Question: What is DownwardAPIVolumeFile?

Answer: D o w n w a r d A P I V o l u m e F i l e   r e p r e s e n t s   i n f o r m a t i o n   t o   c r e a t e   t h e   f i l e   c o n t a i n i n g   t h e   p o d   f i e l d   p a t h   ( s t r i n g ) ,   r e q u i r e d R e q u i r e d :   P a t h   i s   t h e   r e l a t i v e   p a t h   n a m e   o f   t h e   f i l e   t o   b e   c r e a t e d .   M u s t   n o t   b e   a b s o l u t e   o r   c o n t a i n   t h e   ' . . '   p a t h .   M u s t   b e   u t f - 8   e n c o d e d .   T h e   f i r s t   i t e m   o f   t h e   r e l a t i v e   p a t h   m u s t   n o t   s t a r t   w i t h   ' . . ' f i e l d R e f   ( O b j e c t F i e l d S e l e c t o r ) R e q u i r e d :   S e l e c t s   a   f i e l d   o f   t h e   p o d :   o n l y   a n n o t a t i o n s ,   l a b e l s ,   n a m e ,   n a m e s p a c e   a n d   u i d   a r e   s u p p o r t e d . m o d e   ( i n t 3 2 ) O p t i o n a l :   m o d e   b i t s   u s e d   t o   s e t   p e r m i s s i o n s   o n   t h i s   f i l e ,   m u s t   b e   a n   o c t a l   v a l u e   b e t w e e n   0 0 0 0   a n d   0 7 7 7   o r   a   d e c i m a l   v a l u e   b e t w e e n   0   a n d   5 1 1 .   Y A M L   a c c e p t s   b o t h   o c t a l   a n d   d e c i m a l   v a l u e s ,   J S O N   r e q u i r e s   d e c i m a l   v a l u e s   f o r   m o d e   b i t s .   I f   n o t   s p e c i f i e d ,   t h e   v o l u m e   d e f a u l t M o d e   w i l l   b e   u s e d .   T h i s   m i g h t   b e   i n   c o n f l i c t   w i t h   o t h e r   o p t i o n s   t h a t   a f f e c t   t h e   f i l e   m o d e ,   l i k e   f s G r o u p ,   a n d   t h e   r e s u l t   c a n   b e   o t h e r   m o d e   b i t s   s e t . r e s o u r c e F i e l d R e f   ( R e s o u r c e F i e l d S e l e c t o r ) S e l e c t s   a   r e s o u r c e   o f   t h e   c o n t a i n e r :   o n l y   r e s o u r c e s   l i m i t s   a n d   r e q u e s t s   ( l i m i t s . c p u ,   l i m i t s . m e


Question: What is KeyToPath?

Answer: M a p s   a   s t r i n g   k e y   t o   a   p a t h   w i t h i n   a   v o l u m e .   k e y   ( s t r i n g ) ,   r e q u i r e d k e y   i s   t h e   k e y   t o   p r o j e c t . p a t h   ( s t r i n g ) ,   r e q u i r e d p a t h   i s   t h e   r e l a t i v e   p a t h   o f   t h e   f i l e   t o   m a p   t h e   k e y   t o .   M a y   n o t   b e   a n   a b s o l u t e   p a t h .   M a y   n o t   c o n t a i n   t h e   p a t h   e l e m e n t   ' . . ' .   M a y   n o t   s t a r t   w i t h   t h e   s t r i n g   ' . . ' . m o d e   ( i n t 3 2 ) m o d e   i s   O p t i o n a l :   m o d e   b i t s   u s e d   t o   s e t   p e r m i s s i o n s   o n   t h i s   f i l e .   M u s t   b e   a n   o c t a l   v a l u e   b e t w e e n   0 0 0 0   a n d   0 7 7 7   o r   a   d e c i m a l   v a l u e   b e t w e e n   0   a n d   5 1 1 .   Y A M L   a c c e p t s   b o t h   o c t a l   a n d   d e c i m a l   v a l u e s ,   J S O N   r e q u i r e s   d e c i m a l   v a l u e s   f o r   m o d e   b i t s .   I f   n o t   s p e c i f i e d ,   t h e   v o l u m e   d e f a u l t M o d e   w i l l   b e   u s e d .   T h i s   m i g h t   b e   i n   c o n f l i c t   w i t h   o t h e r   o p t i o n s   t h a t   a f f e c t   t h e   f i l e   m o d e ,   l i k e   f s G r o u p ,   a n d   t h e   r e s u l t   c a n   b e   o t h e r   m o d e   b i t s   s e t .   k e y   ( s t r i n g ) ,   r e q u i r e d   k e y   i s   t h e   k e y   t o   p r o j e c t .   p a t h   ( s t r i n g ) ,   r e q u i r e d   p a t h   i s   t h e   r e l a t i v e   p a t h   o f   t h e   f i l e   t o   m a p   t h e   k e y   t o .   M a y   n o t   b e   a n   a b s o l u t e   p a t h .   M a y   n o t   c o n t a i n   t h e   p a t h   e l e m e n t   ' . . ' .   M a y   n o t   s t a r t   w i t h   t h e   s t r i n g   ' . . ' .   m o d e   ( i n t 3 2 )   m o d e   i s   O p t i o n a l :   m o d e   b i t s   u s e d   t o   s e t   p e r


Question: What is Multi-tenancy?

Answer: Multi-tenancyThis page provides an overview of available configuration options and best practices for cluster multi-tenancy.Sharing clusters saves costs and simplifies administration. However, sharing clusters also presents challenges such as security, fairness, and managing noisy neighbors.Clusters can be shared in many ways. In some cases, different applications may run in the same cluster. In other cases, multiple instances of the same application may run in the same cluster, one for each end user. All these types of sharing are frequently described using the umbrella term multi-tenancy.While Kubernetes does not have first-class concepts of end users or tenants, it provides several features to help manage different tenancy requirements. These are discussed below.Use casesThe first step to determining how to share your cluster is understanding your use case, so you can evaluate the patterns and tools available. In general, multi-tenancy in Kubernetes clusters falls into two broad categories, though many variations and hybrids are also possible.Multiple teamsA common form of multi-tenancy is to share a cluster between multiple teams within an organization, each of whom may operate one or more workloads. These workloads frequently need to communicate with each other, and with other workloads located on the same or different clusters.In this scenario, members of the teams often have direct access to Kubernetes resources via tools such as kubectl, or indirect access through GitOps controllers or other types of release automation tools. There is often some level of trust between members of different teams, but Kubernetes policies such as RBAC, quotas, and network policies are essential to safely and fairly share clusters.Multiple customersThe other major form of multi-tenancy frequently involves a Software-as-a-Service (SaaS) vendor running multiple instances of a workload for customers. This business model is so strongly associated with this deployment style that many people call it "SaaS tenancy." However, a better term might be "multi-customer tenancy," since SaaS vendors may also use other deployment models, and this deployment model can also be used outside of SaaS.In this scenario, the customers do not have access to the cluster; Kubernetes is invisible from their perspective and is only used by the vendor to manage the workloads. Cost optimization is frequently a critical concern, and Kubernetes policies are used to ensure that the workloads are strongly isolated from each other.TerminologyTenantsWhen discussing multi-tenancy in Kubernetes, there is no single definition for a "tenant". Rather, the definition of a tenant will vary depending on whether multi-team or multi-customer tenancy is being discussed.In multi-team usage, a tenant is typically a team, where each team typically deploys a small number of workloads that scales with the complexity of the service. However, the definition of "team" may itself be fuzzy, as teams may be organized


Question: How does Multi-tenancy work?

Answer: Multi-tenancyThis page provides an overview of available configuration options and best practices for cluster multi-tenancy.Sharing clusters saves costs and simplifies administration. However, sharing clusters also presents challenges such as security, fairness, and managing noisy neighbors.Clusters can be shared in many ways. In some cases, different applications may run in the same cluster. In other cases, multiple instances of the same application may run in the same cluster, one for each end user. All these types of sharing are frequently described using the umbrella term multi-tenancy.While Kubernetes does not have first-class concepts of end users or tenants, it provides several features to help manage different tenancy requirements. These are discussed below.Use casesThe first step to determining how to share your cluster is understanding your use case, so you can evaluate the patterns and tools available. In general, multi-tenancy in Kubernetes clusters falls into two broad categories, though many variations and hybrids are also possible.Multiple teamsA common form of multi-tenancy is to share a cluster between multiple teams within an organization, each of whom may operate one or more workloads. These workloads frequently need to communicate with each other, and with other workloads located on the same or different clusters.In this scenario, members of the teams often have direct access to Kubernetes resources via tools such as kubectl, or indirect access through GitOps controllers or other types of release automation tools. There is often some level of trust between members of different teams, but Kubernetes policies such as RBAC, quotas, and network policies are essential to safely and fairly share clusters.Multiple customersThe other major form of multi-tenancy frequently involves a Software-as-a-Service (SaaS) vendor running multiple instances of a workload for customers. This business model is so strongly associated with this deployment style that many people call it "SaaS tenancy." However, a better term might be "multi-customer tenancy," since SaaS vendors may also use other deployment models, and this deployment model can also be used outside of SaaS.In this scenario, the customers do not have access to the cluster; Kubernetes is invisible from their perspective and is only used by the vendor to manage the workloads. Cost optimization is frequently a critical concern, and Kubernetes policies are used to ensure that the workloads are strongly isolated from each other.TerminologyTenantsWhen discussing multi-tenancy in Kubernetes, there is no single definition for a "tenant". Rather, the definition of a tenant will vary depending on whether multi-team or multi-customer tenancy is being discussed.In multi-team usage, a tenant is typically a team, where each team typically deploys a small number of workloads that scales with the complexity of the service. However, the definition of "team" may itself be fuzzy, as teams may be organized


Question: When would you use Multi-tenancy?

Answer: Multi-tenancyThis page provides an overview of available configuration options and best practices for cluster multi-tenancy.Sharing clusters saves costs and simplifies administration. However, sharing clusters also presents challenges such as security, fairness, and managing noisy neighbors.Clusters can be shared in many ways. In some cases, different applications may run in the same cluster. In other cases, multiple instances of the same application may run in the same cluster, one for each end user. All these types of sharing are frequently described using the umbrella term multi-tenancy.While Kubernetes does not have first-class concepts of end users or tenants, it provides several features to help manage different tenancy requirements. These are discussed below.Use casesThe first step to determining how to share your cluster is understanding your use case, so you can evaluate the patterns and tools available. In general, multi-tenancy in Kubernetes clusters falls into two broad categories, though many variations and hybrids are also possible.Multiple teamsA common form of multi-tenancy is to share a cluster between multiple teams within an organization, each of whom may operate one or more workloads. These workloads frequently need to communicate with each other, and with other workloads located on the same or different clusters.In this scenario, members of the teams often have direct access to Kubernetes resources via tools such as kubectl, or indirect access through GitOps controllers or other types of release automation tools. There is often some level of trust between members of different teams, but Kubernetes policies such as RBAC, quotas, and network policies are essential to safely and fairly share clusters.Multiple customersThe other major form of multi-tenancy frequently involves a Software-as-a-Service (SaaS) vendor running multiple instances of a workload for customers. This business model is so strongly associated with this deployment style that many people call it "SaaS tenancy." However, a better term might be "multi-customer tenancy," since SaaS vendors may also use other deployment models, and this deployment model can also be used outside of SaaS.In this scenario, the customers do not have access to the cluster; Kubernetes is invisible from their perspective and is only used by the vendor to manage the workloads. Cost optimization is frequently a critical concern, and Kubernetes policies are used to ensure that the workloads are strongly isolated from each other.TerminologyTenantsWhen discussing multi-tenancy in Kubernetes, there is no single definition for a "tenant". Rather, the definition of a tenant will vary depending on whether multi-team or multi-customer tenancy is being discussed.In multi-team usage, a tenant is typically a team, where each team typically deploys a small number of workloads that scales with the complexity of the service. However, the definition of "team" may itself be fuzzy, as teams may be organized


Question: What are the benefits of Multi-tenancy?

Answer: Multi-tenancyThis page provides an overview of available configuration options and best practices for cluster multi-tenancy.Sharing clusters saves costs and simplifies administration. However, sharing clusters also presents challenges such as security, fairness, and managing noisy neighbors.Clusters can be shared in many ways. In some cases, different applications may run in the same cluster. In other cases, multiple instances of the same application may run in the same cluster, one for each end user. All these types of sharing are frequently described using the umbrella term multi-tenancy.While Kubernetes does not have first-class concepts of end users or tenants, it provides several features to help manage different tenancy requirements. These are discussed below.Use casesThe first step to determining how to share your cluster is understanding your use case, so you can evaluate the patterns and tools available. In general, multi-tenancy in Kubernetes clusters falls into two broad categories, though many variations and hybrids are also possible.Multiple teamsA common form of multi-tenancy is to share a cluster between multiple teams within an organization, each of whom may operate one or more workloads. These workloads frequently need to communicate with each other, and with other workloads located on the same or different clusters.In this scenario, members of the teams often have direct access to Kubernetes resources via tools such as kubectl, or indirect access through GitOps controllers or other types of release automation tools. There is often some level of trust between members of different teams, but Kubernetes policies such as RBAC, quotas, and network policies are essential to safely and fairly share clusters.Multiple customersThe other major form of multi-tenancy frequently involves a Software-as-a-Service (SaaS) vendor running multiple instances of a workload for customers. This business model is so strongly associated with this deployment style that many people call it "SaaS tenancy." However, a better term might be "multi-customer tenancy," since SaaS vendors may also use other deployment models, and this deployment model can also be used outside of SaaS.In this scenario, the customers do not have access to the cluster; Kubernetes is invisible from their perspective and is only used by the vendor to manage the workloads. Cost optimization is frequently a critical concern, and Kubernetes policies are used to ensure that the workloads are strongly isolated from each other.TerminologyTenantsWhen discussing multi-tenancy in Kubernetes, there is no single definition for a "tenant". Rather, the definition of a tenant will vary depending on whether multi-team or multi-customer tenancy is being discussed.In multi-team usage, a tenant is typically a team, where each team typically deploys a small number of workloads that scales with the complexity of the service. However, the definition of "team" may itself be fuzzy, as teams may be organized


Question: What is Multi-tenancy?

Answer: T h i s   p a g e   p r o v i d e s   a n   o v e r v i e w   o f   a v a i l a b l e   c o n f i g u r a t i o n   o p t i o n s   a n d   b e s t   p r a c t i c e s   f o r   c l u s t e r   m u l t i - t e n a n c y .   S h a r i n g   c l u s t e r s   s a v e s   c o s t s   a n d   s i m p l i f i e s   a d m i n i s t r a t i o n .   H o w e v e r ,   s h a r i n g   c l u s t e r s   a l s o   p r e s e n t s   c h a l l e n g e s   s u c h   a s   s e c u r i t y ,   f a i r n e s s ,   a n d   m a n a g i n g   n o i s y   n e i g h b o r s .   C l u s t e r s   c a n   b e   s h a r e d   i n   m a n y   w a y s .   I n   s o m e   c a s e s ,   d i f f e r e n t   a p p l i c a t i o n s   m a y   r u n   i n   t h e   s a m e   c l u s t e r .   I n   o t h e r   c a s e s ,   m u l t i p l e   i n s t a n c e s   o f   t h e   s a m e   a p p l i c a t i o n   m a y   r u n   i n   t h e   s a m e   c l u s t e r ,   o n e   f o r   e a c h   e n d   u s e r .   A l l   t h e s e   t y p e s   o f   s h a r i n g   a r e   f r e q u e n t l y   d e s c r i b e d   u s i n g   t h e   u m b r e l l a   t e r m   m u l t i - t e n a n c y .   W h i l e   K u b e r n e t e s   d o e s   n o t   h a v e   f i r s t - c l a s s   c o n c e p t s   o f   e n d   u s e r s   o r   t e n a n t s ,   i t   p r o v i d e s   s e v e r a l   f e a t u r e s   t o   h e l p   m a n a g e   d i f f e r e n t   t e n a n c y   r e q u i r e m e n t s .   T h e s e   a r e   d i s c u s s e d   b e l o w .


Question: What is Use cases?

Answer: T h e   f i r s t   s t e p   t o   d e t e r m i n i n g   h o w   t o   s h a r e   y o u r   c l u s t e r   i s   u n d e r s t a n d i n g   y o u r   u s e   c a s e ,   s o   y o u   c a n   e v a l u a t e   t h e   p a t t e r n s   a n d   t o o l s   a v a i l a b l e .   I n   g e n e r a l ,   m u l t i - t e n a n c y   i n   K u b e r n e t e s   c l u s t e r s   f a l l s   i n t o   t w o   b r o a d   c a t e g o r i e s ,   t h o u g h   m a n y   v a r i a t i o n s   a n d   h y b r i d s   a r e   a l s o   p o s s i b l e .


Question: What is Multiple teams?

Answer: A   c o m m o n   f o r m   o f   m u l t i - t e n a n c y   i s   t o   s h a r e   a   c l u s t e r   b e t w e e n   m u l t i p l e   t e a m s   w i t h i n   a n   o r g a n i z a t i o n ,   e a c h   o f   w h o m   m a y   o p e r a t e   o n e   o r   m o r e   w o r k l o a d s .   T h e s e   w o r k l o a d s   f r e q u e n t l y   n e e d   t o   c o m m u n i c a t e   w i t h   e a c h   o t h e r ,   a n d   w i t h   o t h e r   w o r k l o a d s   l o c a t e d   o n   t h e   s a m e   o r   d i f f e r e n t   c l u s t e r s .   I n   t h i s   s c e n a r i o ,   m e m b e r s   o f   t h e   t e a m s   o f t e n   h a v e   d i r e c t   a c c e s s   t o   K u b e r n e t e s   r e s o u r c e s   v i a   t o o l s   s u c h   a s   k u b e c t l ,   o r   i n d i r e c t   a c c e s s   t h r o u g h   G i t O p s   c o n t r o l l e r s   o r   o t h e r   t y p e s   o f   r e l e a s e   a u t o m a t i o n   t o o l s .   T h e r e   i s   o f t e n   s o m e   l e v e l   o f   t r u s t   b e t w e e n   m e m b e r s   o f   d i f f e r e n t   t e a m s ,   b u t   K u b e r n e t e s   p o l i c i e s   s u c h   a s   R B A C ,   q u o t a s ,   a n d   n e t w o r k   p o l i c i e s   a r e   e s s e n t i a l   t o   s a f e l y   a n d   f a i r l y   s h a r e   c l u s t e r s .


Question: What is Multiple customers?

Answer: T h e   o t h e r   m a j o r   f o r m   o f   m u l t i - t e n a n c y   f r e q u e n t l y   i n v o l v e s   a   S o f t w a r e - a s - a - S e r v i c e   ( S a a S )   v e n d o r   r u n n i n g   m u l t i p l e   i n s t a n c e s   o f   a   w o r k l o a d   f o r   c u s t o m e r s .   T h i s   b u s i n e s s   m o d e l   i s   s o   s t r o n g l y   a s s o c i a t e d   w i t h   t h i s   d e p l o y m e n t   s t y l e   t h a t   m a n y   p e o p l e   c a l l   i t   " S a a S   t e n a n c y . "   H o w e v e r ,   a   b e t t e r   t e r m   m i g h t   b e   " m u l t i - c u s t o m e r   t e n a n c y , "   s i n c e   S a a S   v e n d o r s   m a y   a l s o   u s e   o t h e r   d e p l o y m e n t   m o d e l s ,   a n d   t h i s   d e p l o y m e n t   m o d e l   c a n   a l s o   b e   u s e d   o u t s i d e   o f   S a a S .   I n   t h i s   s c e n a r i o ,   t h e   c u s t o m e r s   d o   n o t   h a v e   a c c e s s   t o   t h e   c l u s t e r ;   K u b e r n e t e s   i s   i n v i s i b l e   f r o m   t h e i r   p e r s p e c t i v e   a n d   i s   o n l y   u s e d   b y   t h e   v e n d o r   t o   m a n a g e   t h e   w o r k l o a d s .   C o s t   o p t i m i z a t i o n   i s   f r e q u e n t l y   a   c r i t i c a l   c o n c e r n ,   a n d   K u b e r n e t e s   p o l i c i e s   a r e   u s e d   t o   e n s u r e   t h a t   t h e   w o r k l o a d s   a r e   s t r o n g l y   i s o l a t e d   f r o m   e a c h   o t h e r .


Question: What is Tenants?

Answer: W h e n   d i s c u s s i n g   m u l t i - t e n a n c y   i n   K u b e r n e t e s ,   t h e r e   i s   n o   s i n g l e   d e f i n i t i o n   f o r   a   " t e n a n t " .   R a t h e r ,   t h e   d e f i n i t i o n   o f   a   t e n a n t   w i l l   v a r y   d e p e n d i n g   o n   w h e t h e r   m u l t i - t e a m   o r   m u l t i - c u s t o m e r   t e n a n c y   i s   b e i n g   d i s c u s s e d .   I n   m u l t i - t e a m   u s a g e ,   a   t e n a n t   i s   t y p i c a l l y   a   t e a m ,   w h e r e   e a c h   t e a m   t y p i c a l l y   d e p l o y s   a   s m a l l   n u m b e r   o f   w o r k l o a d s   t h a t   s c a l e s   w i t h   t h e   c o m p l e x i t y   o f   t h e   s e r v i c e .   H o w e v e r ,   t h e   d e f i n i t i o n   o f   " t e a m "   m a y   i t s e l f   b e   f u z z y ,   a s   t e a m s   m a y   b e   o r g a n i z e d   i n t o   h i g h e r - l e v e l   d i v i s i o n s   o r   s u b d i v i d e d   i n t o   s m a l l e r   t e a m s .   B y   c o n t r a s t ,   i f   e a c h   t e a m   d e p l o y s   d e d i c a t e d   w o r k l o a d s   f o r   e a c h   n e w   c l i e n t ,   t h e y   a r e   u s i n g   a   m u l t i - c u s t o m e r   m o d e l   o f   t e n a n c y .   I n   t h i s   c a s e ,   a   " t e n a n t "   i s   s i m p l y   a   g r o u p   o f   u s e r s   w h o   s h a r e   a   s i n g l e   w o r k l o a d .   T h i s   m a y   b e   a s   l a r g e   a s   a n   e n t i r e   c o m p a n y ,   o r   a s   s m a l l   a s   a   s i n g l e   t e a m   a t   t h a t   c o m p a n y .   I n   m a n y   c a s e s ,   t h e   s a m e   o r g a n i z a t i o n   m a y   u s e   b o t h   d e f i n i t i o n s   o f   " t e n a n t s "   i n   d i f f e r e n t   c o n t e x t s .   F o r   e x a m p l e ,   a   p l a t f o r m   t e a m   m a y   o f f e r   s h a r e d   s e r v i c e s   s u c h   a s   s e c u r i t y   t o o l s   a n d   d a t a b a s


Question: What is Isolation?

Answer: T h e r e   a r e   s e v e r a l   w a y s   t o   d e s i g n   a n d   b u i l d   m u l t i - t e n a n t   s o l u t i o n s   w i t h   K u b e r n e t e s .   E a c h   o f   t h e s e   m e t h o d s   c o m e s   w i t h   i t s   o w n   s e t   o f   t r a d e o f f s   t h a t   i m p a c t   t h e   i s o l a t i o n   l e v e l ,   i m p l e m e n t a t i o n   e f f o r t ,   o p e r a t i o n a l   c o m p l e x i t y ,   a n d   c o s t   o f   s e r v i c e .   A   K u b e r n e t e s   c l u s t e r   c o n s i s t s   o f   a   c o n t r o l   p l a n e   w h i c h   r u n s   K u b e r n e t e s   s o f t w a r e ,   a n d   a   d a t a   p l a n e   c o n s i s t i n g   o f   w o r k e r   n o d e s   w h e r e   t e n a n t   w o r k l o a d s   a r e   e x e c u t e d   a s   p o d s .   T e n a n t   i s o l a t i o n   c a n   b e   a p p l i e d   i n   b o t h   t h e   c o n t r o l   p l a n e   a n d   t h e   d a t a   p l a n e   b a s e d   o n   o r g a n i z a t i o n a l   r e q u i r e m e n t s .   T h e   l e v e l   o f   i s o l a t i o n   o f f e r e d   i s   s o m e t i m e s   d e s c r i b e d   u s i n g   t e r m s   l i k e   “ h a r d ”   m u l t i - t e n a n c y ,   w h i c h   i m p l i e s   s t r o n g   i s o l a t i o n ,   a n d   “ s o f t ”   m u l t i - t e n a n c y ,   w h i c h   i m p l i e s   w e a k e r   i s o l a t i o n .   I n   p a r t i c u l a r ,   " h a r d "   m u l t i - t e n a n c y   i s   o f t e n   u s e d   t o   d e s c r i b e   c a s e s   w h e r e   t h e   t e n a n t s   d o   n o t   t r u s t   e a c h   o t h e r ,   o f t e n   f r o m   s e c u r i t y   a n d   r e s o u r c e   s h a r i n g   p e r s p e c t i v e s   ( e . g .   g u a r d i n g   a g a i n s t   a t t a c k s   s u c h   a s   d a t a   e x f i l t r a t i o n   o r   D o S ) .   S i n c e   d a t a   p l a n e s   t y p i c a l l y   h a v e   m u c h   l a r g e r   a t t a c k   s u r f a c e


Question: What is Control plane isolation?

Answer: C o n t r o l   p l a n e   i s o l a t i o n   e n s u r e s   t h a t   d i f f e r e n t   t e n a n t s   c a n n o t   a c c e s s   o r   a f f e c t   e a c h   o t h e r s '   K u b e r n e t e s   A P I   r e s o u r c e s .


Question: What is Namespaces?

Answer: I n   K u b e r n e t e s ,   a   N a m e s p a c e   p r o v i d e s   a   m e c h a n i s m   f o r   i s o l a t i n g   g r o u p s   o f   A P I   r e s o u r c e s   w i t h i n   a   s i n g l e   c l u s t e r .   T h i s   i s o l a t i o n   h a s   t w o   k e y   d i m e n s i o n s :   O b j e c t   n a m e s   w i t h i n   a   n a m e s p a c e   c a n   o v e r l a p   w i t h   n a m e s   i n   o t h e r   n a m e s p a c e s ,   s i m i l a r   t o   f i l e s   i n   f o l d e r s .   T h i s   a l l o w s   t e n a n t s   t o   n a m e   t h e i r   r e s o u r c e s   w i t h o u t   h a v i n g   t o   c o n s i d e r   w h a t   o t h e r   t e n a n t s   a r e   d o i n g . M a n y   K u b e r n e t e s   s e c u r i t y   p o l i c i e s   a r e   s c o p e d   t o   n a m e s p a c e s .   F o r   e x a m p l e ,   R B A C   R o l e s   a n d   N e t w o r k   P o l i c i e s   a r e   n a m e s p a c e - s c o p e d   r e s o u r c e s .   U s i n g   R B A C ,   U s e r s   a n d   S e r v i c e   A c c o u n t s   c a n   b e   r e s t r i c t e d   t o   a   n a m e s p a c e .   O b j e c t   n a m e s   w i t h i n   a   n a m e s p a c e   c a n   o v e r l a p   w i t h   n a m e s   i n   o t h e r   n a m e s p a c e s ,   s i m i l a r   t o   f i l e s   i n   f o l d e r s .   T h i s   a l l o w s   t e n a n t s   t o   n a m e   t h e i r   r e s o u r c e s   w i t h o u t   h a v i n g   t o   c o n s i d e r   w h a t   o t h e r   t e n a n t s   a r e   d o i n g .   M a n y   K u b e r n e t e s   s e c u r i t y   p o l i c i e s   a r e   s c o p e d   t o   n a m e s p a c e s .   F o r   e x a m p l e ,   R B A C   R o l e s   a n d   N e t w o r k   P o l i c i e s   a r e   n a m e s p a c e - s c o p e d   r e s o u r c e s .   U s i n g   R B A C ,   U s e r s   a n d   S e r v i c e   A c c o u n t s   c a n   b e   r e s t r i c t e d   t o   a   n a m e s p a c e .   I n   a   m u l t i - t e n a n t   e


Question: What is Access controls?

Answer: T h e   m o s t   i m p o r t a n t   t y p e   o f   i s o l a t i o n   f o r   t h e   c o n t r o l   p l a n e   i s   a u t h o r i z a t i o n .   I f   t e a m s   o r   t h e i r   w o r k l o a d s   c a n   a c c e s s   o r   m o d i f y   e a c h   o t h e r s '   A P I   r e s o u r c e s ,   t h e y   c a n   c h a n g e   o r   d i s a b l e   a l l   o t h e r   t y p e s   o f   p o l i c i e s   t h e r e b y   n e g a t i n g   a n y   p r o t e c t i o n   t h o s e   p o l i c i e s   m a y   o f f e r .   A s   a   r e s u l t ,   i t   i s   c r i t i c a l   t o   e n s u r e   t h a t   e a c h   t e n a n t   h a s   t h e   a p p r o p r i a t e   a c c e s s   t o   o n l y   t h e   n a m e s p a c e s   t h e y   n e e d ,   a n d   n o   m o r e .   T h i s   i s   k n o w n   a s   t h e   " P r i n c i p l e   o f   L e a s t   P r i v i l e g e . "   R o l e - b a s e d   a c c e s s   c o n t r o l   ( R B A C )   i s   c o m m o n l y   u s e d   t o   e n f o r c e   a u t h o r i z a t i o n   i n   t h e   K u b e r n e t e s   c o n t r o l   p l a n e ,   f o r   b o t h   u s e r s   a n d   w o r k l o a d s   ( s e r v i c e   a c c o u n t s ) .   R o l e s   a n d   R o l e B i n d i n g s   a r e   K u b e r n e t e s   o b j e c t s   t h a t   a r e   u s e d   a t   a   n a m e s p a c e   l e v e l   t o   e n f o r c e   a c c e s s   c o n t r o l   i n   y o u r   a p p l i c a t i o n ;   s i m i l a r   o b j e c t s   e x i s t   f o r   a u t h o r i z i n g   a c c e s s   t o   c l u s t e r - l e v e l   o b j e c t s ,   t h o u g h   t h e s e   a r e   l e s s   u s e f u l   f o r   m u l t i - t e n a n t   c l u s t e r s .   I n   a   m u l t i - t e a m   e n v i r o n m e n t ,   R B A C   m u s t   b e   u s e d   t o   r e s t r i c t   t e n a n t s '   a c c e s s   t o   t h e   a p p r o p r i a t e   n a m e s p a c e s ,   a n d   e n s u r e   t h a t   c l u s t e r - w i d e   r e s o


Question: What is Quotas?

Answer: K u b e r n e t e s   w o r k l o a d s   c o n s u m e   n o d e   r e s o u r c e s ,   l i k e   C P U   a n d   m e m o r y .   I n   a   m u l t i - t e n a n t   e n v i r o n m e n t ,   y o u   c a n   u s e   R e s o u r c e   Q u o t a s   t o   m a n a g e   r e s o u r c e   u s a g e   o f   t e n a n t   w o r k l o a d s .   F o r   t h e   m u l t i p l e   t e a m s   u s e   c a s e ,   w h e r e   t e n a n t s   h a v e   a c c e s s   t o   t h e   K u b e r n e t e s   A P I ,   y o u   c a n   u s e   r e s o u r c e   q u o t a s   t o   l i m i t   t h e   n u m b e r   o f   A P I   r e s o u r c e s   ( f o r   e x a m p l e :   t h e   n u m b e r   o f   P o d s ,   o r   t h e   n u m b e r   o f   C o n f i g M a p s )   t h a t   a   t e n a n t   c a n   c r e a t e .   L i m i t s   o n   o b j e c t   c o u n t   e n s u r e   f a i r n e s s   a n d   a i m   t o   a v o i d   n o i s y   n e i g h b o r   i s s u e s   f r o m   a f f e c t i n g   o t h e r   t e n a n t s   t h a t   s h a r e   a   c o n t r o l   p l a n e .   R e s o u r c e   q u o t a s   a r e   n a m e s p a c e d   o b j e c t s .   B y   m a p p i n g   t e n a n t s   t o   n a m e s p a c e s ,   c l u s t e r   a d m i n s   c a n   u s e   q u o t a s   t o   e n s u r e   t h a t   a   t e n a n t   c a n n o t   m o n o p o l i z e   a   c l u s t e r ' s   r e s o u r c e s   o r   o v e r w h e l m   i t s   c o n t r o l   p l a n e .   N a m e s p a c e   m a n a g e m e n t   t o o l s   s i m p l i f y   t h e   a d m i n i s t r a t i o n   o f   q u o t a s .   I n   a d d i t i o n ,   w h i l e   K u b e r n e t e s   q u o t a s   o n l y   a p p l y   w i t h i n   a   s i n g l e   n a m e s p a c e ,   s o m e   n a m e s p a c e   m a n a g e m e n t   t o o l s   a l l o w   g r o u p s   o f   n a m e s p a c e s   t o   s h a r e   q u o t a s ,   g i v i n g   a d m i n i s t r a t o r s   f a r   m o r e   f l e x i b i l i t


Question: What is Data Plane Isolation?

Answer: D a t a   p l a n e   i s o l a t i o n   e n s u r e s   t h a t   p o d s   a n d   w o r k l o a d s   f o r   d i f f e r e n t   t e n a n t s   a r e   s u f f i c i e n t l y   i s o l a t e d .


Question: What is Network isolation?

Answer: B y   d e f a u l t ,   a l l   p o d s   i n   a   K u b e r n e t e s   c l u s t e r   a r e   a l l o w e d   t o   c o m m u n i c a t e   w i t h   e a c h   o t h e r ,   a n d   a l l   n e t w o r k   t r a f f i c   i s   u n e n c r y p t e d .   T h i s   c a n   l e a d   t o   s e c u r i t y   v u l n e r a b i l i t i e s   w h e r e   t r a f f i c   i s   a c c i d e n t a l l y   o r   m a l i c i o u s l y   s e n t   t o   a n   u n i n t e n d e d   d e s t i n a t i o n ,   o r   i s   i n t e r c e p t e d   b y   a   w o r k l o a d   o n   a   c o m p r o m i s e d   n o d e .   P o d - t o - p o d   c o m m u n i c a t i o n   c a n   b e   c o n t r o l l e d   u s i n g   N e t w o r k   P o l i c i e s ,   w h i c h   r e s t r i c t   c o m m u n i c a t i o n   b e t w e e n   p o d s   u s i n g   n a m e s p a c e   l a b e l s   o r   I P   a d d r e s s   r a n g e s .   I n   a   m u l t i - t e n a n t   e n v i r o n m e n t   w h e r e   s t r i c t   n e t w o r k   i s o l a t i o n   b e t w e e n   t e n a n t s   i s   r e q u i r e d ,   s t a r t i n g   w i t h   a   d e f a u l t   p o l i c y   t h a t   d e n i e s   c o m m u n i c a t i o n   b e t w e e n   p o d s   i s   r e c o m m e n d e d   w i t h   a n o t h e r   r u l e   t h a t   a l l o w s   a l l   p o d s   t o   q u e r y   t h e   D N S   s e r v e r   f o r   n a m e   r e s o l u t i o n .   W i t h   s u c h   a   d e f a u l t   p o l i c y   i n   p l a c e ,   y o u   c a n   b e g i n   a d d i n g   m o r e   p e r m i s s i v e   r u l e s   t h a t   a l l o w   f o r   c o m m u n i c a t i o n   w i t h i n   a   n a m e s p a c e .   I t   i s   a l s o   r e c o m m e n d e d   n o t   t o   u s e   e m p t y   l a b e l   s e l e c t o r   ' { } '   f o r   n a m e s p a c e S e l e c t o r   f i e l d   i n   n e t w o r k   p o l i c y   d e f i n i t i o n ,   i n   c a s e   t r a f f i c   n e e d   t o   b e   a l l o w e d


Question: What is Warning:?

Answer: M o r e   a d v a n c e d   n e t w o r k   i s o l a t i o n   m a y   b e   p r o v i d e d   b y   s e r v i c e   m e s h e s ,   w h i c h   p r o v i d e   O S I   L a y e r   7   p o l i c i e s   b a s e d   o n   w o r k l o a d   i d e n t i t y ,   i n   a d d i t i o n   t o   n a m e s p a c e s .   T h e s e   h i g h e r - l e v e l   p o l i c i e s   c a n   m a k e   i t   e a s i e r   t o   m a n a g e   n a m e s p a c e - b a s e d   m u l t i - t e n a n c y ,   e s p e c i a l l y   w h e n   m u l t i p l e   n a m e s p a c e s   a r e   d e d i c a t e d   t o   a   s i n g l e   t e n a n t .   T h e y   f r e q u e n t l y   a l s o   o f f e r   e n c r y p t i o n   u s i n g   m u t u a l   T L S ,   p r o t e c t i n g   y o u r   d a t a   e v e n   i n   t h e   p r e s e n c e   o f   a   c o m p r o m i s e d   n o d e ,   a n d   w o r k   a c r o s s   d e d i c a t e d   o r   v i r t u a l   c l u s t e r s .   H o w e v e r ,   t h e y   c a n   b e   s i g n i f i c a n t l y   m o r e   c o m p l e x   t o   m a n a g e   a n d   m a y   n o t   b e   a p p r o p r i a t e   f o r   a l l   u s e r s .


Question: What is Storage isolation?

Answer: K u b e r n e t e s   o f f e r s   s e v e r a l   t y p e s   o f   v o l u m e s   t h a t   c a n   b e   u s e d   a s   p e r s i s t e n t   s t o r a g e   f o r   w o r k l o a d s .   F o r   s e c u r i t y   a n d   d a t a - i s o l a t i o n ,   d y n a m i c   v o l u m e   p r o v i s i o n i n g   i s   r e c o m m e n d e d   a n d   v o l u m e   t y p e s   t h a t   u s e   n o d e   r e s o u r c e s   s h o u l d   b e   a v o i d e d .   S t o r a g e C l a s s e s   a l l o w   y o u   t o   d e s c r i b e   c u s t o m   " c l a s s e s "   o f   s t o r a g e   o f f e r e d   b y   y o u r   c l u s t e r ,   b a s e d   o n   q u a l i t y - o f - s e r v i c e   l e v e l s ,   b a c k u p   p o l i c i e s ,   o r   c u s t o m   p o l i c i e s   d e t e r m i n e d   b y   t h e   c l u s t e r   a d m i n i s t r a t o r s .   P o d s   c a n   r e q u e s t   s t o r a g e   u s i n g   a   P e r s i s t e n t V o l u m e C l a i m .   A   P e r s i s t e n t V o l u m e C l a i m   i s   a   n a m e s p a c e d   r e s o u r c e ,   w h i c h   e n a b l e s   i s o l a t i n g   p o r t i o n s   o f   t h e   s t o r a g e   s y s t e m   a n d   d e d i c a t i n g   i t   t o   t e n a n t s   w i t h i n   t h e   s h a r e d   K u b e r n e t e s   c l u s t e r .   H o w e v e r ,   i t   i s   i m p o r t a n t   t o   n o t e   t h a t   a   P e r s i s t e n t V o l u m e   i s   a   c l u s t e r - w i d e   r e s o u r c e   a n d   h a s   a   l i f e c y c l e   i n d e p e n d e n t   o f   w o r k l o a d s   a n d   n a m e s p a c e s .   F o r   e x a m p l e ,   y o u   c a n   c o n f i g u r e   a   s e p a r a t e   S t o r a g e C l a s s   f o r   e a c h   t e n a n t   a n d   u s e   t h i s   t o   s t r e n g t h e n   i s o l a t i o n .   I f   a   S t o r a g e C l a s s   i s   s h a r e d ,   y o u   s h o u l d   s e t   a   r e c l a i m   p o l i c y   o f   D e l e t e   t o   e n s u r e


Question: What is Sandboxing containers?

Answer: K u b e r n e t e s   p o d s   a r e   c o m p o s e d   o f   o n e   o r   m o r e   c o n t a i n e r s   t h a t   e x e c u t e   o n   w o r k e r   n o d e s .   C o n t a i n e r s   u t i l i z e   O S - l e v e l   v i r t u a l i z a t i o n   a n d   h e n c e   o f f e r   a   w e a k e r   i s o l a t i o n   b o u n d a r y   t h a n   v i r t u a l   m a c h i n e s   t h a t   u t i l i z e   h a r d w a r e - b a s e d   v i r t u a l i z a t i o n .   I n   a   s h a r e d   e n v i r o n m e n t ,   u n p a t c h e d   v u l n e r a b i l i t i e s   i n   t h e   a p p l i c a t i o n   a n d   s y s t e m   l a y e r s   c a n   b e   e x p l o i t e d   b y   a t t a c k e r s   f o r   c o n t a i n e r   b r e a k o u t s   a n d   r e m o t e   c o d e   e x e c u t i o n   t h a t   a l l o w   a c c e s s   t o   h o s t   r e s o u r c e s .   I n   s o m e   a p p l i c a t i o n s ,   l i k e   a   C o n t e n t   M a n a g e m e n t   S y s t e m   ( C M S ) ,   c u s t o m e r s   m a y   b e   a l l o w e d   t h e   a b i l i t y   t o   u p l o a d   a n d   e x e c u t e   u n t r u s t e d   s c r i p t s   o r   c o d e .   I n   e i t h e r   c a s e ,   m e c h a n i s m s   t o   f u r t h e r   i s o l a t e   a n d   p r o t e c t   w o r k l o a d s   u s i n g   s t r o n g   i s o l a t i o n   a r e   d e s i r a b l e .   S a n d b o x i n g   p r o v i d e s   a   w a y   t o   i s o l a t e   w o r k l o a d s   r u n n i n g   i n   a   s h a r e d   c l u s t e r .   I t   t y p i c a l l y   i n v o l v e s   r u n n i n g   e a c h   p o d   i n   a   s e p a r a t e   e x e c u t i o n   e n v i r o n m e n t   s u c h   a s   a   v i r t u a l   m a c h i n e   o r   a   u s e r s p a c e   k e r n e l .   S a n d b o x i n g   i s   o f t e n   r e c o m m e n d e d   w h e n   y o u   a r e   r u n n i n g   u n t r u s t e d   c o d e ,   w h e r e   w o r k l o a d s   a r e   a s s u m e d   t o   b e


Question: What is Node Isolation?

Answer: N o d e   i s o l a t i o n   i s   a n o t h e r   t e c h n i q u e   t h a t   y o u   c a n   u s e   t o   i s o l a t e   t e n a n t   w o r k l o a d s   f r o m   e a c h   o t h e r .   W i t h   n o d e   i s o l a t i o n ,   a   s e t   o f   n o d e s   i s   d e d i c a t e d   t o   r u n n i n g   p o d s   f r o m   a   p a r t i c u l a r   t e n a n t   a n d   c o - m i n g l i n g   o f   t e n a n t   p o d s   i s   p r o h i b i t e d .   T h i s   c o n f i g u r a t i o n   r e d u c e s   t h e   n o i s y   t e n a n t   i s s u e ,   a s   a l l   p o d s   r u n n i n g   o n   a   n o d e   w i l l   b e l o n g   t o   a   s i n g l e   t e n a n t .   T h e   r i s k   o f   i n f o r m a t i o n   d i s c l o s u r e   i s   s l i g h t l y   l o w e r   w i t h   n o d e   i s o l a t i o n   b e c a u s e   a n   a t t a c k e r   t h a t   m a n a g e s   t o   e s c a p e   f r o m   a   c o n t a i n e r   w i l l   o n l y   h a v e   a c c e s s   t o   t h e   c o n t a i n e r s   a n d   v o l u m e s   m o u n t e d   t o   t h a t   n o d e .   A l t h o u g h   w o r k l o a d s   f r o m   d i f f e r e n t   t e n a n t s   a r e   r u n n i n g   o n   d i f f e r e n t   n o d e s ,   i t   i s   i m p o r t a n t   t o   b e   a w a r e   t h a t   t h e   k u b e l e t   a n d   ( u n l e s s   u s i n g   v i r t u a l   c o n t r o l   p l a n e s )   t h e   A P I   s e r v i c e   a r e   s t i l l   s h a r e d   s e r v i c e s .   A   s k i l l e d   a t t a c k e r   c o u l d   u s e   t h e   p e r m i s s i o n s   a s s i g n e d   t o   t h e   k u b e l e t   o r   o t h e r   p o d s   r u n n i n g   o n   t h e   n o d e   t o   m o v e   l a t e r a l l y   w i t h i n   t h e   c l u s t e r   a n d   g a i n   a c c e s s   t o   t e n a n t   w o r k l o a d s   r u n n i n g   o n   o t h e r   n o d e s .   I f   t h i s   i s   a   m a j o r   c o n c e r n ,   c o n s i d e r   i m p l e


Question: What is Additional Considerations?

Answer: T h i s   s e c t i o n   d i s c u s s e s   o t h e r   K u b e r n e t e s   c o n s t r u c t s   a n d   p a t t e r n s   t h a t   a r e   r e l e v a n t   f o r   m u l t i - t e n a n c y .


Question: What is API Priority and Fairness?

Answer: A P I   p r i o r i t y   a n d   f a i r n e s s   i s   a   K u b e r n e t e s   f e a t u r e   t h a t   a l l o w s   y o u   t o   a s s i g n   a   p r i o r i t y   t o   c e r t a i n   p o d s   r u n n i n g   w i t h i n   t h e   c l u s t e r .   W h e n   a n   a p p l i c a t i o n   c a l l s   t h e   K u b e r n e t e s   A P I ,   t h e   A P I   s e r v e r   e v a l u a t e s   t h e   p r i o r i t y   a s s i g n e d   t o   p o d .   C a l l s   f r o m   p o d s   w i t h   h i g h e r   p r i o r i t y   a r e   f u l f i l l e d   b e f o r e   t h o s e   w i t h   a   l o w e r   p r i o r i t y .   W h e n   c o n t e n t i o n   i s   h i g h ,   l o w e r   p r i o r i t y   c a l l s   c a n   b e   q u e u e d   u n t i l   t h e   s e r v e r   i s   l e s s   b u s y   o r   y o u   c a n   r e j e c t   t h e   r e q u e s t s .   U s i n g   A P I   p r i o r i t y   a n d   f a i r n e s s   w i l l   n o t   b e   v e r y   c o m m o n   i n   S a a S   e n v i r o n m e n t s   u n l e s s   y o u   a r e   a l l o w i n g   c u s t o m e r s   t o   r u n   a p p l i c a t i o n s   t h a t   i n t e r f a c e   w i t h   t h e   K u b e r n e t e s   A P I ,   f o r   e x a m p l e ,   a   c o n t r o l l e r .


Question: What is Quality-of-Service (QoS)?

Answer: W h e n   y o u ’ r e   r u n n i n g   a   S a a S   a p p l i c a t i o n ,   y o u   m a y   w a n t   t h e   a b i l i t y   t o   o f f e r   d i f f e r e n t   Q u a l i t y - o f - S e r v i c e   ( Q o S )   t i e r s   o f   s e r v i c e   t o   d i f f e r e n t   t e n a n t s .   F o r   e x a m p l e ,   y o u   m a y   h a v e   f r e e m i u m   s e r v i c e   t h a t   c o m e s   w i t h   f e w e r   p e r f o r m a n c e   g u a r a n t e e s   a n d   f e a t u r e s   a n d   a   f o r - f e e   s e r v i c e   t i e r   w i t h   s p e c i f i c   p e r f o r m a n c e   g u a r a n t e e s .   F o r t u n a t e l y ,   t h e r e   a r e   s e v e r a l   K u b e r n e t e s   c o n s t r u c t s   t h a t   c a n   h e l p   y o u   a c c o m p l i s h   t h i s   w i t h i n   a   s h a r e d   c l u s t e r ,   i n c l u d i n g   n e t w o r k   Q o S ,   s t o r a g e   c l a s s e s ,   a n d   p o d   p r i o r i t y   a n d   p r e e m p t i o n .   T h e   i d e a   w i t h   e a c h   o f   t h e s e   i s   t o   p r o v i d e   t e n a n t s   w i t h   t h e   q u a l i t y   o f   s e r v i c e   t h a t   t h e y   p a i d   f o r .   L e t ’ s   s t a r t   b y   l o o k i n g   a t   n e t w o r k i n g   Q o S .   T y p i c a l l y ,   a l l   p o d s   o n   a   n o d e   s h a r e   a   n e t w o r k   i n t e r f a c e .   W i t h o u t   n e t w o r k   Q o S ,   s o m e   p o d s   m a y   c o n s u m e   a n   u n f a i r   s h a r e   o f   t h e   a v a i l a b l e   b a n d w i d t h   a t   t h e   e x p e n s e   o f   o t h e r   p o d s .   T h e   K u b e r n e t e s   b a n d w i d t h   p l u g i n   c r e a t e s   a n   e x t e n d e d   r e s o u r c e   f o r   n e t w o r k i n g   t h a t   a l l o w s   y o u   t o   u s e   K u b e r n e t e s   r e s o u r c e s   c o n s t r u c t s ,   i . e .   r e q u e s t s / l i m i t s ,   t o   a p p l y   r a t e   l i m i t s   t o   p o d s   b y   u s


Question: What is DNS?

Answer: K u b e r n e t e s   c l u s t e r s   i n c l u d e   a   D o m a i n   N a m e   S y s t e m   ( D N S )   s e r v i c e   t o   p r o v i d e   t r a n s l a t i o n s   f r o m   n a m e s   t o   I P   a d d r e s s e s ,   f o r   a l l   S e r v i c e s   a n d   P o d s .   B y   d e f a u l t ,   t h e   K u b e r n e t e s   D N S   s e r v i c e   a l l o w s   l o o k u p s   a c r o s s   a l l   n a m e s p a c e s   i n   t h e   c l u s t e r .   I n   m u l t i - t e n a n t   e n v i r o n m e n t s   w h e r e   t e n a n t s   c a n   a c c e s s   p o d s   a n d   o t h e r   K u b e r n e t e s   r e s o u r c e s ,   o r   w h e r e   s t r o n g e r   i s o l a t i o n   i s   r e q u i r e d ,   i t   m a y   b e   n e c e s s a r y   t o   p r e v e n t   p o d s   f r o m   l o o k i n g   u p   s e r v i c e s   i n   o t h e r   N a m e s p a c e s .   Y o u   c a n   r e s t r i c t   c r o s s - n a m e s p a c e   D N S   l o o k u p s   b y   c o n f i g u r i n g   s e c u r i t y   r u l e s   f o r   t h e   D N S   s e r v i c e .   F o r   e x a m p l e ,   C o r e D N S   ( t h e   d e f a u l t   D N S   s e r v i c e   f o r   K u b e r n e t e s )   c a n   l e v e r a g e   K u b e r n e t e s   m e t a d a t a   t o   r e s t r i c t   q u e r i e s   t o   P o d s   a n d   S e r v i c e s   w i t h i n   a   n a m e s p a c e .   F o r   m o r e   i n f o r m a t i o n ,   r e a d   a n   e x a m p l e   o f   c o n f i g u r i n g   t h i s   w i t h i n   t h e   C o r e D N S   d o c u m e n t a t i o n .   W h e n   a   V i r t u a l   C o n t r o l   P l a n e   p e r   t e n a n t   m o d e l   i s   u s e d ,   a   D N S   s e r v i c e   m u s t   b e   c o n f i g u r e d   p e r   t e n a n t   o r   a   m u l t i - t e n a n t   D N S   s e r v i c e   m u s t   b e   u s e d .   H e r e   i s   a n   e x a m p l e   o f   a   c u s t o m i z e d   v e r s i o n   o f   C o r e D N S   t h a t   s u p p o r


Question: What is Operators?

Answer: O p e r a t o r s   a r e   K u b e r n e t e s   c o n t r o l l e r s   t h a t   m a n a g e   a p p l i c a t i o n s .   O p e r a t o r s   c a n   s i m p l i f y   t h e   m a n a g e m e n t   o f   m u l t i p l e   i n s t a n c e s   o f   a n   a p p l i c a t i o n ,   l i k e   a   d a t a b a s e   s e r v i c e ,   w h i c h   m a k e s   t h e m   a   c o m m o n   b u i l d i n g   b l o c k   i n   t h e   m u l t i - c o n s u m e r   ( S a a S )   m u l t i - t e n a n c y   u s e   c a s e .   O p e r a t o r s   u s e d   i n   a   m u l t i - t e n a n t   e n v i r o n m e n t   s h o u l d   f o l l o w   a   s t r i c t e r   s e t   o f   g u i d e l i n e s .   S p e c i f i c a l l y ,   t h e   O p e r a t o r   s h o u l d :   S u p p o r t   c r e a t i n g   r e s o u r c e s   w i t h i n   d i f f e r e n t   t e n a n t   n a m e s p a c e s ,   r a t h e r   t h a n   j u s t   i n   t h e   n a m e s p a c e   i n   w h i c h   t h e   O p e r a t o r   i s   d e p l o y e d . E n s u r e   t h a t   t h e   P o d s   a r e   c o n f i g u r e d   w i t h   r e s o u r c e   r e q u e s t s   a n d   l i m i t s ,   t o   e n s u r e   s c h e d u l i n g   a n d   f a i r n e s s . S u p p o r t   c o n f i g u r a t i o n   o f   P o d s   f o r   d a t a - p l a n e   i s o l a t i o n   t e c h n i q u e s   s u c h   a s   n o d e   i s o l a t i o n   a n d   s a n d b o x e d   c o n t a i n e r s .


Question: What is Implementations?

Answer: T h e r e   a r e   t w o   p r i m a r y   w a y s   t o   s h a r e   a   K u b e r n e t e s   c l u s t e r   f o r   m u l t i - t e n a n c y :   u s i n g   N a m e s p a c e s   ( t h a t   i s ,   a   N a m e s p a c e   p e r   t e n a n t )   o r   b y   v i r t u a l i z i n g   t h e   c o n t r o l   p l a n e   ( t h a t   i s ,   v i r t u a l   c o n t r o l   p l a n e   p e r   t e n a n t ) .   I n   b o t h   c a s e s ,   d a t a   p l a n e   i s o l a t i o n ,   a n d   m a n a g e m e n t   o f   a d d i t i o n a l   c o n s i d e r a t i o n s   s u c h   a s   A P I   P r i o r i t y   a n d   F a i r n e s s ,   i s   a l s o   r e c o m m e n d e d .   N a m e s p a c e   i s o l a t i o n   i s   w e l l - s u p p o r t e d   b y   K u b e r n e t e s ,   h a s   a   n e g l i g i b l e   r e s o u r c e   c o s t ,   a n d   p r o v i d e s   m e c h a n i s m s   t o   a l l o w   t e n a n t s   t o   i n t e r a c t   a p p r o p r i a t e l y ,   s u c h   a s   b y   a l l o w i n g   s e r v i c e - t o - s e r v i c e   c o m m u n i c a t i o n .   H o w e v e r ,   i t   c a n   b e   d i f f i c u l t   t o   c o n f i g u r e ,   a n d   d o e s n ' t   a p p l y   t o   K u b e r n e t e s   r e s o u r c e s   t h a t   c a n ' t   b e   n a m e s p a c e d ,   s u c h   a s   C u s t o m   R e s o u r c e   D e f i n i t i o n s ,   S t o r a g e   C l a s s e s ,   a n d   W e b h o o k s .   C o n t r o l   p l a n e   v i r t u a l i z a t i o n   a l l o w s   f o r   i s o l a t i o n   o f   n o n - n a m e s p a c e d   r e s o u r c e s   a t   t h e   c o s t   o f   s o m e w h a t   h i g h e r   r e s o u r c e   u s a g e   a n d   m o r e   d i f f i c u l t   c r o s s - t e n a n t   s h a r i n g .   I t   i s   a   g o o d   o p t i o n   w h e n   n a m e s p a c e   i s o l a t i o n   i s   i n s u f f i c i e n t   b u t   d e d i c a t e d   c l u s t e r s   a r e   u n d e s i r a b l e ,   d u


Question: What is Namespace per tenant?

Answer: A s   p r e v i o u s l y   m e n t i o n e d ,   y o u   s h o u l d   c o n s i d e r   i s o l a t i n g   e a c h   w o r k l o a d   i n   i t s   o w n   n a m e s p a c e ,   e v e n   i f   y o u   a r e   u s i n g   d e d i c a t e d   c l u s t e r s   o r   v i r t u a l i z e d   c o n t r o l   p l a n e s .   T h i s   e n s u r e s   t h a t   e a c h   w o r k l o a d   o n l y   h a s   a c c e s s   t o   i t s   o w n   r e s o u r c e s ,   s u c h   a s   C o n f i g M a p s   a n d   S e c r e t s ,   a n d   a l l o w s   y o u   t o   t a i l o r   d e d i c a t e d   s e c u r i t y   p o l i c i e s   f o r   e a c h   w o r k l o a d .   I n   a d d i t i o n ,   i t   i s   a   b e s t   p r a c t i c e   t o   g i v e   e a c h   n a m e s p a c e   n a m e s   t h a t   a r e   u n i q u e   a c r o s s   y o u r   e n t i r e   f l e e t   ( t h a t   i s ,   e v e n   i f   t h e y   a r e   i n   s e p a r a t e   c l u s t e r s ) ,   a s   t h i s   g i v e s   y o u   t h e   f l e x i b i l i t y   t o   s w i t c h   b e t w e e n   d e d i c a t e d   a n d   s h a r e d   c l u s t e r s   i n   t h e   f u t u r e ,   o r   t o   u s e   m u l t i - c l u s t e r   t o o l i n g   s u c h   a s   s e r v i c e   m e s h e s .   C o n v e r s e l y ,   t h e r e   a r e   a l s o   a d v a n t a g e s   t o   a s s i g n i n g   n a m e s p a c e s   a t   t h e   t e n a n t   l e v e l ,   n o t   j u s t   t h e   w o r k l o a d   l e v e l ,   s i n c e   t h e r e   a r e   o f t e n   p o l i c i e s   t h a t   a p p l y   t o   a l l   w o r k l o a d s   o w n e d   b y   a   s i n g l e   t e n a n t .   H o w e v e r ,   t h i s   r a i s e s   i t s   o w n   p r o b l e m s .   F i r s t l y ,   t h i s   m a k e s   i t   d i f f i c u l t   o r   i m p o s s i b l e   t o   c u s t o m i z e   p o l i c i e s   t o   i n d i v i d u a l   w o r k l o a d s ,   a n d   s e c o n d l y ,   i t   m a y   b e   c


Question: What is Virtual control plane per tenant?

Answer: A n o t h e r   f o r m   o f   c o n t r o l - p l a n e   i s o l a t i o n   i s   t o   u s e   K u b e r n e t e s   e x t e n s i o n s   t o   p r o v i d e   e a c h   t e n a n t   a   v i r t u a l   c o n t r o l - p l a n e   t h a t   e n a b l e s   s e g m e n t a t i o n   o f   c l u s t e r - w i d e   A P I   r e s o u r c e s .   D a t a   p l a n e   i s o l a t i o n   t e c h n i q u e s   c a n   b e   u s e d   w i t h   t h i s   m o d e l   t o   s e c u r e l y   m a n a g e   w o r k e r   n o d e s   a c r o s s   t e n a n t s .   T h e   v i r t u a l   c o n t r o l   p l a n e   b a s e d   m u l t i - t e n a n c y   m o d e l   e x t e n d s   n a m e s p a c e - b a s e d   m u l t i - t e n a n c y   b y   p r o v i d i n g   e a c h   t e n a n t   w i t h   d e d i c a t e d   c o n t r o l   p l a n e   c o m p o n e n t s ,   a n d   h e n c e   c o m p l e t e   c o n t r o l   o v e r   c l u s t e r - w i d e   r e s o u r c e s   a n d   a d d - o n   s e r v i c e s .   W o r k e r   n o d e s   a r e   s h a r e d   a c r o s s   a l l   t e n a n t s ,   a n d   a r e   m a n a g e d   b y   a   K u b e r n e t e s   c l u s t e r   t h a t   i s   n o r m a l l y   i n a c c e s s i b l e   t o   t e n a n t s .   T h i s   c l u s t e r   i s   o f t e n   r e f e r r e d   t o   a s   a   s u p e r - c l u s t e r   ( o r   s o m e t i m e s   a s   a   h o s t - c l u s t e r ) .   S i n c e   a   t e n a n t ’ s   c o n t r o l - p l a n e   i s   n o t   d i r e c t l y   a s s o c i a t e d   w i t h   u n d e r l y i n g   c o m p u t e   r e s o u r c e s   i t   i s   r e f e r r e d   t o   a s   a   v i r t u a l   c o n t r o l   p l a n e .   A   v i r t u a l   c o n t r o l   p l a n e   t y p i c a l l y   c o n s i s t s   o f   t h e   K u b e r n e t e s   A P I   s e r v e r ,   t h e   c o n t r o l l e r   m a n a g e r ,   a n d   t h e   e t c d   d a t a   s t o r e .   I t   i n t e r a c t


Question: What is Security?

Answer: SecuritySecurity is an important concern for most organizations and people who run Kubernetes clusters. You can find a basic security checklist elsewhere in the Kubernetes documentation.To learn how to deploy and manage security aspects of Kubernetes, you can follow the tutorials in this section.Apply Pod Security Standards at the Cluster LevelApply Pod Security Standards at the Namespace LevelRestrict a Container's Access to Resources with AppArmorRestrict a Container's Syscalls with seccomp


Question: How does Security work?

Answer: SecuritySecurity is an important concern for most organizations and people who run Kubernetes clusters. You can find a basic security checklist elsewhere in the Kubernetes documentation.To learn how to deploy and manage security aspects of Kubernetes, you can follow the tutorials in this section.Apply Pod Security Standards at the Cluster LevelApply Pod Security Standards at the Namespace LevelRestrict a Container's Access to Resources with AppArmorRestrict a Container's Syscalls with seccomp


Question: When would you use Security?

Answer: SecuritySecurity is an important concern for most organizations and people who run Kubernetes clusters. You can find a basic security checklist elsewhere in the Kubernetes documentation.To learn how to deploy and manage security aspects of Kubernetes, you can follow the tutorials in this section.Apply Pod Security Standards at the Cluster LevelApply Pod Security Standards at the Namespace LevelRestrict a Container's Access to Resources with AppArmorRestrict a Container's Syscalls with seccomp


Question: What are the benefits of Security?

Answer: SecuritySecurity is an important concern for most organizations and people who run Kubernetes clusters. You can find a basic security checklist elsewhere in the Kubernetes documentation.To learn how to deploy and manage security aspects of Kubernetes, you can follow the tutorials in this section.Apply Pod Security Standards at the Cluster LevelApply Pod Security Standards at the Namespace LevelRestrict a Container's Access to Resources with AppArmorRestrict a Container's Syscalls with seccomp


Question: What is Security?

Answer: S e c u r i t y   i s   a n   i m p o r t a n t   c o n c e r n   f o r   m o s t   o r g a n i z a t i o n s   a n d   p e o p l e   w h o   r u n   K u b e r n e t e s   c l u s t e r s .   Y o u   c a n   f i n d   a   b a s i c   s e c u r i t y   c h e c k l i s t   e l s e w h e r e   i n   t h e   K u b e r n e t e s   d o c u m e n t a t i o n .   T o   l e a r n   h o w   t o   d e p l o y   a n d   m a n a g e   s e c u r i t y   a s p e c t s   o f   K u b e r n e t e s ,   y o u   c a n   f o l l o w   t h e   t u t o r i a l s   i n   t h i s   s e c t i o n .


Question: What is Overprovision Node Capacity For A Cluster?

Answer: Overprovision Node Capacity For A ClusterThis page guides you through configuring Node overprovisioning in your Kubernetes cluster. Node overprovisioning is a strategy that proactively reserves a portion of your cluster's compute resources. This reservation helps reduce the time required to schedule new pods during scaling events, enhancing your cluster's responsiveness to sudden spikes in traffic or workload demands.By maintaining some unused capacity, you ensure that resources are immediately available when new pods are created, preventing them from entering a pending state while the cluster scales up.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.You should already have a basic understanding of Deployments, Pod priority, and PriorityClasses.Your cluster must be set up with an autoscaler that manages nodes based on demand.Create a PriorityClassBegin by defining a PriorityClass for the placeholder Pods. First, create a PriorityClass with a negative priority value, that you will shortly assign to the placeholder pods. Later, you will set up a Deployment that uses this PriorityClasspriorityclass/low-priority-class.yaml apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: placeholder # these Pods represent placeholder capacity value: -1000 globalDefault: false description: "Negative priority for placeholder pods to enable overprovisioning."Then create the PriorityClass:kubectl apply -f https://k8s.io/examples/priorityclass/low-priority-class.yaml You will next define a Deployment that uses the negative-priority PriorityClass and runs a minimal container. When you add this to your cluster, Kubernetes runs those placeholder pods to reserve capacity. Any time there is a capacity shortage, the control plane will pick one these placeholder pods as the first candidate to preempt.Run Pods that request node capacityReview the sample manifest:deployments/deployment-with-capacity-reservation.yaml apiVersion: apps/v1 kind: Deployment metadata: name: capacity-reservation # You should decide what namespace to deploy this into spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: capacity-placeholder template: metadata: labels: app.kubernetes.io/name: capacity-placeholder annotations: kubernetes.io/description: "Capacity reservation" spec: priorityClassName: placeholder affinity: # Try to place these overhead Pods on different nodes # if possible podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/name: capacity-placeholder topologyKey: topology.kubernetes.io/hostname containers: - name: pause image: registry.k8s.io/pause:3.6 resources: requests: cpu: "50m" memory: "512Mi" limits: memory: "512Mi" Pick a namespace for the placeholder podsYou should select, or create, a namespace that the placeholder Pods will go into.Create the placeholder deploymentCreat


Question: How does Overprovision Node Capacity For A Cluster work?

Answer: Overprovision Node Capacity For A ClusterThis page guides you through configuring Node overprovisioning in your Kubernetes cluster. Node overprovisioning is a strategy that proactively reserves a portion of your cluster's compute resources. This reservation helps reduce the time required to schedule new pods during scaling events, enhancing your cluster's responsiveness to sudden spikes in traffic or workload demands.By maintaining some unused capacity, you ensure that resources are immediately available when new pods are created, preventing them from entering a pending state while the cluster scales up.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.You should already have a basic understanding of Deployments, Pod priority, and PriorityClasses.Your cluster must be set up with an autoscaler that manages nodes based on demand.Create a PriorityClassBegin by defining a PriorityClass for the placeholder Pods. First, create a PriorityClass with a negative priority value, that you will shortly assign to the placeholder pods. Later, you will set up a Deployment that uses this PriorityClasspriorityclass/low-priority-class.yaml apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: placeholder # these Pods represent placeholder capacity value: -1000 globalDefault: false description: "Negative priority for placeholder pods to enable overprovisioning."Then create the PriorityClass:kubectl apply -f https://k8s.io/examples/priorityclass/low-priority-class.yaml You will next define a Deployment that uses the negative-priority PriorityClass and runs a minimal container. When you add this to your cluster, Kubernetes runs those placeholder pods to reserve capacity. Any time there is a capacity shortage, the control plane will pick one these placeholder pods as the first candidate to preempt.Run Pods that request node capacityReview the sample manifest:deployments/deployment-with-capacity-reservation.yaml apiVersion: apps/v1 kind: Deployment metadata: name: capacity-reservation # You should decide what namespace to deploy this into spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: capacity-placeholder template: metadata: labels: app.kubernetes.io/name: capacity-placeholder annotations: kubernetes.io/description: "Capacity reservation" spec: priorityClassName: placeholder affinity: # Try to place these overhead Pods on different nodes # if possible podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/name: capacity-placeholder topologyKey: topology.kubernetes.io/hostname containers: - name: pause image: registry.k8s.io/pause:3.6 resources: requests: cpu: "50m" memory: "512Mi" limits: memory: "512Mi" Pick a namespace for the placeholder podsYou should select, or create, a namespace that the placeholder Pods will go into.Create the placeholder deploymentCreat


Question: When would you use Overprovision Node Capacity For A Cluster?

Answer: Overprovision Node Capacity For A ClusterThis page guides you through configuring Node overprovisioning in your Kubernetes cluster. Node overprovisioning is a strategy that proactively reserves a portion of your cluster's compute resources. This reservation helps reduce the time required to schedule new pods during scaling events, enhancing your cluster's responsiveness to sudden spikes in traffic or workload demands.By maintaining some unused capacity, you ensure that resources are immediately available when new pods are created, preventing them from entering a pending state while the cluster scales up.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.You should already have a basic understanding of Deployments, Pod priority, and PriorityClasses.Your cluster must be set up with an autoscaler that manages nodes based on demand.Create a PriorityClassBegin by defining a PriorityClass for the placeholder Pods. First, create a PriorityClass with a negative priority value, that you will shortly assign to the placeholder pods. Later, you will set up a Deployment that uses this PriorityClasspriorityclass/low-priority-class.yaml apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: placeholder # these Pods represent placeholder capacity value: -1000 globalDefault: false description: "Negative priority for placeholder pods to enable overprovisioning."Then create the PriorityClass:kubectl apply -f https://k8s.io/examples/priorityclass/low-priority-class.yaml You will next define a Deployment that uses the negative-priority PriorityClass and runs a minimal container. When you add this to your cluster, Kubernetes runs those placeholder pods to reserve capacity. Any time there is a capacity shortage, the control plane will pick one these placeholder pods as the first candidate to preempt.Run Pods that request node capacityReview the sample manifest:deployments/deployment-with-capacity-reservation.yaml apiVersion: apps/v1 kind: Deployment metadata: name: capacity-reservation # You should decide what namespace to deploy this into spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: capacity-placeholder template: metadata: labels: app.kubernetes.io/name: capacity-placeholder annotations: kubernetes.io/description: "Capacity reservation" spec: priorityClassName: placeholder affinity: # Try to place these overhead Pods on different nodes # if possible podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/name: capacity-placeholder topologyKey: topology.kubernetes.io/hostname containers: - name: pause image: registry.k8s.io/pause:3.6 resources: requests: cpu: "50m" memory: "512Mi" limits: memory: "512Mi" Pick a namespace for the placeholder podsYou should select, or create, a namespace that the placeholder Pods will go into.Create the placeholder deploymentCreat


Question: What are the benefits of Overprovision Node Capacity For A Cluster?

Answer: Overprovision Node Capacity For A ClusterThis page guides you through configuring Node overprovisioning in your Kubernetes cluster. Node overprovisioning is a strategy that proactively reserves a portion of your cluster's compute resources. This reservation helps reduce the time required to schedule new pods during scaling events, enhancing your cluster's responsiveness to sudden spikes in traffic or workload demands.By maintaining some unused capacity, you ensure that resources are immediately available when new pods are created, preventing them from entering a pending state while the cluster scales up.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.You should already have a basic understanding of Deployments, Pod priority, and PriorityClasses.Your cluster must be set up with an autoscaler that manages nodes based on demand.Create a PriorityClassBegin by defining a PriorityClass for the placeholder Pods. First, create a PriorityClass with a negative priority value, that you will shortly assign to the placeholder pods. Later, you will set up a Deployment that uses this PriorityClasspriorityclass/low-priority-class.yaml apiVersion: scheduling.k8s.io/v1 kind: PriorityClass metadata: name: placeholder # these Pods represent placeholder capacity value: -1000 globalDefault: false description: "Negative priority for placeholder pods to enable overprovisioning."Then create the PriorityClass:kubectl apply -f https://k8s.io/examples/priorityclass/low-priority-class.yaml You will next define a Deployment that uses the negative-priority PriorityClass and runs a minimal container. When you add this to your cluster, Kubernetes runs those placeholder pods to reserve capacity. Any time there is a capacity shortage, the control plane will pick one these placeholder pods as the first candidate to preempt.Run Pods that request node capacityReview the sample manifest:deployments/deployment-with-capacity-reservation.yaml apiVersion: apps/v1 kind: Deployment metadata: name: capacity-reservation # You should decide what namespace to deploy this into spec: replicas: 1 selector: matchLabels: app.kubernetes.io/name: capacity-placeholder template: metadata: labels: app.kubernetes.io/name: capacity-placeholder annotations: kubernetes.io/description: "Capacity reservation" spec: priorityClassName: placeholder affinity: # Try to place these overhead Pods on different nodes # if possible podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 100 podAffinityTerm: labelSelector: matchLabels: app.kubernetes.io/name: capacity-placeholder topologyKey: topology.kubernetes.io/hostname containers: - name: pause image: registry.k8s.io/pause:3.6 resources: requests: cpu: "50m" memory: "512Mi" limits: memory: "512Mi" Pick a namespace for the placeholder podsYou should select, or create, a namespace that the placeholder Pods will go into.Create the placeholder deploymentCreat


Question: What is Overprovision Node Capacity For A Cluster?

Answer: T h i s   p a g e   g u i d e s   y o u   t h r o u g h   c o n f i g u r i n g   N o d e   o v e r p r o v i s i o n i n g   i n   y o u r   K u b e r n e t e s   c l u s t e r .   N o d e   o v e r p r o v i s i o n i n g   i s   a   s t r a t e g y   t h a t   p r o a c t i v e l y   r e s e r v e s   a   p o r t i o n   o f   y o u r   c l u s t e r ' s   c o m p u t e   r e s o u r c e s .   T h i s   r e s e r v a t i o n   h e l p s   r e d u c e   t h e   t i m e   r e q u i r e d   t o   s c h e d u l e   n e w   p o d s   d u r i n g   s c a l i n g   e v e n t s ,   e n h a n c i n g   y o u r   c l u s t e r ' s   r e s p o n s i v e n e s s   t o   s u d d e n   s p i k e s   i n   t r a f f i c   o r   w o r k l o a d   d e m a n d s .   B y   m a i n t a i n i n g   s o m e   u n u s e d   c a p a c i t y ,   y o u   e n s u r e   t h a t   r e s o u r c e s   a r e   i m m e d i a t e l y   a v a i l a b l e   w h e n   n e w   p o d s   a r e   c r e a t e d ,   p r e v e n t i n g   t h e m   f r o m   e n t e r i n g   a   p e n d i n g   s t a t e   w h i l e   t h e   c l u s t e r   s c a l e s   u p .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r . Y o u   s h o u l d   a l r e a d y   h a v e   a   b a s i c   u n d e r s t a n d i n g   o f   D e p l o y m e n t s ,   P o d   p r i o r i t y ,   a n d   P r i o r i t y C l a s s e s . Y o u r   c l u s t e r   m u s t   b e   s e t   u p   w i t h   a n   a u t o s c a l e r   t h a t   m a n a g e s   n o d e s   b a s e d   o n   d e m a n d .


Question: What is Create a PriorityClass?

Answer: B e g i n   b y   d e f i n i n g   a   P r i o r i t y C l a s s   f o r   t h e   p l a c e h o l d e r   P o d s .   F i r s t ,   c r e a t e   a   P r i o r i t y C l a s s   w i t h   a   n e g a t i v e   p r i o r i t y   v a l u e ,   t h a t   y o u   w i l l   s h o r t l y   a s s i g n   t o   t h e   p l a c e h o l d e r   p o d s .   L a t e r ,   y o u   w i l l   s e t   u p   a   D e p l o y m e n t   t h a t   u s e s   t h i s   P r i o r i t y C l a s s   a p i V e r s i o n :   s c h e d u l i n g . k 8 s . i o / v 1   k i n d :   P r i o r i t y C l a s s   m e t a d a t a :   n a m e :   p l a c e h o l d e r   #   t h e s e   P o d s   r e p r e s e n t   p l a c e h o l d e r   c a p a c i t y   v a l u e :   - 1 0 0 0   g l o b a l D e f a u l t :   f a l s e   d e s c r i p t i o n :   " N e g a t i v e   p r i o r i t y   f o r   p l a c e h o l d e r   p o d s   t o   e n a b l e   o v e r p r o v i s i o n i n g . "   T h e n   c r e a t e   t h e   P r i o r i t y C l a s s :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p r i o r i t y c l a s s / l o w - p r i o r i t y - c l a s s . y a m l   Y o u   w i l l   n e x t   d e f i n e   a   D e p l o y m e n t   t h a t   u s e s   t h e   n e g a t i v e - p r i o r i t y   P r i o r i t y C l a s s   a n d   r u n s   a   m i n i m a l   c o n t a i n e r .   W h e n   y o u   a d d   t h i s   t o   y o u r   c l u s t e r ,   K u b e r n e t e s   r u n s   t h o s e   p l a c e h o l d e r   p o d s   t o   r e s e r v e   c a p a c i t y .   A n y   t i m e   t h e r e   i s   a   c a p a c i t y   s h o r t a g e ,   t h e   c o n t r o l   p l a n e   w i l l   p i c k   o n e   t h e s e   p l a c e h o l d e r   p o d s   a s   t h e   f i r s t   c a n d i d a t e   t o   p r e e m p t .


Question: What is Run Pods that request node capacity?

Answer: R e v i e w   t h e   s a m p l e   m a n i f e s t :   a p i V e r s i o n :   a p p s / v 1   k i n d :   D e p l o y m e n t   m e t a d a t a :   n a m e :   c a p a c i t y - r e s e r v a t i o n   #   Y o u   s h o u l d   d e c i d e   w h a t   n a m e s p a c e   t o   d e p l o y   t h i s   i n t o   s p e c :   r e p l i c a s :   1   s e l e c t o r :   m a t c h L a b e l s :   a p p . k u b e r n e t e s . i o / n a m e :   c a p a c i t y - p l a c e h o l d e r   t e m p l a t e :   m e t a d a t a :   l a b e l s :   a p p . k u b e r n e t e s . i o / n a m e :   c a p a c i t y - p l a c e h o l d e r   a n n o t a t i o n s :   k u b e r n e t e s . i o / d e s c r i p t i o n :   " C a p a c i t y   r e s e r v a t i o n "   s p e c :   p r i o r i t y C l a s s N a m e :   p l a c e h o l d e r   a f f i n i t y :   #   T r y   t o   p l a c e   t h e s e   o v e r h e a d   P o d s   o n   d i f f e r e n t   n o d e s   #   i f   p o s s i b l e   p o d A n t i A f f i n i t y :   p r e f e r r e d D u r i n g S c h e d u l i n g I g n o r e d D u r i n g E x e c u t i o n :   -   w e i g h t :   1 0 0   p o d A f f i n i t y T e r m :   l a b e l S e l e c t o r :   m a t c h L a b e l s :   a p p . k u b e r n e t e s . i o / n a m e :   c a p a c i t y - p l a c e h o l d e r   t o p o l o g y K e y :   t o p o l o g y . k u b e r n e t e s . i o / h o s t n a m e   c o n t a i n e r s :   -   n a m e :   p a u s e   i m a g e :   r e g i s t r y . k 8 s . i o / p a u s e : 3 . 6   r e s o u r c e s :   r e q u e s t s :   c p u :   " 5 0 m "   m e m o r y :   " 5 1 2 M i "   l i m i t s :   m e m o r y :   " 5 1 2 M i "


Question: What is Pick a namespace for the placeholder pods?

Answer: Y o u   s h o u l d   s e l e c t ,   o r   c r e a t e ,   a   n a m e s p a c e   t h a t   t h e   p l a c e h o l d e r   P o d s   w i l l   g o   i n t o .


Question: What is Create the placeholder deployment?

Answer: C r e a t e   a   D e p l o y m e n t   b a s e d   o n   t h a t   m a n i f e s t :   #   C h a n g e   t h e   n a m e s p a c e   n a m e   " e x a m p l e "   k u b e c t l   - - n a m e s p a c e   e x a m p l e   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / d e p l o y m e n t s / d e p l o y m e n t - w i t h - c a p a c i t y - r e s e r v a t i o n . y a m l


Question: What is Adjust placeholder resource requests?

Answer: C o n f i g u r e   t h e   r e s o u r c e   r e q u e s t s   a n d   l i m i t s   f o r   t h e   p l a c e h o l d e r   p o d s   t o   d e f i n e   t h e   a m o u n t   o f   o v e r p r o v i s i o n e d   r e s o u r c e s   y o u   w a n t   t o   m a i n t a i n .   T h i s   r e s e r v a t i o n   e n s u r e s   t h a t   a   s p e c i f i c   a m o u n t   o f   C P U   a n d   m e m o r y   i s   k e p t   a v a i l a b l e   f o r   n e w   p o d s .   T o   e d i t   t h e   D e p l o y m e n t ,   m o d i f y   t h e   r e s o u r c e s   s e c t i o n   i n   t h e   D e p l o y m e n t   m a n i f e s t   f i l e   t o   s e t   a p p r o p r i a t e   r e q u e s t s   a n d   l i m i t s .   Y o u   c a n   d o w n l o a d   t h a t   f i l e   l o c a l l y   a n d   t h e n   e d i t   i t   w i t h   w h i c h e v e r   t e x t   e d i t o r   y o u   p r e f e r .   Y o u   c a n   a l s o   e d i t   t h e   D e p l o y m e n t   u s i n g   k u b e c t l :   k u b e c t l   e d i t   d e p l o y m e n t   c a p a c i t y - r e s e r v a t i o n   F o r   e x a m p l e ,   t o   r e s e r v e   a   t o t a l   o f   a   0 . 5   C P U   a n d   1 G i B   o f   m e m o r y   a c r o s s   5   p l a c e h o l d e r   p o d s ,   d e f i n e   t h e   r e s o u r c e   r e q u e s t s   a n d   l i m i t s   f o r   a   s i n g l e   p l a c e h o l d e r   p o d   a s   f o l l o w s :   r e s o u r c e s :   r e q u e s t s :   c p u :   " 1 0 0 m "   m e m o r y :   " 2 0 0 M i "   l i m i t s :   c p u :   " 1 0 0 m "


Question: What is Calculate the total reserved resources?

Answer: F o r   e x a m p l e ,   w i t h   5   r e p l i c a s   e a c h   r e s e r v i n g   0 . 1   C P U   a n d   2 0 0 M i B   o f   m e m o r y : T o t a l   C P U   r e s e r v e d :   5   ×   0 . 1   =   0 . 5   ( i n   t h e   P o d   s p e c i f i c a t i o n ,   y o u ' l l   w r i t e   t h e   q u a n t i t y   5 0 0 m ) T o t a l   m e m o r y   r e s e r v e d :   5   ×   2 0 0 M i B   =   1 G i B   ( i n   t h e   P o d   s p e c i f i c a t i o n ,   y o u ' l l   w r i t e   1   G i )   T o   s c a l e   t h e   D e p l o y m e n t ,   a d j u s t   t h e   n u m b e r   o f   r e p l i c a s   b a s e d   o n   y o u r   c l u s t e r ' s   s i z e   a n d   e x p e c t e d   w o r k l o a d :   k u b e c t l   s c a l e   d e p l o y m e n t   c a p a c i t y - r e s e r v a t i o n   - - r e p l i c a s = 5   V e r i f y   t h e   s c a l i n g :   k u b e c t l   g e t   d e p l o y m e n t   c a p a c i t y - r e s e r v a t i o n   T h e   o u t p u t   s h o u l d   r e f l e c t   t h e   u p d a t e d   n u m b e r   o f   r e p l i c a s :   N A M E   R E A D Y   U P - T O - D A T E   A V A I L A B L E   A G E   c a p a c i t y - r e s e r v a t i o n   5 / 5   5   5   2 m


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   P r i o r i t y C l a s s e s   a n d   h o w   t h e y   a f f e c t   p o d   s c h e d u l i n g . E x p l o r e   n o d e   a u t o s c a l i n g   t o   d y n a m i c a l l y   a d j u s t   y o u r   c l u s t e r ' s   s i z e   b a s e d   o n   w o r k l o a d   d e m a n d s . U n d e r s t a n d   P o d   p r e e m p t i o n ,   a   k e y   m e c h a n i s m   f o r   K u b e r n e t e s   t o   h a n d l e   r e s o u r c e   c o n t e n t i o n .   T h e   s a m e   p a g e   c o v e r s   e v i c t i o n ,   w h i c h   i s   l e s s   r e l e v a n t   t o   t h e   p l a c e h o l d e r   P o d   a p p r o a c h ,   b u t   i s   a l s o   a   m e c h a n i s m   f o r   K u b e r n e t e s   t o   r e a c t   w h e n   r e s o u r c e s   a r e   c o n t e n d e d .


Question: What is Role?

Answer: RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata (ObjectMeta)Standard object's metadata.rules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this RolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.RoleListRoleList is a collection of RolesapiVersion: rbac.authorization.k8s.io/v1kind: RoleListmetadata (ListMeta)Standard object's metadata.items ([]Role), requiredItems is a list of RolesOperationsget read the specified RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}Parametersname (in path): string, requiredname of the Rolenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Role): OK401: Unauthorizedlist list or watch objects of kind RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in quer


Question: How does Role work?

Answer: RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata (ObjectMeta)Standard object's metadata.rules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this RolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.RoleListRoleList is a collection of RolesapiVersion: rbac.authorization.k8s.io/v1kind: RoleListmetadata (ListMeta)Standard object's metadata.items ([]Role), requiredItems is a list of RolesOperationsget read the specified RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}Parametersname (in path): string, requiredname of the Rolenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Role): OK401: Unauthorizedlist list or watch objects of kind RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in quer


Question: When would you use Role?

Answer: RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata (ObjectMeta)Standard object's metadata.rules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this RolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.RoleListRoleList is a collection of RolesapiVersion: rbac.authorization.k8s.io/v1kind: RoleListmetadata (ListMeta)Standard object's metadata.items ([]Role), requiredItems is a list of RolesOperationsget read the specified RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}Parametersname (in path): string, requiredname of the Rolenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Role): OK401: Unauthorizedlist list or watch objects of kind RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in quer


Question: What are the benefits of Role?

Answer: RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1import "k8s.io/api/rbac/v1"RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.apiVersion: rbac.authorization.k8s.io/v1kind: Rolemetadata (ObjectMeta)Standard object's metadata.rules ([]PolicyRule)Atomic: will be replaced during a mergeRules holds all the PolicyRules for this RolePolicyRule holds information that describes a policy rule, but does not contain information about who the rule applies to or which namespace the rule applies to.rules.apiGroups ([]string)Atomic: will be replaced during a mergeAPIGroups is the name of the APIGroup that contains the resources. If multiple API groups are specified, any action requested against one of the enumerated resources in any API group will be allowed. "" represents the core API group and "*" represents all API groups.rules.resources ([]string)Atomic: will be replaced during a mergeResources is a list of resources this rule applies to. '*' represents all resources.rules.verbs ([]string), requiredAtomic: will be replaced during a mergeVerbs is a list of Verbs that apply to ALL the ResourceKinds contained in this rule. '*' represents all verbs.rules.resourceNames ([]string)Atomic: will be replaced during a mergeResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.rules.nonResourceURLs ([]string)Atomic: will be replaced during a mergeNonResourceURLs is a set of partial urls that a user should have access to. *s are allowed, but only as the full, final step in the path Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding. Rules can either apply to API resources (such as "pods" or "secrets") or non-resource URL paths (such as "/api"), but not both.RoleListRoleList is a collection of RolesapiVersion: rbac.authorization.k8s.io/v1kind: RoleListmetadata (ListMeta)Standard object's metadata.items ([]Role), requiredItems is a list of RolesOperationsget read the specified RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/roles/{name}Parametersname (in path): string, requiredname of the Rolenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (Role): OK401: Unauthorizedlist list or watch objects of kind RoleHTTP RequestGET /apis/rbac.authorization.k8s.io/v1/namespaces/{namespace}/rolesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in quer


Question: What is Role?

Answer: a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / r b a c / v 1 "


Question: What is Role?

Answer: R o l e   i s   a   n a m e s p a c e d ,   l o g i c a l   g r o u p i n g   o f   P o l i c y R u l e s   t h a t   c a n   b e   r e f e r e n c e d   a s   a   u n i t   b y   a   R o l e B i n d i n g .   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   R o l e m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . r u l e s   ( [ ] P o l i c y R u l e ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e R u l e s   h o l d s   a l l   t h e   P o l i c y R u l e s   f o r   t h i s   R o l e P o l i c y R u l e   h o l d s   i n f o r m a t i o n   t h a t   d e s c r i b e s   a   p o l i c y   r u l e ,   b u t   d o e s   n o t   c o n t a i n   i n f o r m a t i o n   a b o u t   w h o   t h e   r u l e   a p p l i e s   t o   o r   w h i c h   n a m e s p a c e   t h e   r u l e   a p p l i e s   t o . r u l e s . a p i G r o u p s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e A P I G r o u p s   i s   t h e   n a m e   o f   t h e   A P I G r o u p   t h a t   c o n t a i n s   t h e   r e s o u r c e s .   I f   m u l t i p l e   A P I   g r o u p s   a r e   s p e c i f i e d ,   a n y   a c t i o n   r e q u e s t e d   a g a i n s t   o n e   o f   t h e   e n u m e r a t e d   r e s o u r c e s   i n   a n y   A P I   g r o u p   w i l l   b e   a l l o w e d .   " "   r e p r e s e n t s   t h e   c o r e   A P I   g r o u p   a n d   " * "   r e p r e s e n t s   a l l   A P I   g r o u p s . r u l e s . r e s o u r c e s   ( [ ] s t r i n g ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e R e s o u r c e s   i s   a   l i s t   o f   r e s o u r c e s   t h i s   r u l e   a p p l i e s   t o .   ' * '   r e p r e s e n t s   a l l   r e s o u r c e s . r u l e s . v e r b s   ( [ ] s t r i n g ) ,   r e q u i r e d A t o m i c :   w i l l   b e   r e p


Question: What is RoleList?

Answer: R o l e L i s t   i s   a   c o l l e c t i o n   o f   R o l e s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 k i n d :   R o l e L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a . i t e m s   ( [ ] R o l e ) ,   r e q u i r e d I t e m s   i s   a   l i s t   o f   R o l e s   a p i V e r s i o n :   r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1   k i n d :   R o l e L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   o b j e c t ' s   m e t a d a t a .   i t e m s   ( [ ] R o l e ) ,   r e q u i r e d   I t e m s   i s   a   l i s t   o f   R o l e s


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r o l e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R o l e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R o l e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R o l e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r o l e s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n


Question: What is Response?

Answer: 2 0 0   ( R o l e L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r b a c . a u t h o r i z a t i o n . k 8 s . i o / v 1 / r o l e s