Question: What is Before you begin?

Answer: Y o u   s h o u l d   a l r e a d y   b e   f a m i l i a r   w i t h   t h e   b a s i c ,   n o n - p a r a l l e l ,   u s e   o f   J o b .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 2 1 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o


Question: What is Choose an approach?

Answer: T o   a c c e s s   t h e   w o r k   i t e m   f r o m   t h e   w o r k e r   p r o g r a m ,   y o u   h a v e   a   f e w   o p t i o n s :   R e a d   t h e   J O B _ C O M P L E T I O N _ I N D E X   e n v i r o n m e n t   v a r i a b l e .   T h e   J o b   c o n t r o l l e r   a u t o m a t i c a l l y   l i n k s   t h i s   v a r i a b l e   t o   t h e   a n n o t a t i o n   c o n t a i n i n g   t h e   c o m p l e t i o n   i n d e x . R e a d   a   f i l e   t h a t   c o n t a i n s   t h e   c o m p l e t i o n   i n d e x . A s s u m i n g   t h a t   y o u   c a n ' t   m o d i f y   t h e   p r o g r a m ,   y o u   c a n   w r a p   i t   w i t h   a   s c r i p t   t h a t   r e a d s   t h e   i n d e x   u s i n g   a n y   o f   t h e   m e t h o d s   a b o v e   a n d   c o n v e r t s   i t   i n t o   s o m e t h i n g   t h a t   t h e   p r o g r a m   c a n   u s e   a s   i n p u t .   F o r   t h i s   e x a m p l e ,   i m a g i n e   t h a t   y o u   c h o s e   o p t i o n   3   a n d   y o u   w a n t   t o   r u n   t h e   r e v   u t i l i t y .   T h i s   p r o g r a m   a c c e p t s   a   f i l e   a s   a n   a r g u m e n t   a n d   p r i n t s   i t s   c o n t e n t   r e v e r s e d .   r e v   d a t a . t x t   Y o u ' l l   u s e   t h e   r e v   t o o l   f r o m   t h e   b u s y b o x   c o n t a i n e r   i m a g e .   A s   t h i s   i s   o n l y   a n   e x a m p l e ,   e a c h   P o d   o n l y   d o e s   a   t i n y   p i e c e   o f   w o r k   ( r e v e r s i n g   a   s h o r t   s t r i n g ) .   I n   a   r e a l   w o r k l o a d   y o u   m i g h t ,   f o r   e x a m p l e ,   c r e a t e   a   J o b   t h a t   r e p r e s e n t s   t h e   t a s k   o f   p r o d u c i n g   6 0   s e c o n d s   o f   v i d e o   b a s e d   o n   s c e n e   d a t a .   E a c h   w o r k   i t e m   i n   t h e   v i d e o   r e n d e r i n g   J o b   w o u l d   b e   t o   r e n d e r   a   p a r t i


Question: What is Define an Indexed Job?

Answer: H e r e   i s   a   s a m p l e   J o b   m a n i f e s t   t h a t   u s e s   I n d e x e d   c o m p l e t i o n   m o d e :   a p i V e r s i o n :   b a t c h / v 1   k i n d :   J o b   m e t a d a t a :   n a m e :   ' i n d e x e d - j o b '   s p e c :   c o m p l e t i o n s :   5   p a r a l l e l i s m :   3   c o m p l e t i o n M o d e :   I n d e x e d   t e m p l a t e :   s p e c :   r e s t a r t P o l i c y :   N e v e r   i n i t C o n t a i n e r s :   -   n a m e :   ' i n p u t '   i m a g e :   ' d o c k e r . i o / l i b r a r y / b a s h '   c o m m a n d :   -   " b a s h "   -   " - c "   -   |   i t e m s = ( f o o   b a r   b a z   q u x   x y z )   e c h o   $ { i t e m s [ $ J O B _ C O M P L E T I O N _ I N D E X ] }   >   / i n p u t / d a t a . t x t   v o l u m e M o u n t s :   -   m o u n t P a t h :   / i n p u t   n a m e :   i n p u t   c o n t a i n e r s :   -   n a m e :   ' w o r k e r '   i m a g e :   ' d o c k e r . i o / l i b r a r y / b u s y b o x '   c o m m a n d :   -   " r e v "   -   " / i n p u t / d a t a . t x t "   v o l u m e M o u n t s :   -   m o u n t P a t h :   / i n p u t   n a m e :   i n p u t   v o l u m e s :   -   n a m e :   i n p u t   e m p t y D i r :   { }   I n   t h e   e x a m p l e   a b o v e ,   y o u   u s e   t h e   b u i l t i n   J O B _ C O M P L E T I O N _ I N D E X   e n v i r o n m e n t   v a r i a b l e   s e t   b y   t h e   J o b   c o n t r o l l e r   f o r   a l l   c o n t a i n e r s .   A n   i n i t   c o n t a i n e r   m a p s   t h e   i n d e x   t o   a   s t a t i c   v a l u e   a n d   w r i t e s   i t   t o   a   f i l e   t h a t   i s   s h a r e d   w i t h   t h e   c o n t a i n e r   r u n n i n g   t h e   w o r k e r   t h r o u g h   a n   e m p t y D i r   v o l u m e .   O p t i o n a l l y ,   y o u   c a n   d e f i n e   y o u r   o w n   e n v i r o n m e n t   v a r i a b l e   t h r o u g h   t h e   d o w n w a r d   A P I   t o   p


Question: What is Running the Job?

Answer: N o w   r u n   t h e   J o b :   #   T h i s   u s e s   t h e   f i r s t   a p p r o a c h   ( r e l y i n g   o n   $ J O B _ C O M P L E T I O N _ I N D E X )   k u b e c t l   a p p l y   - f   h t t p s : / / k u b e r n e t e s . i o / e x a m p l e s / a p p l i c a t i o n / j o b / i n d e x e d - j o b . y a m l   W h e n   y o u   c r e a t e   t h i s   J o b ,   t h e   c o n t r o l   p l a n e   c r e a t e s   a   s e r i e s   o f   P o d s ,   o n e   f o r   e a c h   i n d e x   y o u   s p e c i f i e d .   T h e   v a l u e   o f   . s p e c . p a r a l l e l i s m   d e t e r m i n e s   h o w   m a n y   c a n   r u n   a t   o n c e   w h e r e a s   . s p e c . c o m p l e t i o n s   d e t e r m i n e s   h o w   m a n y   P o d s   t h e   J o b   c r e a t e s   i n   t o t a l .   B e c a u s e   . s p e c . p a r a l l e l i s m   i s   l e s s   t h a n   . s p e c . c o m p l e t i o n s ,   t h e   c o n t r o l   p l a n e   w a i t s   f o r   s o m e   o f   t h e   f i r s t   P o d s   t o   c o m p l e t e   b e f o r e   s t a r t i n g   m o r e   o f   t h e m .   Y o u   c a n   w a i t   f o r   t h e   J o b   t o   s u c c e e d ,   w i t h   a   t i m e o u t :   #   T h e   c h e c k   f o r   c o n d i t i o n   n a m e   i s   c a s e   i n s e n s i t i v e   k u b e c t l   w a i t   - - f o r = c o n d i t i o n = c o m p l e t e   - - t i m e o u t = 3 0 0 s   j o b / i n d e x e d - j o b   N o w ,   d e s c r i b e   t h e   J o b   a n d   c h e c k   t h a t   i t   w a s   s u c c e s s f u l .   k u b e c t l   d e s c r i b e   j o b s / i n d e x e d - j o b   T h e   o u t p u t   i s   s i m i l a r   t o :   N a m e :   i n d e x e d - j o b   N a m e s p a c e :   d e f a u l t   S e l e c t o r :   c o n t r o l l e r - u i d = b f 8 6 5 e 0 4 - 0 b 6 7 - 4 8 3 b - 9 a 9 0 - 7 4 c f c 4 c 3 e 7 5 6   L a b e l s :   c o n t r o l l e r - u i d = b f 8 6 5 e 0 4 - 0 b 6 7 - 4 8 3 b - 9 a 9 0 - 7 4


Question: What is Pod Security Admission?

Answer: Pod Security AdmissionAn overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.FEATURE STATE: Kubernetes v1.25 [stable]The Kubernetes Pod Security Standards define different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion.Kubernetes offers a built-in Pod Security admission controller to enforce the Pod Security Standards. Pod security restrictions are applied at the namespace level when pods are created.Built-in Pod Security admission enforcementThis page is part of the documentation for Kubernetes v1.34. If you are running a different version of Kubernetes, consult the documentation for that release.Pod Security levelsPod Security admission places requirements on a Pod's Security Context and other related fields according to the three levels defined by the Pod Security Standards: privileged, baseline, and restricted. Refer to the Pod Security Standards page for an in-depth look at those requirements.Pod Security Admission labels for namespacesOnce the feature is enabled or the webhook is installed, you can configure namespaces to define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of labels that you can set to define which of the predefined Pod Security Standard levels you want to use for a namespace. The label you select defines what action the control plane takes if a potential violation is detected:Pod Security Admission modesModeDescriptionenforcePolicy violations will cause the pod to be rejected.auditPolicy violations will trigger the addition of an audit annotation to the event recorded in the audit log, but are otherwise allowed.warnPolicy violations will trigger a user-facing warning, but are otherwise allowed.A namespace can configure any or all modes, or even set a different level for different modes.For each mode, there are two labels that determine the policy used:# The per-mode level label indicates which policy level to apply for the mode. # # MODE must be one of `enforce`, `audit`, or `warn`. # LEVEL must be one of `privileged`, `baseline`, or `restricted`. pod-security.kubernetes.io/<MODE>: <LEVEL> # Optional: per-mode version label that can be used to pin the policy to the # version that shipped with a given Kubernetes minor version (for example v1.34). # # MODE must be one of `enforce`, `audit`, or `warn`. # VERSION must be a valid Kubernetes minor version, or `latest`. pod-security.kubernetes.io/<MODE>-version: <VERSION> Check out Enforce Pod Security Standards with Namespace Labels to see example usage.Workload resources and Pod templatesPods are often created indirectly, by creating a workload object such as a Deployment or Job. The workload object defines a Pod template and a controller for the workload resource creates Pods based on that template. To help catch violations early, both the audit and warning modes are applied to the workloa


Question: How does Pod Security Admission work?

Answer: Pod Security AdmissionAn overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.FEATURE STATE: Kubernetes v1.25 [stable]The Kubernetes Pod Security Standards define different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion.Kubernetes offers a built-in Pod Security admission controller to enforce the Pod Security Standards. Pod security restrictions are applied at the namespace level when pods are created.Built-in Pod Security admission enforcementThis page is part of the documentation for Kubernetes v1.34. If you are running a different version of Kubernetes, consult the documentation for that release.Pod Security levelsPod Security admission places requirements on a Pod's Security Context and other related fields according to the three levels defined by the Pod Security Standards: privileged, baseline, and restricted. Refer to the Pod Security Standards page for an in-depth look at those requirements.Pod Security Admission labels for namespacesOnce the feature is enabled or the webhook is installed, you can configure namespaces to define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of labels that you can set to define which of the predefined Pod Security Standard levels you want to use for a namespace. The label you select defines what action the control plane takes if a potential violation is detected:Pod Security Admission modesModeDescriptionenforcePolicy violations will cause the pod to be rejected.auditPolicy violations will trigger the addition of an audit annotation to the event recorded in the audit log, but are otherwise allowed.warnPolicy violations will trigger a user-facing warning, but are otherwise allowed.A namespace can configure any or all modes, or even set a different level for different modes.For each mode, there are two labels that determine the policy used:# The per-mode level label indicates which policy level to apply for the mode. # # MODE must be one of `enforce`, `audit`, or `warn`. # LEVEL must be one of `privileged`, `baseline`, or `restricted`. pod-security.kubernetes.io/<MODE>: <LEVEL> # Optional: per-mode version label that can be used to pin the policy to the # version that shipped with a given Kubernetes minor version (for example v1.34). # # MODE must be one of `enforce`, `audit`, or `warn`. # VERSION must be a valid Kubernetes minor version, or `latest`. pod-security.kubernetes.io/<MODE>-version: <VERSION> Check out Enforce Pod Security Standards with Namespace Labels to see example usage.Workload resources and Pod templatesPods are often created indirectly, by creating a workload object such as a Deployment or Job. The workload object defines a Pod template and a controller for the workload resource creates Pods based on that template. To help catch violations early, both the audit and warning modes are applied to the workloa


Question: When would you use Pod Security Admission?

Answer: Pod Security AdmissionAn overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.FEATURE STATE: Kubernetes v1.25 [stable]The Kubernetes Pod Security Standards define different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion.Kubernetes offers a built-in Pod Security admission controller to enforce the Pod Security Standards. Pod security restrictions are applied at the namespace level when pods are created.Built-in Pod Security admission enforcementThis page is part of the documentation for Kubernetes v1.34. If you are running a different version of Kubernetes, consult the documentation for that release.Pod Security levelsPod Security admission places requirements on a Pod's Security Context and other related fields according to the three levels defined by the Pod Security Standards: privileged, baseline, and restricted. Refer to the Pod Security Standards page for an in-depth look at those requirements.Pod Security Admission labels for namespacesOnce the feature is enabled or the webhook is installed, you can configure namespaces to define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of labels that you can set to define which of the predefined Pod Security Standard levels you want to use for a namespace. The label you select defines what action the control plane takes if a potential violation is detected:Pod Security Admission modesModeDescriptionenforcePolicy violations will cause the pod to be rejected.auditPolicy violations will trigger the addition of an audit annotation to the event recorded in the audit log, but are otherwise allowed.warnPolicy violations will trigger a user-facing warning, but are otherwise allowed.A namespace can configure any or all modes, or even set a different level for different modes.For each mode, there are two labels that determine the policy used:# The per-mode level label indicates which policy level to apply for the mode. # # MODE must be one of `enforce`, `audit`, or `warn`. # LEVEL must be one of `privileged`, `baseline`, or `restricted`. pod-security.kubernetes.io/<MODE>: <LEVEL> # Optional: per-mode version label that can be used to pin the policy to the # version that shipped with a given Kubernetes minor version (for example v1.34). # # MODE must be one of `enforce`, `audit`, or `warn`. # VERSION must be a valid Kubernetes minor version, or `latest`. pod-security.kubernetes.io/<MODE>-version: <VERSION> Check out Enforce Pod Security Standards with Namespace Labels to see example usage.Workload resources and Pod templatesPods are often created indirectly, by creating a workload object such as a Deployment or Job. The workload object defines a Pod template and a controller for the workload resource creates Pods based on that template. To help catch violations early, both the audit and warning modes are applied to the workloa


Question: What are the benefits of Pod Security Admission?

Answer: Pod Security AdmissionAn overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.FEATURE STATE: Kubernetes v1.25 [stable]The Kubernetes Pod Security Standards define different isolation levels for Pods. These standards let you define how you want to restrict the behavior of pods in a clear, consistent fashion.Kubernetes offers a built-in Pod Security admission controller to enforce the Pod Security Standards. Pod security restrictions are applied at the namespace level when pods are created.Built-in Pod Security admission enforcementThis page is part of the documentation for Kubernetes v1.34. If you are running a different version of Kubernetes, consult the documentation for that release.Pod Security levelsPod Security admission places requirements on a Pod's Security Context and other related fields according to the three levels defined by the Pod Security Standards: privileged, baseline, and restricted. Refer to the Pod Security Standards page for an in-depth look at those requirements.Pod Security Admission labels for namespacesOnce the feature is enabled or the webhook is installed, you can configure namespaces to define the admission control mode you want to use for pod security in each namespace. Kubernetes defines a set of labels that you can set to define which of the predefined Pod Security Standard levels you want to use for a namespace. The label you select defines what action the control plane takes if a potential violation is detected:Pod Security Admission modesModeDescriptionenforcePolicy violations will cause the pod to be rejected.auditPolicy violations will trigger the addition of an audit annotation to the event recorded in the audit log, but are otherwise allowed.warnPolicy violations will trigger a user-facing warning, but are otherwise allowed.A namespace can configure any or all modes, or even set a different level for different modes.For each mode, there are two labels that determine the policy used:# The per-mode level label indicates which policy level to apply for the mode. # # MODE must be one of `enforce`, `audit`, or `warn`. # LEVEL must be one of `privileged`, `baseline`, or `restricted`. pod-security.kubernetes.io/<MODE>: <LEVEL> # Optional: per-mode version label that can be used to pin the policy to the # version that shipped with a given Kubernetes minor version (for example v1.34). # # MODE must be one of `enforce`, `audit`, or `warn`. # VERSION must be a valid Kubernetes minor version, or `latest`. pod-security.kubernetes.io/<MODE>-version: <VERSION> Check out Enforce Pod Security Standards with Namespace Labels to see example usage.Workload resources and Pod templatesPods are often created indirectly, by creating a workload object such as a Deployment or Job. The workload object defines a Pod template and a controller for the workload resource creates Pods based on that template. To help catch violations early, both the audit and warning modes are applied to the workloa


Question: What is Pod Security Admission?

Answer: T h e   K u b e r n e t e s   P o d   S e c u r i t y   S t a n d a r d s   d e f i n e   d i f f e r e n t   i s o l a t i o n   l e v e l s   f o r   P o d s .   T h e s e   s t a n d a r d s   l e t   y o u   d e f i n e   h o w   y o u   w a n t   t o   r e s t r i c t   t h e   b e h a v i o r   o f   p o d s   i n   a   c l e a r ,   c o n s i s t e n t   f a s h i o n .   K u b e r n e t e s   o f f e r s   a   b u i l t - i n   P o d   S e c u r i t y   a d m i s s i o n   c o n t r o l l e r   t o   e n f o r c e   t h e   P o d   S e c u r i t y   S t a n d a r d s .   P o d   s e c u r i t y   r e s t r i c t i o n s   a r e   a p p l i e d   a t   t h e   n a m e s p a c e   l e v e l   w h e n   p o d s   a r e   c r e a t e d .


Question: What is Built-in Pod Security admission enforcement?

Answer: T h i s   p a g e   i s   p a r t   o f   t h e   d o c u m e n t a t i o n   f o r   K u b e r n e t e s   v 1 . 3 4 .   I f   y o u   a r e   r u n n i n g   a   d i f f e r e n t   v e r s i o n   o f   K u b e r n e t e s ,   c o n s u l t   t h e   d o c u m e n t a t i o n   f o r   t h a t   r e l e a s e .


Question: What is Pod Security levels?

Answer: P o d   S e c u r i t y   a d m i s s i o n   p l a c e s   r e q u i r e m e n t s   o n   a   P o d ' s   S e c u r i t y   C o n t e x t   a n d   o t h e r   r e l a t e d   f i e l d s   a c c o r d i n g   t o   t h e   t h r e e   l e v e l s   d e f i n e d   b y   t h e   P o d   S e c u r i t y   S t a n d a r d s :   p r i v i l e g e d ,   b a s e l i n e ,   a n d   r e s t r i c t e d .   R e f e r   t o   t h e   P o d   S e c u r i t y   S t a n d a r d s   p a g e   f o r   a n   i n - d e p t h   l o o k   a t   t h o s e   r e q u i r e m e n t s .


Question: What is Pod Security Admission labels for namespaces?

Answer: O n c e   t h e   f e a t u r e   i s   e n a b l e d   o r   t h e   w e b h o o k   i s   i n s t a l l e d ,   y o u   c a n   c o n f i g u r e   n a m e s p a c e s   t o   d e f i n e   t h e   a d m i s s i o n   c o n t r o l   m o d e   y o u   w a n t   t o   u s e   f o r   p o d   s e c u r i t y   i n   e a c h   n a m e s p a c e .   K u b e r n e t e s   d e f i n e s   a   s e t   o f   l a b e l s   t h a t   y o u   c a n   s e t   t o   d e f i n e   w h i c h   o f   t h e   p r e d e f i n e d   P o d   S e c u r i t y   S t a n d a r d   l e v e l s   y o u   w a n t   t o   u s e   f o r   a   n a m e s p a c e .   T h e   l a b e l   y o u   s e l e c t   d e f i n e s   w h a t   a c t i o n   t h e   c o n t r o l   p l a n e   t a k e s   i f   a   p o t e n t i a l   v i o l a t i o n   i s   d e t e c t e d :   A   n a m e s p a c e   c a n   c o n f i g u r e   a n y   o r   a l l   m o d e s ,   o r   e v e n   s e t   a   d i f f e r e n t   l e v e l   f o r   d i f f e r e n t   m o d e s .   F o r   e a c h   m o d e ,   t h e r e   a r e   t w o   l a b e l s   t h a t   d e t e r m i n e   t h e   p o l i c y   u s e d :   #   T h e   p e r - m o d e   l e v e l   l a b e l   i n d i c a t e s   w h i c h   p o l i c y   l e v e l   t o   a p p l y   f o r   t h e   m o d e .   #   #   M O D E   m u s t   b e   o n e   o f   ` e n f o r c e ` ,   ` a u d i t ` ,   o r   ` w a r n ` .   #   L E V E L   m u s t   b e   o n e   o f   ` p r i v i l e g e d ` ,   ` b a s e l i n e ` ,   o r   ` r e s t r i c t e d ` .   p o d - s e c u r i t y . k u b e r n e t e s . i o / < M O D E > :   < L E V E L >   #   O p t i o n a l :   p e r - m o d e   v e r s i o n   l a b e l   t h a t   c a n   b e   u s e d   t o   p i n   t h e   p o l i c y   t o   t h e   #   v e r s i o n   t h a t   s h i p p e d   w i t h   a   g i v e n   K u b e r n e t e s   m i n o r   v e r s i o n   ( f o r   e x a m p l e   v 1 . 3 4 ) .   #   #   M O D E


Question: What is Workload resources and Pod templates?

Answer: P o d s   a r e   o f t e n   c r e a t e d   i n d i r e c t l y ,   b y   c r e a t i n g   a   w o r k l o a d   o b j e c t   s u c h   a s   a   D e p l o y m e n t   o r   J o b .   T h e   w o r k l o a d   o b j e c t   d e f i n e s   a   P o d   t e m p l a t e   a n d   a   c o n t r o l l e r   f o r   t h e   w o r k l o a d   r e s o u r c e   c r e a t e s   P o d s   b a s e d   o n   t h a t   t e m p l a t e .   T o   h e l p   c a t c h   v i o l a t i o n s   e a r l y ,   b o t h   t h e   a u d i t   a n d   w a r n i n g   m o d e s   a r e   a p p l i e d   t o   t h e   w o r k l o a d   r e s o u r c e s .   H o w e v e r ,   e n f o r c e   m o d e   i s   n o t   a p p l i e d   t o   w o r k l o a d   r e s o u r c e s ,   o n l y   t o   t h e   r e s u l t i n g   p o d   o b j e c t s .


Question: What is Exemptions?

Answer: Y o u   c a n   d e f i n e   e x e m p t i o n s   f r o m   p o d   s e c u r i t y   e n f o r c e m e n t   i n   o r d e r   t o   a l l o w   t h e   c r e a t i o n   o f   p o d s   t h a t   w o u l d   h a v e   o t h e r w i s e   b e e n   p r o h i b i t e d   d u e   t o   t h e   p o l i c y   a s s o c i a t e d   w i t h   a   g i v e n   n a m e s p a c e .   E x e m p t i o n s   c a n   b e   s t a t i c a l l y   c o n f i g u r e d   i n   t h e   A d m i s s i o n   C o n t r o l l e r   c o n f i g u r a t i o n .   E x e m p t i o n s   m u s t   b e   e x p l i c i t l y   e n u m e r a t e d .   R e q u e s t s   m e e t i n g   e x e m p t i o n   c r i t e r i a   a r e   i g n o r e d   b y   t h e   A d m i s s i o n   C o n t r o l l e r   ( a l l   e n f o r c e ,   a u d i t   a n d   w a r n   b e h a v i o r s   a r e   s k i p p e d ) .   E x e m p t i o n   d i m e n s i o n s   i n c l u d e :   U s e r n a m e s :   r e q u e s t s   f r o m   u s e r s   w i t h   a n   e x e m p t   a u t h e n t i c a t e d   ( o r   i m p e r s o n a t e d )   u s e r n a m e   a r e   i g n o r e d . R u n t i m e C l a s s N a m e s :   p o d s   a n d   w o r k l o a d   r e s o u r c e s   s p e c i f y i n g   a n   e x e m p t   r u n t i m e   c l a s s   n a m e   a r e   i g n o r e d . N a m e s p a c e s :   p o d s   a n d   w o r k l o a d   r e s o u r c e s   i n   a n   e x e m p t   n a m e s p a c e   a r e   i g n o r e d .


Question: What is Caution:?

Answer: U p d a t e s   t o   t h e   f o l l o w i n g   p o d   f i e l d s   a r e   e x e m p t   f r o m   p o l i c y   c h e c k s ,   m e a n i n g   t h a t   i f   a   p o d   u p d a t e   r e q u e s t   o n l y   c h a n g e s   t h e s e   f i e l d s ,   i t   w i l l   n o t   b e   d e n i e d   e v e n   i f   t h e   p o d   i s   i n   v i o l a t i o n   o f   t h e   c u r r e n t   p o l i c y   l e v e l :   A n y   m e t a d a t a   u p d a t e s   e x c e p t   c h a n g e s   t o   t h e   s e c c o m p   o r   A p p A r m o r   a n n o t a t i o n s : s e c c o m p . s e c u r i t y . a l p h a . k u b e r n e t e s . i o / p o d   ( d e p r e c a t e d ) c o n t a i n e r . s e c c o m p . s e c u r i t y . a l p h a . k u b e r n e t e s . i o / *   ( d e p r e c a t e d ) c o n t a i n e r . a p p a r m o r . s e c u r i t y . b e t a . k u b e r n e t e s . i o / *   ( d e p r e c a t e d ) V a l i d   u p d a t e s   t o   . s p e c . a c t i v e D e a d l i n e S e c o n d s V a l i d   u p d a t e s   t o   . s p e c . t o l e r a t i o n s   s e c c o m p . s e c u r i t y . a l p h a . k u b e r n e t e s . i o / p o d   ( d e p r e c a t e d ) c o n t a i n e r . s e c c o m p . s e c u r i t y . a l p h a . k u b e r n e t e s . i o / *   ( d e p r e c a t e d ) c o n t a i n e r . a p p a r m o r . s e c u r i t y . b e t a . k u b e r n e t e s . i o / *   ( d e p r e c a t e d )


Question: What is Metrics?

Answer: H e r e   a r e   t h e   P r o m e t h e u s   m e t r i c s   e x p o s e d   b y   k u b e - a p i s e r v e r :   p o d _ s e c u r i t y _ e r r o r s _ t o t a l :   T h i s   m e t r i c   i n d i c a t e s   t h e   n u m b e r   o f   e r r o r s   p r e v e n t i n g   n o r m a l   e v a l u a t i o n .   N o n - f a t a l   e r r o r s   m a y   r e s u l t   i n   t h e   l a t e s t   r e s t r i c t e d   p r o f i l e   b e i n g   u s e d   f o r   e n f o r c e m e n t . p o d _ s e c u r i t y _ e v a l u a t i o n s _ t o t a l :   T h i s   m e t r i c   i n d i c a t e s   t h e   n u m b e r   o f   p o l i c y   e v a l u a t i o n s   t h a t   h a v e   o c c u r r e d ,   n o t   c o u n t i n g   i g n o r e d   o r   e x e m p t   r e q u e s t s   d u r i n g   e x p o r t i n g . p o d _ s e c u r i t y _ e x e m p t i o n s _ t o t a l :   T h i s   m e t r i c   i n d i c a t e s   t h e   n u m b e r   o f   e x e m p t   r e q u e s t s ,   n o t   c o u n t i n g   i g n o r e d   o r   o u t   o f   s c o p e   r e q u e s t s .


Question: What is What's next?

Answer: P o d   S e c u r i t y   S t a n d a r d s E n f o r c i n g   P o d   S e c u r i t y   S t a n d a r d s E n f o r c e   P o d   S e c u r i t y   S t a n d a r d s   b y   C o n f i g u r i n g   t h e   B u i l t - i n   A d m i s s i o n   C o n t r o l l e r E n f o r c e   P o d   S e c u r i t y   S t a n d a r d s   w i t h   N a m e s p a c e   L a b e l s   I f   y o u   a r e   r u n n i n g   a n   o l d e r   v e r s i o n   o f   K u b e r n e t e s   a n d   w a n t   t o   u p g r a d e   t o   a   v e r s i o n   o f   K u b e r n e t e s   t h a t   d o e s   n o t   i n c l u d e   P o d S e c u r i t y P o l i c i e s ,   r e a d   m i g r a t e   f r o m   P o d S e c u r i t y P o l i c y   t o   t h e   B u i l t - I n   P o d S e c u r i t y   A d m i s s i o n   C o n t r o l l e r .


Question: What is CSIDriver?

Answer: CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: CSIDrivermetadata (ObjectMeta)Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (CSIDriverSpec), requiredspec represents the specification of the CSI Driver.CSIDriverSpecCSIDriverSpec is the specification of a CSIDriver.attachRequired (boolean)attachRequired indicates this CSI volume driver requires an attach operation (because it implements the CSI ControllerPublishVolume() method), and that the Kubernetes attach detach controller should call the attach volume interface which checks the volumeattachment status and waits until the volume is attached before proceeding to mounting. The CSI external-attacher coordinates with CSI volume driver and updates the volumeattachment status when the attach operation is complete. If the value is specified to false, the attach operation will be skipped. Otherwise the attach operation will be called.This field is immutable.fsGroupPolicy (string)fsGroupPolicy defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details.This field was immutable in Kubernetes < 1.29 and now is mutable.Defaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.nodeAllocatableUpdatePeriodSeconds (int64)nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.This is a beta feature and requires the MutableCSINodeAllocatableCount feature gate to be enabled.This field is mutable.podIn


Question: How does CSIDriver work?

Answer: CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: CSIDrivermetadata (ObjectMeta)Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (CSIDriverSpec), requiredspec represents the specification of the CSI Driver.CSIDriverSpecCSIDriverSpec is the specification of a CSIDriver.attachRequired (boolean)attachRequired indicates this CSI volume driver requires an attach operation (because it implements the CSI ControllerPublishVolume() method), and that the Kubernetes attach detach controller should call the attach volume interface which checks the volumeattachment status and waits until the volume is attached before proceeding to mounting. The CSI external-attacher coordinates with CSI volume driver and updates the volumeattachment status when the attach operation is complete. If the value is specified to false, the attach operation will be skipped. Otherwise the attach operation will be called.This field is immutable.fsGroupPolicy (string)fsGroupPolicy defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details.This field was immutable in Kubernetes < 1.29 and now is mutable.Defaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.nodeAllocatableUpdatePeriodSeconds (int64)nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.This is a beta feature and requires the MutableCSINodeAllocatableCount feature gate to be enabled.This field is mutable.podIn


Question: When would you use CSIDriver?

Answer: CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: CSIDrivermetadata (ObjectMeta)Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (CSIDriverSpec), requiredspec represents the specification of the CSI Driver.CSIDriverSpecCSIDriverSpec is the specification of a CSIDriver.attachRequired (boolean)attachRequired indicates this CSI volume driver requires an attach operation (because it implements the CSI ControllerPublishVolume() method), and that the Kubernetes attach detach controller should call the attach volume interface which checks the volumeattachment status and waits until the volume is attached before proceeding to mounting. The CSI external-attacher coordinates with CSI volume driver and updates the volumeattachment status when the attach operation is complete. If the value is specified to false, the attach operation will be skipped. Otherwise the attach operation will be called.This field is immutable.fsGroupPolicy (string)fsGroupPolicy defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details.This field was immutable in Kubernetes < 1.29 and now is mutable.Defaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.nodeAllocatableUpdatePeriodSeconds (int64)nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.This is a beta feature and requires the MutableCSINodeAllocatableCount feature gate to be enabled.This field is mutable.podIn


Question: What are the benefits of CSIDriver?

Answer: CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster.apiVersion: storage.k8s.io/v1import "k8s.io/api/storage/v1"CSIDriverCSIDriver captures information about a Container Storage Interface (CSI) volume driver deployed on the cluster. Kubernetes attach detach controller uses this object to determine whether attach is required. Kubelet uses this object to determine whether pod information needs to be passed on mount. CSIDriver objects are non-namespaced.apiVersion: storage.k8s.io/v1kind: CSIDrivermetadata (ObjectMeta)Standard object metadata. metadata.Name indicates the name of the CSI driver that this object refers to; it MUST be the same name returned by the CSI GetPluginName() call for that driver. The driver name must be 63 characters or less, beginning and ending with an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and alphanumerics between. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (CSIDriverSpec), requiredspec represents the specification of the CSI Driver.CSIDriverSpecCSIDriverSpec is the specification of a CSIDriver.attachRequired (boolean)attachRequired indicates this CSI volume driver requires an attach operation (because it implements the CSI ControllerPublishVolume() method), and that the Kubernetes attach detach controller should call the attach volume interface which checks the volumeattachment status and waits until the volume is attached before proceeding to mounting. The CSI external-attacher coordinates with CSI volume driver and updates the volumeattachment status when the attach operation is complete. If the value is specified to false, the attach operation will be skipped. Otherwise the attach operation will be called.This field is immutable.fsGroupPolicy (string)fsGroupPolicy defines if the underlying volume supports changing ownership and permission of the volume before being mounted. Refer to the specific FSGroupPolicy values for additional details.This field was immutable in Kubernetes < 1.29 and now is mutable.Defaults to ReadWriteOnceWithFSType, which will examine each volume to determine if Kubernetes should modify ownership and permissions of the volume. With the default policy the defined fsGroup will only be applied if a fstype is defined and the volume's access mode contains ReadWriteOnce.nodeAllocatableUpdatePeriodSeconds (int64)nodeAllocatableUpdatePeriodSeconds specifies the interval between periodic updates of the CSINode allocatable capacity for this driver. When set, both periodic updates and updates triggered by capacity-related failures are enabled. If not set, no updates occur (neither periodic nor upon detecting capacity-related failures), and the allocatable.count remains static. The minimum allowed value for this field is 10 seconds.This is a beta feature and requires the MutableCSINodeAllocatableCount feature gate to be enabled.This field is mutable.podIn


Question: What is CSIDriver?

Answer: a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / s t o r a g e / v 1 "


Question: What is CSIDriver?

Answer: C S I D r i v e r   c a p t u r e s   i n f o r m a t i o n   a b o u t   a   C o n t a i n e r   S t o r a g e   I n t e r f a c e   ( C S I )   v o l u m e   d r i v e r   d e p l o y e d   o n   t h e   c l u s t e r .   K u b e r n e t e s   a t t a c h   d e t a c h   c o n t r o l l e r   u s e s   t h i s   o b j e c t   t o   d e t e r m i n e   w h e t h e r   a t t a c h   i s   r e q u i r e d .   K u b e l e t   u s e s   t h i s   o b j e c t   t o   d e t e r m i n e   w h e t h e r   p o d   i n f o r m a t i o n   n e e d s   t o   b e   p a s s e d   o n   m o u n t .   C S I D r i v e r   o b j e c t s   a r e   n o n - n a m e s p a c e d .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1 k i n d :   C S I D r i v e r m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t   m e t a d a t a .   m e t a d a t a . N a m e   i n d i c a t e s   t h e   n a m e   o f   t h e   C S I   d r i v e r   t h a t   t h i s   o b j e c t   r e f e r s   t o ;   i t   M U S T   b e   t h e   s a m e   n a m e   r e t u r n e d   b y   t h e   C S I   G e t P l u g i n N a m e ( )   c a l l   f o r   t h a t   d r i v e r .   T h e   d r i v e r   n a m e   m u s t   b e   6 3   c h a r a c t e r s   o r   l e s s ,   b e g i n n i n g   a n d   e n d i n g   w i t h   a n   a l p h a n u m e r i c   c h a r a c t e r   ( [ a - z 0 - 9 A - Z ] )   w i t h   d a s h e s   ( - ) ,   d o t s   ( . ) ,   a n d   a l p h a n u m e r i c s   b e t w e e n .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a s p e c   ( C S I D r i v e r S p e c ) ,   r e q u i r e d s p e c   r e p r e s e n t s   t h e   s p e c i f i c a t i o n   o f   t h e   C S I   D r i v e r .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   C S I D r i v e r   m e t a d a t a   ( O b j


Question: What is CSIDriverSpec?

Answer: C S I D r i v e r S p e c   i s   t h e   s p e c i f i c a t i o n   o f   a   C S I D r i v e r .   a t t a c h R e q u i r e d   ( b o o l e a n ) a t t a c h R e q u i r e d   i n d i c a t e s   t h i s   C S I   v o l u m e   d r i v e r   r e q u i r e s   a n   a t t a c h   o p e r a t i o n   ( b e c a u s e   i t   i m p l e m e n t s   t h e   C S I   C o n t r o l l e r P u b l i s h V o l u m e ( )   m e t h o d ) ,   a n d   t h a t   t h e   K u b e r n e t e s   a t t a c h   d e t a c h   c o n t r o l l e r   s h o u l d   c a l l   t h e   a t t a c h   v o l u m e   i n t e r f a c e   w h i c h   c h e c k s   t h e   v o l u m e a t t a c h m e n t   s t a t u s   a n d   w a i t s   u n t i l   t h e   v o l u m e   i s   a t t a c h e d   b e f o r e   p r o c e e d i n g   t o   m o u n t i n g .   T h e   C S I   e x t e r n a l - a t t a c h e r   c o o r d i n a t e s   w i t h   C S I   v o l u m e   d r i v e r   a n d   u p d a t e s   t h e   v o l u m e a t t a c h m e n t   s t a t u s   w h e n   t h e   a t t a c h   o p e r a t i o n   i s   c o m p l e t e .   I f   t h e   v a l u e   i s   s p e c i f i e d   t o   f a l s e ,   t h e   a t t a c h   o p e r a t i o n   w i l l   b e   s k i p p e d .   O t h e r w i s e   t h e   a t t a c h   o p e r a t i o n   w i l l   b e   c a l l e d . T h i s   f i e l d   i s   i m m u t a b l e . f s G r o u p P o l i c y   ( s t r i n g ) f s G r o u p P o l i c y   d e f i n e s   i f   t h e   u n d e r l y i n g   v o l u m e   s u p p o r t s   c h a n g i n g   o w n e r s h i p   a n d   p e r m i s s i o n   o f   t h e   v o l u m e   b e f o r e   b e i n g   m o u n t e d .   R e f e r   t o   t h e   s p e c i f i c   F S G r o u p P o l i c y   v a l u e s   f o r   a d d i t i o n a l   d e t a i l s . T h i s   f i e l d   w a s   i m m u t a b l e   i n   K u b e r n e t e s   <   1 . 2 9   a n d   n o w   i s   m u t a b l e . D e f a u l t s   t o   R e a d W r i


Question: What is CSIDriverList?

Answer: C S I D r i v e r L i s t   i s   a   c o l l e c t i o n   o f   C S I D r i v e r   o b j e c t s .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1 k i n d :   C S I D r i v e r L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a i t e m s   ( [ ] C S I D r i v e r ) ,   r e q u i r e d i t e m s   i s   t h e   l i s t   o f   C S I D r i v e r   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   C S I D r i v e r L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a   i t e m s   ( [ ] C S I D r i v e r ) ,   r e q u i r e d   i t e m s   i s   t h e   l i s t   o f   C S I D r i v e r


Question: What is HTTP Request?

Answer: G E T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C S I D r i v e r p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C S I D r i v e r   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s


Question: What is Parameters?

Answer: b o d y :   C S I D r i v e r ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   b o d y :   C S I D r i v e r ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r ) :   O K   2 0 1   ( C S I D r i v e r ) :   C r e a t e d   2 0 2   ( C S I D r i v e r ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C S I D r i v e r b o d y :   C S I D r i v e r ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C S I D r i v e r   b o d y :   C S I D r i v e r ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r ) :   O K   2 0 1   ( C S I D r i v e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C S I D r i v e r b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C S I D r i v e r   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r ) :   O K   2 0 1   ( C S I D r i v e r ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   C S I D r i v e r b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   C S I D r i v e r   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( C S I D r i v e r ) :   O K   2 0 2   ( C S I D r i v e r ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / s t o r a g e . k 8 s . i o / v 1 / c s i d r i v e r s


Question: What is Parameters?

Answer: b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   l a b e l S e l e c t o r   (


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Use a SOCKS5 Proxy to Access the Kubernetes API?

Answer: Use a SOCKS5 Proxy to Access the Kubernetes APIFEATURE STATE: Kubernetes v1.24 [stable]This page shows how to use a SOCKS5 proxy to access the API of a remote Kubernetes cluster. This is useful when the cluster you want to access does not expose its API directly on the public internet.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.24.To check the version, enter kubectl version.You need SSH client software (the ssh tool), and an SSH service running on the remote server. You must be able to log in to the SSH service on the remote server.Task contextNote:This example tunnels traffic using SSH, with the SSH client and server acting as a SOCKS proxy. You can instead use any other kind of SOCKS5 proxies.Figure 1 represents what you're going to achieve in this task.You have a client computer, referred to as local in the steps ahead, from where you're going to create requests to talk to the Kubernetes API.The Kubernetes server/API is hosted on a remote server.You will use SSH client and server software to create a secure SOCKS5 tunnel between the local and the remote server. The HTTPS traffic between the client and the Kubernetes API will flow over the SOCKS5 tunnel, which is itself tunnelled over SSH.graph LR; subgraph local[Local client machine] client([client])-. localtraffic .-> local_ssh[Local SSHSOCKS5 proxy]; end local_ssh[SSHSOCKS5proxy]-- SSH Tunnel -->sshd subgraph remote[Remote server] sshd[SSHserver]-- local traffic -->service1; end client([client])-. proxied HTTPs trafficgoing through the proxy .->service1[Kubernetes API]; classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s; class client plain; class cluster cluster;JavaScript must be enabled to view this contentFigure 1. SOCKS5 tutorial componentsUsing ssh to create a SOCKS5 proxyThe following command starts a SOCKS5 proxy between your client machine and the remote SOCKS server:# The SSH tunnel continues running in the foreground after you run this ssh -D 1080 -q -N username@kubernetes-remote-server.example The SOCKS5 proxy lets you connect to your cluster's API server based on the following configuration:-D 1080: opens a SOCKS proxy on local port :1080.-q: quiet mode. Causes most warning and diagnostic messages to be suppressed.-N: Do not execute a remote command. Useful for just forwarding ports.username@kubernetes-remote-server.example: the


Question: How does Use a SOCKS5 Proxy to Access the Kubernetes API work?

Answer: Use a SOCKS5 Proxy to Access the Kubernetes APIFEATURE STATE: Kubernetes v1.24 [stable]This page shows how to use a SOCKS5 proxy to access the API of a remote Kubernetes cluster. This is useful when the cluster you want to access does not expose its API directly on the public internet.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.24.To check the version, enter kubectl version.You need SSH client software (the ssh tool), and an SSH service running on the remote server. You must be able to log in to the SSH service on the remote server.Task contextNote:This example tunnels traffic using SSH, with the SSH client and server acting as a SOCKS proxy. You can instead use any other kind of SOCKS5 proxies.Figure 1 represents what you're going to achieve in this task.You have a client computer, referred to as local in the steps ahead, from where you're going to create requests to talk to the Kubernetes API.The Kubernetes server/API is hosted on a remote server.You will use SSH client and server software to create a secure SOCKS5 tunnel between the local and the remote server. The HTTPS traffic between the client and the Kubernetes API will flow over the SOCKS5 tunnel, which is itself tunnelled over SSH.graph LR; subgraph local[Local client machine] client([client])-. localtraffic .-> local_ssh[Local SSHSOCKS5 proxy]; end local_ssh[SSHSOCKS5proxy]-- SSH Tunnel -->sshd subgraph remote[Remote server] sshd[SSHserver]-- local traffic -->service1; end client([client])-. proxied HTTPs trafficgoing through the proxy .->service1[Kubernetes API]; classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s; class client plain; class cluster cluster;JavaScript must be enabled to view this contentFigure 1. SOCKS5 tutorial componentsUsing ssh to create a SOCKS5 proxyThe following command starts a SOCKS5 proxy between your client machine and the remote SOCKS server:# The SSH tunnel continues running in the foreground after you run this ssh -D 1080 -q -N username@kubernetes-remote-server.example The SOCKS5 proxy lets you connect to your cluster's API server based on the following configuration:-D 1080: opens a SOCKS proxy on local port :1080.-q: quiet mode. Causes most warning and diagnostic messages to be suppressed.-N: Do not execute a remote command. Useful for just forwarding ports.username@kubernetes-remote-server.example: the


Question: When would you use Use a SOCKS5 Proxy to Access the Kubernetes API?

Answer: Use a SOCKS5 Proxy to Access the Kubernetes APIFEATURE STATE: Kubernetes v1.24 [stable]This page shows how to use a SOCKS5 proxy to access the API of a remote Kubernetes cluster. This is useful when the cluster you want to access does not expose its API directly on the public internet.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.24.To check the version, enter kubectl version.You need SSH client software (the ssh tool), and an SSH service running on the remote server. You must be able to log in to the SSH service on the remote server.Task contextNote:This example tunnels traffic using SSH, with the SSH client and server acting as a SOCKS proxy. You can instead use any other kind of SOCKS5 proxies.Figure 1 represents what you're going to achieve in this task.You have a client computer, referred to as local in the steps ahead, from where you're going to create requests to talk to the Kubernetes API.The Kubernetes server/API is hosted on a remote server.You will use SSH client and server software to create a secure SOCKS5 tunnel between the local and the remote server. The HTTPS traffic between the client and the Kubernetes API will flow over the SOCKS5 tunnel, which is itself tunnelled over SSH.graph LR; subgraph local[Local client machine] client([client])-. localtraffic .-> local_ssh[Local SSHSOCKS5 proxy]; end local_ssh[SSHSOCKS5proxy]-- SSH Tunnel -->sshd subgraph remote[Remote server] sshd[SSHserver]-- local traffic -->service1; end client([client])-. proxied HTTPs trafficgoing through the proxy .->service1[Kubernetes API]; classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s; class client plain; class cluster cluster;JavaScript must be enabled to view this contentFigure 1. SOCKS5 tutorial componentsUsing ssh to create a SOCKS5 proxyThe following command starts a SOCKS5 proxy between your client machine and the remote SOCKS server:# The SSH tunnel continues running in the foreground after you run this ssh -D 1080 -q -N username@kubernetes-remote-server.example The SOCKS5 proxy lets you connect to your cluster's API server based on the following configuration:-D 1080: opens a SOCKS proxy on local port :1080.-q: quiet mode. Causes most warning and diagnostic messages to be suppressed.-N: Do not execute a remote command. Useful for just forwarding ports.username@kubernetes-remote-server.example: the


Question: What are the benefits of Use a SOCKS5 Proxy to Access the Kubernetes API?

Answer: Use a SOCKS5 Proxy to Access the Kubernetes APIFEATURE STATE: Kubernetes v1.24 [stable]This page shows how to use a SOCKS5 proxy to access the API of a remote Kubernetes cluster. This is useful when the cluster you want to access does not expose its API directly on the public internet.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.24.To check the version, enter kubectl version.You need SSH client software (the ssh tool), and an SSH service running on the remote server. You must be able to log in to the SSH service on the remote server.Task contextNote:This example tunnels traffic using SSH, with the SSH client and server acting as a SOCKS proxy. You can instead use any other kind of SOCKS5 proxies.Figure 1 represents what you're going to achieve in this task.You have a client computer, referred to as local in the steps ahead, from where you're going to create requests to talk to the Kubernetes API.The Kubernetes server/API is hosted on a remote server.You will use SSH client and server software to create a secure SOCKS5 tunnel between the local and the remote server. The HTTPS traffic between the client and the Kubernetes API will flow over the SOCKS5 tunnel, which is itself tunnelled over SSH.graph LR; subgraph local[Local client machine] client([client])-. localtraffic .-> local_ssh[Local SSHSOCKS5 proxy]; end local_ssh[SSHSOCKS5proxy]-- SSH Tunnel -->sshd subgraph remote[Remote server] sshd[SSHserver]-- local traffic -->service1; end client([client])-. proxied HTTPs trafficgoing through the proxy .->service1[Kubernetes API]; classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000; classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff; classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5; class ingress,service1,service2,pod1,pod2,pod3,pod4 k8s; class client plain; class cluster cluster;JavaScript must be enabled to view this contentFigure 1. SOCKS5 tutorial componentsUsing ssh to create a SOCKS5 proxyThe following command starts a SOCKS5 proxy between your client machine and the remote SOCKS server:# The SSH tunnel continues running in the foreground after you run this ssh -D 1080 -q -N username@kubernetes-remote-server.example The SOCKS5 proxy lets you connect to your cluster's API server based on the following configuration:-D 1080: opens a SOCKS proxy on local port :1080.-q: quiet mode. Causes most warning and diagnostic messages to be suppressed.-N: Do not execute a remote command. Useful for just forwarding ports.username@kubernetes-remote-server.example: the


Question: What is Use a SOCKS5 Proxy to Access the Kubernetes API?

Answer: T h i s   p a g e   s h o w s   h o w   t o   u s e   a   S O C K S 5   p r o x y   t o   a c c e s s   t h e   A P I   o f   a   r e m o t e   K u b e r n e t e s   c l u s t e r .   T h i s   i s   u s e f u l   w h e n   t h e   c l u s t e r   y o u   w a n t   t o   a c c e s s   d o e s   n o t   e x p o s e   i t s   A P I   d i r e c t l y   o n   t h e   p u b l i c   i n t e r n e t .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   v 1 . 2 4 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Note:?

Answer: F i g u r e   1   r e p r e s e n t s   w h a t   y o u ' r e   g o i n g   t o   a c h i e v e   i n   t h i s   t a s k .   Y o u   h a v e   a   c l i e n t   c o m p u t e r ,   r e f e r r e d   t o   a s   l o c a l   i n   t h e   s t e p s   a h e a d ,   f r o m   w h e r e   y o u ' r e   g o i n g   t o   c r e a t e   r e q u e s t s   t o   t a l k   t o   t h e   K u b e r n e t e s   A P I . T h e   K u b e r n e t e s   s e r v e r / A P I   i s   h o s t e d   o n   a   r e m o t e   s e r v e r . Y o u   w i l l   u s e   S S H   c l i e n t   a n d   s e r v e r   s o f t w a r e   t o   c r e a t e   a   s e c u r e   S O C K S 5   t u n n e l   b e t w e e n   t h e   l o c a l   a n d   t h e   r e m o t e   s e r v e r .   T h e   H T T P S   t r a f f i c   b e t w e e n   t h e   c l i e n t   a n d   t h e   K u b e r n e t e s   A P I   w i l l   f l o w   o v e r   t h e   S O C K S 5   t u n n e l ,   w h i c h   i s   i t s e l f   t u n n e l l e d   o v e r   S S H .   g r a p h   L R ;   s u b g r a p h   l o c a l [ L o c a l   c l i e n t   m a c h i n e ]   c l i e n t ( [ c l i e n t ] ) - .   l o c a l t r a f f i c   . - >   l o c a l _ s s h [ L o c a l   S S H S O C K S 5   p r o x y ] ;   e n d   l o c a l _ s s h [ S S H S O C K S 5 p r o x y ] - -   S S H   T u n n e l   - - > s s h d   s u b g r a p h   r e m o t e [ R e m o t e   s e r v e r ]   s s h d [ S S H s e r v e r ] - -   l o c a l   t r a f f i c   - - > s e r v i c e 1 ;   e n d   c l i e n t ( [ c l i e n t ] ) - .   p r o x i e d   H T T P s   t r a f f i c g o i n g   t h r o u g h   t h e   p r o x y   . - > s e r v i c e 1 [ K u b e r n e t e s   A P I ] ;   c l a s s D e f   p l a i n   f i l l : # d d d , s t r o k e : # f f f , s t r o k e - w i d t h : 4 p x , c o l o r : # 0 0 0 ;   c l a s s D e f   k 8 s   f i l l : # 3 2 6 c e 5 , s t r o k e : # f f f , s t r o k e - w i d t h : 4 p x , c o l o r : # f f f ;   c l a s s D e f   c l u s t e r   f


Question: What is Using ssh to create a SOCKS5 proxy?

Answer: T h e   f o l l o w i n g   c o m m a n d   s t a r t s   a   S O C K S 5   p r o x y   b e t w e e n   y o u r   c l i e n t   m a c h i n e   a n d   t h e   r e m o t e   S O C K S   s e r v e r :   #   T h e   S S H   t u n n e l   c o n t i n u e s   r u n n i n g   i n   t h e   f o r e g r o u n d   a f t e r   y o u   r u n   t h i s   s s h   - D   1 0 8 0   - q   - N   u s e r n a m e @ k u b e r n e t e s - r e m o t e - s e r v e r . e x a m p l e   T h e   S O C K S 5   p r o x y   l e t s   y o u   c o n n e c t   t o   y o u r   c l u s t e r ' s   A P I   s e r v e r   b a s e d   o n   t h e   f o l l o w i n g   c o n f i g u r a t i o n :   - D   1 0 8 0 :   o p e n s   a   S O C K S   p r o x y   o n   l o c a l   p o r t   : 1 0 8 0 . - q :   q u i e t   m o d e .   C a u s e s   m o s t   w a r n i n g   a n d   d i a g n o s t i c   m e s s a g e s   t o   b e   s u p p r e s s e d . - N :   D o   n o t   e x e c u t e   a   r e m o t e   c o m m a n d .   U s e f u l   f o r   j u s t   f o r w a r d i n g   p o r t s . u s e r n a m e @ k u b e r n e t e s - r e m o t e - s e r v e r . e x a m p l e :   t h e   r e m o t e   S S H   s e r v e r   b e h i n d   w h i c h   t h e   K u b e r n e t e s   c l u s t e r   i s   r u n n i n g   ( e g :   a   b a s t i o n   h o s t ) .


Question: What is Client configuration?

Answer: T o   a c c e s s   t h e   K u b e r n e t e s   A P I   s e r v e r   t h r o u g h   t h e   p r o x y   y o u   m u s t   i n s t r u c t   k u b e c t l   t o   s e n d   q u e r i e s   t h r o u g h   t h e   S O C K S   p r o x y   w e   c r e a t e d   e a r l i e r .   D o   t h i s   b y   e i t h e r   s e t t i n g   t h e   a p p r o p r i a t e   e n v i r o n m e n t   v a r i a b l e ,   o r   v i a   t h e   p r o x y - u r l   a t t r i b u t e   i n   t h e   k u b e c o n f i g   f i l e .   U s i n g   a n   e n v i r o n m e n t   v a r i a b l e :   e x p o r t   H T T P S _ P R O X Y = s o c k s 5 : / / l o c a l h o s t : 1 0 8 0   T o   a l w a y s   u s e   t h i s   s e t t i n g   o n   a   s p e c i f i c   k u b e c t l   c o n t e x t ,   s p e c i f y   t h e   p r o x y - u r l   a t t r i b u t e   i n   t h e   r e l e v a n t   c l u s t e r   e n t r y   w i t h i n   t h e   ~ / . k u b e / c o n f i g   f i l e .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   c l u s t e r s :   -   c l u s t e r :   c e r t i f i c a t e - a u t h o r i t y - d a t a :   L R M E M M W 2   #   s h o r t e n e d   f o r   r e a d a b i l i t y   s e r v e r :   h t t p s : / / < A P I _ S E R V E R _ I P _ A D D R E S S > : 6 4 4 3   #   t h e   " K u b e r n e t e s   A P I "   s e r v e r ,   i n   o t h e r   w o r d s   t h e   I P   a d d r e s s   o f   k u b e r n e t e s - r e m o t e - s e r v e r . e x a m p l e   p r o x y - u r l :   s o c k s 5 : / / l o c a l h o s t : 1 0 8 0   #   t h e   " S S H   S O C K S 5   p r o x y "   i n   t h e   d i a g r a m   a b o v e   n a m e :   d e f a u l t   c o n t e x t s :   -   c o n t e x t :   c l u s t e r :   d e f a u l t   u s e r :   d e f a u l t   n a m e :   d e f a u l t   c u r r e n t - c o n t e x t :   d e f a u l t   k i n d :   C o n f i g   p r e f e r e n c e s :   { }   u s e r s :   -   n a m e :   d e f a u l t   u s e r :   c l i e n t - c e r t i f i c


Question: What is Note:?

Answer: B e f o r e   k u b e c t l   1 . 2 4 ,   m o s t   k u b e c t l   c o m m a n d s   w o r k e d   w h e n   u s i n g   a   s o c k s   p r o x y ,   e x c e p t   k u b e c t l   e x e c . k u b e c t l   s u p p o r t s   b o t h   H T T P S _ P R O X Y   a n d   h t t p s _ p r o x y   e n v i r o n m e n t   v a r i a b l e s .   T h e s e   a r e   u s e d   b y   o t h e r   p r o g r a m s   t h a t   s u p p o r t   S O C K S ,   s u c h   a s   c u r l .   T h e r e f o r e   i n   s o m e   c a s e s   i t   w i l l   b e   b e t t e r   t o   d e f i n e   t h e   e n v i r o n m e n t   v a r i a b l e   o n   t h e   c o m m a n d   l i n e : H T T P S _ P R O X Y = s o c k s 5 : / / l o c a l h o s t : 1 0 8 0   k u b e c t l   g e t   p o d s   W h e n   u s i n g   p r o x y - u r l ,   t h e   p r o x y   i s   u s e d   o n l y   f o r   t h e   r e l e v a n t   k u b e c t l   c o n t e x t ,   w h e r e a s   t h e   e n v i r o n m e n t   v a r i a b l e   w i l l   a f f e c t   a l l   c o n t e x t s . T h e   k 8 s   A P I   s e r v e r   h o s t n a m e   c a n   b e   f u r t h e r   p r o t e c t e d   f r o m   D N S   l e a k a g e   b y   u s i n g   t h e   s o c k s 5 h   p r o t o c o l   n a m e   i n s t e a d   o f   t h e   m o r e   c o m m o n l y   k n o w n   s o c k s 5   p r o t o c o l   s h o w n   a b o v e .   I n   t h i s   c a s e ,   k u b e c t l   w i l l   a s k   t h e   p r o x y   s e r v e r   ( s u c h   a s   a n   s s h   b a s t i o n )   t o   r e s o l v e   t h e   k 8 s   A P I   s e r v e r   d o m a i n   n a m e ,   i n s t e a d   o f   r e s o l v i n g   i t   o n   t h e   s y s t e m   r u n n i n g   k u b e c t l .   N o t e   a l s o   t h a t   w i t h   s o c k s 5 h ,   a   k 8 s   A P I   s e r v e r   U R L   l i k e   h t t p s : / / l o c a l h o s t : 6 4 4 3 / a p i   d o e s   n o t   r e f e r   t o   y o u r   l o c a l   c l i e n t   c o m p u t e r .   I n s t e a d ,


Question: What is Clean up?

Answer: S t o p   t h e   s s h   p o r t - f o r w a r d i n g   p r o c e s s   b y   p r e s s i n g   C T R L + C   o n   t h e   t e r m i n a l   w h e r e   i t   i s   r u n n i n g .   T y p e   u n s e t   h t t p s _ p r o x y   i n   a   t e r m i n a l   t o   s t o p   f o r w a r d i n g   h t t p   t r a f f i c   t h r o u g h   t h e   p r o x y .


Question: What is Further reading?

Answer: O p e n S S H   r e m o t e   l o g i n   c l i e n t


Question: What is Authorization Resources?

Answer: Authorization ResourcesLocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.SelfSubjectRulesReviewSelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.RoleBindingRoleBinding references a role, but does not contain it.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: How does Authorization Resources work?

Answer: Authorization ResourcesLocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.SelfSubjectRulesReviewSelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.RoleBindingRoleBinding references a role, but does not contain it.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: When would you use Authorization Resources?

Answer: Authorization ResourcesLocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.SelfSubjectRulesReviewSelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.RoleBindingRoleBinding references a role, but does not contain it.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What are the benefits of Authorization Resources?

Answer: Authorization ResourcesLocalSubjectAccessReviewLocalSubjectAccessReview checks whether or not a user or group can perform an action in a given namespace.SelfSubjectAccessReviewSelfSubjectAccessReview checks whether or the current user can perform an action.SelfSubjectRulesReviewSelfSubjectRulesReview enumerates the set of actions the current user can perform within a namespace.SubjectAccessReviewSubjectAccessReview checks whether or not a user or group can perform an action.ClusterRoleClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.ClusterRoleBindingClusterRoleBinding references a ClusterRole, but not contain it.RoleRole is a namespaced, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding.RoleBindingRoleBinding references a role, but does not contain it.This page is automatically generated.If you plan to report an issue with this page, mention that the page is auto-generated in your issue description. The fix may need to happen elsewhere in the Kubernetes project.


Question: What is LocalSubjectAccessReview?

Answer: L o c a l S u b j e c t A c c e s s R e v i e w   c h e c k s   w h e t h e r   o r   n o t   a   u s e r   o r   g r o u p   c a n   p e r f o r m   a n   a c t i o n   i n   a   g i v e n   n a m e s p a c e .


Question: What is SelfSubjectAccessReview?

Answer: S e l f S u b j e c t A c c e s s R e v i e w   c h e c k s   w h e t h e r   o r   t h e   c u r r e n t   u s e r   c a n   p e r f o r m   a n   a c t i o n .


Question: What is SelfSubjectRulesReview?

Answer: S e l f S u b j e c t R u l e s R e v i e w   e n u m e r a t e s   t h e   s e t   o f   a c t i o n s   t h e   c u r r e n t   u s e r   c a n   p e r f o r m   w i t h i n   a   n a m e s p a c e .


Question: What is SubjectAccessReview?

Answer: S u b j e c t A c c e s s R e v i e w   c h e c k s   w h e t h e r   o r   n o t   a   u s e r   o r   g r o u p   c a n   p e r f o r m   a n   a c t i o n .


Question: What is ClusterRole?

Answer: C l u s t e r R o l e   i s   a   c l u s t e r   l e v e l ,   l o g i c a l   g r o u p i n g   o f   P o l i c y R u l e s   t h a t   c a n   b e   r e f e r e n c e d   a s   a   u n i t   b y   a   R o l e B i n d i n g   o r   C l u s t e r R o l e B i n d i n g .


Question: What is ClusterRoleBinding?

Answer: C l u s t e r R o l e B i n d i n g   r e f e r e n c e s   a   C l u s t e r R o l e ,   b u t   n o t   c o n t a i n   i t .


Question: What is Role?

Answer: R o l e   i s   a   n a m e s p a c e d ,   l o g i c a l   g r o u p i n g   o f   P o l i c y R u l e s   t h a t   c a n   b e   r e f e r e n c e d   a s   a   u n i t   b y   a   R o l e B i n d i n g .


Question: What is RoleBinding?

Answer: R o l e B i n d i n g   r e f e r e n c e s   a   r o l e ,   b u t   d o e s   n o t   c o n t a i n   i t .   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is ResourceQuota?

Answer: ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespace.apiVersion: v1import "k8s.io/api/core/v1"ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespaceapiVersion: v1kind: ResourceQuotametadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ResourceQuotaSpec)Spec defines the desired quota. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ResourceQuotaStatus)Status defines the actual enforced quota and its current usage. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusResourceQuotaSpecResourceQuotaSpec defines the desired hard limits to enforce for Quota.hard (map[string]Quantity)hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/scopeSelector (ScopeSelector)scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.scopeSelector.matchExpressions ([]ScopedResourceSelectorRequirement)Atomic: will be replaced during a mergeA list of scope selector requirements by scope of the resources.A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.scopeSelector.matchExpressions.operator (string), requiredRepresents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.scopeSelector.matchExpressions.scopeName (string), requiredThe name of the scope that the selector applies to.scopeSelector.matchExpressions.values ([]string)Atomic: will be replaced during a mergeAn array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.scopes ([]string)Atomic: will be replaced during a mergeA collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.ResourceQuotaStatusResourceQuotaStatus defines the enforced hard limits and observed use.hard (map[string]Quantity)Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/used (map[string]Quantity)Used is the current observed total usage of the resource in the namespace.ResourceQuotaListResourceQuotaList is a list of ResourceQuota items.apiVersion: v1kind: ResourceQuotaListmetadata (ListMeta)Standard list metadata. More info: https://gi


Question: How does ResourceQuota work?

Answer: ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespace.apiVersion: v1import "k8s.io/api/core/v1"ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespaceapiVersion: v1kind: ResourceQuotametadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ResourceQuotaSpec)Spec defines the desired quota. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ResourceQuotaStatus)Status defines the actual enforced quota and its current usage. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusResourceQuotaSpecResourceQuotaSpec defines the desired hard limits to enforce for Quota.hard (map[string]Quantity)hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/scopeSelector (ScopeSelector)scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.scopeSelector.matchExpressions ([]ScopedResourceSelectorRequirement)Atomic: will be replaced during a mergeA list of scope selector requirements by scope of the resources.A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.scopeSelector.matchExpressions.operator (string), requiredRepresents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.scopeSelector.matchExpressions.scopeName (string), requiredThe name of the scope that the selector applies to.scopeSelector.matchExpressions.values ([]string)Atomic: will be replaced during a mergeAn array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.scopes ([]string)Atomic: will be replaced during a mergeA collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.ResourceQuotaStatusResourceQuotaStatus defines the enforced hard limits and observed use.hard (map[string]Quantity)Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/used (map[string]Quantity)Used is the current observed total usage of the resource in the namespace.ResourceQuotaListResourceQuotaList is a list of ResourceQuota items.apiVersion: v1kind: ResourceQuotaListmetadata (ListMeta)Standard list metadata. More info: https://gi


Question: When would you use ResourceQuota?

Answer: ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespace.apiVersion: v1import "k8s.io/api/core/v1"ResourceQuotaResourceQuota sets aggregate quota restrictions enforced per namespaceapiVersion: v1kind: ResourceQuotametadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataspec (ResourceQuotaSpec)Spec defines the desired quota. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusstatus (ResourceQuotaStatus)Status defines the actual enforced quota and its current usage. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-statusResourceQuotaSpecResourceQuotaSpec defines the desired hard limits to enforce for Quota.hard (map[string]Quantity)hard is the set of desired hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/scopeSelector (ScopeSelector)scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota but expressed using ScopeSelectorOperator in combination with possible values. For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.A scope selector represents the AND of the selectors represented by the scoped-resource selector requirements.scopeSelector.matchExpressions ([]ScopedResourceSelectorRequirement)Atomic: will be replaced during a mergeA list of scope selector requirements by scope of the resources.A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator that relates the scope name and values.scopeSelector.matchExpressions.operator (string), requiredRepresents a scope's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist.scopeSelector.matchExpressions.scopeName (string), requiredThe name of the scope that the selector applies to.scopeSelector.matchExpressions.values ([]string)Atomic: will be replaced during a mergeAn array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.scopes ([]string)Atomic: will be replaced during a mergeA collection of filters that must match each object tracked by a quota. If not specified, the quota matches all objects.ResourceQuotaStatusResourceQuotaStatus defines the enforced hard limits and observed use.hard (map[string]Quantity)Hard is the set of enforced hard limits for each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/used (map[string]Quantity)Used is the current observed total usage of the resource in the namespace.ResourceQuotaListResourceQuotaList is a list of ResourceQuota items.apiVersion: v1kind: ResourceQuotaListmetadata (ListMeta)Standard list metadata. More info: https://gi