Question: What is Audit Annotations?

Answer: Audit AnnotationsThis page serves as a reference for the audit annotations of the kubernetes.io namespace. These annotations apply to Event object from API group audit.k8s.io.Note:The following annotations are not used within the Kubernetes API. When you enable auditing in your cluster, audit event data is written using Event from API group audit.k8s.io. The annotations apply to audit events. Audit events are different from objects in the Event API (API group events.k8s.io).k8s.io/deprecatedExample: k8s.io/deprecated: "true"Value must be "true" or "false". The value "true" indicates that the request used a deprecated API version.k8s.io/removed-releaseExample: k8s.io/removed-release: "1.22"Value must be in the format "<MAJOR>.<MINOR>". It is set to target the removal release on requests made to deprecated API versions with a target removal release.pod-security.kubernetes.io/exemptExample: pod-security.kubernetes.io/exempt: namespaceValue must be one of user, namespace, or runtimeClass which correspond to Pod Security Exemption dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement.pod-security.kubernetes.io/enforce-policyExample: pod-security.kubernetes.io/enforce-policy: restricted:latestValue must be privileged:<version>, baseline:<version>, restricted:<version> which correspond to Pod Security Standard levels accompanied by a version which must be latest or a valid Kubernetes version in the format v<MAJOR>.<MINOR>. This annotations informs about the enforcement level that allowed or denied the pod during PodSecurity admission.See Pod Security Standards for more information.pod-security.kubernetes.io/audit-violationsExample: pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...Value details an audit policy violation, it contains the Pod Security Standard level that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement.See Pod Security Standards for more information.apiserver.latency.k8s.io/etcdExample: apiserver.latency.k8s.io/etcd: "4.730661757s"This annotation indiactes the measure of latency incurred inside the storage layer, it accounts for the time it takes to send data to the etcd and get the complete response back.The value of this audit annotation does not include the time incurred in admission, or validation.apiserver.latency.k8s.io/decode-response-objectExample: apiserver.latency.k8s.io/decode-response-object: "450.6649ns"This annotation records the time taken to decode the response received from the storage layer (etcd)apiserver.latency.k8s.io/apf-queue-waitExample: apiserver.latency.k8s.io/apf-queue-wait: "100ns"This annotation records the time that a request spent queued due to API server priorities.See API Priority and Fairness (APF) for more information about


Question: How does Audit Annotations work?

Answer: Audit AnnotationsThis page serves as a reference for the audit annotations of the kubernetes.io namespace. These annotations apply to Event object from API group audit.k8s.io.Note:The following annotations are not used within the Kubernetes API. When you enable auditing in your cluster, audit event data is written using Event from API group audit.k8s.io. The annotations apply to audit events. Audit events are different from objects in the Event API (API group events.k8s.io).k8s.io/deprecatedExample: k8s.io/deprecated: "true"Value must be "true" or "false". The value "true" indicates that the request used a deprecated API version.k8s.io/removed-releaseExample: k8s.io/removed-release: "1.22"Value must be in the format "<MAJOR>.<MINOR>". It is set to target the removal release on requests made to deprecated API versions with a target removal release.pod-security.kubernetes.io/exemptExample: pod-security.kubernetes.io/exempt: namespaceValue must be one of user, namespace, or runtimeClass which correspond to Pod Security Exemption dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement.pod-security.kubernetes.io/enforce-policyExample: pod-security.kubernetes.io/enforce-policy: restricted:latestValue must be privileged:<version>, baseline:<version>, restricted:<version> which correspond to Pod Security Standard levels accompanied by a version which must be latest or a valid Kubernetes version in the format v<MAJOR>.<MINOR>. This annotations informs about the enforcement level that allowed or denied the pod during PodSecurity admission.See Pod Security Standards for more information.pod-security.kubernetes.io/audit-violationsExample: pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...Value details an audit policy violation, it contains the Pod Security Standard level that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement.See Pod Security Standards for more information.apiserver.latency.k8s.io/etcdExample: apiserver.latency.k8s.io/etcd: "4.730661757s"This annotation indiactes the measure of latency incurred inside the storage layer, it accounts for the time it takes to send data to the etcd and get the complete response back.The value of this audit annotation does not include the time incurred in admission, or validation.apiserver.latency.k8s.io/decode-response-objectExample: apiserver.latency.k8s.io/decode-response-object: "450.6649ns"This annotation records the time taken to decode the response received from the storage layer (etcd)apiserver.latency.k8s.io/apf-queue-waitExample: apiserver.latency.k8s.io/apf-queue-wait: "100ns"This annotation records the time that a request spent queued due to API server priorities.See API Priority and Fairness (APF) for more information about


Question: When would you use Audit Annotations?

Answer: Audit AnnotationsThis page serves as a reference for the audit annotations of the kubernetes.io namespace. These annotations apply to Event object from API group audit.k8s.io.Note:The following annotations are not used within the Kubernetes API. When you enable auditing in your cluster, audit event data is written using Event from API group audit.k8s.io. The annotations apply to audit events. Audit events are different from objects in the Event API (API group events.k8s.io).k8s.io/deprecatedExample: k8s.io/deprecated: "true"Value must be "true" or "false". The value "true" indicates that the request used a deprecated API version.k8s.io/removed-releaseExample: k8s.io/removed-release: "1.22"Value must be in the format "<MAJOR>.<MINOR>". It is set to target the removal release on requests made to deprecated API versions with a target removal release.pod-security.kubernetes.io/exemptExample: pod-security.kubernetes.io/exempt: namespaceValue must be one of user, namespace, or runtimeClass which correspond to Pod Security Exemption dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement.pod-security.kubernetes.io/enforce-policyExample: pod-security.kubernetes.io/enforce-policy: restricted:latestValue must be privileged:<version>, baseline:<version>, restricted:<version> which correspond to Pod Security Standard levels accompanied by a version which must be latest or a valid Kubernetes version in the format v<MAJOR>.<MINOR>. This annotations informs about the enforcement level that allowed or denied the pod during PodSecurity admission.See Pod Security Standards for more information.pod-security.kubernetes.io/audit-violationsExample: pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...Value details an audit policy violation, it contains the Pod Security Standard level that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement.See Pod Security Standards for more information.apiserver.latency.k8s.io/etcdExample: apiserver.latency.k8s.io/etcd: "4.730661757s"This annotation indiactes the measure of latency incurred inside the storage layer, it accounts for the time it takes to send data to the etcd and get the complete response back.The value of this audit annotation does not include the time incurred in admission, or validation.apiserver.latency.k8s.io/decode-response-objectExample: apiserver.latency.k8s.io/decode-response-object: "450.6649ns"This annotation records the time taken to decode the response received from the storage layer (etcd)apiserver.latency.k8s.io/apf-queue-waitExample: apiserver.latency.k8s.io/apf-queue-wait: "100ns"This annotation records the time that a request spent queued due to API server priorities.See API Priority and Fairness (APF) for more information about


Question: What are the benefits of Audit Annotations?

Answer: Audit AnnotationsThis page serves as a reference for the audit annotations of the kubernetes.io namespace. These annotations apply to Event object from API group audit.k8s.io.Note:The following annotations are not used within the Kubernetes API. When you enable auditing in your cluster, audit event data is written using Event from API group audit.k8s.io. The annotations apply to audit events. Audit events are different from objects in the Event API (API group events.k8s.io).k8s.io/deprecatedExample: k8s.io/deprecated: "true"Value must be "true" or "false". The value "true" indicates that the request used a deprecated API version.k8s.io/removed-releaseExample: k8s.io/removed-release: "1.22"Value must be in the format "<MAJOR>.<MINOR>". It is set to target the removal release on requests made to deprecated API versions with a target removal release.pod-security.kubernetes.io/exemptExample: pod-security.kubernetes.io/exempt: namespaceValue must be one of user, namespace, or runtimeClass which correspond to Pod Security Exemption dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement.pod-security.kubernetes.io/enforce-policyExample: pod-security.kubernetes.io/enforce-policy: restricted:latestValue must be privileged:<version>, baseline:<version>, restricted:<version> which correspond to Pod Security Standard levels accompanied by a version which must be latest or a valid Kubernetes version in the format v<MAJOR>.<MINOR>. This annotations informs about the enforcement level that allowed or denied the pod during PodSecurity admission.See Pod Security Standards for more information.pod-security.kubernetes.io/audit-violationsExample: pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...Value details an audit policy violation, it contains the Pod Security Standard level that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement.See Pod Security Standards for more information.apiserver.latency.k8s.io/etcdExample: apiserver.latency.k8s.io/etcd: "4.730661757s"This annotation indiactes the measure of latency incurred inside the storage layer, it accounts for the time it takes to send data to the etcd and get the complete response back.The value of this audit annotation does not include the time incurred in admission, or validation.apiserver.latency.k8s.io/decode-response-objectExample: apiserver.latency.k8s.io/decode-response-object: "450.6649ns"This annotation records the time taken to decode the response received from the storage layer (etcd)apiserver.latency.k8s.io/apf-queue-waitExample: apiserver.latency.k8s.io/apf-queue-wait: "100ns"This annotation records the time that a request spent queued due to API server priorities.See API Priority and Fairness (APF) for more information about


Question: What is Audit Annotations?

Answer: T h i s   p a g e   s e r v e s   a s   a   r e f e r e n c e   f o r   t h e   a u d i t   a n n o t a t i o n s   o f   t h e   k u b e r n e t e s . i o   n a m e s p a c e .   T h e s e   a n n o t a t i o n s   a p p l y   t o   E v e n t   o b j e c t   f r o m   A P I   g r o u p   a u d i t . k 8 s . i o .


Question: What is k8s.io/deprecated?

Answer: E x a m p l e :   k 8 s . i o / d e p r e c a t e d :   " t r u e "   V a l u e   m u s t   b e   " t r u e "   o r   " f a l s e " .   T h e   v a l u e   " t r u e "   i n d i c a t e s   t h a t   t h e   r e q u e s t   u s e d   a   d e p r e c a t e d   A P I   v e r s i o n .


Question: What is k8s.io/removed-release?

Answer: E x a m p l e :   k 8 s . i o / r e m o v e d - r e l e a s e :   " 1 . 2 2 "   V a l u e   m u s t   b e   i n   t h e   f o r m a t   " < M A J O R > . < M I N O R > " .   I t   i s   s e t   t o   t a r g e t   t h e   r e m o v a l   r e l e a s e   o n   r e q u e s t s   m a d e   t o   d e p r e c a t e d   A P I   v e r s i o n s   w i t h   a   t a r g e t   r e m o v a l   r e l e a s e .


Question: What is pod-security.kubernetes.io/exempt?

Answer: E x a m p l e :   p o d - s e c u r i t y . k u b e r n e t e s . i o / e x e m p t :   n a m e s p a c e   V a l u e   m u s t   b e   o n e   o f   u s e r ,   n a m e s p a c e ,   o r   r u n t i m e C l a s s   w h i c h   c o r r e s p o n d   t o   P o d   S e c u r i t y   E x e m p t i o n   d i m e n s i o n s .   T h i s   a n n o t a t i o n   i n d i c a t e s   o n   w h i c h   d i m e n s i o n   w a s   b a s e d   t h e   e x e m p t i o n   f r o m   t h e   P o d S e c u r i t y   e n f o r c e m e n t .


Question: What is pod-security.kubernetes.io/enforce-policy?

Answer: E x a m p l e :   p o d - s e c u r i t y . k u b e r n e t e s . i o / e n f o r c e - p o l i c y :   r e s t r i c t e d : l a t e s t   V a l u e   m u s t   b e   p r i v i l e g e d : < v e r s i o n > ,   b a s e l i n e : < v e r s i o n > ,   r e s t r i c t e d : < v e r s i o n >   w h i c h   c o r r e s p o n d   t o   P o d   S e c u r i t y   S t a n d a r d   l e v e l s   a c c o m p a n i e d   b y   a   v e r s i o n   w h i c h   m u s t   b e   l a t e s t   o r   a   v a l i d   K u b e r n e t e s   v e r s i o n   i n   t h e   f o r m a t   v < M A J O R > . < M I N O R > .   T h i s   a n n o t a t i o n s   i n f o r m s   a b o u t   t h e   e n f o r c e m e n t   l e v e l   t h a t   a l l o w e d   o r   d e n i e d   t h e   p o d   d u r i n g   P o d S e c u r i t y   a d m i s s i o n .   S e e   P o d   S e c u r i t y   S t a n d a r d s   f o r   m o r e   i n f o r m a t i o n .


Question: What is pod-security.kubernetes.io/audit-violations?

Answer: E x a m p l e :   p o d - s e c u r i t y . k u b e r n e t e s . i o / a u d i t - v i o l a t i o n s :   w o u l d   v i o l a t e   P o d S e c u r i t y   " r e s t r i c t e d : l a t e s t " :   a l l o w P r i v i l e g e E s c a l a t i o n   ! =   f a l s e   ( c o n t a i n e r   " e x a m p l e "   m u s t   s e t   s e c u r i t y C o n t e x t . a l l o w P r i v i l e g e E s c a l a t i o n = f a l s e ) ,   . . .   V a l u e   d e t a i l s   a n   a u d i t   p o l i c y   v i o l a t i o n ,   i t   c o n t a i n s   t h e   P o d   S e c u r i t y   S t a n d a r d   l e v e l   t h a t   w a s   t r a n s g r e s s e d   a s   w e l l   a s   t h e   s p e c i f i c   p o l i c i e s   o n   t h e   f i e l d s   t h a t   w e r e   v i o l a t e d   f r o m   t h e   P o d S e c u r i t y   e n f o r c e m e n t .   S e e   P o d   S e c u r i t y   S t a n d a r d s   f o r   m o r e   i n f o r m a t i o n .


Question: What is apiserver.latency.k8s.io/etcd?

Answer: E x a m p l e :   a p i s e r v e r . l a t e n c y . k 8 s . i o / e t c d :   " 4 . 7 3 0 6 6 1 7 5 7 s "   T h i s   a n n o t a t i o n   i n d i a c t e s   t h e   m e a s u r e   o f   l a t e n c y   i n c u r r e d   i n s i d e   t h e   s t o r a g e   l a y e r ,   i t   a c c o u n t s   f o r   t h e   t i m e   i t   t a k e s   t o   s e n d   d a t a   t o   t h e   e t c d   a n d   g e t   t h e   c o m p l e t e   r e s p o n s e   b a c k .   T h e   v a l u e   o f   t h i s   a u d i t   a n n o t a t i o n   d o e s   n o t   i n c l u d e   t h e   t i m e   i n c u r r e d   i n   a d m i s s i o n ,   o r   v a l i d a t i o n .


Question: What is apiserver.latency.k8s.io/decode-response-object?

Answer: E x a m p l e :   a p i s e r v e r . l a t e n c y . k 8 s . i o / d e c o d e - r e s p o n s e - o b j e c t :   " 4 5 0 . 6 6 4 9 n s "   T h i s   a n n o t a t i o n   r e c o r d s   t h e   t i m e   t a k e n   t o   d e c o d e   t h e   r e s p o n s e   r e c e i v e d   f r o m   t h e   s t o r a g e   l a y e r   ( e t c d )


Question: What is apiserver.latency.k8s.io/apf-queue-wait?

Answer: E x a m p l e :   a p i s e r v e r . l a t e n c y . k 8 s . i o / a p f - q u e u e - w a i t :   " 1 0 0 n s "   T h i s   a n n o t a t i o n   r e c o r d s   t h e   t i m e   t h a t   a   r e q u e s t   s p e n t   q u e u e d   d u e   t o   A P I   s e r v e r   p r i o r i t i e s .   S e e   A P I   P r i o r i t y   a n d   F a i r n e s s   ( A P F )   f o r   m o r e   i n f o r m a t i o n   a b o u t   t h i s   m e c h a n i s m .


Question: What is authorization.k8s.io/decision?

Answer: E x a m p l e :   a u t h o r i z a t i o n . k 8 s . i o / d e c i s i o n :   " f o r b i d "   V a l u e   m u s t   b e   f o r b i d   o r   a l l o w .   T h i s   a n n o t a t i o n   i n d i c a t e s   w h e t h e r   o r   n o t   a   r e q u e s t   w a s   a u t h o r i z e d   i n   K u b e r n e t e s   a u d i t   l o g s .   S e e   A u d i t i n g   f o r   m o r e   i n f o r m a t i o n .


Question: What is authorization.k8s.io/reason?

Answer: E x a m p l e :   a u t h o r i z a t i o n . k 8 s . i o / r e a s o n :   " H u m a n - r e a d a b l e   r e a s o n   f o r   t h e   d e c i s i o n "   T h i s   a n n o t a t i o n   g i v e s   r e a s o n   f o r   t h e   d e c i s i o n   i n   K u b e r n e t e s   a u d i t   l o g s .   S e e   A u d i t i n g   f o r   m o r e   i n f o r m a t i o n .


Question: What is missing-san.invalid-cert.kubernetes.io/$hostname?

Answer: E x a m p l e :   m i s s i n g - s a n . i n v a l i d - c e r t . k u b e r n e t e s . i o / e x a m p l e - s v c . e x a m p l e - n a m e s p a c e . s v c :   " r e l i e s   o n   a   l e g a c y   C o m m o n   N a m e   f i e l d   i n s t e a d   o f   t h e   S A N   e x t e n s i o n   f o r   s u b j e c t   v a l i d a t i o n "   U s e d   b y   K u b e r n e t e s   v e r s i o n   v 1 . 2 4   a n d   l a t e r   T h i s   a n n o t a t i o n   i n d i c a t e s   a   w e b h o o k   o r   a g g r e g a t e d   A P I   s e r v e r   i s   u s i n g   a n   i n v a l i d   c e r t i f i c a t e   t h a t   i s   m i s s i n g   s u b j e c t A l t N a m e s .   S u p p o r t   f o r   t h e s e   c e r t i f i c a t e s   w a s   d i s a b l e d   b y   d e f a u l t   i n   K u b e r n e t e s   1 . 1 9 ,   a n d   r e m o v e d   i n   K u b e r n e t e s   1 . 2 3 .   R e q u e s t s   t o   e n d p o i n t s   u s i n g   t h e s e   c e r t i f i c a t e s   w i l l   f a i l .   S e r v i c e s   u s i n g   t h e s e   c e r t i f i c a t e s   s h o u l d   r e p l a c e   t h e m   a s   s o o n   a s   p o s s i b l e   t o   a v o i d   d i s r u p t i o n   w h e n   r u n n i n g   i n   K u b e r n e t e s   1 . 2 3 +   e n v i r o n m e n t s .   T h e r e ' s   m o r e   i n f o r m a t i o n   a b o u t   t h i s   i n   t h e   G o   d o c u m e n t a t i o n :   X . 5 0 9   C o m m o n N a m e   d e p r e c a t i o n .


Question: What is insecure-sha1.invalid-cert.kubernetes.io/$hostname?

Answer: E x a m p l e :   i n s e c u r e - s h a 1 . i n v a l i d - c e r t . k u b e r n e t e s . i o / e x a m p l e - s v c . e x a m p l e - n a m e s p a c e . s v c :   " u s e s   a n   i n s e c u r e   S H A - 1   s i g n a t u r e "   U s e d   b y   K u b e r n e t e s   v e r s i o n   v 1 . 2 4   a n d   l a t e r   T h i s   a n n o t a t i o n   i n d i c a t e s   a   w e b h o o k   o r   a g g r e g a t e d   A P I   s e r v e r   i s   u s i n g   a n   i n s e c u r e   c e r t i f i c a t e   s i g n e d   w i t h   a   S H A - 1   h a s h .   S u p p o r t   f o r   t h e s e   i n s e c u r e   c e r t i f i c a t e s   i s   d i s a b l e d   b y   d e f a u l t   i n   K u b e r n e t e s   1 . 2 4 ,   a n d   w i l l   b e   r e m o v e d   i n   a   f u t u r e   r e l e a s e .   S e r v i c e s   u s i n g   t h e s e   c e r t i f i c a t e s   s h o u l d   r e p l a c e   t h e m   a s   s o o n   a s   p o s s i b l e ,   t o   e n s u r e   c o n n e c t i o n s   a r e   s e c u r e d   p r o p e r l y   a n d   t o   a v o i d   d i s r u p t i o n   i n   f u t u r e   r e l e a s e s .   T h e r e ' s   m o r e   i n f o r m a t i o n   a b o u t   t h i s   i n   t h e   G o   d o c u m e n t a t i o n :   R e j e c t i n g   S H A - 1   c e r t i f i c a t e s .


Question: What is validation.policy.admission.k8s.io/validation_failure?

Answer: E x a m p l e :   v a l i d a t i o n . p o l i c y . a d m i s s i o n . k 8 s . i o / v a l i d a t i o n _ f a i l u r e :   ' [ { " m e s s a g e " :   " I n v a l i d   v a l u e " ,   { " p o l i c y " :   " p o l i c y . e x a m p l e . c o m " ,   { " b i n d i n g " :   " p o l i c y b i n d i n g . e x a m p l e . c o m " ,   { " e x p r e s s i o n I n d e x " :   " 1 " ,   { " v a l i d a t i o n A c t i o n s " :   [ " A u d i t " ] } ] '   U s e d   b y   K u b e r n e t e s   v e r s i o n   v 1 . 2 7   a n d   l a t e r .   T h i s   a n n o t a t i o n   i n d i c a t e s   t h a t   a   a d m i s s i o n   p o l i c y   v a l i d a t i o n   e v a l u a t e d   t o   f a l s e   f o r   a n   A P I   r e q u e s t ,   o r   t h a t   t h e   v a l i d a t i o n   r e s u l t e d   i n   a n   e r r o r   w h i l e   t h e   p o l i c y   w a s   c o n f i g u r e d   w i t h   f a i l u r e P o l i c y :   F a i l .   T h e   v a l u e   o f   t h e   a n n o t a t i o n   i s   a   J S O N   o b j e c t .   T h e   m e s s a g e   i n   t h e   J S O N   p r o v i d e s   t h e   m e s s a g e   a b o u t   t h e   v a l i d a t i o n   f a i l u r e .   T h e   p o l i c y ,   b i n d i n g   a n d   e x p r e s s i o n I n d e x   i n   t h e   J S O N   i d e n t i f i e s   t h e   n a m e   o f   t h e   V a l i d a t i n g A d m i s s i o n P o l i c y ,   t h e   n a m e   o f   t h e   V a l i d a t i n g A d m i s s i o n P o l i c y B i n d i n g   a n d   t h e   i n d e x   i n   t h e   p o l i c y   v a l i d a t i o n s   o f   t h e   C E L   e x p r e s s i o n s   t h a t   f a i l e d ,   r e s p e c t i v e l y .   T h e   v a l i d a t i o n A c t i o n s   s h o w s   w h a t   a c t i o n s   w e r e   t a k e n   f o r   t h i s   v a l i d a t i o n   f a i l u r e .   S e e   V a l i d a t i n g   A d m i s s i o n   P o l i c y   f o r   m o r e   d e t a i l s   a b o u t   v a l i d a t i o n A c t i o n s .


Question: What is Change the Reclaim Policy of a PersistentVolume?

Answer: Change the Reclaim Policy of a PersistentVolumeThis page shows how to change the reclaim policy of a Kubernetes PersistentVolume.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Why change reclaim policy of a PersistentVolumePersistentVolumes can have various reclaim policies, including "Retain", "Recycle", and "Delete". For dynamically provisioned PersistentVolumes, the default reclaim policy is "Delete". This means that a dynamically provisioned volume is automatically deleted when a user deletes the corresponding PersistentVolumeClaim. This automatic behavior might be inappropriate if the volume contains precious data. In that case, it is more appropriate to use the "Retain" policy. With the "Retain" policy, if a user deletes a PersistentVolumeClaim, the corresponding PersistentVolume will not be deleted. Instead, it is moved to the Released phase, where all of its data can be manually recovered.Changing the reclaim policy of a PersistentVolumeList the PersistentVolumes in your cluster:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 10s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 6s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim3 manual 3s This list also includes the name of the claims that are bound to each volume for easier identification of dynamically provisioned volumes.Choose one of your PersistentVolumes and change its reclaim policy:kubectl patch pv <your-pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}' where <your-pv-name> is the name of your chosen PersistentVolume.Note:On Windows, you must double quote any JSONPath template that contains spaces (not single quote as shown above for bash). This in turn means that you must use a single quote or escaped double quote around any literals in the template. For example:kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"Retain\"}}" Verify that your chosen PersistentVolume has the right policy:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 40s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 36s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Retain Bound default/claim3 manual 33s In the preceding output,


Question: How does Change the Reclaim Policy of a PersistentVolume work?

Answer: Change the Reclaim Policy of a PersistentVolumeThis page shows how to change the reclaim policy of a Kubernetes PersistentVolume.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Why change reclaim policy of a PersistentVolumePersistentVolumes can have various reclaim policies, including "Retain", "Recycle", and "Delete". For dynamically provisioned PersistentVolumes, the default reclaim policy is "Delete". This means that a dynamically provisioned volume is automatically deleted when a user deletes the corresponding PersistentVolumeClaim. This automatic behavior might be inappropriate if the volume contains precious data. In that case, it is more appropriate to use the "Retain" policy. With the "Retain" policy, if a user deletes a PersistentVolumeClaim, the corresponding PersistentVolume will not be deleted. Instead, it is moved to the Released phase, where all of its data can be manually recovered.Changing the reclaim policy of a PersistentVolumeList the PersistentVolumes in your cluster:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 10s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 6s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim3 manual 3s This list also includes the name of the claims that are bound to each volume for easier identification of dynamically provisioned volumes.Choose one of your PersistentVolumes and change its reclaim policy:kubectl patch pv <your-pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}' where <your-pv-name> is the name of your chosen PersistentVolume.Note:On Windows, you must double quote any JSONPath template that contains spaces (not single quote as shown above for bash). This in turn means that you must use a single quote or escaped double quote around any literals in the template. For example:kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"Retain\"}}" Verify that your chosen PersistentVolume has the right policy:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 40s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 36s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Retain Bound default/claim3 manual 33s In the preceding output,


Question: When would you use Change the Reclaim Policy of a PersistentVolume?

Answer: Change the Reclaim Policy of a PersistentVolumeThis page shows how to change the reclaim policy of a Kubernetes PersistentVolume.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Why change reclaim policy of a PersistentVolumePersistentVolumes can have various reclaim policies, including "Retain", "Recycle", and "Delete". For dynamically provisioned PersistentVolumes, the default reclaim policy is "Delete". This means that a dynamically provisioned volume is automatically deleted when a user deletes the corresponding PersistentVolumeClaim. This automatic behavior might be inappropriate if the volume contains precious data. In that case, it is more appropriate to use the "Retain" policy. With the "Retain" policy, if a user deletes a PersistentVolumeClaim, the corresponding PersistentVolume will not be deleted. Instead, it is moved to the Released phase, where all of its data can be manually recovered.Changing the reclaim policy of a PersistentVolumeList the PersistentVolumes in your cluster:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 10s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 6s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim3 manual 3s This list also includes the name of the claims that are bound to each volume for easier identification of dynamically provisioned volumes.Choose one of your PersistentVolumes and change its reclaim policy:kubectl patch pv <your-pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}' where <your-pv-name> is the name of your chosen PersistentVolume.Note:On Windows, you must double quote any JSONPath template that contains spaces (not single quote as shown above for bash). This in turn means that you must use a single quote or escaped double quote around any literals in the template. For example:kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"Retain\"}}" Verify that your chosen PersistentVolume has the right policy:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 40s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 36s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Retain Bound default/claim3 manual 33s In the preceding output,


Question: What are the benefits of Change the Reclaim Policy of a PersistentVolume?

Answer: Change the Reclaim Policy of a PersistentVolumeThis page shows how to change the reclaim policy of a Kubernetes PersistentVolume.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Why change reclaim policy of a PersistentVolumePersistentVolumes can have various reclaim policies, including "Retain", "Recycle", and "Delete". For dynamically provisioned PersistentVolumes, the default reclaim policy is "Delete". This means that a dynamically provisioned volume is automatically deleted when a user deletes the corresponding PersistentVolumeClaim. This automatic behavior might be inappropriate if the volume contains precious data. In that case, it is more appropriate to use the "Retain" policy. With the "Retain" policy, if a user deletes a PersistentVolumeClaim, the corresponding PersistentVolume will not be deleted. Instead, it is moved to the Released phase, where all of its data can be manually recovered.Changing the reclaim policy of a PersistentVolumeList the PersistentVolumes in your cluster:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 10s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 6s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim3 manual 3s This list also includes the name of the claims that are bound to each volume for easier identification of dynamically provisioned volumes.Choose one of your PersistentVolumes and change its reclaim policy:kubectl patch pv <your-pv-name> -p '{"spec":{"persistentVolumeReclaimPolicy":"Retain"}}' where <your-pv-name> is the name of your chosen PersistentVolume.Note:On Windows, you must double quote any JSONPath template that contains spaces (not single quote as shown above for bash). This in turn means that you must use a single quote or escaped double quote around any literals in the template. For example:kubectl patch pv <your-pv-name> -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"Retain\"}}" Verify that your chosen PersistentVolume has the right policy:kubectl get pv The output is similar to this:NAME CAPACITY ACCESSMODES RECLAIMPOLICY STATUS CLAIM STORAGECLASS REASON AGE pvc-b6efd8da-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim1 manual 40s pvc-b95650f8-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Delete Bound default/claim2 manual 36s pvc-bb3ca71d-b7b5-11e6-9d58-0ed433a7dd94 4Gi RWO Retain Bound default/claim3 manual 33s In the preceding output,


Question: What is Change the Reclaim Policy of a PersistentVolume?

Answer: T h i s   p a g e   s h o w s   h o w   t o   c h a n g e   t h e   r e c l a i m   p o l i c y   o f   a   K u b e r n e t e s   P e r s i s t e n t V o l u m e .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Why change reclaim policy of a PersistentVolume?

Answer: P e r s i s t e n t V o l u m e s   c a n   h a v e   v a r i o u s   r e c l a i m   p o l i c i e s ,   i n c l u d i n g   " R e t a i n " ,   " R e c y c l e " ,   a n d   " D e l e t e " .   F o r   d y n a m i c a l l y   p r o v i s i o n e d   P e r s i s t e n t V o l u m e s ,   t h e   d e f a u l t   r e c l a i m   p o l i c y   i s   " D e l e t e " .   T h i s   m e a n s   t h a t   a   d y n a m i c a l l y   p r o v i s i o n e d   v o l u m e   i s   a u t o m a t i c a l l y   d e l e t e d   w h e n   a   u s e r   d e l e t e s   t h e   c o r r e s p o n d i n g   P e r s i s t e n t V o l u m e C l a i m .   T h i s   a u t o m a t i c   b e h a v i o r   m i g h t   b e   i n a p p r o p r i a t e   i f   t h e   v o l u m e   c o n t a i n s   p r e c i o u s   d a t a .   I n   t h a t   c a s e ,   i t   i s   m o r e   a p p r o p r i a t e   t o   u s e   t h e   " R e t a i n "   p o l i c y .   W i t h   t h e   " R e t a i n "   p o l i c y ,   i f   a   u s e r   d e l e t e s   a   P e r s i s t e n t V o l u m e C l a i m ,   t h e   c o r r e s p o n d i n g   P e r s i s t e n t V o l u m e   w i l l   n o t   b e   d e l e t e d .   I n s t e a d ,   i t   i s   m o v e d   t o   t h e   R e l e a s e d   p h a s e ,   w h e r e   a l l   o f   i t s   d a t a   c a n   b e   m a n u a l l y   r e c o v e r e d .


Question: What is Changing the reclaim policy of a PersistentVolume?

Answer: L i s t   t h e   P e r s i s t e n t V o l u m e s   i n   y o u r   c l u s t e r : k u b e c t l   g e t   p v   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s : N A M E   C A P A C I T Y   A C C E S S M O D E S   R E C L A I M P O L I C Y   S T A T U S   C L A I M   S T O R A G E C L A S S   R E A S O N   A G E   p v c - b 6 e f d 8 d a - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   D e l e t e   B o u n d   d e f a u l t / c l a i m 1   m a n u a l   1 0 s   p v c - b 9 5 6 5 0 f 8 - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   D e l e t e   B o u n d   d e f a u l t / c l a i m 2   m a n u a l   6 s   p v c - b b 3 c a 7 1 d - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   D e l e t e   B o u n d   d e f a u l t / c l a i m 3   m a n u a l   3 s   T h i s   l i s t   a l s o   i n c l u d e s   t h e   n a m e   o f   t h e   c l a i m s   t h a t   a r e   b o u n d   t o   e a c h   v o l u m e   f o r   e a s i e r   i d e n t i f i c a t i o n   o f   d y n a m i c a l l y   p r o v i s i o n e d   v o l u m e s . C h o o s e   o n e   o f   y o u r   P e r s i s t e n t V o l u m e s   a n d   c h a n g e   i t s   r e c l a i m   p o l i c y : k u b e c t l   p a t c h   p v   < y o u r - p v - n a m e >   - p   ' { " s p e c " : { " p e r s i s t e n t V o l u m e R e c l a i m P o l i c y " : " R e t a i n " } } '   w h e r e   < y o u r - p v - n a m e >   i s   t h e   n a m e   o f   y o u r   c h o s e n   P e r s i s t e n t V o l u m e . N o t e : O n   W i n d o w s ,   y o u   m u s t   d o u b l e   q u o t e   a n y   J S O N P a t h   t e m p l a t e   t h a t   c o n t a i n s   s p a c e s   ( n o t   s i n g l e   q u o t e   a s   s h o w n   a b o v e   f o r   b a s h ) .   T h i s   i n   t u r n   m e a n s   t h a t   y o u   m u s t   u s e   a   s i n g l e   q u o t e   o r   e s c a p e d   d o u b l e   q u o t e   a r o u n d   a n y   l


Question: What is Note:?

Answer: O n   W i n d o w s ,   y o u   m u s t   d o u b l e   q u o t e   a n y   J S O N P a t h   t e m p l a t e   t h a t   c o n t a i n s   s p a c e s   ( n o t   s i n g l e   q u o t e   a s   s h o w n   a b o v e   f o r   b a s h ) .   T h i s   i n   t u r n   m e a n s   t h a t   y o u   m u s t   u s e   a   s i n g l e   q u o t e   o r   e s c a p e d   d o u b l e   q u o t e   a r o u n d   a n y   l i t e r a l s   i n   t h e   t e m p l a t e .   F o r   e x a m p l e :   k u b e c t l   p a t c h   p v   < y o u r - p v - n a m e >   - p   " { \ " s p e c \ " : { \ " p e r s i s t e n t V o l u m e R e c l a i m P o l i c y \ " : \ " R e t a i n \ " } } "   V e r i f y   t h a t   y o u r   c h o s e n   P e r s i s t e n t V o l u m e   h a s   t h e   r i g h t   p o l i c y :   k u b e c t l   g e t   p v   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s :   N A M E   C A P A C I T Y   A C C E S S M O D E S   R E C L A I M P O L I C Y   S T A T U S   C L A I M   S T O R A G E C L A S S   R E A S O N   A G E   p v c - b 6 e f d 8 d a - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   D e l e t e   B o u n d   d e f a u l t / c l a i m 1   m a n u a l   4 0 s   p v c - b 9 5 6 5 0 f 8 - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   D e l e t e   B o u n d   d e f a u l t / c l a i m 2   m a n u a l   3 6 s   p v c - b b 3 c a 7 1 d - b 7 b 5 - 1 1 e 6 - 9 d 5 8 - 0 e d 4 3 3 a 7 d d 9 4   4 G i   R W O   R e t a i n   B o u n d   d e f a u l t / c l a i m 3   m a n u a l   3 3 s   I n   t h e   p r e c e d i n g   o u t p u t ,   y o u   c a n   s e e   t h a t   t h e   v o l u m e   b o u n d   t o   c l a i m   d e f a u l t / c l a i m 3   h a s   r e c l a i m   p o l i c y   R e t a i n .   I t   w i l l   n o t   b e   a u t o m a t i c a l l y   d e l e t e d   w h e n   a   u s e r   d e l e t e s   c l a i m   d e f a u l t / c l a i m 3 .


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   P e r s i s t e n t V o l u m e s . L e a r n   m o r e   a b o u t   P e r s i s t e n t V o l u m e C l a i m s .


Question: What is References?

Answer: P e r s i s t e n t V o l u m e P a y   a t t e n t i o n   t o   t h e   . s p e c . p e r s i s t e n t V o l u m e R e c l a i m P o l i c y   f i e l d   o f   P e r s i s t e n t V o l u m e . P e r s i s t e n t V o l u m e C l a i m   P a y   a t t e n t i o n   t o   t h e   . s p e c . p e r s i s t e n t V o l u m e R e c l a i m P o l i c y   f i e l d   o f   P e r s i s t e n t V o l u m e .


Question: What is Use a User Namespace With a Pod?

Answer: Use a User Namespace With a PodFEATURE STATE: Kubernetes v1.33 [beta] (enabled by default: true)This page shows how to configure a user namespace for pods. This allows you to isolate the user running inside the container from the one in the host.A process running as root in a container can run as a different (non-root) user in the host; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.You can use this feature to reduce the damage a compromised container can do to the host or other pods in the same node. There are several security vulnerabilities rated either HIGH or CRITICAL that were not exploitable when user namespaces is active. It is expected user namespace will mitigate some future vulnerabilities too.Without using a user namespace a container running as root, in the case of a container breakout, has root privileges on the node. And if some capability were granted to the container, the capabilities are valid on the host too. None of this is true when user namespaces are used.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.25.To check the version, enter kubectl version.🛇 This item links to a third party project or product that is not part of Kubernetes itself. More informationThe node OS needs to be LinuxYou need to exec commands in the hostYou need to be able to exec into podsYou need to enable the UserNamespacesSupport feature gateNote:The feature gate to enable user namespaces was previously named UserNamespacesStatelessPodsSupport, when only stateless pods were supported. Only Kubernetes v1.25 through to v1.27 recognise UserNamespacesStatelessPodsSupport.The cluster that you're using must include at least one node that meets the requirements for using user namespaces with Pods.If you have a mixture of nodes and only some of the nodes provide user namespace support for Pods, you also need to ensure that the user namespace Pods are scheduled to suitable nodes.Run a Pod that uses a user namespaceA user namespace for a pod is enabled setting the hostUsers field of .spec to false. For example:pods/user-namespaces-stateless.yaml apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: - name: shell command: ["sleep", "infinity"] image: debian Create the pod on your cluster:kubectl apply -f https://k8s.io/examples/pods/user-namespaces-stateless.yaml Exec into the pod and run readlink /proc/self/ns/user:kubectl exec -ti userns -- bash Run this command:readlink /proc/self/ns/user The


Question: How does Use a User Namespace With a Pod work?

Answer: Use a User Namespace With a PodFEATURE STATE: Kubernetes v1.33 [beta] (enabled by default: true)This page shows how to configure a user namespace for pods. This allows you to isolate the user running inside the container from the one in the host.A process running as root in a container can run as a different (non-root) user in the host; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.You can use this feature to reduce the damage a compromised container can do to the host or other pods in the same node. There are several security vulnerabilities rated either HIGH or CRITICAL that were not exploitable when user namespaces is active. It is expected user namespace will mitigate some future vulnerabilities too.Without using a user namespace a container running as root, in the case of a container breakout, has root privileges on the node. And if some capability were granted to the container, the capabilities are valid on the host too. None of this is true when user namespaces are used.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.25.To check the version, enter kubectl version.🛇 This item links to a third party project or product that is not part of Kubernetes itself. More informationThe node OS needs to be LinuxYou need to exec commands in the hostYou need to be able to exec into podsYou need to enable the UserNamespacesSupport feature gateNote:The feature gate to enable user namespaces was previously named UserNamespacesStatelessPodsSupport, when only stateless pods were supported. Only Kubernetes v1.25 through to v1.27 recognise UserNamespacesStatelessPodsSupport.The cluster that you're using must include at least one node that meets the requirements for using user namespaces with Pods.If you have a mixture of nodes and only some of the nodes provide user namespace support for Pods, you also need to ensure that the user namespace Pods are scheduled to suitable nodes.Run a Pod that uses a user namespaceA user namespace for a pod is enabled setting the hostUsers field of .spec to false. For example:pods/user-namespaces-stateless.yaml apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: - name: shell command: ["sleep", "infinity"] image: debian Create the pod on your cluster:kubectl apply -f https://k8s.io/examples/pods/user-namespaces-stateless.yaml Exec into the pod and run readlink /proc/self/ns/user:kubectl exec -ti userns -- bash Run this command:readlink /proc/self/ns/user The


Question: When would you use Use a User Namespace With a Pod?

Answer: Use a User Namespace With a PodFEATURE STATE: Kubernetes v1.33 [beta] (enabled by default: true)This page shows how to configure a user namespace for pods. This allows you to isolate the user running inside the container from the one in the host.A process running as root in a container can run as a different (non-root) user in the host; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.You can use this feature to reduce the damage a compromised container can do to the host or other pods in the same node. There are several security vulnerabilities rated either HIGH or CRITICAL that were not exploitable when user namespaces is active. It is expected user namespace will mitigate some future vulnerabilities too.Without using a user namespace a container running as root, in the case of a container breakout, has root privileges on the node. And if some capability were granted to the container, the capabilities are valid on the host too. None of this is true when user namespaces are used.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.25.To check the version, enter kubectl version.🛇 This item links to a third party project or product that is not part of Kubernetes itself. More informationThe node OS needs to be LinuxYou need to exec commands in the hostYou need to be able to exec into podsYou need to enable the UserNamespacesSupport feature gateNote:The feature gate to enable user namespaces was previously named UserNamespacesStatelessPodsSupport, when only stateless pods were supported. Only Kubernetes v1.25 through to v1.27 recognise UserNamespacesStatelessPodsSupport.The cluster that you're using must include at least one node that meets the requirements for using user namespaces with Pods.If you have a mixture of nodes and only some of the nodes provide user namespace support for Pods, you also need to ensure that the user namespace Pods are scheduled to suitable nodes.Run a Pod that uses a user namespaceA user namespace for a pod is enabled setting the hostUsers field of .spec to false. For example:pods/user-namespaces-stateless.yaml apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: - name: shell command: ["sleep", "infinity"] image: debian Create the pod on your cluster:kubectl apply -f https://k8s.io/examples/pods/user-namespaces-stateless.yaml Exec into the pod and run readlink /proc/self/ns/user:kubectl exec -ti userns -- bash Run this command:readlink /proc/self/ns/user The


Question: What are the benefits of Use a User Namespace With a Pod?

Answer: Use a User Namespace With a PodFEATURE STATE: Kubernetes v1.33 [beta] (enabled by default: true)This page shows how to configure a user namespace for pods. This allows you to isolate the user running inside the container from the one in the host.A process running as root in a container can run as a different (non-root) user in the host; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.You can use this feature to reduce the damage a compromised container can do to the host or other pods in the same node. There are several security vulnerabilities rated either HIGH or CRITICAL that were not exploitable when user namespaces is active. It is expected user namespace will mitigate some future vulnerabilities too.Without using a user namespace a container running as root, in the case of a container breakout, has root privileges on the node. And if some capability were granted to the container, the capabilities are valid on the host too. None of this is true when user namespaces are used.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.25.To check the version, enter kubectl version.🛇 This item links to a third party project or product that is not part of Kubernetes itself. More informationThe node OS needs to be LinuxYou need to exec commands in the hostYou need to be able to exec into podsYou need to enable the UserNamespacesSupport feature gateNote:The feature gate to enable user namespaces was previously named UserNamespacesStatelessPodsSupport, when only stateless pods were supported. Only Kubernetes v1.25 through to v1.27 recognise UserNamespacesStatelessPodsSupport.The cluster that you're using must include at least one node that meets the requirements for using user namespaces with Pods.If you have a mixture of nodes and only some of the nodes provide user namespace support for Pods, you also need to ensure that the user namespace Pods are scheduled to suitable nodes.Run a Pod that uses a user namespaceA user namespace for a pod is enabled setting the hostUsers field of .spec to false. For example:pods/user-namespaces-stateless.yaml apiVersion: v1 kind: Pod metadata: name: userns spec: hostUsers: false containers: - name: shell command: ["sleep", "infinity"] image: debian Create the pod on your cluster:kubectl apply -f https://k8s.io/examples/pods/user-namespaces-stateless.yaml Exec into the pod and run readlink /proc/self/ns/user:kubectl exec -ti userns -- bash Run this command:readlink /proc/self/ns/user The


Question: What is Use a User Namespace With a Pod?

Answer: T h i s   p a g e   s h o w s   h o w   t o   c o n f i g u r e   a   u s e r   n a m e s p a c e   f o r   p o d s .   T h i s   a l l o w s   y o u   t o   i s o l a t e   t h e   u s e r   r u n n i n g   i n s i d e   t h e   c o n t a i n e r   f r o m   t h e   o n e   i n   t h e   h o s t .   A   p r o c e s s   r u n n i n g   a s   r o o t   i n   a   c o n t a i n e r   c a n   r u n   a s   a   d i f f e r e n t   ( n o n - r o o t )   u s e r   i n   t h e   h o s t ;   i n   o t h e r   w o r d s ,   t h e   p r o c e s s   h a s   f u l l   p r i v i l e g e s   f o r   o p e r a t i o n s   i n s i d e   t h e   u s e r   n a m e s p a c e ,   b u t   i s   u n p r i v i l e g e d   f o r   o p e r a t i o n s   o u t s i d e   t h e   n a m e s p a c e .   Y o u   c a n   u s e   t h i s   f e a t u r e   t o   r e d u c e   t h e   d a m a g e   a   c o m p r o m i s e d   c o n t a i n e r   c a n   d o   t o   t h e   h o s t   o r   o t h e r   p o d s   i n   t h e   s a m e   n o d e .   T h e r e   a r e   s e v e r a l   s e c u r i t y   v u l n e r a b i l i t i e s   r a t e d   e i t h e r   H I G H   o r   C R I T I C A L   t h a t   w e r e   n o t   e x p l o i t a b l e   w h e n   u s e r   n a m e s p a c e s   i s   a c t i v e .   I t   i s   e x p e c t e d   u s e r   n a m e s p a c e   w i l l   m i t i g a t e   s o m e   f u t u r e   v u l n e r a b i l i t i e s   t o o .   W i t h o u t   u s i n g   a   u s e r   n a m e s p a c e   a   c o n t a i n e r   r u n n i n g   a s   r o o t ,   i n   t h e   c a s e   o f   a   c o n t a i n e r   b r e a k o u t ,   h a s   r o o t   p r i v i l e g e s   o n   t h e   n o d e .   A n d   i f   s o m e   c a p a b i l i t y   w e r e   g r a n t e d   t o   t h e   c o n t a i n e r ,   t h e   c a p a b i l i t i e s   a r e   v a l i d   o n   t h e   h o s t   t o o .   N o n e   o f   t h i s   i s   t r u e   w h e n   u s e r   n a m e s p a c e s   a r e   u s e d .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 2 5 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Note:?

Answer: T h e   c l u s t e r   t h a t   y o u ' r e   u s i n g   m u s t   i n c l u d e   a t   l e a s t   o n e   n o d e   t h a t   m e e t s   t h e   r e q u i r e m e n t s   f o r   u s i n g   u s e r   n a m e s p a c e s   w i t h   P o d s .   I f   y o u   h a v e   a   m i x t u r e   o f   n o d e s   a n d   o n l y   s o m e   o f   t h e   n o d e s   p r o v i d e   u s e r   n a m e s p a c e   s u p p o r t   f o r   P o d s ,   y o u   a l s o   n e e d   t o   e n s u r e   t h a t   t h e   u s e r   n a m e s p a c e   P o d s   a r e   s c h e d u l e d   t o   s u i t a b l e   n o d e s .


Question: What is Run a Pod that uses a user namespace?

Answer: A   u s e r   n a m e s p a c e   f o r   a   p o d   i s   e n a b l e d   s e t t i n g   t h e   h o s t U s e r s   f i e l d   o f   . s p e c   t o   f a l s e .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   u s e r n s   s p e c :   h o s t U s e r s :   f a l s e   c o n t a i n e r s :   -   n a m e :   s h e l l   c o m m a n d :   [ " s l e e p " ,   " i n f i n i t y " ]   i m a g e :   d e b i a n   C r e a t e   t h e   p o d   o n   y o u r   c l u s t e r : k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / u s e r - n a m e s p a c e s - s t a t e l e s s . y a m l   E x e c   i n t o   t h e   p o d   a n d   r u n   r e a d l i n k   / p r o c / s e l f / n s / u s e r : k u b e c t l   e x e c   - t i   u s e r n s   - -   b a s h   C r e a t e   t h e   p o d   o n   y o u r   c l u s t e r :   k u b e c t l   a p p l y   - f   h t t p s : / / k 8 s . i o / e x a m p l e s / p o d s / u s e r - n a m e s p a c e s - s t a t e l e s s . y a m l   E x e c   i n t o   t h e   p o d   a n d   r u n   r e a d l i n k   / p r o c / s e l f / n s / u s e r :   k u b e c t l   e x e c   - t i   u s e r n s   - -   b a s h   R u n   t h i s   c o m m a n d :   r e a d l i n k   / p r o c / s e l f / n s / u s e r   T h e   o u t p u t   i s   s i m i l a r   t o :   u s e r : [ 4 0 2 6 5 3 1 8 3 7 ]   A l s o   r u n :   c a t   / p r o c / s e l f / u i d _ m a p   T h e   o u t p u t   i s   s i m i l a r   t o :   0   8 3 3 6 1 7 9 2 0   6 5 5 3 6   T h e n ,   o p e n   a   s h e l l   i n   t h e   h o s t   a n d   r u n   t h e   s a m e   c o m m a n d s .   T h e   r e a d l i n k   c o m m a n d   s h o w s   t h e   u s e r   n a m e s p a c e   t h e   p r o c e s s   i s   r u n n i n g   i n .   I t   s h o u l d   b e   d i f f e r e n t   w h e n   i t   i s   r u n   o n   t h e   h o s t   a n d   i n s i d e   t h e   c o n t a i n


Question: What is kubeadm init?

Answer: kubeadm initThis command initializes a Kubernetes control plane node.SynopsisRun this command in order to set up the Kubernetes control planeThe "init" command executes the following phases:preflight Run pre-flight checks certs Certificate generation /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components /apiserver Generate the certificate for serving the Kubernetes API /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet /front-proxy-ca Generate the self-signed CA to provision identities for front proxy /front-proxy-client Generate the certificate for the front proxy client /etcd-ca Generate the self-signed CA to provision identities for etcd /etcd-server Generate the certificate for serving etcd /etcd-peer Generate the certificate for etcd nodes to communicate with each other /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd /sa Generate a private key for signing service account tokens along with its public key kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file /admin Generate a kubeconfig file for the admin to use and for kubeadm itself /super-admin Generate a kubeconfig file for the super-admin /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes /controller-manager Generate a kubeconfig file for the controller manager to use /scheduler Generate a kubeconfig file for the scheduler to use etcd Generate static Pod manifest file for local etcd /local Generate the static Pod manifest file for a local, single-node local etcd instance control-plane Generate all static Pod manifest files necessary to establish the control plane /apiserver Generates the kube-apiserver static Pod manifest /controller-manager Generates the kube-controller-manager static Pod manifest /scheduler Generates the kube-scheduler static Pod manifest kubelet-start Write kubelet settings and (re)start the kubelet wait-control-plane Wait for the control plane to start upload-config Upload the kubeadm and kubelet configuration to a ConfigMap /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap /kubelet Upload the kubelet component config to a ConfigMap upload-certs Upload certificates to kubeadm-certs mark-control-plane Mark a node as a control-plane bootstrap-token Generates bootstrap tokens used to join a node to a cluster kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap /enable-client-cert-rotation Enable kubelet client certificate rotation addon Install required addons for passing conformance tests /coredns Install the CoreDNS addon to a Kubernetes cluster /kube-proxy Install the kube-proxy addon to a Kubernetes cluster show-join-command Show the join command for control-plane and worker node kubeadm init [flags] Options--apiserv


Question: How does kubeadm init work?

Answer: kubeadm initThis command initializes a Kubernetes control plane node.SynopsisRun this command in order to set up the Kubernetes control planeThe "init" command executes the following phases:preflight Run pre-flight checks certs Certificate generation /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components /apiserver Generate the certificate for serving the Kubernetes API /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet /front-proxy-ca Generate the self-signed CA to provision identities for front proxy /front-proxy-client Generate the certificate for the front proxy client /etcd-ca Generate the self-signed CA to provision identities for etcd /etcd-server Generate the certificate for serving etcd /etcd-peer Generate the certificate for etcd nodes to communicate with each other /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd /sa Generate a private key for signing service account tokens along with its public key kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file /admin Generate a kubeconfig file for the admin to use and for kubeadm itself /super-admin Generate a kubeconfig file for the super-admin /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes /controller-manager Generate a kubeconfig file for the controller manager to use /scheduler Generate a kubeconfig file for the scheduler to use etcd Generate static Pod manifest file for local etcd /local Generate the static Pod manifest file for a local, single-node local etcd instance control-plane Generate all static Pod manifest files necessary to establish the control plane /apiserver Generates the kube-apiserver static Pod manifest /controller-manager Generates the kube-controller-manager static Pod manifest /scheduler Generates the kube-scheduler static Pod manifest kubelet-start Write kubelet settings and (re)start the kubelet wait-control-plane Wait for the control plane to start upload-config Upload the kubeadm and kubelet configuration to a ConfigMap /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap /kubelet Upload the kubelet component config to a ConfigMap upload-certs Upload certificates to kubeadm-certs mark-control-plane Mark a node as a control-plane bootstrap-token Generates bootstrap tokens used to join a node to a cluster kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap /enable-client-cert-rotation Enable kubelet client certificate rotation addon Install required addons for passing conformance tests /coredns Install the CoreDNS addon to a Kubernetes cluster /kube-proxy Install the kube-proxy addon to a Kubernetes cluster show-join-command Show the join command for control-plane and worker node kubeadm init [flags] Options--apiserv


Question: When would you use kubeadm init?

Answer: kubeadm initThis command initializes a Kubernetes control plane node.SynopsisRun this command in order to set up the Kubernetes control planeThe "init" command executes the following phases:preflight Run pre-flight checks certs Certificate generation /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components /apiserver Generate the certificate for serving the Kubernetes API /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet /front-proxy-ca Generate the self-signed CA to provision identities for front proxy /front-proxy-client Generate the certificate for the front proxy client /etcd-ca Generate the self-signed CA to provision identities for etcd /etcd-server Generate the certificate for serving etcd /etcd-peer Generate the certificate for etcd nodes to communicate with each other /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd /sa Generate a private key for signing service account tokens along with its public key kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file /admin Generate a kubeconfig file for the admin to use and for kubeadm itself /super-admin Generate a kubeconfig file for the super-admin /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes /controller-manager Generate a kubeconfig file for the controller manager to use /scheduler Generate a kubeconfig file for the scheduler to use etcd Generate static Pod manifest file for local etcd /local Generate the static Pod manifest file for a local, single-node local etcd instance control-plane Generate all static Pod manifest files necessary to establish the control plane /apiserver Generates the kube-apiserver static Pod manifest /controller-manager Generates the kube-controller-manager static Pod manifest /scheduler Generates the kube-scheduler static Pod manifest kubelet-start Write kubelet settings and (re)start the kubelet wait-control-plane Wait for the control plane to start upload-config Upload the kubeadm and kubelet configuration to a ConfigMap /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap /kubelet Upload the kubelet component config to a ConfigMap upload-certs Upload certificates to kubeadm-certs mark-control-plane Mark a node as a control-plane bootstrap-token Generates bootstrap tokens used to join a node to a cluster kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap /enable-client-cert-rotation Enable kubelet client certificate rotation addon Install required addons for passing conformance tests /coredns Install the CoreDNS addon to a Kubernetes cluster /kube-proxy Install the kube-proxy addon to a Kubernetes cluster show-join-command Show the join command for control-plane and worker node kubeadm init [flags] Options--apiserv


Question: What are the benefits of kubeadm init?

Answer: kubeadm initThis command initializes a Kubernetes control plane node.SynopsisRun this command in order to set up the Kubernetes control planeThe "init" command executes the following phases:preflight Run pre-flight checks certs Certificate generation /ca Generate the self-signed Kubernetes CA to provision identities for other Kubernetes components /apiserver Generate the certificate for serving the Kubernetes API /apiserver-kubelet-client Generate the certificate for the API server to connect to kubelet /front-proxy-ca Generate the self-signed CA to provision identities for front proxy /front-proxy-client Generate the certificate for the front proxy client /etcd-ca Generate the self-signed CA to provision identities for etcd /etcd-server Generate the certificate for serving etcd /etcd-peer Generate the certificate for etcd nodes to communicate with each other /etcd-healthcheck-client Generate the certificate for liveness probes to healthcheck etcd /apiserver-etcd-client Generate the certificate the apiserver uses to access etcd /sa Generate a private key for signing service account tokens along with its public key kubeconfig Generate all kubeconfig files necessary to establish the control plane and the admin kubeconfig file /admin Generate a kubeconfig file for the admin to use and for kubeadm itself /super-admin Generate a kubeconfig file for the super-admin /kubelet Generate a kubeconfig file for the kubelet to use *only* for cluster bootstrapping purposes /controller-manager Generate a kubeconfig file for the controller manager to use /scheduler Generate a kubeconfig file for the scheduler to use etcd Generate static Pod manifest file for local etcd /local Generate the static Pod manifest file for a local, single-node local etcd instance control-plane Generate all static Pod manifest files necessary to establish the control plane /apiserver Generates the kube-apiserver static Pod manifest /controller-manager Generates the kube-controller-manager static Pod manifest /scheduler Generates the kube-scheduler static Pod manifest kubelet-start Write kubelet settings and (re)start the kubelet wait-control-plane Wait for the control plane to start upload-config Upload the kubeadm and kubelet configuration to a ConfigMap /kubeadm Upload the kubeadm ClusterConfiguration to a ConfigMap /kubelet Upload the kubelet component config to a ConfigMap upload-certs Upload certificates to kubeadm-certs mark-control-plane Mark a node as a control-plane bootstrap-token Generates bootstrap tokens used to join a node to a cluster kubelet-finalize Updates settings relevant to the kubelet after TLS bootstrap /enable-client-cert-rotation Enable kubelet client certificate rotation addon Install required addons for passing conformance tests /coredns Install the CoreDNS addon to a Kubernetes cluster /kube-proxy Install the kube-proxy addon to a Kubernetes cluster show-join-command Show the join command for control-plane and worker node kubeadm init [flags] Options--apiserv


Question: What is kubeadm init?

Answer: T h i s   c o m m a n d   i n i t i a l i z e s   a   K u b e r n e t e s   c o n t r o l   p l a n e   n o d e .


Question: What is Synopsis?

Answer: R u n   t h i s   c o m m a n d   i n   o r d e r   t o   s e t   u p   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   T h e   " i n i t "   c o m m a n d   e x e c u t e s   t h e   f o l l o w i n g   p h a s e s :   p r e f l i g h t   R u n   p r e - f l i g h t   c h e c k s   c e r t s   C e r t i f i c a t e   g e n e r a t i o n   / c a   G e n e r a t e   t h e   s e l f - s i g n e d   K u b e r n e t e s   C A   t o   p r o v i s i o n   i d e n t i t i e s   f o r   o t h e r   K u b e r n e t e s   c o m p o n e n t s   / a p i s e r v e r   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   s e r v i n g   t h e   K u b e r n e t e s   A P I   / a p i s e r v e r - k u b e l e t - c l i e n t   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   t h e   A P I   s e r v e r   t o   c o n n e c t   t o   k u b e l e t   / f r o n t - p r o x y - c a   G e n e r a t e   t h e   s e l f - s i g n e d   C A   t o   p r o v i s i o n   i d e n t i t i e s   f o r   f r o n t   p r o x y   / f r o n t - p r o x y - c l i e n t   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   t h e   f r o n t   p r o x y   c l i e n t   / e t c d - c a   G e n e r a t e   t h e   s e l f - s i g n e d   C A   t o   p r o v i s i o n   i d e n t i t i e s   f o r   e t c d   / e t c d - s e r v e r   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   s e r v i n g   e t c d   / e t c d - p e e r   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   e t c d   n o d e s   t o   c o m m u n i c a t e   w i t h   e a c h   o t h e r   / e t c d - h e a l t h c h e c k - c l i e n t   G e n e r a t e   t h e   c e r t i f i c a t e   f o r   l i v e n e s s   p r o b e s   t o   h e a l t h c h e c k   e t c d   / a p i s e r v e r - e t c d - c l i e n t   G e n e r a t e   t h e   c e r t i f i c a t e   t h e   a p i s e r v e r   u s e s   t o   a c c e s s   e t c d   / s a   G e n e r a t e   a   p r i v a t e   k e y   f o r


Question: What is Options?

Answer: T h e   I P   a d d r e s s   t h e   A P I   S e r v e r   w i l l   a d v e r t i s e   i t ' s   l i s t e n i n g   o n .   I f   n o t   s e t   t h e   d e f a u l t   n e t w o r k   i n t e r f a c e   w i l l   b e   u s e d .   P o r t   f o r   t h e   A P I   S e r v e r   t o   b i n d   t o .   O p t i o n a l   e x t r a   S u b j e c t   A l t e r n a t i v e   N a m e s   ( S A N s )   t o   u s e   f o r   t h e   A P I   S e r v e r   s e r v i n g   c e r t i f i c a t e .   C a n   b e   b o t h   I P   a d d r e s s e s   a n d   D N S   n a m e s .   T h e   p a t h   w h e r e   t o   s a v e   a n d   s t o r e   t h e   c e r t i f i c a t e s .   K e y   u s e d   t o   e n c r y p t   t h e   c o n t r o l - p l a n e   c e r t i f i c a t e s   i n   t h e   k u b e a d m - c e r t s   S e c r e t .   T h e   c e r t i f i c a t e   k e y   i s   a   h e x   e n c o d e d   s t r i n g   t h a t   i s   a n   A E S   k e y   o f   s i z e   3 2   b y t e s .   P a t h   t o   a   k u b e a d m   c o n f i g u r a t i o n   f i l e .   S p e c i f y   a   s t a b l e   I P   a d d r e s s   o r   D N S   n a m e   f o r   t h e   c o n t r o l   p l a n e .   P a t h   t o   t h e   C R I   s o c k e t   t o   c o n n e c t .   I f   e m p t y   k u b e a d m   w i l l   t r y   t o   a u t o - d e t e c t   t h i s   v a l u e ;   u s e   t h i s   o p t i o n   o n l y   i f   y o u   h a v e   m o r e   t h a n   o n e   C R I   i n s t a l l e d   o r   i f   y o u   h a v e   n o n - s t a n d a r d   C R I   s o c k e t .   D o n ' t   a p p l y   a n y   c h a n g e s ;   j u s t   o u t p u t   w h a t   w o u l d   b e   d o n e .   A   s e t   o f   k e y = v a l u e   p a i r s   t h a t   d e s c r i b e   f e a t u r e   g a t e s   f o r   v a r i o u s   f e a t u r e s .   O p t i o n s   a r e : C o n t r o l P l a n e K u b e l e t L o c a l M o d e = t r u e | f a l s e   ( B E T A   -   d e f a u l t = t r u e ) N o d


Question: What is Options inherited from parent commands?

Answer: T h e   p a t h   t o   t h e   ' r e a l '   h o s t   r o o t   f i l e s y s t e m .   T h i s   w i l l   c a u s e   k u b e a d m   t o   c h r o o t   i n t o   t h e   p r o v i d e d   p a t h .


Question: What is Init workflow?

Answer: k u b e a d m   i n i t   b o o t s t r a p s   a   K u b e r n e t e s   c o n t r o l   p l a n e   n o d e   b y   e x e c u t i n g   t h e   f o l l o w i n g   s t e p s :   R u n s   a   s e r i e s   o f   p r e - f l i g h t   c h e c k s   t o   v a l i d a t e   t h e   s y s t e m   s t a t e   b e f o r e   m a k i n g   c h a n g e s .   S o m e   c h e c k s   o n l y   t r i g g e r   w a r n i n g s ,   o t h e r s   a r e   c o n s i d e r e d   e r r o r s   a n d   w i l l   e x i t   k u b e a d m   u n t i l   t h e   p r o b l e m   i s   c o r r e c t e d   o r   t h e   u s e r   s p e c i f i e s   - - i g n o r e - p r e f l i g h t - e r r o r s = < l i s t - o f - e r r o r s > . G e n e r a t e s   a   s e l f - s i g n e d   C A   t o   s e t   u p   i d e n t i t i e s   f o r   e a c h   c o m p o n e n t   i n   t h e   c l u s t e r .   T h e   u s e r   c a n   p r o v i d e   t h e i r   o w n   C A   c e r t   a n d / o r   k e y   b y   d r o p p i n g   i t   i n   t h e   c e r t   d i r e c t o r y   c o n f i g u r e d   v i a   - - c e r t - d i r   ( / e t c / k u b e r n e t e s / p k i   b y   d e f a u l t ) .   T h e   A P I   s e r v e r   c e r t s   w i l l   h a v e   a d d i t i o n a l   S A N   e n t r i e s   f o r   a n y   - - a p i s e r v e r - c e r t - e x t r a - s a n s   a r g u m e n t s ,   l o w e r c a s e d   i f   n e c e s s a r y . W r i t e s   k u b e c o n f i g   f i l e s   i n   / e t c / k u b e r n e t e s /   f o r   t h e   k u b e l e t ,   t h e   c o n t r o l l e r - m a n a g e r ,   a n d   t h e   s c h e d u l e r   t o   c o n n e c t   t o   t h e   A P I   s e r v e r ,   e a c h   w i t h   i t s   o w n   i d e n t i t y .   A l s o   a d d i t i o n a l   k u b e c o n f i g   f i l e s   a r e   w r i t t e n ,   f o r   k u b e a d m   a s   a d m i n i s t r a t i v e   e n t i t y   ( a d m i n . c o n f )   a n d   f o r   a   s u p e r   a d m i n   u s e r   t h


Question: What is Using init phases with kubeadm?

Answer: k u b e a d m   a l l o w s   y o u   t o   c r e a t e   a   c o n t r o l   p l a n e   n o d e   i n   p h a s e s   u s i n g   t h e   k u b e a d m   i n i t   p h a s e   c o m m a n d .   T o   v i e w   t h e   o r d e r e d   l i s t   o f   p h a s e s   a n d   s u b - p h a s e s   y o u   c a n   c a l l   k u b e a d m   i n i t   - - h e l p .   T h e   l i s t   w i l l   b e   l o c a t e d   a t   t h e   t o p   o f   t h e   h e l p   s c r e e n   a n d   e a c h   p h a s e   w i l l   h a v e   a   d e s c r i p t i o n   n e x t   t o   i t .   N o t e   t h a t   b y   c a l l i n g   k u b e a d m   i n i t   a l l   o f   t h e   p h a s e s   a n d   s u b - p h a s e s   w i l l   b e   e x e c u t e d   i n   t h i s   e x a c t   o r d e r .   S o m e   p h a s e s   h a v e   u n i q u e   f l a g s ,   s o   i f   y o u   w a n t   t o   h a v e   a   l o o k   a t   t h e   l i s t   o f   a v a i l a b l e   o p t i o n s   a d d   - - h e l p ,   f o r   e x a m p l e :   s u d o   k u b e a d m   i n i t   p h a s e   c o n t r o l - p l a n e   c o n t r o l l e r - m a n a g e r   - - h e l p   Y o u   c a n   a l s o   u s e   - - h e l p   t o   s e e   t h e   l i s t   o f   s u b - p h a s e s   f o r   a   c e r t a i n   p a r e n t   p h a s e :   s u d o   k u b e a d m   i n i t   p h a s e   c o n t r o l - p l a n e   - - h e l p   k u b e a d m   i n i t   a l s o   e x p o s e s   a   f l a g   c a l l e d   - - s k i p - p h a s e s   t h a t   c a n   b e   u s e d   t o   s k i p   c e r t a i n   p h a s e s .   T h e   f l a g   a c c e p t s   a   l i s t   o f   p h a s e   n a m e s   a n d   t h e   n a m e s   c a n   b e   t a k e n   f r o m   t h e   a b o v e   o r d e r e d   l i s t .   A n   e x a m p l e :   s u d o   k u b e a d m   i n i t   p h a s e   c o n t r o l - p l a n e   a l l   - - c o n f i g = c o n f i g f i l e . y a m l   s u d o   k u b e a d m   i n i t   p h a s e   e t c d


Question: What is Caution:?

Answer: I t ' s   p o s s i b l e   t o   c o n f i g u r e   k u b e a d m   i n i t   w i t h   a   c o n f i g u r a t i o n   f i l e   i n s t e a d   o f   c o m m a n d   l i n e   f l a g s ,   a n d   s o m e   m o r e   a d v a n c e d   f e a t u r e s   m a y   o n l y   b e   a v a i l a b l e   a s   c o n f i g u r a t i o n   f i l e   o p t i o n s .   T h i s   f i l e   i s   p a s s e d   u s i n g   t h e   - - c o n f i g   f l a g   a n d   i t   m u s t   c o n t a i n   a   C l u s t e r C o n f i g u r a t i o n   s t r u c t u r e   a n d   o p t i o n a l l y   m o r e   s t r u c t u r e s   s e p a r a t e d   b y   - - - \ n .   M i x i n g   - - c o n f i g   w i t h   o t h e r s   f l a g s   m a y   n o t   b e   a l l o w e d   i n   s o m e   c a s e s .   T h e   d e f a u l t   c o n f i g u r a t i o n   c a n   b e   p r i n t e d   o u t   u s i n g   t h e   k u b e a d m   c o n f i g   p r i n t   c o m m a n d .   I f   y o u r   c o n f i g u r a t i o n   i s   n o t   u s i n g   t h e   l a t e s t   v e r s i o n   i t   i s   r e c o m m e n d e d   t h a t   y o u   m i g r a t e   u s i n g   t h e   k u b e a d m   c o n f i g   m i g r a t e   c o m m a n d .   F o r   m o r e   i n f o r m a t i o n   o n   t h e   f i e l d s   a n d   u s a g e   o f   t h e   c o n f i g u r a t i o n   y o u   c a n   n a v i g a t e   t o   o u r   A P I   r e f e r e n c e   p a g e .


Question: What is Using kubeadm init with feature gates?

Answer: k u b e a d m   s u p p o r t s   a   s e t   o f   f e a t u r e   g a t e s   t h a t   a r e   u n i q u e   t o   k u b e a d m   a n d   c a n   o n l y   b e   a p p l i e d   d u r i n g   c l u s t e r   c r e a t i o n   w i t h   k u b e a d m   i n i t .   T h e s e   f e a t u r e s   c a n   c o n t r o l   t h e   b e h a v i o r   o f   t h e   c l u s t e r .   F e a t u r e   g a t e s   a r e   r e m o v e d   a f t e r   a   f e a t u r e   g r a d u a t e s   t o   G A .   T o   p a s s   a   f e a t u r e   g a t e   y o u   c a n   e i t h e r   u s e   t h e   - - f e a t u r e - g a t e s   f l a g   f o r   k u b e a d m   i n i t ,   o r   y o u   c a n   a d d   i t e m s   i n t o   t h e   f e a t u r e G a t e s   f i e l d   w h e n   y o u   p a s s   a   c o n f i g u r a t i o n   f i l e   u s i n g   - - c o n f i g .   P a s s i n g   f e a t u r e   g a t e s   f o r   c o r e   K u b e r n e t e s   c o m p o n e n t s   d i r e c t l y   t o   k u b e a d m   i s   n o t   s u p p o r t e d .   I n s t e a d ,   i t   i s   p o s s i b l e   t o   p a s s   t h e m   b y   C u s t o m i z i n g   c o m p o n e n t s   w i t h   t h e   k u b e a d m   A P I .   L i s t   o f   f e a t u r e   g a t e s :


Question: What is Note:?

Answer: F e a t u r e   g a t e   d e s c r i p t i o n s :   P O R T   i s   t a k e n   f r o m   - - s e c u r e - p o r t   o f   a   c o m p o n e n t . A D D R E S S   i s   - - a d v e r t i s e - a d d r e s s   f o r   k u b e - a p i s e r v e r   a n d   - - b i n d - a d d r e s s   f o r   t h e   k u b e - c o n t r o l l e r - m a n a g e r   a n d   k u b e - s c h e d u l e r . E N D P O I N T   i s   o n l y   / h e a l t h z   f o r   k u b e - c o n t r o l l e r - m a n a g e r   u n t i l   i t   s u p p o r t s   / l i v e z   a s   w e l l .   I f   y o u   s p e c i f y   c u s t o m   A D D R E S S   o r   P O R T   i n   t h e   k u b e a d m   c o n f i g u r a t i o n   t h e y   w i l l   b e   r e s p e c t e d .   W i t h o u t   t h e   f e a t u r e   g a t e   e n a b l e d ,   k u b e a d m   w i l l   o n l y   w a i t   f o r   t h e   k u b e - a p i s e r v e r   o n   a   c o n t r o l   p l a n e   n o d e   t o   b e c o m e   r e a d y .   T h e   w a i t   p r o c e s s   s t a r t s   r i g h t   a f t e r   t h e   k u b e l e t   o n   t h e   h o s t   i s   s t a r t e d   b y   k u b e a d m .   Y o u   a r e   a d v i s e d   t o   e n a b l e   t h i s   f e a t u r e   g a t e   i n   c a s e   y o u   w i s h   t o   o b s e r v e   a   r e a d y   s t a t e   f r o m   a l l   c o n t r o l   p l a n e   c o m p o n e n t s   d u r i n g   t h e   k u b e a d m   i n i t   o r   k u b e a d m   j o i n   c o m m a n d   e x e c u t i o n .   L i s t   o f   d e p r e c a t e d   f e a t u r e   g a t e s :   F e a t u r e   g a t e   d e s c r i p t i o n s :   L i s t   o f   r e m o v e d   f e a t u r e   g a t e s :   F e a t u r e   g a t e   d e s c r i p t i o n s :


Question: What is Adding kube-proxy parameters?

Answer: F o r   i n f o r m a t i o n   a b o u t   k u b e - p r o x y   p a r a m e t e r s   i n   t h e   k u b e a d m   c o n f i g u r a t i o n   s e e :   k u b e - p r o x y   r e f e r e n c e   F o r   i n f o r m a t i o n   a b o u t   e n a b l i n g   I P V S   m o d e   w i t h   k u b e a d m   s e e :   I P V S


Question: What is Passing custom flags to control plane components?

Answer: F o r   i n f o r m a t i o n   a b o u t   p a s s i n g   f l a g s   t o   c o n t r o l   p l a n e   c o m p o n e n t s   s e e :   c o n t r o l - p l a n e - f l a g s


Question: What is Running kubeadm without an Internet connection?

Answer: F o r   r u n n i n g   k u b e a d m   w i t h o u t   a n   I n t e r n e t   c o n n e c t i o n   y o u   h a v e   t o   p r e - p u l l   t h e   r e q u i r e d   c o n t r o l   p l a n e   i m a g e s .   Y o u   c a n   l i s t   a n d   p u l l   t h e   i m a g e s   u s i n g   t h e   k u b e a d m   c o n f i g   i m a g e s   s u b - c o m m a n d :   k u b e a d m   c o n f i g   i m a g e s   l i s t   k u b e a d m   c o n f i g   i m a g e s   p u l l   Y o u   c a n   p a s s   - - c o n f i g   t o   t h e   a b o v e   c o m m a n d s   w i t h   a   k u b e a d m   c o n f i g u r a t i o n   f i l e   t o   c o n t r o l   t h e   k u b e r n e t e s V e r s i o n   a n d   i m a g e R e p o s i t o r y   f i e l d s .   A l l   d e f a u l t   r e g i s t r y . k 8 s . i o   i m a g e s   t h a t   k u b e a d m   r e q u i r e s   s u p p o r t   m u l t i p l e   a r c h i t e c t u r e s .


Question: What is Using custom images?

Answer: B y   d e f a u l t ,   k u b e a d m   p u l l s   i m a g e s   f r o m   r e g i s t r y . k 8 s . i o .   I f   t h e   r e q u e s t e d   K u b e r n e t e s   v e r s i o n   i s   a   C I   l a b e l   ( s u c h   a s   c i / l a t e s t )   g c r . i o / k 8 s - s t a g i n g - c i - i m a g e s   i s   u s e d .   Y o u   c a n   o v e r r i d e   t h i s   b e h a v i o r   b y   u s i n g   k u b e a d m   w i t h   a   c o n f i g u r a t i o n   f i l e .   A l l o w e d   c u s t o m i z a t i o n   a r e :   T o   p r o v i d e   k u b e r n e t e s V e r s i o n   w h i c h   a f f e c t s   t h e   v e r s i o n   o f   t h e   i m a g e s . T o   p r o v i d e   a n   a l t e r n a t i v e   i m a g e R e p o s i t o r y   t o   b e   u s e d   i n s t e a d   o f   r e g i s t r y . k 8 s . i o . T o   p r o v i d e   a   s p e c i f i c   i m a g e R e p o s i t o r y   a n d   i m a g e T a g   f o r   e t c d   o r   C o r e D N S .   I m a g e   p a t h s   b e t w e e n   t h e   d e f a u l t   r e g i s t r y . k 8 s . i o   a n d   a   c u s t o m   r e p o s i t o r y   s p e c i f i e d   u s i n g   i m a g e R e p o s i t o r y   m a y   d i f f e r   f o r   b a c k w a r d s   c o m p a t i b i l i t y   r e a s o n s .   F o r   e x a m p l e ,   o n e   i m a g e   m i g h t   h a v e   a   s u b p a t h   a t   r e g i s t r y . k 8 s . i o / s u b p a t h / i m a g e ,   b u t   b e   d e f a u l t e d   t o   m y . c u s t o m r e p o s i t o r y . i o / i m a g e   w h e n   u s i n g   a   c u s t o m   r e p o s i t o r y .   T o   e n s u r e   y o u   p u s h   t h e   i m a g e s   t o   y o u r   c u s t o m   r e p o s i t o r y   i n   p a t h s   t h a t   k u b e a d m   c a n   c o n s u m e ,   y o u   m u s t :   P u l l   i m a g e s   f r o m   t h e   d e f a u l t s   p a t h s   a t   r e g i s t r y . k 8 s . i o   u s i n g   k u b e a d m   c o n f i g   i m a g e s   { l i s t | p u l l } . P u s h   i m


Question: What is Custom sandbox (pause) images?

Answer: T o   s e t   a   c u s t o m   i m a g e   f o r   t h e s e   y o u   n e e d   t o   c o n f i g u r e   t h i s   i n   y o u r   c o n t a i n e r   r u n t i m e   t o   u s e   t h e   i m a g e .   C o n s u l t   t h e   d o c u m e n t a t i o n   f o r   y o u r   c o n t a i n e r   r u n t i m e   t o   f i n d   o u t   h o w   t o   c h a n g e   t h i s   s e t t i n g ;   f o r   s e l e c t e d   c o n t a i n e r   r u n t i m e s ,   y o u   c a n   a l s o   f i n d   a d v i c e   w i t h i n   t h e   C o n t a i n e r   R u n t i m e s   t o p i c .


Question: What is Uploading control plane certificates to the cluster?

Answer: B y   a d d i n g   t h e   f l a g   - - u p l o a d - c e r t s   t o   k u b e a d m   i n i t   y o u   c a n   t e m p o r a r y   u p l o a d   t h e   c o n t r o l   p l a n e   c e r t i f i c a t e s   t o   a   S e c r e t   i n   t h e   c l u s t e r .   P l e a s e   n o t e   t h a t   t h i s   S e c r e t   w i l l   e x p i r e   a u t o m a t i c a l l y   a f t e r   2   h o u r s .   T h e   c e r t i f i c a t e s   a r e   e n c r y p t e d   u s i n g   a   3 2 b y t e   k e y   t h a t   c a n   b e   s p e c i f i e d   u s i n g   - - c e r t i f i c a t e - k e y .   T h e   s a m e   k e y   c a n   b e   u s e d   t o   d o w n l o a d   t h e   c e r t i f i c a t e s   w h e n   a d d i t i o n a l   c o n t r o l   p l a n e   n o d e s   a r e   j o i n i n g ,   b y   p a s s i n g   - - c o n t r o l - p l a n e   a n d   - - c e r t i f i c a t e - k e y   t o   k u b e a d m   j o i n .   T h e   f o l l o w i n g   p h a s e   c o m m a n d   c a n   b e   u s e d   t o   r e - u p l o a d   t h e   c e r t i f i c a t e s   a f t e r   e x p i r a t i o n :   k u b e a d m   i n i t   p h a s e   u p l o a d - c e r t s   - - u p l o a d - c e r t s   - - c o n f i g = S O M E _ Y A M L _ F I L E


Question: What is Note:?

Answer: I f   a   p r e d e f i n e d   c e r t i f i c a t e   k e y   i s   n o t   p a s s e d   t o   k u b e a d m   i n i t   a n d   k u b e a d m   i n i t   p h a s e   u p l o a d - c e r t s   a   n e w   k e y   w i l l   b e   g e n e r a t e d   a u t o m a t i c a l l y .   T h e   f o l l o w i n g   c o m m a n d   c a n   b e   u s e d   t o   g e n e r a t e   a   n e w   k e y   o n   d e m a n d :   k u b e a d m   c e r t s   c e r t i f i c a t e - k e y


Question: What is Certificate management with kubeadm?

Answer: F o r   d e t a i l e d   i n f o r m a t i o n   o n   c e r t i f i c a t e   m a n a g e m e n t   w i t h   k u b e a d m   s e e   C e r t i f i c a t e   M a n a g e m e n t   w i t h   k u b e a d m .   T h e   d o c u m e n t   i n c l u d e s   i n f o r m a t i o n   a b o u t   u s i n g   e x t e r n a l   C A ,   c u s t o m   c e r t i f i c a t e s   a n d   c e r t i f i c a t e   r e n e w a l .


Question: What is Managing the kubeadm drop-in file for the kubelet?

Answer: T h e   k u b e a d m   p a c k a g e   s h i p s   w i t h   a   c o n f i g u r a t i o n   f i l e   f o r   r u n n i n g   t h e   k u b e l e t   b y   s y s t e m d .   N o t e   t h a t   t h e   k u b e a d m   C L I   n e v e r   t o u c h e s   t h i s   d r o p - i n   f i l e .   T h i s   d r o p - i n   f i l e   i s   p a r t   o f   t h e   k u b e a d m   D E B / R P M   p a c k a g e .   F o r   f u r t h e r   i n f o r m a t i o n ,   s e e   M a n a g i n g   t h e   k u b e a d m   d r o p - i n   f i l e   f o r   s y s t e m d .


Question: What is Use kubeadm with CRI runtimes?

Answer: B y   d e f a u l t ,   k u b e a d m   a t t e m p t s   t o   d e t e c t   y o u r   c o n t a i n e r   r u n t i m e .   F o r   m o r e   d e t a i l s   o n   t h i s   d e t e c t i o n ,   s e e   t h e   k u b e a d m   C R I   i n s t a l l a t i o n   g u i d e .


Question: What is Setting the node name?

Answer: B y   d e f a u l t ,   k u b e a d m   a s s i g n s   a   n o d e   n a m e   b a s e d   o n   a   m a c h i n e ' s   h o s t   a d d r e s s .   Y o u   c a n   o v e r r i d e   t h i s   s e t t i n g   w i t h   t h e   - - n o d e - n a m e   f l a g .   T h e   f l a g   p a s s e s   t h e   a p p r o p r i a t e   - - h o s t n a m e - o v e r r i d e   v a l u e   t o   t h e   k u b e l e t .   B e   a w a r e   t h a t   o v e r r i d i n g   t h e   h o s t n a m e   c a n   i n t e r f e r e   w i t h   c l o u d   p r o v i d e r s .


Question: What is Automating kubeadm?

Answer: R a t h e r   t h a n   c o p y i n g   t h e   t o k e n   y o u   o b t a i n e d   f r o m   k u b e a d m   i n i t   t o   e a c h   n o d e ,   a s   i n   t h e   b a s i c   k u b e a d m   t u t o r i a l ,   y o u   c a n   p a r a l l e l i z e   t h e   t o k e n   d i s t r i b u t i o n   f o r   e a s i e r   a u t o m a t i o n .   T o   i m p l e m e n t   t h i s   a u t o m a t i o n ,   y o u   m u s t   k n o w   t h e   I P   a d d r e s s   t h a t   t h e   c o n t r o l   p l a n e   n o d e   w i l l   h a v e   a f t e r   i t   i s   s t a r t e d ,   o r   u s e   a   D N S   n a m e   o r   a n   a d d r e s s   o f   a   l o a d   b a l a n c e r .   G e n e r a t e   a   t o k e n .   T h i s   t o k e n   m u s t   h a v e   t h e   f o r m   < 6   c h a r a c t e r   s t r i n g > . < 1 6   c h a r a c t e r   s t r i n g > .   M o r e   f o r m a l l y ,   i t   m u s t   m a t c h   t h e   r e g e x :   [ a - z 0 - 9 ] { 6 } \ . [ a - z 0 - 9 ] { 1 6 } . k u b e a d m   c a n   g e n e r a t e   a   t o k e n   f o r   y o u : k u b e a d m   t o k e n   g e n e r a t e   S t a r t   b o t h   t h e   c o n t r o l   p l a n e   n o d e   a n d   t h e   w o r k e r   n o d e s   c o n c u r r e n t l y   w i t h   t h i s   t o k e n .   A s   t h e y   c o m e   u p   t h e y   s h o u l d   f i n d   e a c h   o t h e r   a n d   f o r m   t h e   c l u s t e r .   T h e   s a m e   - - t o k e n   a r g u m e n t   c a n   b e   u s e d   o n   b o t h   k u b e a d m   i n i t   a n d   k u b e a d m   j o i n . S i m i l a r   c a n   b e   d o n e   f o r   - - c e r t i f i c a t e - k e y   w h e n   j o i n i n g   a d d i t i o n a l   c o n t r o l   p l a n e   n o d e s .   T h e   k e y   c a n   b e   g e n e r a t e d   u s i n g : k u b e a d m   c e r t s   c e r t i f i c a t e - k e y   G e n e r a t e   a   t o k e n .   T h i s   t o k e n   m u s t   h a v e   t h e   f o r m   < 6   c h a r a c t e r   s


Question: What is What's next?

Answer: k u b e a d m   i n i t   p h a s e   t o   u n d e r s t a n d   m o r e   a b o u t   k u b e a d m   i n i t   p h a s e s k u b e a d m   j o i n   t o   b o o t s t r a p   a   K u b e r n e t e s   w o r k e r   n o d e   a n d   j o i n   i t   t o   t h e   c l u s t e r k u b e a d m   u p g r a d e   t o   u p g r a d e   a   K u b e r n e t e s   c l u s t e r   t o   a   n e w e r   v e r s i o n k u b e a d m   r e s e t   t o   r e v e r t   a n y   c h a n g e s   m a d e   t o   t h i s   h o s t   b y   k u b e a d m   i n i t   o r   k u b e a d m   j o i n