Question: How does Overview work?

Answer: OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.This page is an overview of Kubernetes.The name Kubernetes originates from Greek, meaning helmsman or pilot. K8s as an abbreviation results from counting the eight letters between the "K" and the "s". Google open-sourced the Kubernetes project in 2014. Kubernetes combines over 15 years of Google's experience running production workloads at scale with best-of-breed ideas and practices from the community.Why you need Kubernetes and what it can doContainers are a good way to bundle and run your applications. In a production environment, you need to manage the containers that run the applications and ensure that there is no downtime. For example, if a container goes down, another container needs to start. Wouldn't it be easier if this behavior was handled by a system?That's how Kubernetes comes to the rescue! Kubernetes provides you with a framework to run distributed systems resiliently. It takes care of scaling and failover for your application, provides deployment patterns, and more. For example: Kubernetes can easily manage a canary deployment for your system.Kubernetes provides you with:Service discovery and load balancing Kubernetes can expose a container using the DNS name or using their own IP address. If traffic to a container is high, Kubernetes is able to load balance and distribute the network traffic so that the deployment is stable.Storage orchestration Kubernetes allows you to automatically mount a storage system of your choice, such as local storages, public cloud providers, and more.Automated rollouts and rollbacks You can describe the desired state for your deployed containers using Kubernetes, and it can change the actual state to the desired state at a controlled rate. For example, you can automate Kubernetes to create new containers for your deployment, remove existing containers and adopt all their resources to the new container.Automatic bin packing You provide Kubernetes with a cluster of nodes that it can use to run containerized tasks. You tell Kubernetes how much CPU and memory (RAM) each container needs. Kubernetes can fit containers onto your nodes to make the best use of your resources.Self-healing Kubernetes restarts containers that fail, replaces containers, kills containers that don't respond to your user-defined health check, and doesn't advertise them to clients until they are ready to serve.Secret and configuration management Kubernetes lets you store and manage sensitive information, such as passwords, OAuth tokens, and SSH keys. You can deploy and update secrets and application configuration without rebuilding your container images, and without exposing secrets in your stack configuration.Batch execution In addition to services, Kub


Question: When would you use Overview?

Answer: OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.This page is an overview of Kubernetes.The name Kubernetes originates from Greek, meaning helmsman or pilot. K8s as an abbreviation results from counting the eight letters between the "K" and the "s". Google open-sourced the Kubernetes project in 2014. Kubernetes combines over 15 years of Google's experience running production workloads at scale with best-of-breed ideas and practices from the community.Why you need Kubernetes and what it can doContainers are a good way to bundle and run your applications. In a production environment, you need to manage the containers that run the applications and ensure that there is no downtime. For example, if a container goes down, another container needs to start. Wouldn't it be easier if this behavior was handled by a system?That's how Kubernetes comes to the rescue! Kubernetes provides you with a framework to run distributed systems resiliently. It takes care of scaling and failover for your application, provides deployment patterns, and more. For example: Kubernetes can easily manage a canary deployment for your system.Kubernetes provides you with:Service discovery and load balancing Kubernetes can expose a container using the DNS name or using their own IP address. If traffic to a container is high, Kubernetes is able to load balance and distribute the network traffic so that the deployment is stable.Storage orchestration Kubernetes allows you to automatically mount a storage system of your choice, such as local storages, public cloud providers, and more.Automated rollouts and rollbacks You can describe the desired state for your deployed containers using Kubernetes, and it can change the actual state to the desired state at a controlled rate. For example, you can automate Kubernetes to create new containers for your deployment, remove existing containers and adopt all their resources to the new container.Automatic bin packing You provide Kubernetes with a cluster of nodes that it can use to run containerized tasks. You tell Kubernetes how much CPU and memory (RAM) each container needs. Kubernetes can fit containers onto your nodes to make the best use of your resources.Self-healing Kubernetes restarts containers that fail, replaces containers, kills containers that don't respond to your user-defined health check, and doesn't advertise them to clients until they are ready to serve.Secret and configuration management Kubernetes lets you store and manage sensitive information, such as passwords, OAuth tokens, and SSH keys. You can deploy and update secrets and application configuration without rebuilding your container images, and without exposing secrets in your stack configuration.Batch execution In addition to services, Kub


Question: What are the benefits of Overview?

Answer: OverviewKubernetes is a portable, extensible, open source platform for managing containerized workloads and services, that facilitates both declarative configuration and automation. It has a large, rapidly growing ecosystem. Kubernetes services, support, and tools are widely available.This page is an overview of Kubernetes.The name Kubernetes originates from Greek, meaning helmsman or pilot. K8s as an abbreviation results from counting the eight letters between the "K" and the "s". Google open-sourced the Kubernetes project in 2014. Kubernetes combines over 15 years of Google's experience running production workloads at scale with best-of-breed ideas and practices from the community.Why you need Kubernetes and what it can doContainers are a good way to bundle and run your applications. In a production environment, you need to manage the containers that run the applications and ensure that there is no downtime. For example, if a container goes down, another container needs to start. Wouldn't it be easier if this behavior was handled by a system?That's how Kubernetes comes to the rescue! Kubernetes provides you with a framework to run distributed systems resiliently. It takes care of scaling and failover for your application, provides deployment patterns, and more. For example: Kubernetes can easily manage a canary deployment for your system.Kubernetes provides you with:Service discovery and load balancing Kubernetes can expose a container using the DNS name or using their own IP address. If traffic to a container is high, Kubernetes is able to load balance and distribute the network traffic so that the deployment is stable.Storage orchestration Kubernetes allows you to automatically mount a storage system of your choice, such as local storages, public cloud providers, and more.Automated rollouts and rollbacks You can describe the desired state for your deployed containers using Kubernetes, and it can change the actual state to the desired state at a controlled rate. For example, you can automate Kubernetes to create new containers for your deployment, remove existing containers and adopt all their resources to the new container.Automatic bin packing You provide Kubernetes with a cluster of nodes that it can use to run containerized tasks. You tell Kubernetes how much CPU and memory (RAM) each container needs. Kubernetes can fit containers onto your nodes to make the best use of your resources.Self-healing Kubernetes restarts containers that fail, replaces containers, kills containers that don't respond to your user-defined health check, and doesn't advertise them to clients until they are ready to serve.Secret and configuration management Kubernetes lets you store and manage sensitive information, such as passwords, OAuth tokens, and SSH keys. You can deploy and update secrets and application configuration without rebuilding your container images, and without exposing secrets in your stack configuration.Batch execution In addition to services, Kub


Question: What is Overview?

Answer: T h i s   p a g e   i s   a n   o v e r v i e w   o f   K u b e r n e t e s .   T h e   n a m e   K u b e r n e t e s   o r i g i n a t e s   f r o m   G r e e k ,   m e a n i n g   h e l m s m a n   o r   p i l o t .   K 8 s   a s   a n   a b b r e v i a t i o n   r e s u l t s   f r o m   c o u n t i n g   t h e   e i g h t   l e t t e r s   b e t w e e n   t h e   " K "   a n d   t h e   " s " .   G o o g l e   o p e n - s o u r c e d   t h e   K u b e r n e t e s   p r o j e c t   i n   2 0 1 4 .   K u b e r n e t e s   c o m b i n e s   o v e r   1 5   y e a r s   o f   G o o g l e ' s   e x p e r i e n c e   r u n n i n g   p r o d u c t i o n   w o r k l o a d s   a t   s c a l e   w i t h   b e s t - o f - b r e e d   i d e a s   a n d   p r a c t i c e s   f r o m   t h e   c o m m u n i t y .


Question: What is Why you need Kubernetes and what it can do?

Answer: C o n t a i n e r s   a r e   a   g o o d   w a y   t o   b u n d l e   a n d   r u n   y o u r   a p p l i c a t i o n s .   I n   a   p r o d u c t i o n   e n v i r o n m e n t ,   y o u   n e e d   t o   m a n a g e   t h e   c o n t a i n e r s   t h a t   r u n   t h e   a p p l i c a t i o n s   a n d   e n s u r e   t h a t   t h e r e   i s   n o   d o w n t i m e .   F o r   e x a m p l e ,   i f   a   c o n t a i n e r   g o e s   d o w n ,   a n o t h e r   c o n t a i n e r   n e e d s   t o   s t a r t .   W o u l d n ' t   i t   b e   e a s i e r   i f   t h i s   b e h a v i o r   w a s   h a n d l e d   b y   a   s y s t e m ?   T h a t ' s   h o w   K u b e r n e t e s   c o m e s   t o   t h e   r e s c u e !   K u b e r n e t e s   p r o v i d e s   y o u   w i t h   a   f r a m e w o r k   t o   r u n   d i s t r i b u t e d   s y s t e m s   r e s i l i e n t l y .   I t   t a k e s   c a r e   o f   s c a l i n g   a n d   f a i l o v e r   f o r   y o u r   a p p l i c a t i o n ,   p r o v i d e s   d e p l o y m e n t   p a t t e r n s ,   a n d   m o r e .   F o r   e x a m p l e :   K u b e r n e t e s   c a n   e a s i l y   m a n a g e   a   c a n a r y   d e p l o y m e n t   f o r   y o u r   s y s t e m .   K u b e r n e t e s   p r o v i d e s   y o u   w i t h :   S e r v i c e   d i s c o v e r y   a n d   l o a d   b a l a n c i n g   K u b e r n e t e s   c a n   e x p o s e   a   c o n t a i n e r   u s i n g   t h e   D N S   n a m e   o r   u s i n g   t h e i r   o w n   I P   a d d r e s s .   I f   t r a f f i c   t o   a   c o n t a i n e r   i s   h i g h ,   K u b e r n e t e s   i s   a b l e   t o   l o a d   b a l a n c e   a n d   d i s t r i b u t e   t h e   n e t w o r k   t r a f f i c   s o   t h a t   t h e   d e p l o y m e n t   i s   s t a b l e . S t o r a g e   o r c h e s t r a t i o n   K u b e r n e t e s   a l l o w s   y o u   t o   a u t o m a t i c a l l y   m o u n t   a   s t o r a g e   s y s t


Question: What is What Kubernetes is not?

Answer: K u b e r n e t e s   i s   n o t   a   t r a d i t i o n a l ,   a l l - i n c l u s i v e   P a a S   ( P l a t f o r m   a s   a   S e r v i c e )   s y s t e m .   S i n c e   K u b e r n e t e s   o p e r a t e s   a t   t h e   c o n t a i n e r   l e v e l   r a t h e r   t h a n   a t   t h e   h a r d w a r e   l e v e l ,   i t   p r o v i d e s   s o m e   g e n e r a l l y   a p p l i c a b l e   f e a t u r e s   c o m m o n   t o   P a a S   o f f e r i n g s ,   s u c h   a s   d e p l o y m e n t ,   s c a l i n g ,   l o a d   b a l a n c i n g ,   a n d   l e t s   u s e r s   i n t e g r a t e   t h e i r   l o g g i n g ,   m o n i t o r i n g ,   a n d   a l e r t i n g   s o l u t i o n s .   H o w e v e r ,   K u b e r n e t e s   i s   n o t   m o n o l i t h i c ,   a n d   t h e s e   d e f a u l t   s o l u t i o n s   a r e   o p t i o n a l   a n d   p l u g g a b l e .   K u b e r n e t e s   p r o v i d e s   t h e   b u i l d i n g   b l o c k s   f o r   b u i l d i n g   d e v e l o p e r   p l a t f o r m s ,   b u t   p r e s e r v e s   u s e r   c h o i c e   a n d   f l e x i b i l i t y   w h e r e   i t   i s   i m p o r t a n t .   K u b e r n e t e s :   D o e s   n o t   l i m i t   t h e   t y p e s   o f   a p p l i c a t i o n s   s u p p o r t e d .   K u b e r n e t e s   a i m s   t o   s u p p o r t   a n   e x t r e m e l y   d i v e r s e   v a r i e t y   o f   w o r k l o a d s ,   i n c l u d i n g   s t a t e l e s s ,   s t a t e f u l ,   a n d   d a t a - p r o c e s s i n g   w o r k l o a d s .   I f   a n   a p p l i c a t i o n   c a n   r u n   i n   a   c o n t a i n e r ,   i t   s h o u l d   r u n   g r e a t   o n   K u b e r n e t e s . D o e s   n o t   d e p l o y   s o u r c e   c o d e   a n d   d o e s   n o t   b u i l d   y o u r   a p p l i c a t i o n .   C o n t i n u o u s   I n t e g r a t i o n ,   D e l i v e r y ,   a n d   D e p l o y m e n t   ( C I / C D )   w o r k f l o w s


Question: What is Historical context for Kubernetes?

Answer: L e t ' s   t a k e   a   l o o k   a t   w h y   K u b e r n e t e s   i s   s o   u s e f u l   b y   g o i n g   b a c k   i n   t i m e .   T r a d i t i o n a l   d e p l o y m e n t   e r a :   E a r l y   o n ,   o r g a n i z a t i o n s   r a n   a p p l i c a t i o n s   o n   p h y s i c a l   s e r v e r s .   T h e r e   w a s   n o   w a y   t o   d e f i n e   r e s o u r c e   b o u n d a r i e s   f o r   a p p l i c a t i o n s   i n   a   p h y s i c a l   s e r v e r ,   a n d   t h i s   c a u s e d   r e s o u r c e   a l l o c a t i o n   i s s u e s .   F o r   e x a m p l e ,   i f   m u l t i p l e   a p p l i c a t i o n s   r u n   o n   a   p h y s i c a l   s e r v e r ,   t h e r e   c a n   b e   i n s t a n c e s   w h e r e   o n e   a p p l i c a t i o n   w o u l d   t a k e   u p   m o s t   o f   t h e   r e s o u r c e s ,   a n d   a s   a   r e s u l t ,   t h e   o t h e r   a p p l i c a t i o n s   w o u l d   u n d e r p e r f o r m .   A   s o l u t i o n   f o r   t h i s   w o u l d   b e   t o   r u n   e a c h   a p p l i c a t i o n   o n   a   d i f f e r e n t   p h y s i c a l   s e r v e r .   B u t   t h i s   d i d   n o t   s c a l e   a s   r e s o u r c e s   w e r e   u n d e r u t i l i z e d ,   a n d   i t   w a s   e x p e n s i v e   f o r   o r g a n i z a t i o n s   t o   m a i n t a i n   m a n y   p h y s i c a l   s e r v e r s .   V i r t u a l i z e d   d e p l o y m e n t   e r a :   A s   a   s o l u t i o n ,   v i r t u a l i z a t i o n   w a s   i n t r o d u c e d .   I t   a l l o w s   y o u   t o   r u n   m u l t i p l e   V i r t u a l   M a c h i n e s   ( V M s )   o n   a   s i n g l e   p h y s i c a l   s e r v e r ' s   C P U .   V i r t u a l i z a t i o n   a l l o w s   a p p l i c a t i o n s   t o   b e   i s o l a t e d   b e t w e e n   V M s   a n d   p r o v i d e s   a   l e v e l   o f   s e c u r i t y   a s   t h e   i n f o r m a t i o n   o f   o n e   a p p l


Question: What is What's next?

Answer: T a k e   a   l o o k   a t   t h e   K u b e r n e t e s   C o m p o n e n t s T a k e   a   l o o k   a t   t h e   T h e   K u b e r n e t e s   A P I T a k e   a   l o o k   a t   t h e   C l u s t e r   A r c h i t e c t u r e R e a d y   t o   G e t   S t a r t e d ?


Question: What is Installing kubeadm?

Answer: Installing kubeadm This page shows how to install the kubeadm toolbox. For information on how to create a cluster with kubeadm once you have performed this installation process, see the Creating a cluster with kubeadm page.This installation guide is for Kubernetes v1.34. If you want to use a different Kubernetes version, please refer to the following pages instead:Installing kubeadm (Kubernetes v1.33)Installing kubeadm (Kubernetes v1.32)Installing kubeadm (Kubernetes v1.31)Installing kubeadm (Kubernetes v1.30)Before you beginA compatible Linux host. The Kubernetes project provides generic instructions for Linux distributions based on Debian and Red Hat, and those distributions without a package manager.2 GB or more of RAM per machine (any less will leave little room for your apps).2 CPUs or more for control plane machines.Full network connectivity between all machines in the cluster (public or private network is fine).Unique hostname, MAC address, and product_uuid for every node. See here for more details.Certain ports are open on your machines. See here for more details.Note:The kubeadm installation is done via binaries that use dynamic linking and assumes that your target system provides glibc. This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.) but it is not always the case with custom and lightweight distributions which don't include glibc by default, such as Alpine Linux. The expectation is that the distribution either includes glibc or a compatibility layer that provides the expected symbols.Check your OS versionNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.The kubeadm project supports LTS kernels. See List of LTS kernels.You can get the kernel version using the command uname -rFor more information, see Linux Kernel Requirements.The kubeadm project supports recent kernel versions. For a list of recent kernels, see Windows Server Release Information.You can get the kernel version (also called the OS version) using the command systeminfoFor more information, see Windows OS version compatibility.A Kubernetes cluster created by kubeadm depends on software that use kernel features. This software includes, but is not limited to the container runtime, the kubelet, and a Container Network Interface plugin.To help you avoid unexpected errors as a result of an unsupported kernel version, kubeadm runs the SystemVerification pre-flight check. This check fails if the kernel version is not supported.You may choose to skip the check, if you know that your kernel provides the required features, even though kubeadm does not support its version.Verify the MAC address and product_uuid are unique for every nodeYou can get the MAC address of the network


Question: How does Installing kubeadm work?

Answer: Installing kubeadm This page shows how to install the kubeadm toolbox. For information on how to create a cluster with kubeadm once you have performed this installation process, see the Creating a cluster with kubeadm page.This installation guide is for Kubernetes v1.34. If you want to use a different Kubernetes version, please refer to the following pages instead:Installing kubeadm (Kubernetes v1.33)Installing kubeadm (Kubernetes v1.32)Installing kubeadm (Kubernetes v1.31)Installing kubeadm (Kubernetes v1.30)Before you beginA compatible Linux host. The Kubernetes project provides generic instructions for Linux distributions based on Debian and Red Hat, and those distributions without a package manager.2 GB or more of RAM per machine (any less will leave little room for your apps).2 CPUs or more for control plane machines.Full network connectivity between all machines in the cluster (public or private network is fine).Unique hostname, MAC address, and product_uuid for every node. See here for more details.Certain ports are open on your machines. See here for more details.Note:The kubeadm installation is done via binaries that use dynamic linking and assumes that your target system provides glibc. This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.) but it is not always the case with custom and lightweight distributions which don't include glibc by default, such as Alpine Linux. The expectation is that the distribution either includes glibc or a compatibility layer that provides the expected symbols.Check your OS versionNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.The kubeadm project supports LTS kernels. See List of LTS kernels.You can get the kernel version using the command uname -rFor more information, see Linux Kernel Requirements.The kubeadm project supports recent kernel versions. For a list of recent kernels, see Windows Server Release Information.You can get the kernel version (also called the OS version) using the command systeminfoFor more information, see Windows OS version compatibility.A Kubernetes cluster created by kubeadm depends on software that use kernel features. This software includes, but is not limited to the container runtime, the kubelet, and a Container Network Interface plugin.To help you avoid unexpected errors as a result of an unsupported kernel version, kubeadm runs the SystemVerification pre-flight check. This check fails if the kernel version is not supported.You may choose to skip the check, if you know that your kernel provides the required features, even though kubeadm does not support its version.Verify the MAC address and product_uuid are unique for every nodeYou can get the MAC address of the network


Question: When would you use Installing kubeadm?

Answer: Installing kubeadm This page shows how to install the kubeadm toolbox. For information on how to create a cluster with kubeadm once you have performed this installation process, see the Creating a cluster with kubeadm page.This installation guide is for Kubernetes v1.34. If you want to use a different Kubernetes version, please refer to the following pages instead:Installing kubeadm (Kubernetes v1.33)Installing kubeadm (Kubernetes v1.32)Installing kubeadm (Kubernetes v1.31)Installing kubeadm (Kubernetes v1.30)Before you beginA compatible Linux host. The Kubernetes project provides generic instructions for Linux distributions based on Debian and Red Hat, and those distributions without a package manager.2 GB or more of RAM per machine (any less will leave little room for your apps).2 CPUs or more for control plane machines.Full network connectivity between all machines in the cluster (public or private network is fine).Unique hostname, MAC address, and product_uuid for every node. See here for more details.Certain ports are open on your machines. See here for more details.Note:The kubeadm installation is done via binaries that use dynamic linking and assumes that your target system provides glibc. This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.) but it is not always the case with custom and lightweight distributions which don't include glibc by default, such as Alpine Linux. The expectation is that the distribution either includes glibc or a compatibility layer that provides the expected symbols.Check your OS versionNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.The kubeadm project supports LTS kernels. See List of LTS kernels.You can get the kernel version using the command uname -rFor more information, see Linux Kernel Requirements.The kubeadm project supports recent kernel versions. For a list of recent kernels, see Windows Server Release Information.You can get the kernel version (also called the OS version) using the command systeminfoFor more information, see Windows OS version compatibility.A Kubernetes cluster created by kubeadm depends on software that use kernel features. This software includes, but is not limited to the container runtime, the kubelet, and a Container Network Interface plugin.To help you avoid unexpected errors as a result of an unsupported kernel version, kubeadm runs the SystemVerification pre-flight check. This check fails if the kernel version is not supported.You may choose to skip the check, if you know that your kernel provides the required features, even though kubeadm does not support its version.Verify the MAC address and product_uuid are unique for every nodeYou can get the MAC address of the network


Question: What are the benefits of Installing kubeadm?

Answer: Installing kubeadm This page shows how to install the kubeadm toolbox. For information on how to create a cluster with kubeadm once you have performed this installation process, see the Creating a cluster with kubeadm page.This installation guide is for Kubernetes v1.34. If you want to use a different Kubernetes version, please refer to the following pages instead:Installing kubeadm (Kubernetes v1.33)Installing kubeadm (Kubernetes v1.32)Installing kubeadm (Kubernetes v1.31)Installing kubeadm (Kubernetes v1.30)Before you beginA compatible Linux host. The Kubernetes project provides generic instructions for Linux distributions based on Debian and Red Hat, and those distributions without a package manager.2 GB or more of RAM per machine (any less will leave little room for your apps).2 CPUs or more for control plane machines.Full network connectivity between all machines in the cluster (public or private network is fine).Unique hostname, MAC address, and product_uuid for every node. See here for more details.Certain ports are open on your machines. See here for more details.Note:The kubeadm installation is done via binaries that use dynamic linking and assumes that your target system provides glibc. This is a reasonable assumption on many Linux distributions (including Debian, Ubuntu, Fedora, CentOS, etc.) but it is not always the case with custom and lightweight distributions which don't include glibc by default, such as Alpine Linux. The expectation is that the distribution either includes glibc or a compatibility layer that provides the expected symbols.Check your OS versionNote: This section links to third party projects that provide functionality required by Kubernetes. The Kubernetes project authors aren't responsible for these projects, which are listed alphabetically. To add a project to this list, read the content guide before submitting a change. More information.The kubeadm project supports LTS kernels. See List of LTS kernels.You can get the kernel version using the command uname -rFor more information, see Linux Kernel Requirements.The kubeadm project supports recent kernel versions. For a list of recent kernels, see Windows Server Release Information.You can get the kernel version (also called the OS version) using the command systeminfoFor more information, see Windows OS version compatibility.A Kubernetes cluster created by kubeadm depends on software that use kernel features. This software includes, but is not limited to the container runtime, the kubelet, and a Container Network Interface plugin.To help you avoid unexpected errors as a result of an unsupported kernel version, kubeadm runs the SystemVerification pre-flight check. This check fails if the kernel version is not supported.You may choose to skip the check, if you know that your kernel provides the required features, even though kubeadm does not support its version.Verify the MAC address and product_uuid are unique for every nodeYou can get the MAC address of the network


Question: What is Installing kubeadm?

Answer: T h i s   p a g e   s h o w s   h o w   t o   i n s t a l l   t h e   k u b e a d m   t o o l b o x .   F o r   i n f o r m a t i o n   o n   h o w   t o   c r e a t e   a   c l u s t e r   w i t h   k u b e a d m   o n c e   y o u   h a v e   p e r f o r m e d   t h i s   i n s t a l l a t i o n   p r o c e s s ,   s e e   t h e   C r e a t i n g   a   c l u s t e r   w i t h   k u b e a d m   p a g e .   T h i s   i n s t a l l a t i o n   g u i d e   i s   f o r   K u b e r n e t e s   v 1 . 3 4 .   I f   y o u   w a n t   t o   u s e   a   d i f f e r e n t   K u b e r n e t e s   v e r s i o n ,   p l e a s e   r e f e r   t o   t h e   f o l l o w i n g   p a g e s   i n s t e a d :   I n s t a l l i n g   k u b e a d m   ( K u b e r n e t e s   v 1 . 3 3 ) I n s t a l l i n g   k u b e a d m   ( K u b e r n e t e s   v 1 . 3 2 ) I n s t a l l i n g   k u b e a d m   ( K u b e r n e t e s   v 1 . 3 1 ) I n s t a l l i n g   k u b e a d m   ( K u b e r n e t e s   v 1 . 3 0 )


Question: What is Before you begin?

Answer: A   c o m p a t i b l e   L i n u x   h o s t .   T h e   K u b e r n e t e s   p r o j e c t   p r o v i d e s   g e n e r i c   i n s t r u c t i o n s   f o r   L i n u x   d i s t r i b u t i o n s   b a s e d   o n   D e b i a n   a n d   R e d   H a t ,   a n d   t h o s e   d i s t r i b u t i o n s   w i t h o u t   a   p a c k a g e   m a n a g e r . 2   G B   o r   m o r e   o f   R A M   p e r   m a c h i n e   ( a n y   l e s s   w i l l   l e a v e   l i t t l e   r o o m   f o r   y o u r   a p p s ) . 2   C P U s   o r   m o r e   f o r   c o n t r o l   p l a n e   m a c h i n e s . F u l l   n e t w o r k   c o n n e c t i v i t y   b e t w e e n   a l l   m a c h i n e s   i n   t h e   c l u s t e r   ( p u b l i c   o r   p r i v a t e   n e t w o r k   i s   f i n e ) . U n i q u e   h o s t n a m e ,   M A C   a d d r e s s ,   a n d   p r o d u c t _ u u i d   f o r   e v e r y   n o d e .   S e e   h e r e   f o r   m o r e   d e t a i l s . C e r t a i n   p o r t s   a r e   o p e n   o n   y o u r   m a c h i n e s .   S e e   h e r e   f o r   m o r e   d e t a i l s .


Question: What is Check your OS version?

Answer: T h e   k u b e a d m   p r o j e c t   s u p p o r t s   L T S   k e r n e l s .   S e e   L i s t   o f   L T S   k e r n e l s . Y o u   c a n   g e t   t h e   k e r n e l   v e r s i o n   u s i n g   t h e   c o m m a n d   u n a m e   - r F o r   m o r e   i n f o r m a t i o n ,   s e e   L i n u x   K e r n e l   R e q u i r e m e n t s .   T h e   k u b e a d m   p r o j e c t   s u p p o r t s   L T S   k e r n e l s .   S e e   L i s t   o f   L T S   k e r n e l s . Y o u   c a n   g e t   t h e   k e r n e l   v e r s i o n   u s i n g   t h e   c o m m a n d   u n a m e   - r   F o r   m o r e   i n f o r m a t i o n ,   s e e   L i n u x   K e r n e l   R e q u i r e m e n t s .   T h e   k u b e a d m   p r o j e c t   s u p p o r t s   r e c e n t   k e r n e l   v e r s i o n s .   F o r   a   l i s t   o f   r e c e n t   k e r n e l s ,   s e e   W i n d o w s   S e r v e r   R e l e a s e   I n f o r m a t i o n . Y o u   c a n   g e t   t h e   k e r n e l   v e r s i o n   ( a l s o   c a l l e d   t h e   O S   v e r s i o n )   u s i n g   t h e   c o m m a n d   s y s t e m i n f o F o r   m o r e   i n f o r m a t i o n ,   s e e   W i n d o w s   O S   v e r s i o n   c o m p a t i b i l i t y .   T h e   k u b e a d m   p r o j e c t   s u p p o r t s   r e c e n t   k e r n e l   v e r s i o n s .   F o r   a   l i s t   o f   r e c e n t   k e r n e l s ,   s e e   W i n d o w s   S e r v e r   R e l e a s e   I n f o r m a t i o n . Y o u   c a n   g e t   t h e   k e r n e l   v e r s i o n   ( a l s o   c a l l e d   t h e   O S   v e r s i o n )   u s i n g   t h e   c o m m a n d   s y s t e m i n f o   F o r   m o r e   i n f o r m a t i o n ,   s e e   W i n d o w s   O S   v e r s i o n   c o m p a t i b i l i t y .   A   K u b e r n e t e s   c l u s t e r   c r e a t e d   b y   k u b e a d m   d e p e n d s   o n   s o f t w a r e   t h a t   u s e   k e r n e l   f e a t u r e s .   T h i s   s o f t w a r e   i n c l u d


Question: What is Verify the MAC address and product_uuid are unique for every node?

Answer: Y o u   c a n   g e t   t h e   M A C   a d d r e s s   o f   t h e   n e t w o r k   i n t e r f a c e s   u s i n g   t h e   c o m m a n d   i p   l i n k   o r   i f c o n f i g   - a T h e   p r o d u c t _ u u i d   c a n   b e   c h e c k e d   b y   u s i n g   t h e   c o m m a n d   s u d o   c a t   / s y s / c l a s s / d m i / i d / p r o d u c t _ u u i d   I t   i s   v e r y   l i k e l y   t h a t   h a r d w a r e   d e v i c e s   w i l l   h a v e   u n i q u e   a d d r e s s e s ,   a l t h o u g h   s o m e   v i r t u a l   m a c h i n e s   m a y   h a v e   i d e n t i c a l   v a l u e s .   K u b e r n e t e s   u s e s   t h e s e   v a l u e s   t o   u n i q u e l y   i d e n t i f y   t h e   n o d e s   i n   t h e   c l u s t e r .   I f   t h e s e   v a l u e s   a r e   n o t   u n i q u e   t o   e a c h   n o d e ,   t h e   i n s t a l l a t i o n   p r o c e s s   m a y   f a i l .


Question: What is Check network adapters?

Answer: I f   y o u   h a v e   m o r e   t h a n   o n e   n e t w o r k   a d a p t e r ,   a n d   y o u r   K u b e r n e t e s   c o m p o n e n t s   a r e   n o t   r e a c h a b l e   o n   t h e   d e f a u l t   r o u t e ,   w e   r e c o m m e n d   y o u   a d d   I P   r o u t e ( s )   s o   K u b e r n e t e s   c l u s t e r   a d d r e s s e s   g o   v i a   t h e   a p p r o p r i a t e   a d a p t e r .


Question: What is Check required ports?

Answer: T h e s e   r e q u i r e d   p o r t s   n e e d   t o   b e   o p e n   i n   o r d e r   f o r   K u b e r n e t e s   c o m p o n e n t s   t o   c o m m u n i c a t e   w i t h   e a c h   o t h e r .   Y o u   c a n   u s e   t o o l s   l i k e   n e t c a t   t o   c h e c k   i f   a   p o r t   i s   o p e n .   F o r   e x a m p l e :   n c   1 2 7 . 0 . 0 . 1   6 4 4 3   - z v   - w   2   T h e   p o d   n e t w o r k   p l u g i n   y o u   u s e   m a y   a l s o   r e q u i r e   c e r t a i n   p o r t s   t o   b e   o p e n .   S i n c e   t h i s   d i f f e r s   w i t h   e a c h   p o d   n e t w o r k   p l u g i n ,   p l e a s e   s e e   t h e   d o c u m e n t a t i o n   f o r   t h e   p l u g i n s   a b o u t   w h a t   p o r t ( s )   t h o s e   n e e d .


Question: What is Swap configuration?

Answer: T h e   d e f a u l t   b e h a v i o r   o f   a   k u b e l e t   i s   t o   f a i l   t o   s t a r t   i f   s w a p   m e m o r y   i s   d e t e c t e d   o n   a   n o d e .   T h i s   m e a n s   t h a t   s w a p   s h o u l d   e i t h e r   b e   d i s a b l e d   o r   t o l e r a t e d   b y   k u b e l e t .   T o   t o l e r a t e   s w a p ,   a d d   f a i l S w a p O n :   f a l s e   t o   k u b e l e t   c o n f i g u r a t i o n   o r   a s   a   c o m m a n d   l i n e   a r g u m e n t .   N o t e :   e v e n   i f   f a i l S w a p O n :   f a l s e   i s   p r o v i d e d ,   w o r k l o a d s   w o u l d n ' t   h a v e   s w a p   a c c e s s   b y   d e f a u l t .   T h i s   c a n   b e   c h a n g e d   b y   s e t t i n g   a   s w a p B e h a v i o r ,   a g a i n   i n   t h e   k u b e l e t   c o n f i g u r a t i o n   f i l e .   T o   u s e   s w a p ,   s e t   a   s w a p B e h a v i o r   o t h e r   t h a n   t h e   d e f a u l t   N o S w a p   s e t t i n g .   S e e   S w a p   m e m o r y   m a n a g e m e n t   f o r   m o r e   d e t a i l s . T o   d i s a b l e   s w a p ,   s u d o   s w a p o f f   - a   c a n   b e   u s e d   t o   d i s a b l e   s w a p p i n g   t e m p o r a r i l y .   T o   m a k e   t h i s   c h a n g e   p e r s i s t e n t   a c r o s s   r e b o o t s ,   m a k e   s u r e   s w a p   i s   d i s a b l e d   i n   c o n f i g   f i l e s   l i k e   / e t c / f s t a b ,   s y s t e m d . s w a p ,   d e p e n d i n g   h o w   i t   w a s   c o n f i g u r e d   o n   y o u r   s y s t e m .


Question: What is Installing a container runtime?

Answer: T o   r u n   c o n t a i n e r s   i n   P o d s ,   K u b e r n e t e s   u s e s   a   c o n t a i n e r   r u n t i m e .   B y   d e f a u l t ,   K u b e r n e t e s   u s e s   t h e   C o n t a i n e r   R u n t i m e   I n t e r f a c e   ( C R I )   t o   i n t e r f a c e   w i t h   y o u r   c h o s e n   c o n t a i n e r   r u n t i m e .   I f   y o u   d o n ' t   s p e c i f y   a   r u n t i m e ,   k u b e a d m   a u t o m a t i c a l l y   t r i e s   t o   d e t e c t   a n   i n s t a l l e d   c o n t a i n e r   r u n t i m e   b y   s c a n n i n g   t h r o u g h   a   l i s t   o f   k n o w n   e n d p o i n t s .   I f   m u l t i p l e   o r   n o   c o n t a i n e r   r u n t i m e s   a r e   d e t e c t e d   k u b e a d m   w i l l   t h r o w   a n   e r r o r   a n d   w i l l   r e q u e s t   t h a t   y o u   s p e c i f y   w h i c h   o n e   y o u   w a n t   t o   u s e .   S e e   c o n t a i n e r   r u n t i m e s   f o r   m o r e   i n f o r m a t i o n .


Question: What is Note:?

Answer: T h e   t a b l e s   b e l o w   i n c l u d e   t h e   k n o w n   e n d p o i n t s   f o r   s u p p o r t e d   o p e r a t i n g   s y s t e m s :   L i n u x   c o n t a i n e r   r u n t i m e s R u n t i m e P a t h   t o   U n i x   d o m a i n   s o c k e t c o n t a i n e r d u n i x : / / / v a r / r u n / c o n t a i n e r d / c o n t a i n e r d . s o c k C R I - O u n i x : / / / v a r / r u n / c r i o / c r i o . s o c k D o c k e r   E n g i n e   ( u s i n g   c r i - d o c k e r d ) u n i x : / / / v a r / r u n / c r i - d o c k e r d . s o c k   W i n d o w s   c o n t a i n e r   r u n t i m e s R u n t i m e P a t h   t o   W i n d o w s   n a m e d   p i p e c o n t a i n e r d n p i p e : / / / / . / p i p e / c o n t a i n e r d - c o n t a i n e r d D o c k e r   E n g i n e   ( u s i n g   c r i - d o c k e r d ) n p i p e : / / / / . / p i p e / c r i - d o c k e r d


Question: What is Installing kubeadm, kubelet and kubectl?

Answer: Y o u   w i l l   i n s t a l l   t h e s e   p a c k a g e s   o n   a l l   o f   y o u r   m a c h i n e s :   k u b e a d m :   t h e   c o m m a n d   t o   b o o t s t r a p   t h e   c l u s t e r . k u b e l e t :   t h e   c o m p o n e n t   t h a t   r u n s   o n   a l l   o f   t h e   m a c h i n e s   i n   y o u r   c l u s t e r   a n d   d o e s   t h i n g s   l i k e   s t a r t i n g   p o d s   a n d   c o n t a i n e r s . k u b e c t l :   t h e   c o m m a n d   l i n e   u t i l   t o   t a l k   t o   y o u r   c l u s t e r .   k u b e a d m :   t h e   c o m m a n d   t o   b o o t s t r a p   t h e   c l u s t e r .   k u b e l e t :   t h e   c o m p o n e n t   t h a t   r u n s   o n   a l l   o f   t h e   m a c h i n e s   i n   y o u r   c l u s t e r   a n d   d o e s   t h i n g s   l i k e   s t a r t i n g   p o d s   a n d   c o n t a i n e r s .   k u b e c t l :   t h e   c o m m a n d   l i n e   u t i l   t o   t a l k   t o   y o u r   c l u s t e r .   k u b e a d m   w i l l   n o t   i n s t a l l   o r   m a n a g e   k u b e l e t   o r   k u b e c t l   f o r   y o u ,   s o   y o u   w i l l   n e e d   t o   e n s u r e   t h e y   m a t c h   t h e   v e r s i o n   o f   t h e   K u b e r n e t e s   c o n t r o l   p l a n e   y o u   w a n t   k u b e a d m   t o   i n s t a l l   f o r   y o u .   I f   y o u   d o   n o t ,   t h e r e   i s   a   r i s k   o f   a   v e r s i o n   s k e w   o c c u r r i n g   t h a t   c a n   l e a d   t o   u n e x p e c t e d ,   b u g g y   b e h a v i o u r .   H o w e v e r ,   o n e   m i n o r   v e r s i o n   s k e w   b e t w e e n   t h e   k u b e l e t   a n d   t h e   c o n t r o l   p l a n e   i s   s u p p o r t e d ,   b u t   t h e   k u b e l e t   v e r s i o n   m a y   n e v e r   e x c e e d   t h e   A P I   s e r v e r   v e r s i o n .   F o r   e x a m p l e ,   t h e   k u b e l e t   r u n n i n g   1 . 7 . 0   s h o u l d   b e   f u l l


Question: What is Warning:?

Answer: F o r   m o r e   i n f o r m a t i o n   o n   v e r s i o n   s k e w s ,   s e e :   K u b e r n e t e s   v e r s i o n   a n d   v e r s i o n - s k e w   p o l i c y K u b e a d m - s p e c i f i c   v e r s i o n   s k e w   p o l i c y


Question: What is Note:?

Answer: T h e s e   i n s t r u c t i o n s   a r e   f o r   K u b e r n e t e s   v 1 . 3 4 . U p d a t e   t h e   a p t   p a c k a g e   i n d e x   a n d   i n s t a l l   p a c k a g e s   n e e d e d   t o   u s e   t h e   K u b e r n e t e s   a p t   r e p o s i t o r y : s u d o   a p t - g e t   u p d a t e   #   a p t - t r a n s p o r t - h t t p s   m a y   b e   a   d u m m y   p a c k a g e ;   i f   s o ,   y o u   c a n   s k i p   t h a t   p a c k a g e   s u d o   a p t - g e t   i n s t a l l   - y   a p t - t r a n s p o r t - h t t p s   c a - c e r t i f i c a t e s   c u r l   g p g   D o w n l o a d   t h e   p u b l i c   s i g n i n g   k e y   f o r   t h e   K u b e r n e t e s   p a c k a g e   r e p o s i t o r i e s .   T h e   s a m e   s i g n i n g   k e y   i s   u s e d   f o r   a l l   r e p o s i t o r i e s   s o   y o u   c a n   d i s r e g a r d   t h e   v e r s i o n   i n   t h e   U R L : #   I f   t h e   d i r e c t o r y   ` / e t c / a p t / k e y r i n g s `   d o e s   n o t   e x i s t ,   i t   s h o u l d   b e   c r e a t e d   b e f o r e   t h e   c u r l   c o m m a n d ,   r e a d   t h e   n o t e   b e l o w .   #   s u d o   m k d i r   - p   - m   7 5 5   / e t c / a p t / k e y r i n g s   c u r l   - f s S L   h t t p s : / / p k g s . k 8 s . i o / c o r e : / s t a b l e : / v 1 . 3 4 / d e b / R e l e a s e . k e y   |   s u d o   g p g   - - d e a r m o r   - o   / e t c / a p t / k e y r i n g s / k u b e r n e t e s - a p t - k e y r i n g . g p g   N o t e : I n   r e l e a s e s   o l d e r   t h a n   D e b i a n   1 2   a n d   U b u n t u   2 2 . 0 4 ,   d i r e c t o r y   / e t c / a p t / k e y r i n g s   d o e s   n o t   e x i s t   b y   d e f a u l t ,   a n d   i t   s h o u l d   b e   c r e a t e d   b e f o r e   t h e   c u r l   c o m m a n d . A d d   t h e   a p p r o p r i a t e   K u b e r n e t e s   a p t   r e p o s i t o r y .   P l e a s e   n o t e   t h a t   t h i s


Question: What is Note:?

Answer: A d d   t h e   a p p r o p r i a t e   K u b e r n e t e s   a p t   r e p o s i t o r y .   P l e a s e   n o t e   t h a t   t h i s   r e p o s i t o r y   h a v e   p a c k a g e s   o n l y   f o r   K u b e r n e t e s   1 . 3 4 ;   f o r   o t h e r   K u b e r n e t e s   m i n o r   v e r s i o n s ,   y o u   n e e d   t o   c h a n g e   t h e   K u b e r n e t e s   m i n o r   v e r s i o n   i n   t h e   U R L   t o   m a t c h   y o u r   d e s i r e d   m i n o r   v e r s i o n   ( y o u   s h o u l d   a l s o   c h e c k   t h a t   y o u   a r e   r e a d i n g   t h e   d o c u m e n t a t i o n   f o r   t h e   v e r s i o n   o f   K u b e r n e t e s   t h a t   y o u   p l a n   t o   i n s t a l l ) . #   T h i s   o v e r w r i t e s   a n y   e x i s t i n g   c o n f i g u r a t i o n   i n   / e t c / a p t / s o u r c e s . l i s t . d / k u b e r n e t e s . l i s t   e c h o   ' d e b   [ s i g n e d - b y = / e t c / a p t / k e y r i n g s / k u b e r n e t e s - a p t - k e y r i n g . g p g ]   h t t p s : / / p k g s . k 8 s . i o / c o r e : / s t a b l e : / v 1 . 3 4 / d e b /   / '   |   s u d o   t e e   / e t c / a p t / s o u r c e s . l i s t . d / k u b e r n e t e s . l i s t   U p d a t e   t h e   a p t   p a c k a g e   i n d e x ,   i n s t a l l   k u b e l e t ,   k u b e a d m   a n d   k u b e c t l ,   a n d   p i n   t h e i r   v e r s i o n : s u d o   a p t - g e t   u p d a t e   s u d o   a p t - g e t   i n s t a l l   - y   k u b e l e t   k u b e a d m   k u b e c t l   s u d o   a p t - m a r k   h o l d   k u b e l e t   k u b e a d m   k u b e c t l   ( O p t i o n a l )   E n a b l e   t h e   k u b e l e t   s e r v i c e   b e f o r e   r u n n i n g   k u b e a d m : s u d o   s y s t e m c t l   e n a b l e   - - n o w   k u b e l e t   A d d   t h e   a p p r o p r i a t e   K u b e r n e t e s   a p t   r e p o s i t o r y .   P l e a s e   n o t e   t h a t   t h i s   r e p o s i t o r


Question: What is Caution:?

Answer: S e t t i n g   S E L i n u x   i n   p e r m i s s i v e   m o d e   b y   r u n n i n g   s e t e n f o r c e   0   a n d   s e d   . . .   e f f e c t i v e l y   d i s a b l e s   i t .   T h i s   i s   r e q u i r e d   t o   a l l o w   c o n t a i n e r s   t o   a c c e s s   t h e   h o s t   f i l e s y s t e m ;   f o r   e x a m p l e ,   s o m e   c l u s t e r   n e t w o r k   p l u g i n s   r e q u i r e   t h a t .   Y o u   h a v e   t o   d o   t h i s   u n t i l   S E L i n u x   s u p p o r t   i s   i m p r o v e d   i n   t h e   k u b e l e t . Y o u   c a n   l e a v e   S E L i n u x   e n a b l e d   i f   y o u   k n o w   h o w   t o   c o n f i g u r e   i t   b u t   i t   m a y   r e q u i r e   s e t t i n g s   t h a t   a r e   n o t   s u p p o r t e d   b y   k u b e a d m .   A d d   t h e   K u b e r n e t e s   y u m   r e p o s i t o r y .   T h e   e x c l u d e   p a r a m e t e r   i n   t h e   r e p o s i t o r y   d e f i n i t i o n   e n s u r e s   t h a t   t h e   p a c k a g e s   r e l a t e d   t o   K u b e r n e t e s   a r e   n o t   u p g r a d e d   u p o n   r u n n i n g   y u m   u p d a t e   a s   t h e r e ' s   a   s p e c i a l   p r o c e d u r e   t h a t   m u s t   b e   f o l l o w e d   f o r   u p g r a d i n g   K u b e r n e t e s .   P l e a s e   n o t e   t h a t   t h i s   r e p o s i t o r y   h a v e   p a c k a g e s   o n l y   f o r   K u b e r n e t e s   1 . 3 4 ;   f o r   o t h e r   K u b e r n e t e s   m i n o r   v e r s i o n s ,   y o u   n e e d   t o   c h a n g e   t h e   K u b e r n e t e s   m i n o r   v e r s i o n   i n   t h e   U R L   t o   m a t c h   y o u r   d e s i r e d   m i n o r   v e r s i o n   ( y o u   s h o u l d   a l s o   c h e c k   t h a t   y o u   a r e   r e a d i n g   t h e   d o c u m e n t a t i o n   f o r   t h e   v e r s i o n   o f   K u b e r n e t e s   t h a t   y o u   p l a n   t o   i n s t a l l ) . #   T h i s   o v


Question: What is Note:?

Answer: D O W N L O A D _ D I R = " / u s r / l o c a l / b i n "   s u d o   m k d i r   - p   " $ D O W N L O A D _ D I R "   O p t i o n a l l y   i n s t a l l   c r i c t l   ( r e q u i r e d   f o r   i n t e r a c t i o n   w i t h   t h e   C o n t a i n e r   R u n t i m e   I n t e r f a c e   ( C R I ) ,   o p t i o n a l   f o r   k u b e a d m ) :   C R I C T L _ V E R S I O N = " v 1 . 3 1 . 0 "   A R C H = " a m d 6 4 "   c u r l   - L   " h t t p s : / / g i t h u b . c o m / k u b e r n e t e s - s i g s / c r i - t o o l s / r e l e a s e s / d o w n l o a d / $ { C R I C T L _ V E R S I O N } / c r i c t l - $ { C R I C T L _ V E R S I O N } - l i n u x - $ { A R C H } . t a r . g z "   |   s u d o   t a r   - C   $ D O W N L O A D _ D I R   - x z   I n s t a l l   k u b e a d m ,   k u b e l e t   a n d   a d d   a   k u b e l e t   s y s t e m d   s e r v i c e :   R E L E A S E = " $ ( c u r l   - s S L   h t t p s : / / d l . k 8 s . i o / r e l e a s e / s t a b l e . t x t ) "   A R C H = " a m d 6 4 "   c d   $ D O W N L O A D _ D I R   s u d o   c u r l   - L   - - r e m o t e - n a m e - a l l   h t t p s : / / d l . k 8 s . i o / r e l e a s e / $ { R E L E A S E } / b i n / l i n u x / $ { A R C H } / { k u b e a d m , k u b e l e t }   s u d o   c h m o d   + x   { k u b e a d m , k u b e l e t }   R E L E A S E _ V E R S I O N = " v 0 . 1 6 . 2 "   c u r l   - s S L   " h t t p s : / / r a w . g i t h u b u s e r c o n t e n t . c o m / k u b e r n e t e s / r e l e a s e / $ { R E L E A S E _ V E R S I O N } / c m d / k r e l / t e m p l a t e s / l a t e s t / k u b e l e t / k u b e l e t . s e r v i c e "   |   s e d   " s : / u s r / b i n : $ { D O W N L O A D _ D I R } : g "   |   s u d o   t e e   / u s r / l i b / s y s t e m d / s y s t e m / k u b e l e t . s e r v i c e   s u d o   m k d i r   - p   / u s r / l i b / s y s t e m d / s y s t e m / k u b e l e t . s e r v i c e . d   c u r l   - s S L   " h t t p s : / / r a w . g


Question: What is Note:?

Answer: I n s t a l l   k u b e c t l   b y   f o l l o w i n g   t h e   i n s t r u c t i o n s   o n   I n s t a l l   T o o l s   p a g e .   O p t i o n a l l y ,   e n a b l e   t h e   k u b e l e t   s e r v i c e   b e f o r e   r u n n i n g   k u b e a d m :   s u d o   s y s t e m c t l   e n a b l e   - - n o w   k u b e l e t


Question: What is Note:?

Answer: T h e   k u b e l e t   i s   n o w   r e s t a r t i n g   e v e r y   f e w   s e c o n d s ,   a s   i t   w a i t s   i n   a   c r a s h l o o p   f o r   k u b e a d m   t o   t e l l   i t   w h a t   t o   d o .


Question: What is Configuring a cgroup driver?

Answer: B o t h   t h e   c o n t a i n e r   r u n t i m e   a n d   t h e   k u b e l e t   h a v e   a   p r o p e r t y   c a l l e d   " c g r o u p   d r i v e r " ,   w h i c h   i s   i m p o r t a n t   f o r   t h e   m a n a g e m e n t   o f   c g r o u p s   o n   L i n u x   m a c h i n e s .


Question: What is Warning:?

Answer: M a t c h i n g   t h e   c o n t a i n e r   r u n t i m e   a n d   k u b e l e t   c g r o u p   d r i v e r s   i s   r e q u i r e d   o r   o t h e r w i s e   t h e   k u b e l e t   p r o c e s s   w i l l   f a i l .   S e e   C o n f i g u r i n g   a   c g r o u p   d r i v e r   f o r   m o r e   d e t a i l s .


Question: What is Troubleshooting?

Answer: I f   y o u   a r e   r u n n i n g   i n t o   d i f f i c u l t i e s   w i t h   k u b e a d m ,   p l e a s e   c o n s u l t   o u r   t r o u b l e s h o o t i n g   d o c s .


Question: What is What's next?

Answer: U s i n g   k u b e a d m   t o   C r e a t e   a   C l u s t e r   I t e m s   o n   t h i s   p a g e   r e f e r   t o   t h i r d   p a r t y   p r o d u c t s   o r   p r o j e c t s   t h a t   p r o v i d e   f u n c t i o n a l i t y   r e q u i r e d   b y   K u b e r n e t e s .   T h e   K u b e r n e t e s   p r o j e c t   a u t h o r s   a r e n ' t   r e s p o n s i b l e   f o r   t h o s e   t h i r d - p a r t y   p r o d u c t s   o r   p r o j e c t s .   S e e   t h e   C N C F   w e b s i t e   g u i d e l i n e s   f o r   m o r e   d e t a i l s .   Y o u   s h o u l d   r e a d   t h e   c o n t e n t   g u i d e   b e f o r e   p r o p o s i n g   a   c h a n g e   t h a t   a d d s   a n   e x t r a   t h i r d - p a r t y   l i n k .


Question: What is Encrypting Confidential Data at Rest?

Answer: Encrypting Confidential Data at RestAll of the APIs in Kubernetes that let you write persistent API resource data support at-rest encryption. For example, you can enable at-rest encryption for Secrets. This at-rest encryption is additional to any system-level encryption for the etcd cluster or for the filesystem(s) on hosts where you are running the kube-apiserver.This page shows how to enable and configure encryption of API data at rest.Note:This task covers encryption for resource data stored using the Kubernetes API. For example, you can encrypt Secret objects, including the key-value data they contain.If you want to encrypt data in filesystems that are mounted into containers, you instead need to either:use a storage integration that provides encrypted volumesencrypt the data within your own applicationBefore you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThis task assumes that you are running the Kubernetes API server as a static pod on each control plane node.Your cluster's control plane must use etcd v3.x (major version 3, any minor version).To encrypt a custom resource, your cluster must be running Kubernetes v1.26 or newer.To use a wildcard to match resources, your cluster must be running Kubernetes v1.27 or newer.To check the version, enter kubectl version.Determine whether encryption at rest is already enabledBy default, the API server stores plain-text representations of resources into etcd, with no at-rest encryption.The kube-apiserver process accepts an argument --encryption-provider-config that specifies a path to a configuration file. The contents of that file, if you specify one, control how Kubernetes API data is encrypted in etcd. If you are running the kube-apiserver without the --encryption-provider-config command line argument, you do not have encryption at rest enabled. If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies the identity provider as the first encryption provider in the list, then you do not have at-rest encryption enabled (the default identity provider does not provide any confidentiality protection.)If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies a provider other than identity as the first encryption provider in the list, then you already have at-rest encryption enabled. However, that check does not tell you whether a previous migration to encrypted storage has succeeded. If you are not sure, see ensure all relevant data are encrypted.Understanding the e


Question: How does Encrypting Confidential Data at Rest work?

Answer: Encrypting Confidential Data at RestAll of the APIs in Kubernetes that let you write persistent API resource data support at-rest encryption. For example, you can enable at-rest encryption for Secrets. This at-rest encryption is additional to any system-level encryption for the etcd cluster or for the filesystem(s) on hosts where you are running the kube-apiserver.This page shows how to enable and configure encryption of API data at rest.Note:This task covers encryption for resource data stored using the Kubernetes API. For example, you can encrypt Secret objects, including the key-value data they contain.If you want to encrypt data in filesystems that are mounted into containers, you instead need to either:use a storage integration that provides encrypted volumesencrypt the data within your own applicationBefore you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThis task assumes that you are running the Kubernetes API server as a static pod on each control plane node.Your cluster's control plane must use etcd v3.x (major version 3, any minor version).To encrypt a custom resource, your cluster must be running Kubernetes v1.26 or newer.To use a wildcard to match resources, your cluster must be running Kubernetes v1.27 or newer.To check the version, enter kubectl version.Determine whether encryption at rest is already enabledBy default, the API server stores plain-text representations of resources into etcd, with no at-rest encryption.The kube-apiserver process accepts an argument --encryption-provider-config that specifies a path to a configuration file. The contents of that file, if you specify one, control how Kubernetes API data is encrypted in etcd. If you are running the kube-apiserver without the --encryption-provider-config command line argument, you do not have encryption at rest enabled. If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies the identity provider as the first encryption provider in the list, then you do not have at-rest encryption enabled (the default identity provider does not provide any confidentiality protection.)If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies a provider other than identity as the first encryption provider in the list, then you already have at-rest encryption enabled. However, that check does not tell you whether a previous migration to encrypted storage has succeeded. If you are not sure, see ensure all relevant data are encrypted.Understanding the e


Question: When would you use Encrypting Confidential Data at Rest?

Answer: Encrypting Confidential Data at RestAll of the APIs in Kubernetes that let you write persistent API resource data support at-rest encryption. For example, you can enable at-rest encryption for Secrets. This at-rest encryption is additional to any system-level encryption for the etcd cluster or for the filesystem(s) on hosts where you are running the kube-apiserver.This page shows how to enable and configure encryption of API data at rest.Note:This task covers encryption for resource data stored using the Kubernetes API. For example, you can encrypt Secret objects, including the key-value data they contain.If you want to encrypt data in filesystems that are mounted into containers, you instead need to either:use a storage integration that provides encrypted volumesencrypt the data within your own applicationBefore you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThis task assumes that you are running the Kubernetes API server as a static pod on each control plane node.Your cluster's control plane must use etcd v3.x (major version 3, any minor version).To encrypt a custom resource, your cluster must be running Kubernetes v1.26 or newer.To use a wildcard to match resources, your cluster must be running Kubernetes v1.27 or newer.To check the version, enter kubectl version.Determine whether encryption at rest is already enabledBy default, the API server stores plain-text representations of resources into etcd, with no at-rest encryption.The kube-apiserver process accepts an argument --encryption-provider-config that specifies a path to a configuration file. The contents of that file, if you specify one, control how Kubernetes API data is encrypted in etcd. If you are running the kube-apiserver without the --encryption-provider-config command line argument, you do not have encryption at rest enabled. If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies the identity provider as the first encryption provider in the list, then you do not have at-rest encryption enabled (the default identity provider does not provide any confidentiality protection.)If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies a provider other than identity as the first encryption provider in the list, then you already have at-rest encryption enabled. However, that check does not tell you whether a previous migration to encrypted storage has succeeded. If you are not sure, see ensure all relevant data are encrypted.Understanding the e


Question: What are the benefits of Encrypting Confidential Data at Rest?

Answer: Encrypting Confidential Data at RestAll of the APIs in Kubernetes that let you write persistent API resource data support at-rest encryption. For example, you can enable at-rest encryption for Secrets. This at-rest encryption is additional to any system-level encryption for the etcd cluster or for the filesystem(s) on hosts where you are running the kube-apiserver.This page shows how to enable and configure encryption of API data at rest.Note:This task covers encryption for resource data stored using the Kubernetes API. For example, you can encrypt Secret objects, including the key-value data they contain.If you want to encrypt data in filesystems that are mounted into containers, you instead need to either:use a storage integration that provides encrypted volumesencrypt the data within your own applicationBefore you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesThis task assumes that you are running the Kubernetes API server as a static pod on each control plane node.Your cluster's control plane must use etcd v3.x (major version 3, any minor version).To encrypt a custom resource, your cluster must be running Kubernetes v1.26 or newer.To use a wildcard to match resources, your cluster must be running Kubernetes v1.27 or newer.To check the version, enter kubectl version.Determine whether encryption at rest is already enabledBy default, the API server stores plain-text representations of resources into etcd, with no at-rest encryption.The kube-apiserver process accepts an argument --encryption-provider-config that specifies a path to a configuration file. The contents of that file, if you specify one, control how Kubernetes API data is encrypted in etcd. If you are running the kube-apiserver without the --encryption-provider-config command line argument, you do not have encryption at rest enabled. If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies the identity provider as the first encryption provider in the list, then you do not have at-rest encryption enabled (the default identity provider does not provide any confidentiality protection.)If you are running the kube-apiserver with the --encryption-provider-config command line argument, and the file that it references specifies a provider other than identity as the first encryption provider in the list, then you already have at-rest encryption enabled. However, that check does not tell you whether a previous migration to encrypted storage has succeeded. If you are not sure, see ensure all relevant data are encrypted.Understanding the e


Question: What is Encrypting Confidential Data at Rest?

Answer: A l l   o f   t h e   A P I s   i n   K u b e r n e t e s   t h a t   l e t   y o u   w r i t e   p e r s i s t e n t   A P I   r e s o u r c e   d a t a   s u p p o r t   a t - r e s t   e n c r y p t i o n .   F o r   e x a m p l e ,   y o u   c a n   e n a b l e   a t - r e s t   e n c r y p t i o n   f o r   S e c r e t s .   T h i s   a t - r e s t   e n c r y p t i o n   i s   a d d i t i o n a l   t o   a n y   s y s t e m - l e v e l   e n c r y p t i o n   f o r   t h e   e t c d   c l u s t e r   o r   f o r   t h e   f i l e s y s t e m ( s )   o n   h o s t s   w h e r e   y o u   a r e   r u n n i n g   t h e   k u b e - a p i s e r v e r .   T h i s   p a g e   s h o w s   h o w   t o   e n a b l e   a n d   c o n f i g u r e   e n c r y p t i o n   o f   A P I   d a t a   a t   r e s t .


Question: What is Note:?

Answer: T h i s   t a s k   c o v e r s   e n c r y p t i o n   f o r   r e s o u r c e   d a t a   s t o r e d   u s i n g   t h e   K u b e r n e t e s   A P I .   F o r   e x a m p l e ,   y o u   c a n   e n c r y p t   S e c r e t   o b j e c t s ,   i n c l u d i n g   t h e   k e y - v a l u e   d a t a   t h e y   c o n t a i n .   I f   y o u   w a n t   t o   e n c r y p t   d a t a   i n   f i l e s y s t e m s   t h a t   a r e   m o u n t e d   i n t o   c o n t a i n e r s ,   y o u   i n s t e a d   n e e d   t o   e i t h e r :   u s e   a   s t o r a g e   i n t e g r a t i o n   t h a t   p r o v i d e s   e n c r y p t e d   v o l u m e s e n c r y p t   t h e   d a t a   w i t h i n   y o u r   o w n   a p p l i c a t i o n


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T h i s   t a s k   a s s u m e s   t h a t   y o u   a r e   r u n n i n g   t h e   K u b e r n e t e s   A P I   s e r v e r   a s   a   s t a t i c   p o d   o n   e a c h   c o n t r o l   p l a n e   n o d e . Y o u r   c l u s t e r ' s   c o n t r o l   p l a n e   m u s t   u s e   e t c d   v 3 . x   ( m a j o r   v e r s i o n   3 ,   a n y   m i n o r   v e r s i o n ) . T o   e n c r y p t   a   c u s t o m   r e s o u r c e ,   y o u r   c l u s t e r   m u s t   b e   r u n n i n g   K u b e r n e t e s   v 1 . 2 6   o r   n e w e r . T o   u s e   a   w i l d c a r d   t o   m a t c h   r e s o u r c e s ,   y o u r   c l u s t e r   m u s t   b e   r u n n i n g   K u b e r n e t e s   v 1 . 2 7   o r   n e w e r .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a


Question: What is Determine whether encryption at rest is already enabled?

Answer: B y   d e f a u l t ,   t h e   A P I   s e r v e r   s t o r e s   p l a i n - t e x t   r e p r e s e n t a t i o n s   o f   r e s o u r c e s   i n t o   e t c d ,   w i t h   n o   a t - r e s t   e n c r y p t i o n .   T h e   k u b e - a p i s e r v e r   p r o c e s s   a c c e p t s   a n   a r g u m e n t   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   t h a t   s p e c i f i e s   a   p a t h   t o   a   c o n f i g u r a t i o n   f i l e .   T h e   c o n t e n t s   o f   t h a t   f i l e ,   i f   y o u   s p e c i f y   o n e ,   c o n t r o l   h o w   K u b e r n e t e s   A P I   d a t a   i s   e n c r y p t e d   i n   e t c d .   I f   y o u   a r e   r u n n i n g   t h e   k u b e - a p i s e r v e r   w i t h o u t   t h e   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   c o m m a n d   l i n e   a r g u m e n t ,   y o u   d o   n o t   h a v e   e n c r y p t i o n   a t   r e s t   e n a b l e d .   I f   y o u   a r e   r u n n i n g   t h e   k u b e - a p i s e r v e r   w i t h   t h e   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   c o m m a n d   l i n e   a r g u m e n t ,   a n d   t h e   f i l e   t h a t   i t   r e f e r e n c e s   s p e c i f i e s   t h e   i d e n t i t y   p r o v i d e r   a s   t h e   f i r s t   e n c r y p t i o n   p r o v i d e r   i n   t h e   l i s t ,   t h e n   y o u   d o   n o t   h a v e   a t - r e s t   e n c r y p t i o n   e n a b l e d   ( t h e   d e f a u l t   i d e n t i t y   p r o v i d e r   d o e s   n o t   p r o v i d e   a n y   c o n f i d e n t i a l i t y   p r o t e c t i o n . )   I f   y o u   a r e   r u n n i n g   t h e   k u b e - a p i s e r v e r   w i t h   t h e   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   c o m m a n d   l i n e   a r g u m e n t ,   a n d   t h e   f i l e   t h a t   i t   r e f e r e n c e s   s p e c i f i e s   a   p r o v i d e r   o t h e r   t h a n   i d e n t i t y   a s   t h e


Question: What is Understanding the encryption at rest configuration?

Answer: - - -   #   #   C A U T I O N :   t h i s   i s   a n   e x a m p l e   c o n f i g u r a t i o n .   #   D o   n o t   u s e   t h i s   f o r   y o u r   o w n   c l u s t e r !   #   a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   E n c r y p t i o n C o n f i g u r a t i o n   r e s o u r c e s :   -   r e s o u r c e s :   -   s e c r e t s   -   c o n f i g m a p s   -   p a n d a s . a w e s o m e . b e a r s . e x a m p l e   #   a   c u s t o m   r e s o u r c e   A P I   p r o v i d e r s :   #   T h i s   c o n f i g u r a t i o n   d o e s   n o t   p r o v i d e   d a t a   c o n f i d e n t i a l i t y .   T h e   f i r s t   #   c o n f i g u r e d   p r o v i d e r   i s   s p e c i f y i n g   t h e   " i d e n t i t y "   m e c h a n i s m ,   w h i c h   #   s t o r e s   r e s o u r c e s   a s   p l a i n   t e x t .   #   -   i d e n t i t y :   { }   #   p l a i n   t e x t ,   i n   o t h e r   w o r d s   N O   e n c r y p t i o n   -   a e s g c m :   k e y s :   -   n a m e :   k e y 1   s e c r e t :   c 2 V j c m V 0 I G l z I H N l Y 3 V y Z Q = =   -   n a m e :   k e y 2   s e c r e t :   d G h p c y B p c y B w Y X N z d 2 9 y Z A = =   -   a e s c b c :   k e y s :   -   n a m e :   k e y 1   s e c r e t :   c 2 V j c m V 0 I G l z I H N l Y 3 V y Z Q = =   -   n a m e :   k e y 2   s e c r e t :   d G h p c y B p c y B w Y X N z d 2 9 y Z A = =   -   s e c r e t b o x :   k e y s :   -   n a m e :   k e y 1   s e c r e t :   Y W J j Z G V m Z 2 h p a m t s b W 5 v c H F y c 3 R 1 d n d 4 e X o x M j M 0 N T Y =   -   r e s o u r c e s :   -   e v e n t s   p r o v i d e r s :   -   i d e n t i t y :   { }   #   d o   n o t   e n c r y p t   E v e n t s   e v e n   t h o u g h   * . *   i s   s p e c i f i e d   b e l o w   -   r e s o u r c e s :   -   ' * . a p p s '   #   w i l d c a r d   m a t c h   r e q u i r e s   K u b e r n e t e s   1 . 2 7   o r   l a t e r   p r o v i d e r s :


Question: What is Note:?

Answer: I f   y o u   h a v e   a   w i l d c a r d   c o v e r i n g   r e s o u r c e s   a n d   w a n t   t o   o p t   o u t   o f   a t - r e s t   e n c r y p t i o n   f o r   a   p a r t i c u l a r   k i n d   o f   r e s o u r c e ,   y o u   a c h i e v e   t h a t   b y   a d d i n g   a   s e p a r a t e   r e s o u r c e s   a r r a y   i t e m   w i t h   t h e   n a m e   o f   t h e   r e s o u r c e   t h a t   y o u   w a n t   t o   e x e m p t ,   f o l l o w e d   b y   a   p r o v i d e r s   a r r a y   i t e m   w h e r e   y o u   s p e c i f y   t h e   i d e n t i t y   p r o v i d e r .   Y o u   a d d   t h i s   i t e m   t o   t h e   l i s t   s o   t h a t   i t   a p p e a r s   e a r l i e r   t h a n   t h e   c o n f i g u r a t i o n   w h e r e   y o u   d o   s p e c i f y   e n c r y p t i o n   ( a   p r o v i d e r   t h a t   i s   n o t   i d e n t i t y ) .   F o r   e x a m p l e ,   i f   ' * . * '   i s   e n a b l e d   a n d   y o u   w a n t   t o   o p t   o u t   o f   e n c r y p t i o n   f o r   E v e n t s   a n d   C o n f i g M a p s ,   a d d   a   n e w   e a r l i e r   i t e m   t o   t h e   r e s o u r c e s ,   f o l l o w e d   b y   t h e   p r o v i d e r s   a r r a y   i t e m   w i t h   i d e n t i t y   a s   t h e   p r o v i d e r .   T h e   m o r e   s p e c i f i c   e n t r y   m u s t   c o m e   b e f o r e   t h e   w i l d c a r d   e n t r y .   T h e   n e w   i t e m   w o u l d   l o o k   s i m i l a r   t o :   . . .   -   r e s o u r c e s :   -   c o n f i g m a p s .   #   s p e c i f i c a l l y   f r o m   t h e   c o r e   A P I   g r o u p ,   #   b e c a u s e   o f   t r a i l i n g   " . "   -   e v e n t s   p r o v i d e r s :   -   i d e n t i t y :   { }   #   a n d   t h e n   o t h e r   e n t r i e s   i n   r e s o u r c e s   E n s u r e   t h a t   t h e   e x e m p t i o n   i s   l i s t e d   b e f o r e   t h e   w i l d c a r d   ' * . * '   i t e m   i n


Question: What is Caution:?

Answer: I f   a n y   r e s o u r c e   i s   n o t   r e a d a b l e   v i a   t h e   e n c r y p t i o n   c o n f i g u r a t i o n   ( b e c a u s e   k e y s   w e r e   c h a n g e d ) ,   a n d   y o u   c a n n o t   r e s t o r e   a   w o r k i n g   c o n f i g u r a t i o n ,   y o u r   o n l y   r e c o u r s e   i s   t o   d e l e t e   t h a t   e n t r y   f r o m   t h e   u n d e r l y i n g   e t c d   d i r e c t l y .   A n y   c a l l s   t o   t h e   K u b e r n e t e s   A P I   t h a t   a t t e m p t   t o   r e a d   t h a t   r e s o u r c e   w i l l   f a i l   u n t i l   i t   i s   d e l e t e d   o r   a   v a l i d   d e c r y p t i o n   k e y   i s   p r o v i d e d .


Question: What is Available providers?

Answer: B e f o r e   y o u   c o n f i g u r e   e n c r y p t i o n - a t - r e s t   f o r   d a t a   i n   y o u r   c l u s t e r ' s   K u b e r n e t e s   A P I ,   y o u   n e e d   t o   s e l e c t   w h i c h   p r o v i d e r ( s )   y o u   w i l l   u s e .   T h e   f o l l o w i n g   t a b l e   d e s c r i b e s   e a c h   a v a i l a b l e   p r o v i d e r .   T h e   i d e n t i t y   p r o v i d e r   i s   t h e   d e f a u l t   i f   y o u   d o   n o t   s p e c i f y   o t h e r w i s e .   T h e   i d e n t i t y   p r o v i d e r   d o e s   n o t   e n c r y p t   s t o r e d   d a t a   a n d   p r o v i d e s   n o   a d d i t i o n a l   c o n f i d e n t i a l i t y   p r o t e c t i o n .


Question: What is Local key storage?

Answer: E n c r y p t i n g   s e c r e t   d a t a   w i t h   a   l o c a l l y   m a n a g e d   k e y   p r o t e c t s   a g a i n s t   a n   e t c d   c o m p r o m i s e ,   b u t   i t   f a i l s   t o   p r o t e c t   a g a i n s t   a   h o s t   c o m p r o m i s e .   S i n c e   t h e   e n c r y p t i o n   k e y s   a r e   s t o r e d   o n   t h e   h o s t   i n   t h e   E n c r y p t i o n C o n f i g u r a t i o n   Y A M L   f i l e ,   a   s k i l l e d   a t t a c k e r   c a n   a c c e s s   t h a t   f i l e   a n d   e x t r a c t   t h e   e n c r y p t i o n   k e y s .


Question: What is Managed (KMS) key storage?

Answer: T h e   K M S   p r o v i d e r   u s e s   e n v e l o p e   e n c r y p t i o n :   K u b e r n e t e s   e n c r y p t s   r e s o u r c e s   u s i n g   a   d a t a   k e y ,   a n d   t h e n   e n c r y p t s   t h a t   d a t a   k e y   u s i n g   t h e   m a n a g e d   e n c r y p t i o n   s e r v i c e .   K u b e r n e t e s   g e n e r a t e s   a   u n i q u e   d a t a   k e y   f o r   e a c h   r e s o u r c e .   T h e   A P I   s e r v e r   s t o r e s   a n   e n c r y p t e d   v e r s i o n   o f   t h e   d a t a   k e y   i n   e t c d   a l o n g s i d e   t h e   c i p h e r t e x t ;   w h e n   r e a d i n g   t h e   r e s o u r c e ,   t h e   A P I   s e r v e r   c a l l s   t h e   m a n a g e d   e n c r y p t i o n   s e r v i c e   a n d   p r o v i d e s   b o t h   t h e   c i p h e r t e x t   a n d   t h e   ( e n c r y p t e d )   d a t a   k e y .   W i t h i n   t h e   m a n a g e d   e n c r y p t i o n   s e r v i c e ,   t h e   p r o v i d e r   u s e   a   k e y   e n c r y p t i o n   k e y   t o   d e c i p h e r   t h e   d a t a   k e y ,   d e c i p h e r s   t h e   d a t a   k e y ,   a n d   f i n a l l y   r e c o v e r s   t h e   p l a i n   t e x t .   C o m m u n i c a t i o n   b e t w e e n   t h e   c o n t r o l   p l a n e   a n d   t h e   K M S   r e q u i r e s   i n - t r a n s i t   p r o t e c t i o n ,   s u c h   a s   T L S .   U s i n g   e n v e l o p e   e n c r y p t i o n   c r e a t e s   d e p e n d e n c e   o n   t h e   k e y   e n c r y p t i o n   k e y ,   w h i c h   i s   n o t   s t o r e d   i n   K u b e r n e t e s .   I n   t h e   K M S   c a s e ,   a n   a t t a c k e r   w h o   i n t e n d s   t o   g e t   u n a u t h o r i s e d   a c c e s s   t o   t h e   p l a i n t e x t   v a l u e s   w o u l d   n e e d   t o   c o m p r o m i s e   e t c d   a n d   t h e   t h i r d - p a r t y   K M S   p r o v i d e r .


Question: What is Protection for encryption keys?

Answer: Y o u   s h o u l d   t a k e   a p p r o p r i a t e   m e a s u r e s   t o   p r o t e c t   t h e   c o n f i d e n t i a l   i n f o r m a t i o n   t h a t   a l l o w s   d e c r y p t i o n ,   w h e t h e r   t h a t   i s   a   l o c a l   e n c r y p t i o n   k e y ,   o r   a n   a u t h e n t i c a t i o n   t o k e n   t h a t   a l l o w s   t h e   A P I   s e r v e r   t o   c a l l   K M S .   E v e n   w h e n   y o u   r e l y   o n   a   p r o v i d e r   t o   m a n a g e   t h e   u s e   a n d   l i f e c y c l e   o f   t h e   m a i n   e n c r y p t i o n   k e y   ( o r   k e y s ) ,   y o u   a r e   s t i l l   r e s p o n s i b l e   f o r   m a k i n g   s u r e   t h a t   a c c e s s   c o n t r o l s   a n d   o t h e r   s e c u r i t y   m e a s u r e s   f o r   t h e   m a n a g e d   e n c r y p t i o n   s e r v i c e   a r e   a p p r o p r i a t e   f o r   y o u r   s e c u r i t y   n e e d s .


Question: What is Generate the encryption key?

Answer: T h e   f o l l o w i n g   s t e p s   a s s u m e   t h a t   y o u   a r e   n o t   u s i n g   K M S ,   a n d   t h e r e f o r e   t h e   s t e p s   a l s o   a s s u m e   t h a t   y o u   n e e d   t o   g e n e r a t e   a n   e n c r y p t i o n   k e y .   I f   y o u   a l r e a d y   h a v e   a n   e n c r y p t i o n   k e y ,   s k i p   t o   W r i t e   a n   e n c r y p t i o n   c o n f i g u r a t i o n   f i l e .


Question: What is Caution:?

Answer: S t o r i n g   t h e   r a w   e n c r y p t i o n   k e y   i n   t h e   E n c r y p t i o n C o n f i g   o n l y   m o d e r a t e l y   i m p r o v e s   y o u r   s e c u r i t y   p o s t u r e ,   c o m p a r e d   t o   n o   e n c r y p t i o n .   F o r   a d d i t i o n a l   s e c r e c y ,   c o n s i d e r   u s i n g   t h e   k m s   p r o v i d e r   a s   t h i s   r e l i e s   o n   k e y s   h e l d   o u t s i d e   y o u r   K u b e r n e t e s   c l u s t e r .   I m p l e m e n t a t i o n s   o f   k m s   c a n   w o r k   w i t h   h a r d w a r e   s e c u r i t y   m o d u l e s   o r   w i t h   e n c r y p t i o n   s e r v i c e s   m a n a g e d   b y   y o u r   c l o u d   p r o v i d e r .   T o   l e a r n   a b o u t   s e t t i n g   u p   e n c r y p t i o n   a t   r e s t   u s i n g   K M S ,   s e e   U s i n g   a   K M S   p r o v i d e r   f o r   d a t a   e n c r y p t i o n .   T h e   K M S   p r o v i d e r   p l u g i n   t h a t   y o u   u s e   m a y   a l s o   c o m e   w i t h   a d d i t i o n a l   s p e c i f i c   d o c u m e n t a t i o n .   S t a r t   b y   g e n e r a t i n g   a   n e w   e n c r y p t i o n   k e y ,   a n d   t h e n   e n c o d e   i t   u s i n g   b a s e 6 4 :   G e n e r a t e   a   3 2 - b y t e   r a n d o m   k e y   a n d   b a s e 6 4   e n c o d e   i t .   Y o u   c a n   u s e   t h i s   c o m m a n d : h e a d   - c   3 2   / d e v / u r a n d o m   |   b a s e 6 4   Y o u   c a n   u s e   / d e v / h w r n g   i n s t e a d   o f   / d e v / u r a n d o m   i f   y o u   w a n t   t o   u s e   y o u r   P C ' s   b u i l t - i n   h a r d w a r e   e n t r o p y   s o u r c e .   N o t   a l l   L i n u x   d e v i c e s   p r o v i d e   a   h a r d w a r e   r a n d o m   g e n e r a t o r .   G e n e r a t e   a   3 2 - b y t e   r a n d o m   k e y   a n d   b a s e 6 4   e n c o d e   i t .   Y o u   c a n   u s e   t h i s   c o m m a n d :   h e a d


Question: What is Replicate the encryption key?

Answer: U s i n g   a   s e c u r e   m e c h a n i s m   f o r   f i l e   t r a n s f e r ,   m a k e   a   c o p y   o f   t h a t   e n c r y p t i o n   k e y   a v a i l a b l e   t o   e v e r y   o t h e r   c o n t r o l   p l a n e   h o s t .   A t   a   m i n i m u m ,   u s e   e n c r y p t i o n   i n   t r a n s i t   -   f o r   e x a m p l e ,   s e c u r e   s h e l l   ( S S H ) .   F o r   m o r e   s e c u r i t y ,   u s e   a s y m m e t r i c   e n c r y p t i o n   b e t w e e n   h o s t s ,   o r   c h a n g e   t h e   a p p r o a c h   y o u   a r e   u s i n g   s o   t h a t   y o u ' r e   r e l y i n g   o n   K M S   e n c r y p t i o n .


Question: What is Caution:?

Answer: C r e a t e   a   n e w   e n c r y p t i o n   c o n f i g u r a t i o n   f i l e .   T h e   c o n t e n t s   s h o u l d   b e   s i m i l a r   t o :   - - -   a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   E n c r y p t i o n C o n f i g u r a t i o n   r e s o u r c e s :   -   r e s o u r c e s :   -   s e c r e t s   -   c o n f i g m a p s   -   p a n d a s . a w e s o m e . b e a r s . e x a m p l e   p r o v i d e r s :   -   a e s c b c :   k e y s :   -   n a m e :   k e y 1   #   S e e   t h e   f o l l o w i n g   t e x t   f o r   m o r e   d e t a i l s   a b o u t   t h e   s e c r e t   v a l u e   s e c r e t :   < B A S E   6 4   E N C O D E D   S E C R E T >   -   i d e n t i t y :   { }   #   t h i s   f a l l b a c k   a l l o w s   r e a d i n g   u n e n c r y p t e d   s e c r e t s ;   #   f o r   e x a m p l e ,   d u r i n g   i n i t i a l   m i g r a t i o n   T o   c r e a t e   a   n e w   e n c r y p t i o n   k e y   ( t h a t   d o e s   n o t   u s e   K M S ) ,   s e e   G e n e r a t e   t h e   e n c r y p t i o n   k e y .


Question: What is Use the new encryption configuration file?

Answer: Y o u   w i l l   n e e d   t o   m o u n t   t h e   n e w   e n c r y p t i o n   c o n f i g   f i l e   t o   t h e   k u b e - a p i s e r v e r   s t a t i c   p o d .   H e r e   i s   a n   e x a m p l e   o n   h o w   t o   d o   t h a t :   S a v e   t h e   n e w   e n c r y p t i o n   c o n f i g   f i l e   t o   / e t c / k u b e r n e t e s / e n c / e n c . y a m l   o n   t h e   c o n t r o l - p l a n e   n o d e . E d i t   t h e   m a n i f e s t   f o r   t h e   k u b e - a p i s e r v e r   s t a t i c   p o d :   / e t c / k u b e r n e t e s / m a n i f e s t s / k u b e - a p i s e r v e r . y a m l   s o   t h a t   i t   i s   s i m i l a r   t o : - - -   #   #   T h i s   i s   a   f r a g m e n t   o f   a   m a n i f e s t   f o r   a   s t a t i c   P o d .   #   C h e c k   w h e t h e r   t h i s   i s   c o r r e c t   f o r   y o u r   c l u s t e r   a n d   f o r   y o u r   A P I   s e r v e r .   #   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   a n n o t a t i o n s :   k u b e a d m . k u b e r n e t e s . i o / k u b e - a p i s e r v e r . a d v e r t i s e - a d d r e s s . e n d p o i n t :   1 0 . 2 0 . 3 0 . 4 0 : 4 4 3   c r e a t i o n T i m e s t a m p :   n u l l   l a b e l s :   a p p . k u b e r n e t e s . i o / c o m p o n e n t :   k u b e - a p i s e r v e r   t i e r :   c o n t r o l - p l a n e   n a m e :   k u b e - a p i s e r v e r   n a m e s p a c e :   k u b e - s y s t e m   s p e c :   c o n t a i n e r s :   -   c o m m a n d :   -   k u b e - a p i s e r v e r   . . .   -   - - e n c r y p t i o n - p r o v i d e r - c o n f i g = / e t c / k u b e r n e t e s / e n c / e n c . y a m l   #   a d d   t h i s   l i n e   v o l u m e M o u n t s :   . . .   -   n a m e :   e n c   #   a d d   t h i s   l i n e   m o u n t P a t h :   / e t c / k u b e r n e t e s / e n c   #   a d d   t h i s   l i n e   r e a d O n l y :   t r u e   #   a d d   t h i s   l i n e   . .


Question: What is Caution:?

Answer: Y o u   n o w   h a v e   e n c r y p t i o n   i n   p l a c e   f o r   o n e   c o n t r o l   p l a n e   h o s t .   A   t y p i c a l   K u b e r n e t e s   c l u s t e r   h a s   m u l t i p l e   c o n t r o l   p l a n e   h o s t s ,   s o   t h e r e   i s   m o r e   t o   d o .


Question: What is Reconfigure other control plane hosts?

Answer: I f   y o u   h a v e   m u l t i p l e   A P I   s e r v e r s   i n   y o u r   c l u s t e r ,   y o u   s h o u l d   d e p l o y   t h e   c h a n g e s   i n   t u r n   t o   e a c h   A P I   s e r v e r .


Question: What is Caution:?

Answer: F o r   c l u s t e r   c o n f i g u r a t i o n s   w i t h   t w o   o r   m o r e   c o n t r o l   p l a n e   n o d e s ,   t h e   e n c r y p t i o n   c o n f i g u r a t i o n   s h o u l d   b e   i d e n t i c a l   a c r o s s   e a c h   c o n t r o l   p l a n e   n o d e .   I f   t h e r e   i s   a   d i f f e r e n c e   i n   t h e   e n c r y p t i o n   p r o v i d e r   c o n f i g u r a t i o n   b e t w e e n   c o n t r o l   p l a n e   n o d e s ,   t h i s   d i f f e r e n c e   m a y   m e a n   t h a t   t h e   k u b e - a p i s e r v e r   c a n ' t   d e c r y p t   d a t a .   W h e n   y o u   a r e   p l a n n i n g   t o   u p d a t e   t h e   e n c r y p t i o n   c o n f i g u r a t i o n   o f   y o u r   c l u s t e r ,   p l a n   t h i s   s o   t h a t   t h e   A P I   s e r v e r s   i n   y o u r   c o n t r o l   p l a n e   c a n   a l w a y s   d e c r y p t   t h e   s t o r e d   d a t a   ( e v e n   p a r t   w a y   t h r o u g h   r o l l i n g   o u t   t h e   c h a n g e ) .   M a k e   s u r e   t h a t   y o u   u s e   t h e   s a m e   e n c r y p t i o n   c o n f i g u r a t i o n   o n   e a c h   c o n t r o l   p l a n e   h o s t .


Question: What is Verify that newly written data is encrypted?

Answer: D a t a   i s   e n c r y p t e d   w h e n   w r i t t e n   t o   e t c d .   A f t e r   r e s t a r t i n g   y o u r   k u b e - a p i s e r v e r ,   a n y   n e w l y   c r e a t e d   o r   u p d a t e d   S e c r e t   ( o r   o t h e r   r e s o u r c e   k i n d s   c o n f i g u r e d   i n   E n c r y p t i o n C o n f i g u r a t i o n )   s h o u l d   b e   e n c r y p t e d   w h e n   s t o r e d .   T o   c h e c k   t h i s ,   y o u   c a n   u s e   t h e   e t c d c t l   c o m m a n d   l i n e   p r o g r a m   t o   r e t r i e v e   t h e   c o n t e n t s   o f   y o u r   s e c r e t   d a t a .   T h i s   e x a m p l e   s h o w s   h o w   t o   c h e c k   t h i s   f o r   e n c r y p t i n g   t h e   S e c r e t   A P I .   C r e a t e   a   n e w   S e c r e t   c a l l e d   s e c r e t 1   i n   t h e   d e f a u l t   n a m e s p a c e : k u b e c t l   c r e a t e   s e c r e t   g e n e r i c   s e c r e t 1   - n   d e f a u l t   - - f r o m - l i t e r a l = m y k e y = m y d a t a   U s i n g   t h e   e t c d c t l   c o m m a n d   l i n e   t o o l ,   r e a d   t h a t   S e c r e t   o u t   o f   e t c d : E T C D C T L _ A P I = 3   e t c d c t l   g e t   / r e g i s t r y / s e c r e t s / d e f a u l t / s e c r e t 1   [ . . . ]   |   h e x d u m p   - C   w h e r e   [ . . . ]   m u s t   b e   t h e   a d d i t i o n a l   a r g u m e n t s   f o r   c o n n e c t i n g   t o   t h e   e t c d   s e r v e r . F o r   e x a m p l e : E T C D C T L _ A P I = 3   e t c d c t l   \   - - c a c e r t = / e t c / k u b e r n e t e s / p k i / e t c d / c a . c r t   \   - - c e r t = / e t c / k u b e r n e t e s / p k i / e t c d / s e r v e r . c r t   \   - - k e y = / e t c / k u b e r n e t e s / p k i / e t c d / s e r v e r . k e y   \   g e t   / r e g i s t r y / s e c r e t s / d e f a u l t / s e c r e t 1   |   h e x d u m p   - C   T h e   o u t p u t   i s   s i m i l a r   t o   t h i s   ( a b b r


Question: What is Ensure all relevant data are encrypted?

Answer: I t ' s   o f t e n   n o t   e n o u g h   t o   m a k e   s u r e   t h a t   n e w   o b j e c t s   g e t   e n c r y p t e d :   y o u   a l s o   w a n t   t h a t   e n c r y p t i o n   t o   a p p l y   t o   t h e   o b j e c t s   t h a t   a r e   a l r e a d y   s t o r e d .   F o r   t h i s   e x a m p l e ,   y o u   h a v e   c o n f i g u r e d   y o u r   c l u s t e r   s o   t h a t   S e c r e t s   a r e   e n c r y p t e d   o n   w r i t e .   P e r f o r m i n g   a   r e p l a c e   o p e r a t i o n   f o r   e a c h   S e c r e t   w i l l   e n c r y p t   t h a t   c o n t e n t   a t   r e s t ,   w h e r e   t h e   o b j e c t s   a r e   u n c h a n g e d .   Y o u   c a n   m a k e   t h i s   c h a n g e   a c r o s s   a l l   S e c r e t s   i n   y o u r   c l u s t e r :   #   R u n   t h i s   a s   a n   a d m i n i s t r a t o r   t h a t   c a n   r e a d   a n d   w r i t e   a l l   S e c r e t s   k u b e c t l   g e t   s e c r e t s   - - a l l - n a m e s p a c e s   - o   j s o n   |   k u b e c t l   r e p l a c e   - f   -   T h e   c o m m a n d   a b o v e   r e a d s   a l l   S e c r e t s   a n d   t h e n   u p d a t e s   t h e m   w i t h   t h e   s a m e   d a t a ,   i n   o r d e r   t o   a p p l y   s e r v e r   s i d e   e n c r y p t i o n .


Question: What is Note:?

Answer: I f   a n   e r r o r   o c c u r s   d u e   t o   a   c o n f l i c t i n g   w r i t e ,   r e t r y   t h e   c o m m a n d .   I t   i s   s a f e   t o   r u n   t h a t   c o m m a n d   m o r e   t h a n   o n c e .   F o r   l a r g e r   c l u s t e r s ,   y o u   m a y   w i s h   t o   s u b d i v i d e   t h e   S e c r e t s   b y   n a m e s p a c e ,   o r   s c r i p t   a n   u p d a t e .


Question: What is Prevent plain text retrieval?

Answer: I f   y o u   w a n t   t o   m a k e   s u r e   t h a t   t h e   o n l y   a c c e s s   t o   a   p a r t i c u l a r   A P I   k i n d   i s   d o n e   u s i n g   e n c r y p t i o n ,   y o u   c a n   r e m o v e   t h e   A P I   s e r v e r ' s   a b i l i t y   t o   r e a d   t h a t   A P I ' s   b a c k i n g   d a t a   a s   p l a i n t e x t .


Question: What is Warning:?

Answer: M a k i n g   t h i s   c h a n g e   p r e v e n t s   t h e   A P I   s e r v e r   f r o m   r e t r i e v i n g   r e s o u r c e s   t h a t   a r e   m a r k e d   a s   e n c r y p t e d   a t   r e s t ,   b u t   a r e   a c t u a l l y   s t o r e d   i n   t h e   c l e a r .   W h e n   y o u   h a v e   c o n f i g u r e d   e n c r y p t i o n   a t   r e s t   f o r   a n   A P I   ( f o r   e x a m p l e :   t h e   A P I   k i n d   S e c r e t ,   r e p r e s e n t i n g   s e c r e t s   r e s o u r c e s   i n   t h e   c o r e   A P I   g r o u p ) ,   y o u   m u s t   e n s u r e   t h a t   a l l   t h o s e   r e s o u r c e s   i n   t h i s   c l u s t e r   r e a l l y   a r e   e n c r y p t e d   a t   r e s t .   C h e c k   t h i s   b e f o r e   y o u   c a r r y   o n   w i t h   t h e   n e x t   s t e p s .   O n c e   a l l   S e c r e t s   i n   y o u r   c l u s t e r   a r e   e n c r y p t e d ,   y o u   c a n   r e m o v e   t h e   i d e n t i t y   p a r t   o f   t h e   e n c r y p t i o n   c o n f i g u r a t i o n .   F o r   e x a m p l e :   - - -   a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   E n c r y p t i o n C o n f i g u r a t i o n   r e s o u r c e s :   -   r e s o u r c e s :   -   s e c r e t s   p r o v i d e r s :   -   a e s c b c :   k e y s :   -   n a m e :   k e y 1   s e c r e t :   < B A S E   6 4   E N C O D E D   S E C R E T >   -   i d e n t i t y :   { }   #   R E M O V E   T H I S   L I N E   … a n d   t h e n   r e s t a r t   e a c h   A P I   s e r v e r   i n   t u r n .   T h i s   c h a n g e   p r e v e n t s   t h e   A P I   s e r v e r   f r o m   a c c e s s i n g   a   p l a i n - t e x t   S e c r e t ,   e v e n   b y   a c c i d e n t .


Question: What is Rotate a decryption key?

Answer: C h a n g i n g   a n   e n c r y p t i o n   k e y   f o r   K u b e r n e t e s   w i t h o u t   i n c u r r i n g   d o w n t i m e   r e q u i r e s   a   m u l t i - s t e p   o p e r a t i o n ,   e s p e c i a l l y   i n   t h e   p r e s e n c e   o f   a   h i g h l y - a v a i l a b l e   d e p l o y m e n t   w h e r e   m u l t i p l e   k u b e - a p i s e r v e r   p r o c e s s e s   a r e   r u n n i n g .   G e n e r a t e   a   n e w   k e y   a n d   a d d   i t   a s   t h e   s e c o n d   k e y   e n t r y   f o r   t h e   c u r r e n t   p r o v i d e r   o n   a l l   c o n t r o l   p l a n e   n o d e s . R e s t a r t   a l l   k u b e - a p i s e r v e r   p r o c e s s e s ,   t o   e n s u r e   e a c h   s e r v e r   c a n   d e c r y p t   a n y   d a t a   t h a t   a r e   e n c r y p t e d   w i t h   t h e   n e w   k e y . M a k e   a   s e c u r e   b a c k u p   o f   t h e   n e w   e n c r y p t i o n   k e y .   I f   y o u   l o s e   a l l   c o p i e s   o f   t h i s   k e y   y o u   w o u l d   n e e d   t o   d e l e t e   a l l   t h e   r e s o u r c e s   w e r e   e n c r y p t e d   u n d e r   t h e   l o s t   k e y ,   a n d   w o r k l o a d s   m a y   n o t   o p e r a t e   a s   e x p e c t e d   d u r i n g   t h e   t i m e   t h a t   a t - r e s t   e n c r y p t i o n   i s   b r o k e n . M a k e   t h e   n e w   k e y   t h e   f i r s t   e n t r y   i n   t h e   k e y s   a r r a y   s o   t h a t   i t   i s   u s e d   f o r   e n c r y p t i o n - a t - r e s t   f o r   n e w   w r i t e s R e s t a r t   a l l   k u b e - a p i s e r v e r   p r o c e s s e s   t o   e n s u r e   e a c h   c o n t r o l   p l a n e   h o s t   n o w   e n c r y p t s   u s i n g   t h e   n e w   k e y A s   a   p r i v i l e g e d   u s e r ,   r u n   k u b e c t l   g e t   s e c r e t s   - - a l l - n a m e s p a c e s   - o   j s o n   |   k u b e c t l   r e p l a c e   - f   -   t o   e n c r


Question: What is Decrypt all data?

Answer: T h i s   e x a m p l e   s h o w s   h o w   t o   s t o p   e n c r y p t i n g   t h e   S e c r e t   A P I   a t   r e s t .   I f   y o u   a r e   e n c r y p t i n g   o t h e r   A P I   k i n d s ,   a d j u s t   t h e   s t e p s   t o   m a t c h .   T o   d i s a b l e   e n c r y p t i o n   a t   r e s t ,   p l a c e   t h e   i d e n t i t y   p r o v i d e r   a s   t h e   f i r s t   e n t r y   i n   y o u r   e n c r y p t i o n   c o n f i g u r a t i o n   f i l e :   - - -   a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   E n c r y p t i o n C o n f i g u r a t i o n   r e s o u r c e s :   -   r e s o u r c e s :   -   s e c r e t s   #   l i s t   a n y   o t h e r   r e s o u r c e s   h e r e   t h a t   y o u   p r e v i o u s l y   w e r e   #   e n c r y p t i n g   a t   r e s t   p r o v i d e r s :   -   i d e n t i t y :   { }   #   a d d   t h i s   l i n e   -   a e s c b c :   k e y s :   -   n a m e :   k e y 1   s e c r e t :   < B A S E   6 4   E N C O D E D   S E C R E T >   #   k e e p   t h i s   i n   p l a c e   #   m a k e   s u r e   i t   c o m e s   a f t e r   " i d e n t i t y "   T h e n   r u n   t h e   f o l l o w i n g   c o m m a n d   t o   f o r c e   d e c r y p t i o n   o f   a l l   S e c r e t s :   k u b e c t l   g e t   s e c r e t s   - - a l l - n a m e s p a c e s   - o   j s o n   |   k u b e c t l   r e p l a c e   - f   -   O n c e   y o u   h a v e   r e p l a c e d   a l l   e x i s t i n g   e n c r y p t e d   r e s o u r c e s   w i t h   b a c k i n g   d a t a   t h a t   d o n ' t   u s e   e n c r y p t i o n ,   y o u   c a n   r e m o v e   t h e   e n c r y p t i o n   s e t t i n g s   f r o m   t h e   k u b e - a p i s e r v e r .


Question: What is Configure automatic reloading?

Answer: Y o u   c a n   c o n f i g u r e   a u t o m a t i c   r e l o a d i n g   o f   e n c r y p t i o n   p r o v i d e r   c o n f i g u r a t i o n .   T h a t   s e t t i n g   d e t e r m i n e s   w h e t h e r   t h e   A P I   s e r v e r   s h o u l d   l o a d   t h e   f i l e   y o u   s p e c i f y   f o r   - - e n c r y p t i o n - p r o v i d e r - c o n f i g   o n l y   o n c e   a t   s t a r t u p ,   o r   a u t o m a t i c a l l y   w h e n e v e r   y o u   c h a n g e   t h a t   f i l e .   E n a b l i n g   t h i s   o p t i o n   a l l o w s   y o u   t o   c h a n g e   t h e   k e y s   f o r   e n c r y p t i o n   a t   r e s t   w i t h o u t   r e s t a r t i n g   t h e   A P I   s e r v e r .   T o   a l l o w   a u t o m a t i c   r e l o a d i n g ,   c o n f i g u r e   t h e   A P I   s e r v e r   t o   r u n   w i t h :   - - e n c r y p t i o n - p r o v i d e r - c o n f i g - a u t o m a t i c - r e l o a d = t r u e .   W h e n   e n a b l e d ,   f i l e   c h a n g e s   a r e   p o l l e d   e v e r y   m i n u t e   t o   o b s e r v e   t h e   m o d i f i c a t i o n s .   T h e   a p i s e r v e r _ e n c r y p t i o n _ c o n f i g _ c o n t r o l l e r _ a u t o m a t i c _ r e l o a d _ l a s t _ t i m e s t a m p _ s e c o n d s   m e t r i c   i d e n t i f i e s   w h e n   t h e   n e w   c o n f i g   b e c o m e s   e f f e c t i v e .   T h i s   a l l o w s   e n c r y p t i o n   k e y s   t o   b e   r o t a t e d   w i t h o u t   r e s t a r t i n g   t h e   A P I   s e r v e r .


Question: What is What's next?

Answer: R e a d   a b o u t   d e c r y p t i n g   d a t a   t h a t   a r e   a l r e a d y   s t o r e d   a t   r e s t L e a r n   m o r e   a b o u t   t h e   E n c r y p t i o n C o n f i g u r a t i o n   c o n f i g u r a t i o n   A P I   ( v 1 ) .