compose files are provided the configuration is merged. Any configuration that is common will be overridden by subsequent file.OpenShift kompose convert examplekompose --provider openshift --file docker-voting.yml convert WARN [worker] Service cannot be created because of missing port. INFO OpenShift file "vote-service.yaml" created INFO OpenShift file "db-service.yaml" created INFO OpenShift file "redis-service.yaml" created INFO OpenShift file "result-service.yaml" created INFO OpenShift file "vote-deploymentconfig.yaml" created INFO OpenShift file "vote-imagestream.yaml" created INFO OpenShift file "worker-deploymentconfig.yaml" created INFO OpenShift file "worker-imagestream.yaml" created INFO OpenShift file "db-deploymentconfig.yaml" created INFO OpenShift file "db-imagestream.yaml" created INFO OpenShift file "redis-deploymentconfig.yaml" created INFO OpenShift file "redis-imagestream.yaml" created INFO OpenShift file "result-deploymentconfig.yaml" created INFO OpenShift file "result-imagestream.yaml" created It also supports creating buildconfig for build directive in a service. By default, it uses the remote repo for the current git branch as the source repo, and the current branch as the source branch for the build. You can specify a different source repo and branch using --build-repo and --build-branch options respectively.kompose --provider openshift --file buildconfig/docker-compose.yml convert WARN [foo] Service cannot be created because of missing port. INFO OpenShift Buildconfig using git@github.com:rtnpro/kompose.git::master as source. INFO OpenShift file "foo-deploymentconfig.yaml" created INFO OpenShift file "foo-imagestream.yaml" created INFO OpenShift file "foo-buildconfig.yaml" created Note:If you are manually pushing the OpenShift artifacts using oc create -f, you need to ensure that you push the imagestream artifact before the buildconfig artifact, to workaround this OpenShift issue: https://github.com/openshift/origin/issues/4518 .Alternative ConversionsThe default kompose transformation will generate Kubernetes Deployments and Services, in yaml format. You have alternative option to generate json with -j. Also, you can alternatively generate Replication Controllers objects, Daemon Sets, or Helm charts.kompose convert -j INFO Kubernetes file "redis-svc.json" created INFO Kubernetes file "web-svc.json" created INFO Kubernetes file "redis-deployment.json" created INFO Kubernetes file "web-deployment.json" created The *-deployment.json files contain the Deployment objects.kompose convert --replication-controller INFO Kubernetes file "redis-svc.yaml" created INFO Kubernetes file "web-svc.yaml" created INFO Kubernetes file "redis-replicationcontroller.yaml" created INFO Kubernetes file "web-replicationcontroller.yaml" created The *-replicationcontroller.yaml files contain the Replication Controller objects. If you want to specify replicas (default is 1), use --replicas flag: kompose convert --replication-controller --replicas 3.kompose convert --daemon-set INFO Kubernetes file "redis-svc.yaml" created INFO Kubernetes file "web-svc.yaml" created INFO Kubernetes file "redis-daemonset.yaml" created INFO Kubernetes file "web-daemonset.yaml" created The *-daemonset.yaml files contain the DaemonSet objects.If you want to generate a Chart to be used with Helm run:kompose convert -c INFO Kubernetes file "web-svc.yaml" created INFO Kubernetes file "redis-svc.yaml" created INFO Kubernetes file "web-deployment.yaml" created INFO Kubernetes file "redis-deployment.yaml" created chart created in "./docker-compose/" tree docker-compose/ docker-compose ├── Chart.yaml ├── README.md └── templates ├── redis-deployment.yaml ├── redis-svc.yaml ├── web-deployment.yaml └── web-svc.yaml The chart structure is aimed at providing a skeleton for building your Helm charts.Labelskompose supports Kompose-specific labels within the docker-compose.yml file in order to explicitly define a service's behavior upon conversion.kompose.service.type defines the type of service to be created.For example:version: "2" services: nginx: image: nginx dockerfile: foobar build: ./foobar cap_add: - ALL container_name: foobar labels: kompose.service.type: nodeport kompose.service.expose defines if the service needs to be made accessible from outside the cluster or not. If the value is set to "true", the provider sets the endpoint automatically, and for any other value, the value is set as the hostname. If multiple ports are defined in a service, the first one is chosen to be the exposed.For the Kubernetes provider, an ingress resource is created and it is assumed that an ingress controller has already been configured.For the OpenShift provider, a route is created.For example:version: "2" services: web: image: tuna/docker-counter23 ports: - "5000:5000" links: - redis labels: kompose.service.expose: "counter.example.com" redis: image: redis:3.0 ports: - "6379" The currently supported options are:KeyValuekompose.service.typenodeport / clusterip / loadbalancerkompose.service.exposetrue / hostnameNote:The kompose.service.type label should be defined with ports only, otherwise kompose will fail.RestartIf you want to create normal pods without controllers you can use restart construct of docker-compose to define that. Follow table below to see what happens on the restart value.docker-compose restartobject createdPod restartPolicy""controller objectAlwaysalwayscontroller objectAlwayson-failurePodOnFailurenoPodNeverNote:The controller object could be deployment or replicationcontroller.For example, the pival service will become pod down here. This container calculated value of pi.version: '2' services: pival: image: perl command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"] restart: "on-failure" Warning about Deployment ConfigurationsIf the Docker Compose file has a volume specified for a service, the Deployment (Kubernetes) or DeploymentConfig (OpenShift) strategy is changed to "Recreate" instead of "RollingUpdate" (default). This is done to avoid multiple instances of a service from accessing a volume at the same time.If the Docker Compose file has service name with _ in it (for example, web_service), then it will be replaced by - and the service name will be renamed accordingly (for example, web-service). Kompose does this because "Kubernetes" doesn't allow _ in object name.Please note that changing service name might break some docker-compose files.Docker Compose VersionsKompose supports Docker Compose versions: 1, 2 and 3. We have limited support on versions 2.1 and 3.2 due to their experimental nature.A full list on compatibility between all three versions is listed in our conversion document including a list of all incompatible Docker Compose keys.


Expose Pod Information to Containers Through Environment VariablesThis page shows how a Pod can use environment variables to expose information about itself to containers running in the Pod, using the downward API. You can use environment variables to expose Pod fields, container fields, or both.In Kubernetes, there are two ways to expose Pod and container fields to a running container:Environment variables, as explained in this taskVolume filesTogether, these two ways of exposing Pod and container fields are called the downward API.As Services are the primary mode of communication between containerized applications managed by Kubernetes, it is helpful to be able to discover them at runtime.Read more about accessing Services here.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesUse Pod fields as values for environment variablesIn this part of exercise, you create a Pod that has one container, and you project Pod-level fields into the running container as environment variables.pods/inject/dapi-envars-pod.yaml apiVersion: v1 kind: Pod metadata: name: dapi-envars-fieldref spec: containers: - name: test-container image: registry.k8s.io/busybox:1.27.2 command: [ "sh", "-c"] args: - while true; do echo -en '\n'; printenv MY_NODE_NAME MY_POD_NAME MY_POD_NAMESPACE; printenv MY_POD_IP MY_POD_SERVICE_ACCOUNT; sleep 10; done; env: - name: MY_NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: MY_POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: MY_POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: MY_POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: MY_POD_SERVICE_ACCOUNT valueFrom: fieldRef: fieldPath: spec.serviceAccountName restartPolicy: Never In that manifest, you can see five environment variables. The env field is an array of environment variable definitions. The first element in the array specifies that the MY_NODE_NAME environment variable gets its value from the Pod's spec.nodeName field. Similarly, the other environment variables get their names from Pod fields.Note:The fields in this example are Pod fields. They are not fields of the container in the Pod.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/inject/dapi-envars-pod.yaml Verify that the container in the Pod is running:# If the new Pod isn't yet healthy, rerun this command a few times. kubectl get pods View the container's logs:kubectl logs dapi-envars-fieldref The output shows the values of selected environment variables:minikube dapi-envars-fieldref default 172.17.0.4 default To see why these values are in the log, look at the command and args fields in the configuration file. When the container starts, it writes the values of five environment variables to stdout. It repeats this every ten seconds.Next, get a shell into the container that is running in your Pod:kubectl exec -it dapi-envars-fieldref -- sh In your shell, view the environment variables:# Run this in a shell inside the container printenv The output shows that certain environment variables have been assigned the values of Pod fields:MY_POD_SERVICE_ACCOUNT=default ... MY_POD_NAMESPACE=default MY_POD_IP=172.17.0.4 ... MY_NODE_NAME=minikube ... MY_POD_NAME=dapi-envars-fieldref Use container fields as values for environment variablesIn the preceding exercise, you used information from Pod-level fields as the values for environment variables. In this next exercise, you are going to pass fields that are part of the Pod definition, but taken from the specific container rather than from the Pod overall.Here is a manifest for another Pod that again has just one container:pods/inject/dapi-envars-container.yaml apiVersion: v1 kind: Pod metadata: name: dapi-envars-resourcefieldref spec: containers: - name: test-container image: registry.k8s.io/busybox:1.27.2 command: [ "sh", "-c"] args: - while true; do echo -en '\n'; printenv MY_CPU_REQUEST MY_CPU_LIMIT; printenv MY_MEM_REQUEST MY_MEM_LIMIT; sleep 10; done; resources: requests: memory: "32Mi" cpu: "125m" limits: memory: "64Mi" cpu: "250m" env: - name: MY_CPU_REQUEST valueFrom: resourceFieldRef: containerName: test-container resource: requests.cpu - name: MY_CPU_LIMIT valueFrom: resourceFieldRef: containerName: test-container resource: limits.cpu - name: MY_MEM_REQUEST valueFrom: resourceFieldRef: containerName: test-container resource: requests.memory - name: MY_MEM_LIMIT valueFrom: resourceFieldRef: containerName: test-container resource: limits.memory restartPolicy: Never In this manifest, you can see four environment variables. The env field is an array of environment variable definitions. The first element in the array specifies that the MY_CPU_REQUEST environment variable gets its value from the requests.cpu field of a container named test-container. Similarly, the other environment variables get their values from fields that are specific to this container.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/inject/dapi-envars-container.yaml Verify that the container in the Pod is running:# If the new Pod isn't yet healthy, rerun this command a few times. kubectl get pods View the container's logs:kubectl logs dapi-envars-resourcefieldref The output shows the values of selected environment variables:1 1 33554432 67108864 What's nextRead Defining Environment Variables for a ContainerRead the spec API definition for Pod. This includes the definition of Container (part of Pod).Read the list of available fields that you can expose using the downward API.Read about Pods, containers and environment variables in the legacy API reference:PodSpecContainerEnvVarEnvVarSourceObjectFieldSelectorResourceFieldSelector


kubeadm reset phasekubeadm reset phase enables you to invoke atomic steps of the node reset process. Hence, you can let kubeadm do some of the work and you can fill in the gaps if you wish to apply customization.kubeadm reset phase is consistent with the kubeadm reset workflow, and behind the scene both use the same code.kubeadm reset phaseSynopsisUse this command to invoke single phase of the "reset" workflowkubeadm reset phase [flags] Options-h, --helphelp for phaseOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase preflightUsing this phase you can execute preflight checks on a node that is being reset.Run reset pre-flight checksSynopsisRun pre-flight checks for kubeadm reset.kubeadm reset phase preflight [flags] Options--dry-runDon't apply any changes; just output what would be done.-f, --forceReset the node without prompting for confirmation.-h, --helphelp for preflight--ignore-preflight-errors stringsA list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase remove-etcd-memberUsing this phase you can remove this control-plane node's etcd member from the etcd cluster.SynopsisRemove a local etcd member for a control plane node.kubeadm reset phase remove-etcd-member [flags] Options--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for remove-etcd-member--kubeconfig string Default: "/etc/kubernetes/admin.conf"The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.Options inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.kubeadm reset phase cleanup-nodeUsing this phase you can perform cleanup on this node.SynopsisRun cleanup node.kubeadm reset phase cleanup-node [flags] Options--cert-dir string Default: "/etc/kubernetes/pki"The path to the directory where the certificates are stored. If specified, clean this directory.--cleanup-tmp-dirCleanup the "/etc/kubernetes/tmp" directory--cri-socket stringPath to the CRI socket to connect. If empty kubeadm will try to auto-detect this value; use this option only if you have more than one CRI installed or if you have non-standard CRI socket.--dry-runDon't apply any changes; just output what would be done.-h, --helphelp for cleanup-nodeOptions inherited from parent commands--rootfs stringThe path to the 'real' host root filesystem. This will cause kubeadm to chroot into the provided path.What's nextkubeadm init to bootstrap a Kubernetes control-plane nodekubeadm join to connect a node to the clusterkubeadm reset to revert any changes made to this host by kubeadm init or kubeadm joinkubeadm alpha to try experimental functionality

kubeadm reset phase


kube-apiserver Admission (v1)Resource TypesAdmissionReviewAdmissionReviewAdmissionReview describes an admission review request/response.FieldDescriptionapiVersionstringadmission.k8s.io/v1kindstringAdmissionReviewrequestAdmissionRequestRequest describes the attributes for the admission request.responseAdmissionResponseResponse describes the attributes for the admission response.AdmissionRequestAppears in:AdmissionReviewAdmissionRequest describes the admission.Attributes for the admission request.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. It allows us to distinguish instances of requests which are otherwise identical (parallel requests, requests when earlier requests did not modify etc) The UID is meant to track the round trip (request/response) between the KAS and the WebHook, not the user request. It is suitable for correlating log entries between the webhook and apiserver, for either auditing or debugging.kind [Required]meta/v1.GroupVersionKindKind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale)resource [Required]meta/v1.GroupVersionResourceResource is the fully-qualified resource being requested (for example, v1.pods)subResourcestringSubResource is the subresource being requested, if any (for example, "status" or "scale")requestKindmeta/v1.GroupVersionKindRequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). If this is specified and differs from the value in "kind", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with kind: {group:"apps", version:"v1", kind:"Deployment"} (matching the rule the webhook registered for), and requestKind: {group:"apps", version:"v1beta1", kind:"Deployment"} (indicating the kind of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type for more details.requestResourcemeta/v1.GroupVersionResourceRequestResource is the fully-qualified resource of the original API request (for example, v1.pods). If this is specified and differs from the value in "resource", an equivalent match and conversion was performed.For example, if deployments can be modified via apps/v1 and apps/v1beta1, and a webhook registered a rule of apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"] and matchPolicy: Equivalent, an API request to apps/v1beta1 deployments would be converted and sent to the webhook with resource: {group:"apps", version:"v1", resource:"deployments"} (matching the resource the webhook registered for), and requestResource: {group:"apps", version:"v1beta1", resource:"deployments"} (indicating the resource of the original API request).See documentation for the "matchPolicy" field in the webhook configuration type.requestSubResourcestringRequestSubResource is the name of the subresource of the original API request, if any (for example, "status" or "scale") If this is specified and differs from the value in "subResource", an equivalent match and conversion was performed. See documentation for the "matchPolicy" field in the webhook configuration type.namestringName is the name of the object as presented in the request. On a CREATE operation, the client may omit name and rely on the server to generate the name. If that is the case, this field will contain an empty string.namespacestringNamespace is the namespace associated with the request (if any).operation [Required]OperationOperation is the operation being performed. This may be different than the operation requested. e.g. a patch can result in either a CREATE or UPDATE Operation.userInfo [Required]authentication/v1.UserInfoUserInfo is information about the requesting userobjectk8s.io/apimachinery/pkg/runtime.RawExtensionObject is the object from the incoming request.oldObjectk8s.io/apimachinery/pkg/runtime.RawExtensionOldObject is the existing object. Only populated for DELETE and UPDATE requests.dryRunboolDryRun indicates that modifications will definitely not be persisted for this request. Defaults to false.optionsk8s.io/apimachinery/pkg/runtime.RawExtensionOptions is the operation option structure of the operation being performed. e.g. meta.k8s.io/v1.DeleteOptions or meta.k8s.io/v1.CreateOptions. This may be different than the options the caller provided. e.g. for a patch request the performed Operation might be a CREATE, in which case the Options will a meta.k8s.io/v1.CreateOptions even though the caller provided meta.k8s.io/v1.PatchOptions.AdmissionResponseAppears in:AdmissionReviewAdmissionResponse describes an admission response.FieldDescriptionuid [Required]k8s.io/apimachinery/pkg/types.UIDUID is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest.allowed [Required]boolAllowed indicates whether or not the admission request was permitted.statusmeta/v1.StatusResult contains extra details into why an admission request was denied. This field IS NOT consulted in any way if "Allowed" is "true".patch[]byteThe patch body. Currently we only support "JSONPatch" which implements RFC 6902.patchTypePatchTypeThe type of Patch. Currently we only allow "JSONPatch".auditAnnotationsmap[string]stringAuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by the admission webhook to add additional context to the audit log for this request.warnings[]stringwarnings is a list of warning messages to return to the requesting API client. Warning messages describe a problem the client making the API request should correct or be aware of. Limit warnings to 120 characters if possible. Warnings over 256 characters and large numbers of warnings may be truncated.Operation(Alias of string)Appears in:AdmissionRequestOperation is the type of resource operation being checked for admission controlPatchType(Alias of string)Appears in:AdmissionResponsePatchType is the type of patch being used to represent the mutated objectThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

kube-apiserver Admission (v1)


VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"VolumeAttachmentVolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.VolumeAttachment objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentmetadata (ObjectMeta)Standard object metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (VolumeAttachmentSpec), requiredspec represents specification of the desired attach/detach volume behavior. Populated by the Kubernetes system.status (VolumeAttachmentStatus)status represents status of the VolumeAttachment request. Populated by the entity completing the attach or detach operation, i.e. the external-attacher.VolumeAttachmentSpecVolumeAttachmentSpec is the specification of a VolumeAttachment request.attacher (string), requiredattacher indicates the name of the volume driver that MUST handle this request. This is the name returned by GetPluginName().nodeName (string), requirednodeName represents the node that the volume should be attached to.source (VolumeAttachmentSource), requiredsource represents the volume that should be attached.VolumeAttachmentSource represents a volume that should be attached. Right now only PersistentVolumes can be attached via external attacher, in the future we may allow also inline volumes in pods. Exactly one member can be set.source.inlineVolumeSpec (PersistentVolumeSpec)inlineVolumeSpec contains all the information necessary to attach a persistent volume defined by a pod's inline VolumeSource. This field is populated only for the CSIMigration feature. It contains translated fields from a pod's inline VolumeSource to a PersistentVolumeSpec. This field is beta-level and is only honored by servers that enabled the CSIMigration feature.source.persistentVolumeName (string)persistentVolumeName represents the name of the persistent volume to attach.VolumeAttachmentStatusVolumeAttachmentStatus is the status of a VolumeAttachment request.attached (boolean), requiredattached indicates the volume is successfully attached. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.attachError (VolumeError)attachError represents the last error encountered during attach operation, if any. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.attachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.attachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so it should not contain sensitive information.attachError.time (Time)time represents the time the error was encountered.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.attachmentMetadata (map[string]string)attachmentMetadata is populated with any information returned by the attach operation, upon successful attach, that must be passed into subsequent WaitForAttach or Mount calls. This field must only be set by the entity completing the attach operation, i.e. the external-attacher.detachError (VolumeError)detachError represents the last error encountered during detach operation, if any. This field must only be set by the entity completing the detach operation, i.e. the external-attacher.VolumeError captures an error encountered during a volume operation.detachError.errorCode (int32)errorCode is a numeric gRPC code representing the error encountered during Attach or Detach operations.This is an optional, beta field that requires the MutableCSINodeAllocatableCount feature gate being enabled to be set.detachError.message (string)message represents the error encountered during Attach or Detach operation. This string may be logged, so it should not contain sensitive information.detachError.time (Time)time represents the time the error was encountered.Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.VolumeAttachmentListVolumeAttachmentList is a collection of VolumeAttachment objects.apiVersion: storage.k8s.io/v1kind: VolumeAttachmentListmetadata (ListMeta)Standard list metadata More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataitems ([]VolumeAttachment), requireditems is the list of VolumeAttachmentsOperationsget read the specified VolumeAttachmentHTTP RequestGET /apis/storage.k8s.io/v1/volumeattachments/{name}Parametersname (in path): string, requiredname of the VolumeAttachmentpretty (in query): stringprettyResponse200 (VolumeAttachment): OK401: Unauthorizedget read status of the specified VolumeAttachmentHTTP RequestGET /apis/storage.k8s.io/v1/volumeattachments/{name}/statusParametersname (in path): string, requiredname of the VolumeAttachmentpretty (in query): stringprettyResponse200 (VolumeAttachment): OK401: Unauthorizedlist list or watch objects of kind VolumeAttachmentHTTP RequestGET /apis/storage.k8s.io/v1/volumeattachmentsParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (VolumeAttachmentList): OK401: Unauthorizedcreate create a VolumeAttachmentHTTP RequestPOST /apis/storage.k8s.io/v1/volumeattachmentsParametersbody: VolumeAttachment, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (VolumeAttachment): OK201 (VolumeAttachment): Created202 (VolumeAttachment): Accepted401: Unauthorizedupdate replace the specified VolumeAttachmentHTTP RequestPUT /apis/storage.k8s.io/v1/volumeattachments/{name}Parametersname (in path): string, requiredname of the VolumeAttachmentbody: VolumeAttachment, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (VolumeAttachment): OK201 (VolumeAttachment): Created401: Unauthorizedupdate replace status of the specified VolumeAttachmentHTTP RequestPUT /apis/storage.k8s.io/v1/volumeattachments/{name}/statusParametersname (in path): string, requiredname of the VolumeAttachmentbody: VolumeAttachment, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationpretty (in query): stringprettyResponse200 (VolumeAttachment): OK201 (VolumeAttachment): Created401: Unauthorizedpatch partially update the specified VolumeAttachmentHTTP RequestPATCH /apis/storage.k8s.io/v1/volumeattachments/{name}Parametersname (in path): string, requiredname of the VolumeAttachmentbody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (VolumeAttachment): OK201 (VolumeAttachment): Created401: Unauthorizedpatch partially update status of the specified VolumeAttachmentHTTP RequestPATCH /apis/storage.k8s.io/v1/volumeattachments/{name}/statusParametersname (in path): string, requiredname of the VolumeAttachmentbody: Patch, requireddryRun (in query): stringdryRunfieldManager (in query): stringfieldManagerfieldValidation (in query): stringfieldValidationforce (in query): booleanforcepretty (in query): stringprettyResponse200 (VolumeAttachment): OK201 (VolumeAttachment): Created401: Unauthorizeddelete delete a VolumeAttachmentHTTP RequestDELETE /apis/storage.k8s.io/v1/volumeattachments/{name}Parametersname (in path): string, requiredname of the VolumeAttachmentbody: DeleteOptionsdryRun (in query): stringdryRungracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentialpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyResponse200 (VolumeAttachment): OK202 (VolumeAttachment): Accepted401: Unauthorizeddeletecollection delete collection of VolumeAttachmentHTTP RequestDELETE /apis/storage.k8s.io/v1/volumeattachmentsParametersbody: DeleteOptionscontinue (in query): stringcontinuedryRun (in query): stringdryRunfieldSelector (in query): stringfieldSelectorgracePeriodSeconds (in query): integergracePeriodSecondsignoreStoreReadErrorWithClusterBreakingPotential (in query): booleanignoreStoreReadErrorWithClusterBreakingPotentiallabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettypropagationPolicy (in query): stringpropagationPolicyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondsResponse200 (Status): OK401: UnauthorizedThis page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.

VolumeAttachment