Question: What is SLI Metrics?

Answer: W i t h   S L I   m e t r i c s   e n a b l e d ,   e a c h   K u b e r n e t e s   c o m p o n e n t   e x p o s e s   t w o   m e t r i c s ,   l a b e l e d   p e r   h e a l t h c h e c k :   a   g a u g e   ( w h i c h   r e p r e s e n t s   t h e   c u r r e n t   s t a t e   o f   t h e   h e a l t h c h e c k ) a   c o u n t e r   ( w h i c h   r e c o r d s   t h e   c u m u l a t i v e   c o u n t s   o b s e r v e d   f o r   e a c h   h e a l t h c h e c k   s t a t e )   Y o u   c a n   u s e   t h e   m e t r i c   i n f o r m a t i o n   t o   c a l c u l a t e   p e r - c o m p o n e n t   a v a i l a b i l i t y   s t a t i s t i c s .   F o r   e x a m p l e ,   t h e   A P I   s e r v e r   c h e c k s   t h e   h e a l t h   o f   e t c d .   Y o u   c a n   w o r k   o u t   a n d   r e p o r t   h o w   a v a i l a b l e   o r   u n a v a i l a b l e   e t c d   h a s   b e e n   -   a s   r e p o r t e d   b y   i t s   c l i e n t ,   t h e   A P I   s e r v e r .   T h e   p r o m e t h e u s   g a u g e   d a t a   l o o k s   l i k e   t h i s :   #   H E L P   k u b e r n e t e s _ h e a l t h c h e c k   [ A L P H A ]   T h i s   m e t r i c   r e c o r d s   t h e   r e s u l t   o f   a   s i n g l e   h e a l t h c h e c k .   #   T Y P E   k u b e r n e t e s _ h e a l t h c h e c k   g a u g e   k u b e r n e t e s _ h e a l t h c h e c k { n a m e = " a u t o r e g i s t e r - c o m p l e t i o n " , t y p e = " h e a l t h z " }   1   k u b e r n e t e s _ h e a l t h c h e c k { n a m e = " a u t o r e g i s t e r - c o m p l e t i o n " , t y p e = " r e a d y z " }   1   k u b e r n e t e s _ h e a l t h c h e c k { n a m e = " e t c d " , t y p e = " h e a l t h z " }   1   k u b e r n e t e s _ h e a l t h c h e c k { n a m e = " e t c d " , t y p e = " r e a d y z " }   1   k u b e r n e t e s _ h e a l t h c h e c k { n a m e = " e t c d - r e a d i n e s s " , t y p e = " r e a d y z " }   1   k u b e r n e t e s _ h e a


Question: What is Using this data?

Answer: T h e   c o m p o n e n t   S L I s   m e t r i c s   e n d p o i n t   i s   i n t e n d e d   t o   b e   s c r a p e d   a t   a   h i g h   f r e q u e n c y .   S c r a p i n g   a t   a   h i g h   f r e q u e n c y   m e a n s   t h a t   y o u   e n d   u p   w i t h   g r e a t e r   g r a n u l a r i t y   o f   t h e   g a u g e ' s   s i g n a l ,   w h i c h   c a n   b e   t h e n   u s e d   t o   c a l c u l a t e   S L O s .   T h e   / m e t r i c s / s l i s   e n d p o i n t   p r o v i d e s   t h e   r a w   d a t a   n e c e s s a r y   t o   c a l c u l a t e   a n   a v a i l a b i l i t y   S L O   f o r   t h e   r e s p e c t i v e   K u b e r n e t e s   c o m p o n e n t .


Question: What is Volume Attributes Classes?

Answer: Volume Attributes ClassesFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page assumes that you are familiar with StorageClasses, volumes and PersistentVolumes in Kubernetes.A VolumeAttributesClass provides a way for administrators to describe the mutable "classes" of storage they offer. Different classes might map to different quality-of-service levels. Kubernetes itself is un-opinionated about what these classes represent.This feature is generally available (GA) as of version 1.34, and users have the option to disable it.You can also only use VolumeAttributesClasses with storage backed by Container Storage Interface, and only where the relevant CSI driver implements the ModifyVolume API.The VolumeAttributesClass APIEach VolumeAttributesClass contains the driverName and parameters, which are used when a PersistentVolume (PV) belonging to the class needs to be dynamically provisioned or modified.The name of a VolumeAttributesClass object is significant and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeAttributesClass objects. While the name of a VolumeAttributesClass object in a PersistentVolumeClaim is mutable, the parameters in an existing class are immutable.apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: silver driverName: pd.csi.storage.gke.io parameters: provisioned-iops: "3000" provisioned-throughput: "50" ProvisionerEach VolumeAttributesClass has a provisioner that determines what volume plugin is used for provisioning PVs. The field driverName must be specified.The feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-provisioner.You are not restricted to specifying the kubernetes-csi/external-provisioner. You can also run and specify external provisioners, which are independent programs that follow a specification defined by Kubernetes. Authors of external provisioners have full discretion over where their code lives, how the provisioner is shipped, how it needs to be run, what volume plugin it uses, etc.To understand how the provisioner works with VolumeAttributesClass, refer to the CSI external-provisioner documentation.ResizerEach VolumeAttributesClass has a resizer that determines what volume plugin is used for modifying PVs. The field driverName must be specified.The modifying volume feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-resizer.For example, an existing PersistentVolumeClaim is using a VolumeAttributesClass named silver:apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: … volumeAttributesClassName: silver … A new VolumeAttributesClass gold is available in the cluster:apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: gold driverName: pd.csi.storage.gke.io parameters: iops: "4000" throughput: "60" The end user can update the PVC with the new VolumeAttributesClass gold and appl


Question: How does Volume Attributes Classes work?

Answer: Volume Attributes ClassesFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page assumes that you are familiar with StorageClasses, volumes and PersistentVolumes in Kubernetes.A VolumeAttributesClass provides a way for administrators to describe the mutable "classes" of storage they offer. Different classes might map to different quality-of-service levels. Kubernetes itself is un-opinionated about what these classes represent.This feature is generally available (GA) as of version 1.34, and users have the option to disable it.You can also only use VolumeAttributesClasses with storage backed by Container Storage Interface, and only where the relevant CSI driver implements the ModifyVolume API.The VolumeAttributesClass APIEach VolumeAttributesClass contains the driverName and parameters, which are used when a PersistentVolume (PV) belonging to the class needs to be dynamically provisioned or modified.The name of a VolumeAttributesClass object is significant and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeAttributesClass objects. While the name of a VolumeAttributesClass object in a PersistentVolumeClaim is mutable, the parameters in an existing class are immutable.apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: silver driverName: pd.csi.storage.gke.io parameters: provisioned-iops: "3000" provisioned-throughput: "50" ProvisionerEach VolumeAttributesClass has a provisioner that determines what volume plugin is used for provisioning PVs. The field driverName must be specified.The feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-provisioner.You are not restricted to specifying the kubernetes-csi/external-provisioner. You can also run and specify external provisioners, which are independent programs that follow a specification defined by Kubernetes. Authors of external provisioners have full discretion over where their code lives, how the provisioner is shipped, how it needs to be run, what volume plugin it uses, etc.To understand how the provisioner works with VolumeAttributesClass, refer to the CSI external-provisioner documentation.ResizerEach VolumeAttributesClass has a resizer that determines what volume plugin is used for modifying PVs. The field driverName must be specified.The modifying volume feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-resizer.For example, an existing PersistentVolumeClaim is using a VolumeAttributesClass named silver:apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: … volumeAttributesClassName: silver … A new VolumeAttributesClass gold is available in the cluster:apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: gold driverName: pd.csi.storage.gke.io parameters: iops: "4000" throughput: "60" The end user can update the PVC with the new VolumeAttributesClass gold and appl


Question: When would you use Volume Attributes Classes?

Answer: Volume Attributes ClassesFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page assumes that you are familiar with StorageClasses, volumes and PersistentVolumes in Kubernetes.A VolumeAttributesClass provides a way for administrators to describe the mutable "classes" of storage they offer. Different classes might map to different quality-of-service levels. Kubernetes itself is un-opinionated about what these classes represent.This feature is generally available (GA) as of version 1.34, and users have the option to disable it.You can also only use VolumeAttributesClasses with storage backed by Container Storage Interface, and only where the relevant CSI driver implements the ModifyVolume API.The VolumeAttributesClass APIEach VolumeAttributesClass contains the driverName and parameters, which are used when a PersistentVolume (PV) belonging to the class needs to be dynamically provisioned or modified.The name of a VolumeAttributesClass object is significant and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeAttributesClass objects. While the name of a VolumeAttributesClass object in a PersistentVolumeClaim is mutable, the parameters in an existing class are immutable.apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: silver driverName: pd.csi.storage.gke.io parameters: provisioned-iops: "3000" provisioned-throughput: "50" ProvisionerEach VolumeAttributesClass has a provisioner that determines what volume plugin is used for provisioning PVs. The field driverName must be specified.The feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-provisioner.You are not restricted to specifying the kubernetes-csi/external-provisioner. You can also run and specify external provisioners, which are independent programs that follow a specification defined by Kubernetes. Authors of external provisioners have full discretion over where their code lives, how the provisioner is shipped, how it needs to be run, what volume plugin it uses, etc.To understand how the provisioner works with VolumeAttributesClass, refer to the CSI external-provisioner documentation.ResizerEach VolumeAttributesClass has a resizer that determines what volume plugin is used for modifying PVs. The field driverName must be specified.The modifying volume feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-resizer.For example, an existing PersistentVolumeClaim is using a VolumeAttributesClass named silver:apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: … volumeAttributesClassName: silver … A new VolumeAttributesClass gold is available in the cluster:apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: gold driverName: pd.csi.storage.gke.io parameters: iops: "4000" throughput: "60" The end user can update the PVC with the new VolumeAttributesClass gold and appl


Question: What are the benefits of Volume Attributes Classes?

Answer: Volume Attributes ClassesFEATURE STATE: Kubernetes v1.34 [stable] (enabled by default: true)This page assumes that you are familiar with StorageClasses, volumes and PersistentVolumes in Kubernetes.A VolumeAttributesClass provides a way for administrators to describe the mutable "classes" of storage they offer. Different classes might map to different quality-of-service levels. Kubernetes itself is un-opinionated about what these classes represent.This feature is generally available (GA) as of version 1.34, and users have the option to disable it.You can also only use VolumeAttributesClasses with storage backed by Container Storage Interface, and only where the relevant CSI driver implements the ModifyVolume API.The VolumeAttributesClass APIEach VolumeAttributesClass contains the driverName and parameters, which are used when a PersistentVolume (PV) belonging to the class needs to be dynamically provisioned or modified.The name of a VolumeAttributesClass object is significant and is how users can request a particular class. Administrators set the name and other parameters of a class when first creating VolumeAttributesClass objects. While the name of a VolumeAttributesClass object in a PersistentVolumeClaim is mutable, the parameters in an existing class are immutable.apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: silver driverName: pd.csi.storage.gke.io parameters: provisioned-iops: "3000" provisioned-throughput: "50" ProvisionerEach VolumeAttributesClass has a provisioner that determines what volume plugin is used for provisioning PVs. The field driverName must be specified.The feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-provisioner.You are not restricted to specifying the kubernetes-csi/external-provisioner. You can also run and specify external provisioners, which are independent programs that follow a specification defined by Kubernetes. Authors of external provisioners have full discretion over where their code lives, how the provisioner is shipped, how it needs to be run, what volume plugin it uses, etc.To understand how the provisioner works with VolumeAttributesClass, refer to the CSI external-provisioner documentation.ResizerEach VolumeAttributesClass has a resizer that determines what volume plugin is used for modifying PVs. The field driverName must be specified.The modifying volume feature support for VolumeAttributesClass is implemented in kubernetes-csi/external-resizer.For example, an existing PersistentVolumeClaim is using a VolumeAttributesClass named silver:apiVersion: v1 kind: PersistentVolumeClaim metadata: name: test-pv-claim spec: … volumeAttributesClassName: silver … A new VolumeAttributesClass gold is available in the cluster:apiVersion: storage.k8s.io/v1 kind: VolumeAttributesClass metadata: name: gold driverName: pd.csi.storage.gke.io parameters: iops: "4000" throughput: "60" The end user can update the PVC with the new VolumeAttributesClass gold and appl


Question: What is Volume Attributes Classes?

Answer: T h i s   p a g e   a s s u m e s   t h a t   y o u   a r e   f a m i l i a r   w i t h   S t o r a g e C l a s s e s ,   v o l u m e s   a n d   P e r s i s t e n t V o l u m e s   i n   K u b e r n e t e s .   A   V o l u m e A t t r i b u t e s C l a s s   p r o v i d e s   a   w a y   f o r   a d m i n i s t r a t o r s   t o   d e s c r i b e   t h e   m u t a b l e   " c l a s s e s "   o f   s t o r a g e   t h e y   o f f e r .   D i f f e r e n t   c l a s s e s   m i g h t   m a p   t o   d i f f e r e n t   q u a l i t y - o f - s e r v i c e   l e v e l s .   K u b e r n e t e s   i t s e l f   i s   u n - o p i n i o n a t e d   a b o u t   w h a t   t h e s e   c l a s s e s   r e p r e s e n t .   T h i s   f e a t u r e   i s   g e n e r a l l y   a v a i l a b l e   ( G A )   a s   o f   v e r s i o n   1 . 3 4 ,   a n d   u s e r s   h a v e   t h e   o p t i o n   t o   d i s a b l e   i t .   Y o u   c a n   a l s o   o n l y   u s e   V o l u m e A t t r i b u t e s C l a s s e s   w i t h   s t o r a g e   b a c k e d   b y   C o n t a i n e r   S t o r a g e   I n t e r f a c e ,   a n d   o n l y   w h e r e   t h e   r e l e v a n t   C S I   d r i v e r   i m p l e m e n t s   t h e   M o d i f y V o l u m e   A P I .


Question: What is The VolumeAttributesClass API?

Answer: E a c h   V o l u m e A t t r i b u t e s C l a s s   c o n t a i n s   t h e   d r i v e r N a m e   a n d   p a r a m e t e r s ,   w h i c h   a r e   u s e d   w h e n   a   P e r s i s t e n t V o l u m e   ( P V )   b e l o n g i n g   t o   t h e   c l a s s   n e e d s   t o   b e   d y n a m i c a l l y   p r o v i s i o n e d   o r   m o d i f i e d .   T h e   n a m e   o f   a   V o l u m e A t t r i b u t e s C l a s s   o b j e c t   i s   s i g n i f i c a n t   a n d   i s   h o w   u s e r s   c a n   r e q u e s t   a   p a r t i c u l a r   c l a s s .   A d m i n i s t r a t o r s   s e t   t h e   n a m e   a n d   o t h e r   p a r a m e t e r s   o f   a   c l a s s   w h e n   f i r s t   c r e a t i n g   V o l u m e A t t r i b u t e s C l a s s   o b j e c t s .   W h i l e   t h e   n a m e   o f   a   V o l u m e A t t r i b u t e s C l a s s   o b j e c t   i n   a   P e r s i s t e n t V o l u m e C l a i m   i s   m u t a b l e ,   t h e   p a r a m e t e r s   i n   a n   e x i s t i n g   c l a s s   a r e   i m m u t a b l e .   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e A t t r i b u t e s C l a s s   m e t a d a t a :   n a m e :   s i l v e r   d r i v e r N a m e :   p d . c s i . s t o r a g e . g k e . i o   p a r a m e t e r s :   p r o v i s i o n e d - i o p s :   " 3 0 0 0 "   p r o v i s i o n e d - t h r o u g h p u t :   " 5 0 "


Question: What is Provisioner?

Answer: E a c h   V o l u m e A t t r i b u t e s C l a s s   h a s   a   p r o v i s i o n e r   t h a t   d e t e r m i n e s   w h a t   v o l u m e   p l u g i n   i s   u s e d   f o r   p r o v i s i o n i n g   P V s .   T h e   f i e l d   d r i v e r N a m e   m u s t   b e   s p e c i f i e d .   T h e   f e a t u r e   s u p p o r t   f o r   V o l u m e A t t r i b u t e s C l a s s   i s   i m p l e m e n t e d   i n   k u b e r n e t e s - c s i / e x t e r n a l - p r o v i s i o n e r .   Y o u   a r e   n o t   r e s t r i c t e d   t o   s p e c i f y i n g   t h e   k u b e r n e t e s - c s i / e x t e r n a l - p r o v i s i o n e r .   Y o u   c a n   a l s o   r u n   a n d   s p e c i f y   e x t e r n a l   p r o v i s i o n e r s ,   w h i c h   a r e   i n d e p e n d e n t   p r o g r a m s   t h a t   f o l l o w   a   s p e c i f i c a t i o n   d e f i n e d   b y   K u b e r n e t e s .   A u t h o r s   o f   e x t e r n a l   p r o v i s i o n e r s   h a v e   f u l l   d i s c r e t i o n   o v e r   w h e r e   t h e i r   c o d e   l i v e s ,   h o w   t h e   p r o v i s i o n e r   i s   s h i p p e d ,   h o w   i t   n e e d s   t o   b e   r u n ,   w h a t   v o l u m e   p l u g i n   i t   u s e s ,   e t c .   T o   u n d e r s t a n d   h o w   t h e   p r o v i s i o n e r   w o r k s   w i t h   V o l u m e A t t r i b u t e s C l a s s ,   r e f e r   t o   t h e   C S I   e x t e r n a l - p r o v i s i o n e r   d o c u m e n t a t i o n .


Question: What is Resizer?

Answer: E a c h   V o l u m e A t t r i b u t e s C l a s s   h a s   a   r e s i z e r   t h a t   d e t e r m i n e s   w h a t   v o l u m e   p l u g i n   i s   u s e d   f o r   m o d i f y i n g   P V s .   T h e   f i e l d   d r i v e r N a m e   m u s t   b e   s p e c i f i e d .   T h e   m o d i f y i n g   v o l u m e   f e a t u r e   s u p p o r t   f o r   V o l u m e A t t r i b u t e s C l a s s   i s   i m p l e m e n t e d   i n   k u b e r n e t e s - c s i / e x t e r n a l - r e s i z e r .   F o r   e x a m p l e ,   a n   e x i s t i n g   P e r s i s t e n t V o l u m e C l a i m   i s   u s i n g   a   V o l u m e A t t r i b u t e s C l a s s   n a m e d   s i l v e r :   a p i V e r s i o n :   v 1   k i n d :   P e r s i s t e n t V o l u m e C l a i m   m e t a d a t a :   n a m e :   t e s t - p v - c l a i m   s p e c :   …   v o l u m e A t t r i b u t e s C l a s s N a m e :   s i l v e r   …   A   n e w   V o l u m e A t t r i b u t e s C l a s s   g o l d   i s   a v a i l a b l e   i n   t h e   c l u s t e r :   a p i V e r s i o n :   s t o r a g e . k 8 s . i o / v 1   k i n d :   V o l u m e A t t r i b u t e s C l a s s   m e t a d a t a :   n a m e :   g o l d   d r i v e r N a m e :   p d . c s i . s t o r a g e . g k e . i o   p a r a m e t e r s :   i o p s :   " 4 0 0 0 "   t h r o u g h p u t :   " 6 0 "   T h e   e n d   u s e r   c a n   u p d a t e   t h e   P V C   w i t h   t h e   n e w   V o l u m e A t t r i b u t e s C l a s s   g o l d   a n d   a p p l y :   a p i V e r s i o n :   v 1   k i n d :   P e r s i s t e n t V o l u m e C l a i m   m e t a d a t a :   n a m e :   t e s t - p v - c l a i m   s p e c :   …   v o l u m e A t t r i b u t e s C l a s s N a m e :   g o l d   …   T o   u n d e r s t a n d   h o w   t h e   r e s i z e r   w o r k s   w i t h   V o l u m e A t t r i b u t e s C l a s s ,   r e f e r   t o   t h e   C S I   e x t e r n a l - r e s i z e r   d o c u m e n t a t i o n .


Question: What is Parameters?

Answer: V o l u m e A t t r i b u t e C l a s s e s   h a v e   p a r a m e t e r s   t h a t   d e s c r i b e   v o l u m e s   b e l o n g i n g   t o   t h e m .   D i f f e r e n t   p a r a m e t e r s   m a y   b e   a c c e p t e d   d e p e n d i n g   o n   t h e   p r o v i s i o n e r   o r   t h e   r e s i z e r .   F o r   e x a m p l e ,   t h e   v a l u e   4 0 0 0 ,   f o r   t h e   p a r a m e t e r   i o p s ,   a n d   t h e   p a r a m e t e r   t h r o u g h p u t   a r e   s p e c i f i c   t o   G C E   P D .   W h e n   a   p a r a m e t e r   i s   o m i t t e d ,   t h e   d e f a u l t   i s   u s e d   a t   v o l u m e   p r o v i s i o n i n g .   I f   a   u s e r   a p p l i e s   t h e   P V C   w i t h   a   d i f f e r e n t   V o l u m e A t t r i b u t e s C l a s s   w i t h   o m i t t e d   p a r a m e t e r s ,   t h e   d e f a u l t   v a l u e   o f   t h e   p a r a m e t e r s   m a y   b e   u s e d   d e p e n d i n g   o n   t h e   C S I   d r i v e r   i m p l e m e n t a t i o n .   P l e a s e   r e f e r   t o   t h e   r e l a t e d   C S I   d r i v e r   d o c u m e n t a t i o n   f o r   m o r e   d e t a i l s .   T h e r e   c a n   b e   a t   m o s t   5 1 2   p a r a m e t e r s   d e f i n e d   f o r   a   V o l u m e A t t r i b u t e s C l a s s .   T h e   t o t a l   l e n g t h   o f   t h e   p a r a m e t e r s   o b j e c t   i n c l u d i n g   i t s   k e y s   a n d   v a l u e s   c a n n o t   e x c e e d   2 5 6   K i B .


Question: What is Set up an Extension API Server?

Answer: Set up an Extension API ServerSetting up an extension API server to work with the aggregation layer allows the Kubernetes apiserver to be extended with additional APIs, which are not part of the core Kubernetes APIs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.You must configure the aggregation layer and enable the apiserver flags.Set up an extension api-server to work with the aggregation layerThe following steps describe how to set up an extension-apiserver at a high level. These steps apply regardless if you're using YAML configs or using APIs. An attempt is made to specifically identify any differences between the two. For a concrete example of how they can be implemented using YAML configs, you can look at the sample-apiserver in the Kubernetes repo.Alternatively, you can use an existing 3rd party solution, such as apiserver-builder, which should generate a skeleton and automate all of the following steps for you.Make sure the APIService API is enabled (check --runtime-config). It should be on by default, unless it's been deliberately turned off in your cluster.You may need to make an RBAC rule allowing you to add APIService objects, or get your cluster administrator to make one. (Since API extensions affect the entire cluster, it is not recommended to do testing/development/debug of an API extension in a live cluster.)Create the Kubernetes namespace you want to run your extension api-service in.Create/get a CA cert to be used to sign the server cert the extension api-server uses for HTTPS.Create a server cert/key for the api-server to use for HTTPS. This cert should be signed by the above CA. It should also have a CN of the Kube DNS name. This is derived from the Kubernetes service and be of the form <service name>.<service name namespace>.svcCreate a Kubernetes secret with the server cert/key in your namespace.Create a Kubernetes deployment for the extension api-server and make sure you are loading the secret as a volume. It should contain a reference to a working image of your extension api-server. The deployment should also be in your namespace.Make sure that your extension-apiserver loads those certs from that volume and that they are used in the HTTPS handshake.Create a Kubernetes service account in your namespace.Create a Kubernetes cluster role for the operations you want to allow on your resources.Create a Kubernetes cluster role binding from the service account in your namespace to the cluster role you created.Create a Kubernetes cluster role binding from the service account in your namespace to the sy


Question: How does Set up an Extension API Server work?

Answer: Set up an Extension API ServerSetting up an extension API server to work with the aggregation layer allows the Kubernetes apiserver to be extended with additional APIs, which are not part of the core Kubernetes APIs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.You must configure the aggregation layer and enable the apiserver flags.Set up an extension api-server to work with the aggregation layerThe following steps describe how to set up an extension-apiserver at a high level. These steps apply regardless if you're using YAML configs or using APIs. An attempt is made to specifically identify any differences between the two. For a concrete example of how they can be implemented using YAML configs, you can look at the sample-apiserver in the Kubernetes repo.Alternatively, you can use an existing 3rd party solution, such as apiserver-builder, which should generate a skeleton and automate all of the following steps for you.Make sure the APIService API is enabled (check --runtime-config). It should be on by default, unless it's been deliberately turned off in your cluster.You may need to make an RBAC rule allowing you to add APIService objects, or get your cluster administrator to make one. (Since API extensions affect the entire cluster, it is not recommended to do testing/development/debug of an API extension in a live cluster.)Create the Kubernetes namespace you want to run your extension api-service in.Create/get a CA cert to be used to sign the server cert the extension api-server uses for HTTPS.Create a server cert/key for the api-server to use for HTTPS. This cert should be signed by the above CA. It should also have a CN of the Kube DNS name. This is derived from the Kubernetes service and be of the form <service name>.<service name namespace>.svcCreate a Kubernetes secret with the server cert/key in your namespace.Create a Kubernetes deployment for the extension api-server and make sure you are loading the secret as a volume. It should contain a reference to a working image of your extension api-server. The deployment should also be in your namespace.Make sure that your extension-apiserver loads those certs from that volume and that they are used in the HTTPS handshake.Create a Kubernetes service account in your namespace.Create a Kubernetes cluster role for the operations you want to allow on your resources.Create a Kubernetes cluster role binding from the service account in your namespace to the cluster role you created.Create a Kubernetes cluster role binding from the service account in your namespace to the sy


Question: When would you use Set up an Extension API Server?

Answer: Set up an Extension API ServerSetting up an extension API server to work with the aggregation layer allows the Kubernetes apiserver to be extended with additional APIs, which are not part of the core Kubernetes APIs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.You must configure the aggregation layer and enable the apiserver flags.Set up an extension api-server to work with the aggregation layerThe following steps describe how to set up an extension-apiserver at a high level. These steps apply regardless if you're using YAML configs or using APIs. An attempt is made to specifically identify any differences between the two. For a concrete example of how they can be implemented using YAML configs, you can look at the sample-apiserver in the Kubernetes repo.Alternatively, you can use an existing 3rd party solution, such as apiserver-builder, which should generate a skeleton and automate all of the following steps for you.Make sure the APIService API is enabled (check --runtime-config). It should be on by default, unless it's been deliberately turned off in your cluster.You may need to make an RBAC rule allowing you to add APIService objects, or get your cluster administrator to make one. (Since API extensions affect the entire cluster, it is not recommended to do testing/development/debug of an API extension in a live cluster.)Create the Kubernetes namespace you want to run your extension api-service in.Create/get a CA cert to be used to sign the server cert the extension api-server uses for HTTPS.Create a server cert/key for the api-server to use for HTTPS. This cert should be signed by the above CA. It should also have a CN of the Kube DNS name. This is derived from the Kubernetes service and be of the form <service name>.<service name namespace>.svcCreate a Kubernetes secret with the server cert/key in your namespace.Create a Kubernetes deployment for the extension api-server and make sure you are loading the secret as a volume. It should contain a reference to a working image of your extension api-server. The deployment should also be in your namespace.Make sure that your extension-apiserver loads those certs from that volume and that they are used in the HTTPS handshake.Create a Kubernetes service account in your namespace.Create a Kubernetes cluster role for the operations you want to allow on your resources.Create a Kubernetes cluster role binding from the service account in your namespace to the cluster role you created.Create a Kubernetes cluster role binding from the service account in your namespace to the sy


Question: What are the benefits of Set up an Extension API Server?

Answer: Set up an Extension API ServerSetting up an extension API server to work with the aggregation layer allows the Kubernetes apiserver to be extended with additional APIs, which are not part of the core Kubernetes APIs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.You must configure the aggregation layer and enable the apiserver flags.Set up an extension api-server to work with the aggregation layerThe following steps describe how to set up an extension-apiserver at a high level. These steps apply regardless if you're using YAML configs or using APIs. An attempt is made to specifically identify any differences between the two. For a concrete example of how they can be implemented using YAML configs, you can look at the sample-apiserver in the Kubernetes repo.Alternatively, you can use an existing 3rd party solution, such as apiserver-builder, which should generate a skeleton and automate all of the following steps for you.Make sure the APIService API is enabled (check --runtime-config). It should be on by default, unless it's been deliberately turned off in your cluster.You may need to make an RBAC rule allowing you to add APIService objects, or get your cluster administrator to make one. (Since API extensions affect the entire cluster, it is not recommended to do testing/development/debug of an API extension in a live cluster.)Create the Kubernetes namespace you want to run your extension api-service in.Create/get a CA cert to be used to sign the server cert the extension api-server uses for HTTPS.Create a server cert/key for the api-server to use for HTTPS. This cert should be signed by the above CA. It should also have a CN of the Kube DNS name. This is derived from the Kubernetes service and be of the form <service name>.<service name namespace>.svcCreate a Kubernetes secret with the server cert/key in your namespace.Create a Kubernetes deployment for the extension api-server and make sure you are loading the secret as a volume. It should contain a reference to a working image of your extension api-server. The deployment should also be in your namespace.Make sure that your extension-apiserver loads those certs from that volume and that they are used in the HTTPS handshake.Create a Kubernetes service account in your namespace.Create a Kubernetes cluster role for the operations you want to allow on your resources.Create a Kubernetes cluster role binding from the service account in your namespace to the cluster role you created.Create a Kubernetes cluster role binding from the service account in your namespace to the sy


Question: What is Set up an Extension API Server?

Answer: S e t t i n g   u p   a n   e x t e n s i o n   A P I   s e r v e r   t o   w o r k   w i t h   t h e   a g g r e g a t i o n   l a y e r   a l l o w s   t h e   K u b e r n e t e s   a p i s e r v e r   t o   b e   e x t e n d e d   w i t h   a d d i t i o n a l   A P I s ,   w h i c h   a r e   n o t   p a r t   o f   t h e   c o r e   K u b e r n e t e s   A P I s .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   m u s t   c o n f i g u r e   t h e   a g g r e g a t i o n   l a y e r   a n d   e n a b l e   t h e   a p i s e r


Question: What is Set up an extension api-server to work with the aggregation layer?

Answer: T h e   f o l l o w i n g   s t e p s   d e s c r i b e   h o w   t o   s e t   u p   a n   e x t e n s i o n - a p i s e r v e r   a t   a   h i g h   l e v e l .   T h e s e   s t e p s   a p p l y   r e g a r d l e s s   i f   y o u ' r e   u s i n g   Y A M L   c o n f i g s   o r   u s i n g   A P I s .   A n   a t t e m p t   i s   m a d e   t o   s p e c i f i c a l l y   i d e n t i f y   a n y   d i f f e r e n c e s   b e t w e e n   t h e   t w o .   F o r   a   c o n c r e t e   e x a m p l e   o f   h o w   t h e y   c a n   b e   i m p l e m e n t e d   u s i n g   Y A M L   c o n f i g s ,   y o u   c a n   l o o k   a t   t h e   s a m p l e - a p i s e r v e r   i n   t h e   K u b e r n e t e s   r e p o .   A l t e r n a t i v e l y ,   y o u   c a n   u s e   a n   e x i s t i n g   3 r d   p a r t y   s o l u t i o n ,   s u c h   a s   a p i s e r v e r - b u i l d e r ,   w h i c h   s h o u l d   g e n e r a t e   a   s k e l e t o n   a n d   a u t o m a t e   a l l   o f   t h e   f o l l o w i n g   s t e p s   f o r   y o u .   M a k e   s u r e   t h e   A P I S e r v i c e   A P I   i s   e n a b l e d   ( c h e c k   - - r u n t i m e - c o n f i g ) .   I t   s h o u l d   b e   o n   b y   d e f a u l t ,   u n l e s s   i t ' s   b e e n   d e l i b e r a t e l y   t u r n e d   o f f   i n   y o u r   c l u s t e r . Y o u   m a y   n e e d   t o   m a k e   a n   R B A C   r u l e   a l l o w i n g   y o u   t o   a d d   A P I S e r v i c e   o b j e c t s ,   o r   g e t   y o u r   c l u s t e r   a d m i n i s t r a t o r   t o   m a k e   o n e .   ( S i n c e   A P I   e x t e n s i o n s   a f f e c t   t h e   e n t i r e   c l u s t e r ,   i t   i s   n o t   r e c o m m e n d e d   t o   d o   t e s t i n g / d e v e l o p m e n t / d e b u g   o f   a n   A P I   e x t e n s i o n   i n   a   l i v e   c l u s t e r . ) C r e a t e   t h e   K u b e r n e t e s   n a m e s p a c e   y o u   w a n t   t o   r u n   y o


Question: What is What's next?

Answer: W a l k   t h r o u g h   t h e   s t e p s   t o   c o n f i g u r e   t h e   A P I   a g g r e g a t i o n   l a y e r   a n d   e n a b l e   t h e   a p i s e r v e r   f l a g s . F o r   a   h i g h   l e v e l   o v e r v i e w ,   s e e   E x t e n d i n g   t h e   K u b e r n e t e s   A P I   w i t h   t h e   a g g r e g a t i o n   l a y e r . L e a r n   h o w   t o   E x t e n d   t h e   K u b e r n e t e s   A P I   u s i n g   C u s t o m   R e s o u r c e   D e f i n i t i o n s .


Question: What is Kubelet CredentialProvider (v1)?

Answer: Kubelet CredentialProvider (v1)Resource TypesCredentialProviderRequestCredentialProviderResponseCredentialProviderRequestCredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderRequestimage [Required]stringimage is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.serviceAccountToken [Required]stringserviceAccountToken is the service account token bound to the pod for which the image is being pulled. This token is only sent to the plugin if the tokenAttributes.serviceAccountTokenAudience field is configured in the kubelet's credential provider configuration.serviceAccountAnnotations [Required]map[string]stringserviceAccountAnnotations is a map of annotations on the service account bound to the pod for which the image is being pulled. The list of annotations in the service account that need to be passed to the plugin is configured in the kubelet's credential provider configuration.CredentialProviderResponseCredentialProviderResponse holds credentials that the kubelet should use for the specified image provided in the original request. Kubelet will read the response from the plugin via stdout. This response should be set to the same apiVersion as CredentialProviderRequest.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderResponsecacheKeyType [Required]PluginCacheKeyTypecacheKeyType indicates the type of caching key to use based on the image provided in the request. There are three valid values for the cache key type: Image, Registry, and Global. If an invalid value is specified, the response will NOT be used by the kubelet.cacheDurationmeta/v1.DurationcacheDuration indicates the duration the provided credentials should be cached for. The kubelet will use this field to set the in-memory cache duration for credentials in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.authmap[string]AuthConfigauth is a map containing authentication information passed into the kubelet. Each key is a match image string (more on this below). The corresponding authConfig value should be valid for all images that match against this key. A plugin should set this field to null if no valid credentials can be returned for the requested image.Each key in the map is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported as subdomains like '*.k8s.io' or 'k8s.*.io', and top-level-domains such as 'k8s.*'. Matching partia


Question: How does Kubelet CredentialProvider (v1) work?

Answer: Kubelet CredentialProvider (v1)Resource TypesCredentialProviderRequestCredentialProviderResponseCredentialProviderRequestCredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderRequestimage [Required]stringimage is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.serviceAccountToken [Required]stringserviceAccountToken is the service account token bound to the pod for which the image is being pulled. This token is only sent to the plugin if the tokenAttributes.serviceAccountTokenAudience field is configured in the kubelet's credential provider configuration.serviceAccountAnnotations [Required]map[string]stringserviceAccountAnnotations is a map of annotations on the service account bound to the pod for which the image is being pulled. The list of annotations in the service account that need to be passed to the plugin is configured in the kubelet's credential provider configuration.CredentialProviderResponseCredentialProviderResponse holds credentials that the kubelet should use for the specified image provided in the original request. Kubelet will read the response from the plugin via stdout. This response should be set to the same apiVersion as CredentialProviderRequest.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderResponsecacheKeyType [Required]PluginCacheKeyTypecacheKeyType indicates the type of caching key to use based on the image provided in the request. There are three valid values for the cache key type: Image, Registry, and Global. If an invalid value is specified, the response will NOT be used by the kubelet.cacheDurationmeta/v1.DurationcacheDuration indicates the duration the provided credentials should be cached for. The kubelet will use this field to set the in-memory cache duration for credentials in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.authmap[string]AuthConfigauth is a map containing authentication information passed into the kubelet. Each key is a match image string (more on this below). The corresponding authConfig value should be valid for all images that match against this key. A plugin should set this field to null if no valid credentials can be returned for the requested image.Each key in the map is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported as subdomains like '*.k8s.io' or 'k8s.*.io', and top-level-domains such as 'k8s.*'. Matching partia


Question: When would you use Kubelet CredentialProvider (v1)?

Answer: Kubelet CredentialProvider (v1)Resource TypesCredentialProviderRequestCredentialProviderResponseCredentialProviderRequestCredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderRequestimage [Required]stringimage is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.serviceAccountToken [Required]stringserviceAccountToken is the service account token bound to the pod for which the image is being pulled. This token is only sent to the plugin if the tokenAttributes.serviceAccountTokenAudience field is configured in the kubelet's credential provider configuration.serviceAccountAnnotations [Required]map[string]stringserviceAccountAnnotations is a map of annotations on the service account bound to the pod for which the image is being pulled. The list of annotations in the service account that need to be passed to the plugin is configured in the kubelet's credential provider configuration.CredentialProviderResponseCredentialProviderResponse holds credentials that the kubelet should use for the specified image provided in the original request. Kubelet will read the response from the plugin via stdout. This response should be set to the same apiVersion as CredentialProviderRequest.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderResponsecacheKeyType [Required]PluginCacheKeyTypecacheKeyType indicates the type of caching key to use based on the image provided in the request. There are three valid values for the cache key type: Image, Registry, and Global. If an invalid value is specified, the response will NOT be used by the kubelet.cacheDurationmeta/v1.DurationcacheDuration indicates the duration the provided credentials should be cached for. The kubelet will use this field to set the in-memory cache duration for credentials in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.authmap[string]AuthConfigauth is a map containing authentication information passed into the kubelet. Each key is a match image string (more on this below). The corresponding authConfig value should be valid for all images that match against this key. A plugin should set this field to null if no valid credentials can be returned for the requested image.Each key in the map is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported as subdomains like '*.k8s.io' or 'k8s.*.io', and top-level-domains such as 'k8s.*'. Matching partia


Question: What are the benefits of Kubelet CredentialProvider (v1)?

Answer: Kubelet CredentialProvider (v1)Resource TypesCredentialProviderRequestCredentialProviderResponseCredentialProviderRequestCredentialProviderRequest includes the image that the kubelet requires authentication for. Kubelet will pass this request object to the plugin via stdin. In general, plugins should prefer responding with the same apiVersion they were sent.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderRequestimage [Required]stringimage is the container image that is being pulled as part of the credential provider plugin request. Plugins may optionally parse the image to extract any information required to fetch credentials.serviceAccountToken [Required]stringserviceAccountToken is the service account token bound to the pod for which the image is being pulled. This token is only sent to the plugin if the tokenAttributes.serviceAccountTokenAudience field is configured in the kubelet's credential provider configuration.serviceAccountAnnotations [Required]map[string]stringserviceAccountAnnotations is a map of annotations on the service account bound to the pod for which the image is being pulled. The list of annotations in the service account that need to be passed to the plugin is configured in the kubelet's credential provider configuration.CredentialProviderResponseCredentialProviderResponse holds credentials that the kubelet should use for the specified image provided in the original request. Kubelet will read the response from the plugin via stdout. This response should be set to the same apiVersion as CredentialProviderRequest.FieldDescriptionapiVersionstringcredentialprovider.kubelet.k8s.io/v1kindstringCredentialProviderResponsecacheKeyType [Required]PluginCacheKeyTypecacheKeyType indicates the type of caching key to use based on the image provided in the request. There are three valid values for the cache key type: Image, Registry, and Global. If an invalid value is specified, the response will NOT be used by the kubelet.cacheDurationmeta/v1.DurationcacheDuration indicates the duration the provided credentials should be cached for. The kubelet will use this field to set the in-memory cache duration for credentials in the AuthConfig. If null, the kubelet will use defaultCacheDuration provided in CredentialProviderConfig. If set to 0, the kubelet will not cache the provided AuthConfig.authmap[string]AuthConfigauth is a map containing authentication information passed into the kubelet. Each key is a match image string (more on this below). The corresponding authConfig value should be valid for all images that match against this key. A plugin should set this field to null if no valid credentials can be returned for the requested image.Each key in the map is a pattern which can optionally contain a port and a path. Globs can be used in the domain, but not in the port or the path. Globs are supported as subdomains like '*.k8s.io' or 'k8s.*.io', and top-level-domains such as 'k8s.*'. Matching partia


Question: What is Resource Types?

Answer: C r e d e n t i a l P r o v i d e r R e q u e s t C r e d e n t i a l P r o v i d e r R e s p o n s e


Question: What is CredentialProviderRequest?

Answer: C r e d e n t i a l P r o v i d e r R e q u e s t   i n c l u d e s   t h e   i m a g e   t h a t   t h e   k u b e l e t   r e q u i r e s   a u t h e n t i c a t i o n   f o r .   K u b e l e t   w i l l   p a s s   t h i s   r e q u e s t   o b j e c t   t o   t h e   p l u g i n   v i a   s t d i n .   I n   g e n e r a l ,   p l u g i n s   s h o u l d   p r e f e r   r e s p o n d i n g   w i t h   t h e   s a m e   a p i V e r s i o n   t h e y   w e r e   s e n t .   i m a g e   i s   t h e   c o n t a i n e r   i m a g e   t h a t   i s   b e i n g   p u l l e d   a s   p a r t   o f   t h e   c r e d e n t i a l   p r o v i d e r   p l u g i n   r e q u e s t .   P l u g i n s   m a y   o p t i o n a l l y   p a r s e   t h e   i m a g e   t o   e x t r a c t   a n y   i n f o r m a t i o n   r e q u i r e d   t o   f e t c h   c r e d e n t i a l s .   s e r v i c e A c c o u n t T o k e n   i s   t h e   s e r v i c e   a c c o u n t   t o k e n   b o u n d   t o   t h e   p o d   f o r   w h i c h   t h e   i m a g e   i s   b e i n g   p u l l e d .   T h i s   t o k e n   i s   o n l y   s e n t   t o   t h e   p l u g i n   i f   t h e   t o k e n A t t r i b u t e s . s e r v i c e A c c o u n t T o k e n A u d i e n c e   f i e l d   i s   c o n f i g u r e d   i n   t h e   k u b e l e t ' s   c r e d e n t i a l   p r o v i d e r   c o n f i g u r a t i o n .   s e r v i c e A c c o u n t A n n o t a t i o n s   i s   a   m a p   o f   a n n o t a t i o n s   o n   t h e   s e r v i c e   a c c o u n t   b o u n d   t o   t h e   p o d   f o r   w h i c h   t h e   i m a g e   i s   b e i n g   p u l l e d .   T h e   l i s t   o f   a n n o t a t i o n s   i n   t h e   s e r v i c e   a c c o u n t   t h a t   n e e d   t o   b e   p a s s e d   t o   t h e   p l u g i n   i s   c o n f i g u r e d   i n   t h e   k u b e l e t ' s   c r e d e n t i a l   p r o v i d e r   c o n f i g u r a t i o n .


Question: What is CredentialProviderResponse?

Answer: C r e d e n t i a l P r o v i d e r R e s p o n s e   h o l d s   c r e d e n t i a l s   t h a t   t h e   k u b e l e t   s h o u l d   u s e   f o r   t h e   s p e c i f i e d   i m a g e   p r o v i d e d   i n   t h e   o r i g i n a l   r e q u e s t .   K u b e l e t   w i l l   r e a d   t h e   r e s p o n s e   f r o m   t h e   p l u g i n   v i a   s t d o u t .   T h i s   r e s p o n s e   s h o u l d   b e   s e t   t o   t h e   s a m e   a p i V e r s i o n   a s   C r e d e n t i a l P r o v i d e r R e q u e s t .   c a c h e K e y T y p e   i n d i c a t e s   t h e   t y p e   o f   c a c h i n g   k e y   t o   u s e   b a s e d   o n   t h e   i m a g e   p r o v i d e d   i n   t h e   r e q u e s t .   T h e r e   a r e   t h r e e   v a l i d   v a l u e s   f o r   t h e   c a c h e   k e y   t y p e :   I m a g e ,   R e g i s t r y ,   a n d   G l o b a l .   I f   a n   i n v a l i d   v a l u e   i s   s p e c i f i e d ,   t h e   r e s p o n s e   w i l l   N O T   b e   u s e d   b y   t h e   k u b e l e t .   c a c h e D u r a t i o n   i n d i c a t e s   t h e   d u r a t i o n   t h e   p r o v i d e d   c r e d e n t i a l s   s h o u l d   b e   c a c h e d   f o r .   T h e   k u b e l e t   w i l l   u s e   t h i s   f i e l d   t o   s e t   t h e   i n - m e m o r y   c a c h e   d u r a t i o n   f o r   c r e d e n t i a l s   i n   t h e   A u t h C o n f i g .   I f   n u l l ,   t h e   k u b e l e t   w i l l   u s e   d e f a u l t C a c h e D u r a t i o n   p r o v i d e d   i n   C r e d e n t i a l P r o v i d e r C o n f i g .   I f   s e t   t o   0 ,   t h e   k u b e l e t   w i l l   n o t   c a c h e   t h e   p r o v i d e d   A u t h C o n f i g .   a u t h   i s   a   m a p   c o n t a i n i n g   a u t h e n t i c a t i o n   i n f o r m a t i o n   p a s s e d   i n t o   t h e   k u b e l e t .   E a c h   k e y   i s   a   m a t c h   i m a g e   s t r i n g   ( m o r e   o n   t h i s   b e l o


Question: What is AuthConfig?

Answer: A p p e a r s   i n :   C r e d e n t i a l P r o v i d e r R e s p o n s e   A u t h C o n f i g   c o n t a i n s   a u t h e n t i c a t i o n   i n f o r m a t i o n   f o r   a   c o n t a i n e r   r e g i s t r y .   O n l y   u s e r n a m e / p a s s w o r d   b a s e d   a u t h e n t i c a t i o n   i s   s u p p o r t e d   t o d a y ,   b u t   m o r e   a u t h e n t i c a t i o n   m e c h a n i s m s   m a y   b e   a d d e d   i n   t h e   f u t u r e .   u s e r n a m e   i s   t h e   u s e r n a m e   u s e d   f o r   a u t h e n t i c a t i n g   t o   t h e   c o n t a i n e r   r e g i s t r y   A n   e m p t y   u s e r n a m e   i s   v a l i d .   p a s s w o r d   i s   t h e   p a s s w o r d   u s e d   f o r   a u t h e n t i c a t i n g   t o   t h e   c o n t a i n e r   r e g i s t r y   A n   e m p t y   p a s s w o r d   i s   v a l i d .


Question: What is PluginCacheKeyType?

Answer: ( A l i a s   o f   s t r i n g )   A p p e a r s   i n :   C r e d e n t i a l P r o v i d e r R e s p o n s e   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Reference?

Answer: This section of the Kubernetes documentation contains references.API ReferenceGlossary - a comprehensive, standardized list of Kubernetes terminologyKubernetes API ReferenceOne-page API Reference for Kubernetes v1.34Using The Kubernetes API - overview of the API for Kubernetes.API access control - details on how Kubernetes controls API accessWell-Known Labels, Annotations and TaintsOfficially supported client librariesTo call the Kubernetes API from a programming language, you can use client libraries. Officially supported client libraries:Kubernetes Go client libraryKubernetes Python client libraryKubernetes Java client libraryKubernetes JavaScript client libraryKubernetes C# client libraryKubernetes Haskell client libraryCLIkubectl - Main CLI tool for running commands and managing Kubernetes clusters.JSONPath - Syntax guide for using JSONPath expressions with kubectl.kubeadm - CLI tool to easily provision a secure Kubernetes cluster.Componentskubelet - The primary agent that runs on each node. The kubelet takes a set of PodSpecs and ensures that the described containers are running and healthy.kube-apiserver - REST API that validates and configures data for API objects such as pods, services, replication controllers.kube-controller-manager - Daemon that embeds the core control loops shipped with Kubernetes.kube-proxy - Can do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across a set of back-ends.kube-scheduler - Scheduler that manages availability, performance, and capacity.Scheduler PoliciesScheduler ProfilesList of ports and protocols that should be open on control plane and worker nodesConfig APIsThis section hosts the documentation for "unpublished" APIs which are used to configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster.kubeconfig (v1)kuberc (v1alpha1)kube-apiserver admission (v1)kube-apiserver configuration (v1alpha1) andkube-apiserver configuration (v1beta1) and kube-apiserver configuration (v1)kube-apiserver event rate limit (v1alpha1)kubelet configuration (v1alpha1) and kubelet configuration (v1beta1) kubelet configuration (v1)kubelet credential providers (v1) kube-scheduler configuration (v1)kube-controller-manager configuration (v1alpha1)kube-proxy configuration (v1alpha1)audit.k8s.io/v1 APIClient authentication API (v1beta1) and Client authentication API (v1)WebhookAdmission configuration (v1)ImagePolicy API (v1alpha1)Config API for kubeadmv1beta3v1beta4External APIsThese are the APIs defined by the Kubernetes project, but are not implemented by the core project:Metrics API (v1beta1)Custom Metrics API (v1beta2)External Metrics API (v1beta1)Design DocsAn archive of the design docs for Kubernetes functionality. Good starting points are Kubernetes Architecture and Kubernetes Design Overview.


Question: How does Reference work?

Answer: This section of the Kubernetes documentation contains references.API ReferenceGlossary - a comprehensive, standardized list of Kubernetes terminologyKubernetes API ReferenceOne-page API Reference for Kubernetes v1.34Using The Kubernetes API - overview of the API for Kubernetes.API access control - details on how Kubernetes controls API accessWell-Known Labels, Annotations and TaintsOfficially supported client librariesTo call the Kubernetes API from a programming language, you can use client libraries. Officially supported client libraries:Kubernetes Go client libraryKubernetes Python client libraryKubernetes Java client libraryKubernetes JavaScript client libraryKubernetes C# client libraryKubernetes Haskell client libraryCLIkubectl - Main CLI tool for running commands and managing Kubernetes clusters.JSONPath - Syntax guide for using JSONPath expressions with kubectl.kubeadm - CLI tool to easily provision a secure Kubernetes cluster.Componentskubelet - The primary agent that runs on each node. The kubelet takes a set of PodSpecs and ensures that the described containers are running and healthy.kube-apiserver - REST API that validates and configures data for API objects such as pods, services, replication controllers.kube-controller-manager - Daemon that embeds the core control loops shipped with Kubernetes.kube-proxy - Can do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across a set of back-ends.kube-scheduler - Scheduler that manages availability, performance, and capacity.Scheduler PoliciesScheduler ProfilesList of ports and protocols that should be open on control plane and worker nodesConfig APIsThis section hosts the documentation for "unpublished" APIs which are used to configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster.kubeconfig (v1)kuberc (v1alpha1)kube-apiserver admission (v1)kube-apiserver configuration (v1alpha1) andkube-apiserver configuration (v1beta1) and kube-apiserver configuration (v1)kube-apiserver event rate limit (v1alpha1)kubelet configuration (v1alpha1) and kubelet configuration (v1beta1) kubelet configuration (v1)kubelet credential providers (v1) kube-scheduler configuration (v1)kube-controller-manager configuration (v1alpha1)kube-proxy configuration (v1alpha1)audit.k8s.io/v1 APIClient authentication API (v1beta1) and Client authentication API (v1)WebhookAdmission configuration (v1)ImagePolicy API (v1alpha1)Config API for kubeadmv1beta3v1beta4External APIsThese are the APIs defined by the Kubernetes project, but are not implemented by the core project:Metrics API (v1beta1)Custom Metrics API (v1beta2)External Metrics API (v1beta1)Design DocsAn archive of the design docs for Kubernetes functionality. Good starting points are Kubernetes Architecture and Kubernetes Design Overview.


Question: When would you use Reference?

Answer: This section of the Kubernetes documentation contains references.API ReferenceGlossary - a comprehensive, standardized list of Kubernetes terminologyKubernetes API ReferenceOne-page API Reference for Kubernetes v1.34Using The Kubernetes API - overview of the API for Kubernetes.API access control - details on how Kubernetes controls API accessWell-Known Labels, Annotations and TaintsOfficially supported client librariesTo call the Kubernetes API from a programming language, you can use client libraries. Officially supported client libraries:Kubernetes Go client libraryKubernetes Python client libraryKubernetes Java client libraryKubernetes JavaScript client libraryKubernetes C# client libraryKubernetes Haskell client libraryCLIkubectl - Main CLI tool for running commands and managing Kubernetes clusters.JSONPath - Syntax guide for using JSONPath expressions with kubectl.kubeadm - CLI tool to easily provision a secure Kubernetes cluster.Componentskubelet - The primary agent that runs on each node. The kubelet takes a set of PodSpecs and ensures that the described containers are running and healthy.kube-apiserver - REST API that validates and configures data for API objects such as pods, services, replication controllers.kube-controller-manager - Daemon that embeds the core control loops shipped with Kubernetes.kube-proxy - Can do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across a set of back-ends.kube-scheduler - Scheduler that manages availability, performance, and capacity.Scheduler PoliciesScheduler ProfilesList of ports and protocols that should be open on control plane and worker nodesConfig APIsThis section hosts the documentation for "unpublished" APIs which are used to configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster.kubeconfig (v1)kuberc (v1alpha1)kube-apiserver admission (v1)kube-apiserver configuration (v1alpha1) andkube-apiserver configuration (v1beta1) and kube-apiserver configuration (v1)kube-apiserver event rate limit (v1alpha1)kubelet configuration (v1alpha1) and kubelet configuration (v1beta1) kubelet configuration (v1)kubelet credential providers (v1) kube-scheduler configuration (v1)kube-controller-manager configuration (v1alpha1)kube-proxy configuration (v1alpha1)audit.k8s.io/v1 APIClient authentication API (v1beta1) and Client authentication API (v1)WebhookAdmission configuration (v1)ImagePolicy API (v1alpha1)Config API for kubeadmv1beta3v1beta4External APIsThese are the APIs defined by the Kubernetes project, but are not implemented by the core project:Metrics API (v1beta1)Custom Metrics API (v1beta2)External Metrics API (v1beta1)Design DocsAn archive of the design docs for Kubernetes functionality. Good starting points are Kubernetes Architecture and Kubernetes Design Overview.


Question: What are the benefits of Reference?

Answer: This section of the Kubernetes documentation contains references.API ReferenceGlossary - a comprehensive, standardized list of Kubernetes terminologyKubernetes API ReferenceOne-page API Reference for Kubernetes v1.34Using The Kubernetes API - overview of the API for Kubernetes.API access control - details on how Kubernetes controls API accessWell-Known Labels, Annotations and TaintsOfficially supported client librariesTo call the Kubernetes API from a programming language, you can use client libraries. Officially supported client libraries:Kubernetes Go client libraryKubernetes Python client libraryKubernetes Java client libraryKubernetes JavaScript client libraryKubernetes C# client libraryKubernetes Haskell client libraryCLIkubectl - Main CLI tool for running commands and managing Kubernetes clusters.JSONPath - Syntax guide for using JSONPath expressions with kubectl.kubeadm - CLI tool to easily provision a secure Kubernetes cluster.Componentskubelet - The primary agent that runs on each node. The kubelet takes a set of PodSpecs and ensures that the described containers are running and healthy.kube-apiserver - REST API that validates and configures data for API objects such as pods, services, replication controllers.kube-controller-manager - Daemon that embeds the core control loops shipped with Kubernetes.kube-proxy - Can do simple TCP/UDP stream forwarding or round-robin TCP/UDP forwarding across a set of back-ends.kube-scheduler - Scheduler that manages availability, performance, and capacity.Scheduler PoliciesScheduler ProfilesList of ports and protocols that should be open on control plane and worker nodesConfig APIsThis section hosts the documentation for "unpublished" APIs which are used to configure kubernetes components or tools. Most of these APIs are not exposed by the API server in a RESTful way though they are essential for a user or an operator to use or manage a cluster.kubeconfig (v1)kuberc (v1alpha1)kube-apiserver admission (v1)kube-apiserver configuration (v1alpha1) andkube-apiserver configuration (v1beta1) and kube-apiserver configuration (v1)kube-apiserver event rate limit (v1alpha1)kubelet configuration (v1alpha1) and kubelet configuration (v1beta1) kubelet configuration (v1)kubelet credential providers (v1) kube-scheduler configuration (v1)kube-controller-manager configuration (v1alpha1)kube-proxy configuration (v1alpha1)audit.k8s.io/v1 APIClient authentication API (v1beta1) and Client authentication API (v1)WebhookAdmission configuration (v1)ImagePolicy API (v1alpha1)Config API for kubeadmv1beta3v1beta4External APIsThese are the APIs defined by the Kubernetes project, but are not implemented by the core project:Metrics API (v1beta1)Custom Metrics API (v1beta2)External Metrics API (v1beta1)Design DocsAn archive of the design docs for Kubernetes functionality. Good starting points are Kubernetes Architecture and Kubernetes Design Overview.


Question: What is Reference?

Answer: K u b e r n e t e s   D o c u m e n t a t i o n   D o c u m e n t a t i o n   A v a i l a b l e   D o c u m e n t a t i o n   V e r s i o n s   G e t t i n g   s t a r t e d   L e a r n i n g   e n v i r o n m e n t   P r o d u c t i o n   e n v i r o n m e n t   C o n t a i n e r   R u n t i m e s   I n s t a l l i n g   K u b e r n e t e s   w i t h   d e p l o y m e n t   t o o l s   B o o t s t r a p p i n g   c l u s t e r s   w i t h   k u b e a d m   I n s t a l l i n g   k u b e a d m   T r o u b l e s h o o t i n g   k u b e a d m   C r e a t i n g   a   c l u s t e r   w i t h   k u b e a d m   C u s t o m i z i n g   c o m p o n e n t s   w i t h   t h e   k u b e a d m   A P I   O p t i o n s   f o r   H i g h l y   A v a i l a b l e   T o p o l o g y   C r e a t i n g   H i g h l y   A v a i l a b l e   C l u s t e r s   w i t h   k u b e a d m   S e t   u p   a   H i g h   A v a i l a b i l i t y   e t c d   C l u s t e r   w i t h   k u b e a d m   C o n f i g u r i n g   e a c h   k u b e l e t   i n   y o u r   c l u s t e r   u s i n g   k u b e a d m   D u a l - s t a c k   s u p p o r t   w i t h   k u b e a d m   T u r n k e y   C l o u d   S o l u t i o n s   B e s t   p r a c t i c e s   C o n s i d e r a t i o n s   f o r   l a r g e   c l u s t e r s   R u n n i n g   i n   m u l t i p l e   z o n e s   V a l i d a t e   n o d e   s e t u p   E n f o r c i n g   P o d   S e c u r i t y   S t a n d a r d s   P K I   c e r t i f i c a t e s   a n d   r e q u i r e m e n t s   C o n c e p t s   O v e r v i e w   K u b e r n e t e s   C o m p o n e n t s   O b j e c t s   I n   K u b e r n e t e s   K u b e r n e t e s   O b j e c t   M a n a g e m e n t   O b j e c t   N a m e s   a n d   I D s   L a b e l s   a n d   S e l e c t o r s   N a m e s p a c e s   A n n o t a t i o n s   F i e l d   S e l e c t o r s   F i n a l i z e r s   O w n e r s   a n d   D e p e n d e n t s   R e c o m m e n d e d   L a b e l s   T h e   K u b e r n e t e s


Question: What is API Reference?

Answer: G l o s s a r y   -   a   c o m p r e h e n s i v e ,   s t a n d a r d i z e d   l i s t   o f   K u b e r n e t e s   t e r m i n o l o g y K u b e r n e t e s   A P I   R e f e r e n c e O n e - p a g e   A P I   R e f e r e n c e   f o r   K u b e r n e t e s   v 1 . 3 4 U s i n g   T h e   K u b e r n e t e s   A P I   -   o v e r v i e w   o f   t h e   A P I   f o r   K u b e r n e t e s . A P I   a c c e s s   c o n t r o l   -   d e t a i l s   o n   h o w   K u b e r n e t e s   c o n t r o l s   A P I   a c c e s s W e l l - K n o w n   L a b e l s ,   A n n o t a t i o n s   a n d   T a i n t s   G l o s s a r y   -   a   c o m p r e h e n s i v e ,   s t a n d a r d i z e d   l i s t   o f   K u b e r n e t e s   t e r m i n o l o g y   K u b e r n e t e s   A P I   R e f e r e n c e   O n e - p a g e   A P I   R e f e r e n c e   f o r   K u b e r n e t e s   v 1 . 3 4   U s i n g   T h e   K u b e r n e t e s   A P I   -   o v e r v i e w   o f   t h e   A P I   f o r   K u b e r n e t e s .   A P I   a c c e s s   c o n t r o l   -   d e t a i l s   o n   h o w   K u b e r n e t e s   c o n t r o l s   A P I   a c c e s s   W e l l - K n o w n   L a b e l s ,   A n n o t a t i o n s   a n d   T a i n t s


Question: What is Officially supported client libraries?

Answer: T o   c a l l   t h e   K u b e r n e t e s   A P I   f r o m   a   p r o g r a m m i n g   l a n g u a g e ,   y o u   c a n   u s e   c l i e n t   l i b r a r i e s .   O f f i c i a l l y   s u p p o r t e d   c l i e n t   l i b r a r i e s :   K u b e r n e t e s   G o   c l i e n t   l i b r a r y K u b e r n e t e s   P y t h o n   c l i e n t   l i b r a r y K u b e r n e t e s   J a v a   c l i e n t   l i b r a r y K u b e r n e t e s   J a v a S c r i p t   c l i e n t   l i b r a r y K u b e r n e t e s   C #   c l i e n t   l i b r a r y K u b e r n e t e s   H a s k e l l   c l i e n t   l i b r a r y


Question: What is CLI?

Answer: k u b e c t l   -   M a i n   C L I   t o o l   f o r   r u n n i n g   c o m m a n d s   a n d   m a n a g i n g   K u b e r n e t e s   c l u s t e r s . J S O N P a t h   -   S y n t a x   g u i d e   f o r   u s i n g   J S O N P a t h   e x p r e s s i o n s   w i t h   k u b e c t l . k u b e a d m   -   C L I   t o o l   t o   e a s i l y   p r o v i s i o n   a   s e c u r e   K u b e r n e t e s   c l u s t e r .   J S O N P a t h   -   S y n t a x   g u i d e   f o r   u s i n g   J S O N P a t h   e x p r e s s i o n s   w i t h   k u b e c t l .


Question: What is Components?

Answer: k u b e l e t   -   T h e   p r i m a r y   a g e n t   t h a t   r u n s   o n   e a c h   n o d e .   T h e   k u b e l e t   t a k e s   a   s e t   o f   P o d S p e c s   a n d   e n s u r e s   t h a t   t h e   d e s c r i b e d   c o n t a i n e r s   a r e   r u n n i n g   a n d   h e a l t h y . k u b e - a p i s e r v e r   -   R E S T   A P I   t h a t   v a l i d a t e s   a n d   c o n f i g u r e s   d a t a   f o r   A P I   o b j e c t s   s u c h   a s   p o d s ,   s e r v i c e s ,   r e p l i c a t i o n   c o n t r o l l e r s . k u b e - c o n t r o l l e r - m a n a g e r   -   D a e m o n   t h a t   e m b e d s   t h e   c o r e   c o n t r o l   l o o p s   s h i p p e d   w i t h   K u b e r n e t e s . k u b e - p r o x y   -   C a n   d o   s i m p l e   T C P / U D P   s t r e a m   f o r w a r d i n g   o r   r o u n d - r o b i n   T C P / U D P   f o r w a r d i n g   a c r o s s   a   s e t   o f   b a c k - e n d s . k u b e - s c h e d u l e r   -   S c h e d u l e r   t h a t   m a n a g e s   a v a i l a b i l i t y ,   p e r f o r m a n c e ,   a n d   c a p a c i t y . S c h e d u l e r   P o l i c i e s S c h e d u l e r   P r o f i l e s L i s t   o f   p o r t s   a n d   p r o t o c o l s   t h a t   s h o u l d   b e   o p e n   o n   c o n t r o l   p l a n e   a n d   w o r k e r   n o d e s   k u b e l e t   -   T h e   p r i m a r y   a g e n t   t h a t   r u n s   o n   e a c h   n o d e .   T h e   k u b e l e t   t a k e s   a   s e t   o f   P o d S p e c s   a n d   e n s u r e s   t h a t   t h e   d e s c r i b e d   c o n t a i n e r s   a r e   r u n n i n g   a n d   h e a l t h y .   k u b e - a p i s e r v e r   -   R E S T   A P I   t h a t   v a l i d a t e s   a n d   c o n f i g u r e s   d a t a   f o r   A P I   o b j e c t s   s u c h   a s   p o d s ,   s e r v i c e s ,   r e p l i c a t i o n   c o n t r o l l e r s .   k u b e - c o n t r o l l e r - m a n a g e r   -   D a e m o n   t h a t


Question: What is Config APIs?

Answer: T h i s   s e c t i o n   h o s t s   t h e   d o c u m e n t a t i o n   f o r   " u n p u b l i s h e d "   A P I s   w h i c h   a r e   u s e d   t o   c o n f i g u r e   k u b e r n e t e s   c o m p o n e n t s   o r   t o o l s .   M o s t   o f   t h e s e   A P I s   a r e   n o t   e x p o s e d   b y   t h e   A P I   s e r v e r   i n   a   R E S T f u l   w a y   t h o u g h   t h e y   a r e   e s s e n t i a l   f o r   a   u s e r   o r   a n   o p e r a t o r   t o   u s e   o r   m a n a g e   a   c l u s t e r .   k u b e c o n f i g   ( v 1 ) k u b e r c   ( v 1 a l p h a 1 ) k u b e - a p i s e r v e r   a d m i s s i o n   ( v 1 ) k u b e - a p i s e r v e r   c o n f i g u r a t i o n   ( v 1 a l p h a 1 )   a n d k u b e - a p i s e r v e r   c o n f i g u r a t i o n   ( v 1 b e t a 1 )   a n d   k u b e - a p i s e r v e r   c o n f i g u r a t i o n   ( v 1 ) k u b e - a p i s e r v e r   e v e n t   r a t e   l i m i t   ( v 1 a l p h a 1 ) k u b e l e t   c o n f i g u r a t i o n   ( v 1 a l p h a 1 )   a n d   k u b e l e t   c o n f i g u r a t i o n   ( v 1 b e t a 1 )   k u b e l e t   c o n f i g u r a t i o n   ( v 1 ) k u b e l e t   c r e d e n t i a l   p r o v i d e r s   ( v 1 )   k u b e - s c h e d u l e r   c o n f i g u r a t i o n   ( v 1 ) k u b e - c o n t r o l l e r - m a n a g e r   c o n f i g u r a t i o n   ( v 1 a l p h a 1 ) k u b e - p r o x y   c o n f i g u r a t i o n   ( v 1 a l p h a 1 ) a u d i t . k 8 s . i o / v 1   A P I C l i e n t   a u t h e n t i c a t i o n   A P I   ( v 1 b e t a 1 )   a n d   C l i e n t   a u t h e n t i c a t i o n   A P I   ( v 1 ) W e b h o o k A d m i s s i o n   c o n f i g u r a t i o n   ( v 1 ) I m a g e P o l i c y   A P I   ( v 1 a l p h a 1 )


Question: What is Config API for kubeadm?

Answer: v 1 b e t a 3 v 1 b e t a 4


Question: What is External APIs?

Answer: T h e s e   a r e   t h e   A P I s   d e f i n e d   b y   t h e   K u b e r n e t e s   p r o j e c t ,   b u t   a r e   n o t   i m p l e m e n t e d   b y   t h e   c o r e   p r o j e c t :   M e t r i c s   A P I   ( v 1 b e t a 1 ) C u s t o m   M e t r i c s   A P I   ( v 1 b e t a 2 ) E x t e r n a l   M e t r i c s   A P I   ( v 1 b e t a 1 )


Question: What is Design Docs?

Answer: A n   a r c h i v e   o f   t h e   d e s i g n   d o c s   f o r   K u b e r n e t e s   f u n c t i o n a l i t y .   G o o d   s t a r t i n g   p o i n t s   a r e   K u b e r n e t e s   A r c h i t e c t u r e   a n d   K u b e r n e t e s   D e s i g n   O v e r v i e w .


Question: What is Security?

Answer: SecurityConcepts for keeping your cloud-native workload secure.This section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read Cloud Native Security and Kubernetes for the broader context about how to secure your cluster and the applications that you're running on it.Kubernetes security mechanismsKubernetes includes several APIs and security controls, as well as ways to define policies that can form part of how you manage information security.Control plane protectionA key security mechanism for any Kubernetes cluster is to control access to the Kubernetes API.Kubernetes expects you to configure and use TLS to provide data encryption in transit within the control plane, and between the control plane and its clients. You can also enable encryption at rest for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.SecretsThe Secret API provides basic protection for configuration values that require confidentiality.Workload protectionEnforce Pod security standards to ensure that Pods and their containers are isolated appropriately. You can also use RuntimeClasses to define custom isolation if you need it.Network policies let you control network traffic between Pods, or between Pods and the network outside your cluster.You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.Admission controlAdmission controllers are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see Admission Webhook Good Practices.AuditingKubernetes audit logging provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Cloud provider securityNote: Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information.If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:Cloud provider securityIaaS ProviderLinkAlibaba Cloudhttps://www.alibabacl


Question: How does Security work?

Answer: SecurityConcepts for keeping your cloud-native workload secure.This section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read Cloud Native Security and Kubernetes for the broader context about how to secure your cluster and the applications that you're running on it.Kubernetes security mechanismsKubernetes includes several APIs and security controls, as well as ways to define policies that can form part of how you manage information security.Control plane protectionA key security mechanism for any Kubernetes cluster is to control access to the Kubernetes API.Kubernetes expects you to configure and use TLS to provide data encryption in transit within the control plane, and between the control plane and its clients. You can also enable encryption at rest for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.SecretsThe Secret API provides basic protection for configuration values that require confidentiality.Workload protectionEnforce Pod security standards to ensure that Pods and their containers are isolated appropriately. You can also use RuntimeClasses to define custom isolation if you need it.Network policies let you control network traffic between Pods, or between Pods and the network outside your cluster.You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.Admission controlAdmission controllers are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see Admission Webhook Good Practices.AuditingKubernetes audit logging provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Cloud provider securityNote: Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information.If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:Cloud provider securityIaaS ProviderLinkAlibaba Cloudhttps://www.alibabacl


Question: When would you use Security?

Answer: SecurityConcepts for keeping your cloud-native workload secure.This section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read Cloud Native Security and Kubernetes for the broader context about how to secure your cluster and the applications that you're running on it.Kubernetes security mechanismsKubernetes includes several APIs and security controls, as well as ways to define policies that can form part of how you manage information security.Control plane protectionA key security mechanism for any Kubernetes cluster is to control access to the Kubernetes API.Kubernetes expects you to configure and use TLS to provide data encryption in transit within the control plane, and between the control plane and its clients. You can also enable encryption at rest for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.SecretsThe Secret API provides basic protection for configuration values that require confidentiality.Workload protectionEnforce Pod security standards to ensure that Pods and their containers are isolated appropriately. You can also use RuntimeClasses to define custom isolation if you need it.Network policies let you control network traffic between Pods, or between Pods and the network outside your cluster.You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.Admission controlAdmission controllers are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see Admission Webhook Good Practices.AuditingKubernetes audit logging provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Cloud provider securityNote: Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information.If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:Cloud provider securityIaaS ProviderLinkAlibaba Cloudhttps://www.alibabacl


Question: What are the benefits of Security?

Answer: SecurityConcepts for keeping your cloud-native workload secure.This section of the Kubernetes documentation aims to help you learn to run workloads more securely, and about the essential aspects of keeping a Kubernetes cluster secure.Kubernetes is based on a cloud-native architecture, and draws on advice from the CNCF about good practice for cloud native information security.Read Cloud Native Security and Kubernetes for the broader context about how to secure your cluster and the applications that you're running on it.Kubernetes security mechanismsKubernetes includes several APIs and security controls, as well as ways to define policies that can form part of how you manage information security.Control plane protectionA key security mechanism for any Kubernetes cluster is to control access to the Kubernetes API.Kubernetes expects you to configure and use TLS to provide data encryption in transit within the control plane, and between the control plane and its clients. You can also enable encryption at rest for the data stored within Kubernetes control plane; this is separate from using encryption at rest for your own workloads' data, which might also be a good idea.SecretsThe Secret API provides basic protection for configuration values that require confidentiality.Workload protectionEnforce Pod security standards to ensure that Pods and their containers are isolated appropriately. You can also use RuntimeClasses to define custom isolation if you need it.Network policies let you control network traffic between Pods, or between Pods and the network outside your cluster.You can deploy security controls from the wider ecosystem to implement preventative or detective controls around Pods, their containers, and the images that run in them.Admission controlAdmission controllers are plugins that intercept Kubernetes API requests and can validate or mutate the requests based on specific fields in the request. Thoughtfully designing these controllers helps to avoid unintended disruptions as Kubernetes APIs change across version updates. For design considerations, see Admission Webhook Good Practices.AuditingKubernetes audit logging provides a security-relevant, chronological set of records documenting the sequence of actions in a cluster. The cluster audits the activities generated by users, by applications that use the Kubernetes API, and by the control plane itself.Cloud provider securityNote: Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the content guide before submitting a change. More information.If you are running a Kubernetes cluster on your own hardware or a different cloud provider, consult your documentation for security best practices. Here are links to some of the popular cloud providers' security documentation:Cloud provider securityIaaS ProviderLinkAlibaba Cloudhttps://www.alibabacl


Question: What is Security?

Answer: T h i s   s e c t i o n   o f   t h e   K u b e r n e t e s   d o c u m e n t a t i o n   a i m s   t o   h e l p   y o u   l e a r n   t o   r u n   w o r k l o a d s   m o r e   s e c u r e l y ,   a n d   a b o u t   t h e   e s s e n t i a l   a s p e c t s   o f   k e e p i n g   a   K u b e r n e t e s   c l u s t e r   s e c u r e .   K u b e r n e t e s   i s   b a s e d   o n   a   c l o u d - n a t i v e   a r c h i t e c t u r e ,   a n d   d r a w s   o n   a d v i c e   f r o m   t h e   C N C F   a b o u t   g o o d   p r a c t i c e   f o r   c l o u d   n a t i v e   i n f o r m a t i o n   s e c u r i t y .   R e a d   C l o u d   N a t i v e   S e c u r i t y   a n d   K u b e r n e t e s   f o r   t h e   b r o a d e r   c o n t e x t   a b o u t   h o w   t o   s e c u r e   y o u r   c l u s t e r   a n d   t h e   a p p l i c a t i o n s   t h a t   y o u ' r e   r u n n i n g   o n   i t .


Question: What is Kubernetes security mechanisms?

Answer: K u b e r n e t e s   i n c l u d e s   s e v e r a l   A P I s   a n d   s e c u r i t y   c o n t r o l s ,   a s   w e l l   a s   w a y s   t o   d e f i n e   p o l i c i e s   t h a t   c a n   f o r m   p a r t   o f   h o w   y o u   m a n a g e   i n f o r m a t i o n   s e c u r i t y .


Question: What is Control plane protection?

Answer: A   k e y   s e c u r i t y   m e c h a n i s m   f o r   a n y   K u b e r n e t e s   c l u s t e r   i s   t o   c o n t r o l   a c c e s s   t o   t h e   K u b e r n e t e s   A P I .   K u b e r n e t e s   e x p e c t s   y o u   t o   c o n f i g u r e   a n d   u s e   T L S   t o   p r o v i d e   d a t a   e n c r y p t i o n   i n   t r a n s i t   w i t h i n   t h e   c o n t r o l   p l a n e ,   a n d   b e t w e e n   t h e   c o n t r o l   p l a n e   a n d   i t s   c l i e n t s .   Y o u   c a n   a l s o   e n a b l e   e n c r y p t i o n   a t   r e s t   f o r   t h e   d a t a   s t o r e d   w i t h i n   K u b e r n e t e s   c o n t r o l   p l a n e ;   t h i s   i s   s e p a r a t e   f r o m   u s i n g   e n c r y p t i o n   a t   r e s t   f o r   y o u r   o w n   w o r k l o a d s '   d a t a ,   w h i c h   m i g h t   a l s o   b e   a   g o o d   i d e a .


Question: What is Secrets?

Answer: T h e   S e c r e t   A P I   p r o v i d e s   b a s i c   p r o t e c t i o n   f o r   c o n f i g u r a t i o n   v a l u e s   t h a t   r e q u i r e   c o n f i d e n t i a l i t y .


Question: What is Workload protection?

Answer: E n f o r c e   P o d   s e c u r i t y   s t a n d a r d s   t o   e n s u r e   t h a t   P o d s   a n d   t h e i r   c o n t a i n e r s   a r e   i s o l a t e d   a p p r o p r i a t e l y .   Y o u   c a n   a l s o   u s e   R u n t i m e C l a s s e s   t o   d e f i n e   c u s t o m   i s o l a t i o n   i f   y o u   n e e d   i t .   N e t w o r k   p o l i c i e s   l e t   y o u   c o n t r o l   n e t w o r k   t r a f f i c   b e t w e e n   P o d s ,   o r   b e t w e e n   P o d s   a n d   t h e   n e t w o r k   o u t s i d e   y o u r   c l u s t e r .   Y o u   c a n   d e p l o y   s e c u r i t y   c o n t r o l s   f r o m   t h e   w i d e r   e c o s y s t e m   t o   i m p l e m e n t   p r e v e n t a t i v e   o r   d e t e c t i v e   c o n t r o l s   a r o u n d   P o d s ,   t h e i r   c o n t a i n e r s ,   a n d   t h e   i m a g e s   t h a t   r u n   i n   t h e m .


Question: What is Admission control?

Answer: A d m i s s i o n   c o n t r o l l e r s   a r e   p l u g i n s   t h a t   i n t e r c e p t   K u b e r n e t e s   A P I   r e q u e s t s   a n d   c a n   v a l i d a t e   o r   m u t a t e   t h e   r e q u e s t s   b a s e d   o n   s p e c i f i c   f i e l d s   i n   t h e   r e q u e s t .   T h o u g h t f u l l y   d e s i g n i n g   t h e s e   c o n t r o l l e r s   h e l p s   t o   a v o i d   u n i n t e n d e d   d i s r u p t i o n s   a s   K u b e r n e t e s   A P I s   c h a n g e   a c r o s s   v e r s i o n   u p d a t e s .   F o r   d e s i g n   c o n s i d e r a t i o n s ,   s e e   A d m i s s i o n   W e b h o o k   G o o d   P r a c t i c e s .


Question: What is Auditing?

Answer: K u b e r n e t e s   a u d i t   l o g g i n g   p r o v i d e s   a   s e c u r i t y - r e l e v a n t ,   c h r o n o l o g i c a l   s e t   o f   r e c o r d s   d o c u m e n t i n g   t h e   s e q u e n c e   o f   a c t i o n s   i n   a   c l u s t e r .   T h e   c l u s t e r   a u d i t s   t h e   a c t i v i t i e s   g e n e r a t e d   b y   u s e r s ,   b y   a p p l i c a t i o n s   t h a t   u s e   t h e   K u b e r n e t e s   A P I ,   a n d   b y   t h e   c o n t r o l   p l a n e   i t s e l f .


Question: What is Cloud provider security?

Answer: I f   y o u   a r e   r u n n i n g   a   K u b e r n e t e s   c l u s t e r   o n   y o u r   o w n   h a r d w a r e   o r   a   d i f f e r e n t   c l o u d   p r o v i d e r ,   c o n s u l t   y o u r   d o c u m e n t a t i o n   f o r   s e c u r i t y   b e s t   p r a c t i c e s .   H e r e   a r e   l i n k s   t o   s o m e   o f   t h e   p o p u l a r   c l o u d   p r o v i d e r s '   s e c u r i t y   d o c u m e n t a t i o n :


Question: What is Policies?

Answer: Y o u   c a n   d e f i n e   s e c u r i t y   p o l i c i e s   u s i n g   K u b e r n e t e s - n a t i v e   m e c h a n i s m s ,   s u c h   a s   N e t w o r k P o l i c y   ( d e c l a r a t i v e   c o n t r o l   o v e r   n e t w o r k   p a c k e t   f i l t e r i n g )   o r   V a l i d a t i n g A d m i s s i o n P o l i c y   ( d e c l a r a t i v e   r e s t r i c t i o n s   o n   w h a t   c h a n g e s   s o m e o n e   c a n   m a k e   u s i n g   t h e   K u b e r n e t e s   A P I ) .   H o w e v e r ,   y o u   c a n   a l s o   r e l y   o n   p o l i c y   i m p l e m e n t a t i o n s   f r o m   t h e   w i d e r   e c o s y s t e m   a r o u n d   K u b e r n e t e s .   K u b e r n e t e s   p r o v i d e s   e x t e n s i o n   m e c h a n i s m s   t o   l e t   t h o s e   e c o s y s t e m   p r o j e c t s   i m p l e m e n t   t h e i r   o w n   p o l i c y   c o n t r o l s   o n   s o u r c e   c o d e   r e v i e w ,   c o n t a i n e r   i m a g e   a p p r o v a l ,   A P I   a c c e s s   c o n t r o l s ,   n e t w o r k i n g ,   a n d   m o r e .   F o r   m o r e   i n f o r m a t i o n   a b o u t   p o l i c y   m e c h a n i s m s   a n d   K u b e r n e t e s ,   r e a d   P o l i c i e s .