Question: How does Compatibility Version For Kubernetes Control Plane Components work?

Answer: Compatibility Version For Kubernetes Control Plane ComponentsSince release v1.32, we introduced configurable version compatibility and emulation options to Kubernetes control plane components to make upgrades safer by providing more control and increasing the granularity of steps available to cluster administrators.Emulated VersionThe emulation option is set by the --emulated-version flag of control plane components. It allows the component to emulate the behavior (APIs, features, ...) of an earlier version of Kubernetes.When used, the capabilities available will match the emulated version:Any capabilities present in the binary version that were introduced after the emulation version will be unavailable.Any capabilities removed after the emulation version will be available.This enables a binary from a particular Kubernetes release to emulate the behavior of a previous version with sufficient fidelity that interoperability with other system components can be defined in terms of the emulated version.The --emulated-version must be <= binaryVersion. See the help message of the --emulated-version flag for supported range of emulated versions.


Question: When would you use Compatibility Version For Kubernetes Control Plane Components?

Answer: Compatibility Version For Kubernetes Control Plane ComponentsSince release v1.32, we introduced configurable version compatibility and emulation options to Kubernetes control plane components to make upgrades safer by providing more control and increasing the granularity of steps available to cluster administrators.Emulated VersionThe emulation option is set by the --emulated-version flag of control plane components. It allows the component to emulate the behavior (APIs, features, ...) of an earlier version of Kubernetes.When used, the capabilities available will match the emulated version:Any capabilities present in the binary version that were introduced after the emulation version will be unavailable.Any capabilities removed after the emulation version will be available.This enables a binary from a particular Kubernetes release to emulate the behavior of a previous version with sufficient fidelity that interoperability with other system components can be defined in terms of the emulated version.The --emulated-version must be <= binaryVersion. See the help message of the --emulated-version flag for supported range of emulated versions.


Question: What are the benefits of Compatibility Version For Kubernetes Control Plane Components?

Answer: Compatibility Version For Kubernetes Control Plane ComponentsSince release v1.32, we introduced configurable version compatibility and emulation options to Kubernetes control plane components to make upgrades safer by providing more control and increasing the granularity of steps available to cluster administrators.Emulated VersionThe emulation option is set by the --emulated-version flag of control plane components. It allows the component to emulate the behavior (APIs, features, ...) of an earlier version of Kubernetes.When used, the capabilities available will match the emulated version:Any capabilities present in the binary version that were introduced after the emulation version will be unavailable.Any capabilities removed after the emulation version will be available.This enables a binary from a particular Kubernetes release to emulate the behavior of a previous version with sufficient fidelity that interoperability with other system components can be defined in terms of the emulated version.The --emulated-version must be <= binaryVersion. See the help message of the --emulated-version flag for supported range of emulated versions.


Question: What is Compatibility Version For Kubernetes Control Plane Components?

Answer: S i n c e   r e l e a s e   v 1 . 3 2 ,   w e   i n t r o d u c e d   c o n f i g u r a b l e   v e r s i o n   c o m p a t i b i l i t y   a n d   e m u l a t i o n   o p t i o n s   t o   K u b e r n e t e s   c o n t r o l   p l a n e   c o m p o n e n t s   t o   m a k e   u p g r a d e s   s a f e r   b y   p r o v i d i n g   m o r e   c o n t r o l   a n d   i n c r e a s i n g   t h e   g r a n u l a r i t y   o f   s t e p s   a v a i l a b l e   t o   c l u s t e r   a d m i n i s t r a t o r s .


Question: What is Emulated Version?

Answer: T h e   e m u l a t i o n   o p t i o n   i s   s e t   b y   t h e   - - e m u l a t e d - v e r s i o n   f l a g   o f   c o n t r o l   p l a n e   c o m p o n e n t s .   I t   a l l o w s   t h e   c o m p o n e n t   t o   e m u l a t e   t h e   b e h a v i o r   ( A P I s ,   f e a t u r e s ,   . . . )   o f   a n   e a r l i e r   v e r s i o n   o f   K u b e r n e t e s .   W h e n   u s e d ,   t h e   c a p a b i l i t i e s   a v a i l a b l e   w i l l   m a t c h   t h e   e m u l a t e d   v e r s i o n :   A n y   c a p a b i l i t i e s   p r e s e n t   i n   t h e   b i n a r y   v e r s i o n   t h a t   w e r e   i n t r o d u c e d   a f t e r   t h e   e m u l a t i o n   v e r s i o n   w i l l   b e   u n a v a i l a b l e . A n y   c a p a b i l i t i e s   r e m o v e d   a f t e r   t h e   e m u l a t i o n   v e r s i o n   w i l l   b e   a v a i l a b l e .   T h i s   e n a b l e s   a   b i n a r y   f r o m   a   p a r t i c u l a r   K u b e r n e t e s   r e l e a s e   t o   e m u l a t e   t h e   b e h a v i o r   o f   a   p r e v i o u s   v e r s i o n   w i t h   s u f f i c i e n t   f i d e l i t y   t h a t   i n t e r o p e r a b i l i t y   w i t h   o t h e r   s y s t e m   c o m p o n e n t s   c a n   b e   d e f i n e d   i n   t e r m s   o f   t h e   e m u l a t e d   v e r s i o n .   T h e   - - e m u l a t e d - v e r s i o n   m u s t   b e   < =   b i n a r y V e r s i o n .   S e e   t h e   h e l p   m e s s a g e   o f   t h e   - - e m u l a t e d - v e r s i o n   f l a g   f o r   s u p p o r t e d   r a n g e   o f   e m u l a t e d   v e r s i o n s .


Question: What is Configure Pod Initialization?

Answer:
Configure Pod InitializationThis page shows how to use an Init Container to initialize a Pod before an application Container runs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Create a Pod that has an Init ContainerIn this exercise you create a Pod that has one application Container and one Init Container. The init container runs to completion before the application container starts.Here is the configuration file for the Pod:pods/init-containers.yaml apiVersion: v1 kind: Pod metadata: name: init-demo spec: containers: - name: nginx image: nginx ports: - containerPort: 80 volumeMounts: - name: workdir mountPath: /usr/share/nginx/html # These containers are run during pod initialization initContainers: - name: install image: busybox:1.28 command: - wget - "-O" - "/work-dir/index.html" - http://info.cern.ch volumeMounts: - name: workdir mountPath: "/work-dir" dnsPolicy: Default volumes: - name: workdir emptyDir: {} In the configuration file, you can see that the Pod has a Volume that the init container and the application container share.The init container mounts the shared Volume at /work-dir, and the application container mounts the shared Volume at /usr/share/nginx/html. The init container runs the following command and then terminates:wget -O /work-dir/index.html http://info.cern.ch Notice that the init container writes the index.html file in the root directory of the nginx server.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/init-containers.yaml Verify that the nginx container is running:kubectl get pod init-demo The output shows that the nginx container is running:NAME READY STATUS RESTARTS AGE init-demo 1/1 Running 0 1m Get a shell into the nginx container running in the init-demo Pod:kubectl exec -it init-demo -- /bin/bash In your shell, send a GET request to the nginx server:root@nginx:~# apt-get update root@nginx:~# apt-get install curl root@nginx:~# curl localhost The output shows that nginx is serving the web page that was written by the init container: <title>http://info.cern.ch</title>
http://info.cern.ch - home of the first website
 ...
Browse the first website
 ... What's nextLearn more about communicating between Containers running in the same Pod.Learn more about Init Containers.Learn more about Volumes.Learn more about Debugging Init Containers


Question: How does Configure Pod Initialization work?

Answer:
Configure Pod InitializationThis page shows how to use an Init Container to initialize a Pod before an application Container runs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Create a Pod that has an Init ContainerIn this exercise you create a Pod that has one application Container and one Init Container. The init container runs to completion before the application container starts.Here is the configuration file for the Pod:pods/init-containers.yaml apiVersion: v1 kind: Pod metadata: name: init-demo spec: containers: - name: nginx image: nginx ports: - containerPort: 80 volumeMounts: - name: workdir mountPath: /usr/share/nginx/html # These containers are run during pod initialization initContainers: - name: install image: busybox:1.28 command: - wget - "-O" - "/work-dir/index.html" - http://info.cern.ch volumeMounts: - name: workdir mountPath: "/work-dir" dnsPolicy: Default volumes: - name: workdir emptyDir: {} In the configuration file, you can see that the Pod has a Volume that the init container and the application container share.The init container mounts the shared Volume at /work-dir, and the application container mounts the shared Volume at /usr/share/nginx/html. The init container runs the following command and then terminates:wget -O /work-dir/index.html http://info.cern.ch Notice that the init container writes the index.html file in the root directory of the nginx server.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/init-containers.yaml Verify that the nginx container is running:kubectl get pod init-demo The output shows that the nginx container is running:NAME READY STATUS RESTARTS AGE init-demo 1/1 Running 0 1m Get a shell into the nginx container running in the init-demo Pod:kubectl exec -it init-demo -- /bin/bash In your shell, send a GET request to the nginx server:root@nginx:~# apt-get update root@nginx:~# apt-get install curl root@nginx:~# curl localhost The output shows that nginx is serving the web page that was written by the init container: <title>http://info.cern.ch</title>
http://info.cern.ch - home of the first website
 ...
Browse the first website
 ... What's nextLearn more about communicating between Containers running in the same Pod.Learn more about Init Containers.Learn more about Volumes.Learn more about Debugging Init Containers


Question: When would you use Configure Pod Initialization?

Answer:
Configure Pod InitializationThis page shows how to use an Init Container to initialize a Pod before an application Container runs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Create a Pod that has an Init ContainerIn this exercise you create a Pod that has one application Container and one Init Container. The init container runs to completion before the application container starts.Here is the configuration file for the Pod:pods/init-containers.yaml apiVersion: v1 kind: Pod metadata: name: init-demo spec: containers: - name: nginx image: nginx ports: - containerPort: 80 volumeMounts: - name: workdir mountPath: /usr/share/nginx/html # These containers are run during pod initialization initContainers: - name: install image: busybox:1.28 command: - wget - "-O" - "/work-dir/index.html" - http://info.cern.ch volumeMounts: - name: workdir mountPath: "/work-dir" dnsPolicy: Default volumes: - name: workdir emptyDir: {} In the configuration file, you can see that the Pod has a Volume that the init container and the application container share.The init container mounts the shared Volume at /work-dir, and the application container mounts the shared Volume at /usr/share/nginx/html. The init container runs the following command and then terminates:wget -O /work-dir/index.html http://info.cern.ch Notice that the init container writes the index.html file in the root directory of the nginx server.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/init-containers.yaml Verify that the nginx container is running:kubectl get pod init-demo The output shows that the nginx container is running:NAME READY STATUS RESTARTS AGE init-demo 1/1 Running 0 1m Get a shell into the nginx container running in the init-demo Pod:kubectl exec -it init-demo -- /bin/bash In your shell, send a GET request to the nginx server:root@nginx:~# apt-get update root@nginx:~# apt-get install curl root@nginx:~# curl localhost The output shows that nginx is serving the web page that was written by the init container: <title>http://info.cern.ch</title>
http://info.cern.ch - home of the first website
 ...
Browse the first website
 ... What's nextLearn more about communicating between Containers running in the same Pod.Learn more about Init Containers.Learn more about Volumes.Learn more about Debugging Init Containers


Question: What are the benefits of Configure Pod Initialization?

Answer:
Configure Pod InitializationThis page shows how to use an Init Container to initialize a Pod before an application Container runs.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesTo check the version, enter kubectl version.Create a Pod that has an Init ContainerIn this exercise you create a Pod that has one application Container and one Init Container. The init container runs to completion before the application container starts.Here is the configuration file for the Pod:pods/init-containers.yaml apiVersion: v1 kind: Pod metadata: name: init-demo spec: containers: - name: nginx image: nginx ports: - containerPort: 80 volumeMounts: - name: workdir mountPath: /usr/share/nginx/html # These containers are run during pod initialization initContainers: - name: install image: busybox:1.28 command: - wget - "-O" - "/work-dir/index.html" - http://info.cern.ch volumeMounts: - name: workdir mountPath: "/work-dir" dnsPolicy: Default volumes: - name: workdir emptyDir: {} In the configuration file, you can see that the Pod has a Volume that the init container and the application container share.The init container mounts the shared Volume at /work-dir, and the application container mounts the shared Volume at /usr/share/nginx/html. The init container runs the following command and then terminates:wget -O /work-dir/index.html http://info.cern.ch Notice that the init container writes the index.html file in the root directory of the nginx server.Create the Pod:kubectl apply -f https://k8s.io/examples/pods/init-containers.yaml Verify that the nginx container is running:kubectl get pod init-demo The output shows that the nginx container is running:NAME READY STATUS RESTARTS AGE init-demo 1/1 Running 0 1m Get a shell into the nginx container running in the init-demo Pod:kubectl exec -it init-demo -- /bin/bash In your shell, send a GET request to the nginx server:root@nginx:~# apt-get update root@nginx:~# apt-get install curl root@nginx:~# curl localhost The output shows that nginx is serving the web page that was written by the init container: <title>http://info.cern.ch</title>
http://info.cern.ch - home of the first website
 ...
Browse the first website
 ... What's nextLearn more about communicating between Containers running in the same Pod.Learn more about Init Containers.Learn more about Volumes.Learn more about Debugging Init Containers


Question: What is Configure Pod Initialization?

Answer: T h i s   p a g e   s h o w s   h o w   t o   u s e   a n   I n i t   C o n t a i n e r   t o   i n i t i a l i z e   a   P o d   b e f o r e   a n   a p p l i c a t i o n   C o n t a i n e r   r u n s .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s : i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Create a Pod that has an Init Container?

Answer: I n   t h i s   e x e r c i s e   y o u   c r e a t e   a   P o d   t h a t   h a s   o n e   a p p l i c a t i o n   C o n t a i n e r   a n d   o n e   I n i t   C o n t a i n e r .   T h e   i n i t   c o n t a i n e r   r u n s   t o   c o m p l e t i o n   b e f o r e   t h e   a p p l i c a t i o n   c o n t a i n e r   s t a r t s .   H e r e   i s   t h e   c o n f i g u r a t i o n   f i l e   f o r   t h e   P o d :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   i n i t - d e m o   s p e c :   c o n t a i n e r s :   -   n a m e :   n g i n x   i m a g e :   n g i n x   p o r t s :   -   c o n t a i n e r P o r t :   8 0   v o l u m e M o u n t s :   -   n a m e :   w o r k d i r   m o u n t P a t h :   / u s r / s h a r e / n g i n x / h t m l   #   T h e s e   c o n t a i n e r s   a r e   r u n   d u r i n g   p o d   i n i t i a l i z a t i o n   i n i t C o n t a i n e r s :   -   n a m e :   i n s t a l l   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   -   w g e t   -   " - O "   -   " / w o r k - d i r / i n d e x . h t m l "   -   h t t p : / / i n f o . c e r n . c h   v o l u m e M o u n t s :   -   n a m e :   w o r k d i r   m o u n t P a t h :   " / w o r k - d i r "   d n s P o l i c y :   D e f a u l t   v o l u m e s :   -   n a m e :   w o r k d i r   e m p t y D i r :   { }   I n   t h e   c o n f i g u r a t i o n   f i l e ,   y o u   c a n   s e e   t h a t   t h e   P o d   h a s   a   V o l u m e   t h a t   t h e   i n i t   c o n t a i n e r   a n d   t h e   a p p l i c a t i o n   c o n t a i n e r   s h a r e .   T h e   i n i t   c o n t a i n e r   m o u n t s   t h e   s h a r e d   V o l u m e   a t   / w o r k - d i r ,   a n d   t h e   a p p l i c a t i o n   c o n t a i n e r   m o u n t s   t h e   s h a r e d   V o l u m e   a t   / u s r / s h a r e / n g i n x / h t m l .   T h e   i n i t   c o n t a i n e r   r u n s   t h e   f o l l o w i n g   c o m m a n d   a n


Question: What is What's next?

Answer: L e a r n   m o r e   a b o u t   c o m m u n i c a t i n g   b e t w e e n   C o n t a i n e r s   r u n n i n g   i n   t h e   s a m e   P o d . L e a r n   m o r e   a b o u t   I n i t   C o n t a i n e r s . L e a r n   m o r e   a b o u t   V o l u m e s . L e a r n   m o r e   a b o u t   D e b u g g i n g   I n i t   C o n t a i n e r s


Question: What is Enforce Pod Security Standards by Configuring the Built-in Admission Controller?

Answer: Enforce Pod Security Standards by Configuring the Built-in Admission ControllerKubernetes provides a built-in admission controller to enforce the Pod Security Standards. You can configure this admission controller to set cluster-wide defaults and exemptions.Before you beginFollowing an alpha release in Kubernetes v1.22, Pod Security Admission became available by default in Kubernetes v1.23, as a beta. From version 1.25 onwards, Pod Security Admission is generally available.To check the version, enter kubectl version.If you are not running Kubernetes 1.34, you can switch to viewing this page in the documentation for the Kubernetes version that you are running.Configure the Admission ControllerNote:pod-security.admission.config.k8s.io/v1 configuration requires v1.25+. For v1.23 and v1.24, use v1beta1. For v1.22, use v1alpha1.apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1 # see compatibility note kind: PodSecurityConfiguration # Defaults applied when a mode label is not set. # # Level label values must be one of: # - "privileged" (default) # - "baseline" # - "restricted" # # Version label values must be one of: # - "latest" (default) # - specific version like "v1.34" defaults: enforce: "privileged" enforce-version: "latest" audit: "privileged" audit-version: "latest" warn: "privileged" warn-version: "latest" exemptions: # Array of authenticated usernames to exempt. usernames: [] # Array of runtime class names to exempt. runtimeClasses: [] # Array of namespaces to exempt. namespaces: [] Note:The above manifest needs to be specified via the --admission-control-config-file to kube-apiserver.


Question: How does Enforce Pod Security Standards by Configuring the Built-in Admission Controller work?

Answer: Enforce Pod Security Standards by Configuring the Built-in Admission ControllerKubernetes provides a built-in admission controller to enforce the Pod Security Standards. You can configure this admission controller to set cluster-wide defaults and exemptions.Before you beginFollowing an alpha release in Kubernetes v1.22, Pod Security Admission became available by default in Kubernetes v1.23, as a beta. From version 1.25 onwards, Pod Security Admission is generally available.To check the version, enter kubectl version.If you are not running Kubernetes 1.34, you can switch to viewing this page in the documentation for the Kubernetes version that you are running.Configure the Admission ControllerNote:pod-security.admission.config.k8s.io/v1 configuration requires v1.25+. For v1.23 and v1.24, use v1beta1. For v1.22, use v1alpha1.apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1 # see compatibility note kind: PodSecurityConfiguration # Defaults applied when a mode label is not set. # # Level label values must be one of: # - "privileged" (default) # - "baseline" # - "restricted" # # Version label values must be one of: # - "latest" (default) # - specific version like "v1.34" defaults: enforce: "privileged" enforce-version: "latest" audit: "privileged" audit-version: "latest" warn: "privileged" warn-version: "latest" exemptions: # Array of authenticated usernames to exempt. usernames: [] # Array of runtime class names to exempt. runtimeClasses: [] # Array of namespaces to exempt. namespaces: [] Note:The above manifest needs to be specified via the --admission-control-config-file to kube-apiserver.


Question: When would you use Enforce Pod Security Standards by Configuring the Built-in Admission Controller?

Answer: Enforce Pod Security Standards by Configuring the Built-in Admission ControllerKubernetes provides a built-in admission controller to enforce the Pod Security Standards. You can configure this admission controller to set cluster-wide defaults and exemptions.Before you beginFollowing an alpha release in Kubernetes v1.22, Pod Security Admission became available by default in Kubernetes v1.23, as a beta. From version 1.25 onwards, Pod Security Admission is generally available.To check the version, enter kubectl version.If you are not running Kubernetes 1.34, you can switch to viewing this page in the documentation for the Kubernetes version that you are running.Configure the Admission ControllerNote:pod-security.admission.config.k8s.io/v1 configuration requires v1.25+. For v1.23 and v1.24, use v1beta1. For v1.22, use v1alpha1.apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1 # see compatibility note kind: PodSecurityConfiguration # Defaults applied when a mode label is not set. # # Level label values must be one of: # - "privileged" (default) # - "baseline" # - "restricted" # # Version label values must be one of: # - "latest" (default) # - specific version like "v1.34" defaults: enforce: "privileged" enforce-version: "latest" audit: "privileged" audit-version: "latest" warn: "privileged" warn-version: "latest" exemptions: # Array of authenticated usernames to exempt. usernames: [] # Array of runtime class names to exempt. runtimeClasses: [] # Array of namespaces to exempt. namespaces: [] Note:The above manifest needs to be specified via the --admission-control-config-file to kube-apiserver.


Question: What are the benefits of Enforce Pod Security Standards by Configuring the Built-in Admission Controller?

Answer: Enforce Pod Security Standards by Configuring the Built-in Admission ControllerKubernetes provides a built-in admission controller to enforce the Pod Security Standards. You can configure this admission controller to set cluster-wide defaults and exemptions.Before you beginFollowing an alpha release in Kubernetes v1.22, Pod Security Admission became available by default in Kubernetes v1.23, as a beta. From version 1.25 onwards, Pod Security Admission is generally available.To check the version, enter kubectl version.If you are not running Kubernetes 1.34, you can switch to viewing this page in the documentation for the Kubernetes version that you are running.Configure the Admission ControllerNote:pod-security.admission.config.k8s.io/v1 configuration requires v1.25+. For v1.23 and v1.24, use v1beta1. For v1.22, use v1alpha1.apiVersion: apiserver.config.k8s.io/v1 kind: AdmissionConfiguration plugins: - name: PodSecurity configuration: apiVersion: pod-security.admission.config.k8s.io/v1 # see compatibility note kind: PodSecurityConfiguration # Defaults applied when a mode label is not set. # # Level label values must be one of: # - "privileged" (default) # - "baseline" # - "restricted" # # Version label values must be one of: # - "latest" (default) # - specific version like "v1.34" defaults: enforce: "privileged" enforce-version: "latest" audit: "privileged" audit-version: "latest" warn: "privileged" warn-version: "latest" exemptions: # Array of authenticated usernames to exempt. usernames: [] # Array of runtime class names to exempt. runtimeClasses: [] # Array of namespaces to exempt. namespaces: [] Note:The above manifest needs to be specified via the --admission-control-config-file to kube-apiserver.


Question: What is Enforce Pod Security Standards by Configuring the Built-in Admission Controller?

Answer: K u b e r n e t e s   p r o v i d e s   a   b u i l t - i n   a d m i s s i o n   c o n t r o l l e r   t o   e n f o r c e   t h e   P o d   S e c u r i t y   S t a n d a r d s .   Y o u   c a n   c o n f i g u r e   t h i s   a d m i s s i o n   c o n t r o l l e r   t o   s e t   c l u s t e r - w i d e   d e f a u l t s   a n d   e x e m p t i o n s .


Question: What is Before you begin?

Answer: F o l l o w i n g   a n   a l p h a   r e l e a s e   i n   K u b e r n e t e s   v 1 . 2 2 ,   P o d   S e c u r i t y   A d m i s s i o n   b e c a m e   a v a i l a b l e   b y   d e f a u l t   i n   K u b e r n e t e s   v 1 . 2 3 ,   a s   a   b e t a .   F r o m   v e r s i o n   1 . 2 5   o n w a r d s ,   P o d   S e c u r i t y   A d m i s s i o n   i s   g e n e r a l l y   a v a i l a b l e .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   I f   y o u   a r e   n o t   r u n n i n g   K u b e r n e t e s   1 . 3 4 ,   y o u   c a n   s w i t c h   t o   v i e w i n g   t h i s   p a g e   i n   t h e   d o c u m e n t a t i o n   f o r   t h e   K u b e r n e t e s   v e r s i o n   t h a t   y o u   a r e   r u n n i n g .


Question: What is Note:?

Answer: a p i V e r s i o n :   a p i s e r v e r . c o n f i g . k 8 s . i o / v 1   k i n d :   A d m i s s i o n C o n f i g u r a t i o n   p l u g i n s :   -   n a m e :   P o d S e c u r i t y   c o n f i g u r a t i o n :   a p i V e r s i o n :   p o d - s e c u r i t y . a d m i s s i o n . c o n f i g . k 8 s . i o / v 1   #   s e e   c o m p a t i b i l i t y   n o t e   k i n d :   P o d S e c u r i t y C o n f i g u r a t i o n   #   D e f a u l t s   a p p l i e d   w h e n   a   m o d e   l a b e l   i s   n o t   s e t .   #   #   L e v e l   l a b e l   v a l u e s   m u s t   b e   o n e   o f :   #   -   " p r i v i l e g e d "   ( d e f a u l t )   #   -   " b a s e l i n e "   #   -   " r e s t r i c t e d "   #   #   V e r s i o n   l a b e l   v a l u e s   m u s t   b e   o n e   o f :   #   -   " l a t e s t "   ( d e f a u l t )   #   -   s p e c i f i c   v e r s i o n   l i k e   " v 1 . 3 4 "   d e f a u l t s :   e n f o r c e :   " p r i v i l e g e d "   e n f o r c e - v e r s i o n :   " l a t e s t "   a u d i t :   " p r i v i l e g e d "   a u d i t - v e r s i o n :   " l a t e s t "   w a r n :   " p r i v i l e g e d "   w a r n - v e r s i o n :   " l a t e s t "   e x e m p t i o n s :   #   A r r a y   o f   a u t h e n t i c a t e d   u s e r n a m e s   t o   e x e m p t .   u s e r n a m e s :   [ ]   #   A r r a y   o f   r u n t i m e   c l a s s   n a m e s   t o   e x e m p t .   r u n t i m e C l a s s e s :   [ ]   #   A r r a y   o f   n a m e s p a c e s   t o   e x e m p t .   n a m e s p a c e s :   [ ]


Question: What is ResourceClaimTemplate?

Answer: ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.apiVersion: resource.k8s.io/v1import "k8s.io/api/resource/v1"ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplatemetadata (ObjectMeta)Standard object metadataspec (ResourceClaimTemplateSpec), requiredDescribes the ResourceClaim that is to be generated.This field is immutable. A ResourceClaim will get created by the control plane for a Pod when needed and then not get updated anymore.ResourceClaimTemplateSpecResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.spec (ResourceClaimSpec), requiredSpec for the ResourceClaim. The entire content is copied unchanged into the ResourceClaim that gets created from this template. The same fields as in a ResourceClaim are also valid here.metadata (ObjectMeta)ObjectMeta may contain labels and annotations that will be copied into the ResourceClaim when creating it. No other fields are allowed and will be rejected during validation.ResourceClaimTemplateListResourceClaimTemplateList is a collection of claim templates.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplateListmetadata (ListMeta)Standard list metadataitems ([]ResourceClaimTemplate), requiredItems is the list of resource claim templates.Operationsget read the specified ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplates/{name}Parametersname (in path): string, requiredname of the ResourceClaimTemplatenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ResourceClaimTemplate): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplatesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ResourceClaimTemplateList): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/resourceclaimtemplatesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringre


Question: How does ResourceClaimTemplate work?

Answer: ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.apiVersion: resource.k8s.io/v1import "k8s.io/api/resource/v1"ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplatemetadata (ObjectMeta)Standard object metadataspec (ResourceClaimTemplateSpec), requiredDescribes the ResourceClaim that is to be generated.This field is immutable. A ResourceClaim will get created by the control plane for a Pod when needed and then not get updated anymore.ResourceClaimTemplateSpecResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.spec (ResourceClaimSpec), requiredSpec for the ResourceClaim. The entire content is copied unchanged into the ResourceClaim that gets created from this template. The same fields as in a ResourceClaim are also valid here.metadata (ObjectMeta)ObjectMeta may contain labels and annotations that will be copied into the ResourceClaim when creating it. No other fields are allowed and will be rejected during validation.ResourceClaimTemplateListResourceClaimTemplateList is a collection of claim templates.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplateListmetadata (ListMeta)Standard list metadataitems ([]ResourceClaimTemplate), requiredItems is the list of resource claim templates.Operationsget read the specified ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplates/{name}Parametersname (in path): string, requiredname of the ResourceClaimTemplatenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ResourceClaimTemplate): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplatesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ResourceClaimTemplateList): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/resourceclaimtemplatesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringre


Question: When would you use ResourceClaimTemplate?

Answer: ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.apiVersion: resource.k8s.io/v1import "k8s.io/api/resource/v1"ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplatemetadata (ObjectMeta)Standard object metadataspec (ResourceClaimTemplateSpec), requiredDescribes the ResourceClaim that is to be generated.This field is immutable. A ResourceClaim will get created by the control plane for a Pod when needed and then not get updated anymore.ResourceClaimTemplateSpecResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.spec (ResourceClaimSpec), requiredSpec for the ResourceClaim. The entire content is copied unchanged into the ResourceClaim that gets created from this template. The same fields as in a ResourceClaim are also valid here.metadata (ObjectMeta)ObjectMeta may contain labels and annotations that will be copied into the ResourceClaim when creating it. No other fields are allowed and will be rejected during validation.ResourceClaimTemplateListResourceClaimTemplateList is a collection of claim templates.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplateListmetadata (ListMeta)Standard list metadataitems ([]ResourceClaimTemplate), requiredItems is the list of resource claim templates.Operationsget read the specified ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplates/{name}Parametersname (in path): string, requiredname of the ResourceClaimTemplatenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ResourceClaimTemplate): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplatesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ResourceClaimTemplateList): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/resourceclaimtemplatesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringre


Question: What are the benefits of ResourceClaimTemplate?

Answer: ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.apiVersion: resource.k8s.io/v1import "k8s.io/api/resource/v1"ResourceClaimTemplateResourceClaimTemplate is used to produce ResourceClaim objects.This is an alpha type and requires enabling the DynamicResourceAllocation feature gate.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplatemetadata (ObjectMeta)Standard object metadataspec (ResourceClaimTemplateSpec), requiredDescribes the ResourceClaim that is to be generated.This field is immutable. A ResourceClaim will get created by the control plane for a Pod when needed and then not get updated anymore.ResourceClaimTemplateSpecResourceClaimTemplateSpec contains the metadata and fields for a ResourceClaim.spec (ResourceClaimSpec), requiredSpec for the ResourceClaim. The entire content is copied unchanged into the ResourceClaim that gets created from this template. The same fields as in a ResourceClaim are also valid here.metadata (ObjectMeta)ObjectMeta may contain labels and annotations that will be copied into the ResourceClaim when creating it. No other fields are allowed and will be rejected during validation.ResourceClaimTemplateListResourceClaimTemplateList is a collection of claim templates.apiVersion: resource.k8s.io/v1kind: ResourceClaimTemplateListmetadata (ListMeta)Standard list metadataitems ([]ResourceClaimTemplate), requiredItems is the list of resource claim templates.Operationsget read the specified ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplates/{name}Parametersname (in path): string, requiredname of the ResourceClaimTemplatenamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ResourceClaimTemplate): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/namespaces/{namespace}/resourceclaimtemplatesParametersnamespace (in path): string, requirednamespaceallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringresourceVersionMatchsendInitialEvents (in query): booleansendInitialEventstimeoutSeconds (in query): integertimeoutSecondswatch (in query): booleanwatchResponse200 (ResourceClaimTemplateList): OK401: Unauthorizedlist list or watch objects of kind ResourceClaimTemplateHTTP RequestGET /apis/resource.k8s.io/v1/resourceclaimtemplatesParametersallowWatchBookmarks (in query): booleanallowWatchBookmarkscontinue (in query): stringcontinuefieldSelector (in query): stringfieldSelectorlabelSelector (in query): stringlabelSelectorlimit (in query): integerlimitpretty (in query): stringprettyresourceVersion (in query): stringresourceVersionresourceVersionMatch (in query): stringre


Question: What is ResourceClaimTemplate?

Answer: a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / r e s o u r c e / v 1 "


Question: What is ResourceClaimTemplate?

Answer: R e s o u r c e C l a i m T e m p l a t e   i s   u s e d   t o   p r o d u c e   R e s o u r c e C l a i m   o b j e c t s .   T h i s   i s   a n   a l p h a   t y p e   a n d   r e q u i r e s   e n a b l i n g   t h e   D y n a m i c R e s o u r c e A l l o c a t i o n   f e a t u r e   g a t e .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1 k i n d :   R e s o u r c e C l a i m T e m p l a t e m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t   m e t a d a t a s p e c   ( R e s o u r c e C l a i m T e m p l a t e S p e c ) ,   r e q u i r e d D e s c r i b e s   t h e   R e s o u r c e C l a i m   t h a t   i s   t o   b e   g e n e r a t e d . T h i s   f i e l d   i s   i m m u t a b l e .   A   R e s o u r c e C l a i m   w i l l   g e t   c r e a t e d   b y   t h e   c o n t r o l   p l a n e   f o r   a   P o d   w h e n   n e e d e d   a n d   t h e n   n o t   g e t   u p d a t e d   a n y m o r e .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   k i n d :   R e s o u r c e C l a i m T e m p l a t e   m e t a d a t a   ( O b j e c t M e t a )   S t a n d a r d   o b j e c t   m e t a d a t a   s p e c   ( R e s o u r c e C l a i m T e m p l a t e S p e c ) ,   r e q u i r e d   D e s c r i b e s   t h e   R e s o u r c e C l a i m   t h a t   i s   t o   b e   g e n e r a t e d .   T h i s   f i e l d   i s   i m m u t a b l e .   A   R e s o u r c e C l a i m   w i l l   g e t   c r e a t e d   b y   t h e   c o n t r o l   p l a n e   f o r   a   P o d   w h e n   n e e d e d   a n d   t h e n   n o t   g e t   u p d a t e d   a n y m o r e .


Question: What is ResourceClaimTemplateSpec?

Answer: R e s o u r c e C l a i m T e m p l a t e S p e c   c o n t a i n s   t h e   m e t a d a t a   a n d   f i e l d s   f o r   a   R e s o u r c e C l a i m .   s p e c   ( R e s o u r c e C l a i m S p e c ) ,   r e q u i r e d S p e c   f o r   t h e   R e s o u r c e C l a i m .   T h e   e n t i r e   c o n t e n t   i s   c o p i e d   u n c h a n g e d   i n t o   t h e   R e s o u r c e C l a i m   t h a t   g e t s   c r e a t e d   f r o m   t h i s   t e m p l a t e .   T h e   s a m e   f i e l d s   a s   i n   a   R e s o u r c e C l a i m   a r e   a l s o   v a l i d   h e r e . m e t a d a t a   ( O b j e c t M e t a ) O b j e c t M e t a   m a y   c o n t a i n   l a b e l s   a n d   a n n o t a t i o n s   t h a t   w i l l   b e   c o p i e d   i n t o   t h e   R e s o u r c e C l a i m   w h e n   c r e a t i n g   i t .   N o   o t h e r   f i e l d s   a r e   a l l o w e d   a n d   w i l l   b e   r e j e c t e d   d u r i n g   v a l i d a t i o n .   s p e c   ( R e s o u r c e C l a i m S p e c ) ,   r e q u i r e d   S p e c   f o r   t h e   R e s o u r c e C l a i m .   T h e   e n t i r e   c o n t e n t   i s   c o p i e d   u n c h a n g e d   i n t o   t h e   R e s o u r c e C l a i m   t h a t   g e t s   c r e a t e d   f r o m   t h i s   t e m p l a t e .   T h e   s a m e   f i e l d s   a s   i n   a   R e s o u r c e C l a i m   a r e   a l s o   v a l i d   h e r e .   m e t a d a t a   ( O b j e c t M e t a )   O b j e c t M e t a   m a y   c o n t a i n   l a b e l s   a n d   a n n o t a t i o n s   t h a t   w i l l   b e   c o p i e d   i n t o   t h e   R e s o u r c e C l a i m   w h e n   c r e a t i n g   i t .   N o   o t h e r   f i e l d s   a r e   a l l o w e d   a n d   w i l l   b e   r e j e c t e d   d u r i n g   v a l i d a t i o n .


Question: What is ResourceClaimTemplateList?

Answer: R e s o u r c e C l a i m T e m p l a t e L i s t   i s   a   c o l l e c t i o n   o f   c l a i m   t e m p l a t e s .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1 k i n d :   R e s o u r c e C l a i m T e m p l a t e L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a i t e m s   ( [ ] R e s o u r c e C l a i m T e m p l a t e ) ,   r e q u i r e d I t e m s   i s   t h e   l i s t   o f   r e s o u r c e   c l a i m   t e m p l a t e s .   a p i V e r s i o n :   r e s o u r c e . k 8 s . i o / v 1   k i n d :   R e s o u r c e C l a i m T e m p l a t e L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a   i t e m s   ( [ ] R e s o u r c e C l a i m T e m p l a t e ) ,   r e q u i r e d   I t e m s   i s   t h e   l i s t   o f   r e s o u r c e   c l a i m   t e m p l a t e s .


Question: What is HTTP Request?

Answer: G E T   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / r e s o u r c e c l a i m t e m p l a t e s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   R e s o u r c e C l a i m T e m p l a t e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   R e s o u r c e C l a i m T e m p l a t e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e ) :   O K   2 0 1   ( R e s o u r c e C l a i m T e m p l a t e ) :   C r e a t e d   2 0 2   ( R e s o u r c e C l a i m T e m p l a t e ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   R e s o u r c e C l a i m T e m p l a t e ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   R e s o u r c e C l a i m T e m p l a t e ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e ) :   O K   2 0 1   ( R e s o u r c e C l a i m T e m p l a t e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e ) :   O K   2 0 1   ( R e s o u r c e C l a i m T e m p l a t e ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   R e s o u r c e C l a i m T e m p l a t e   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( R e s o u r c e C l a i m T e m p l a t e ) :   O K   2 0 2   ( R e s o u r c e C l a i m T e m p l a t e ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i s / r e s o u r c e . k 8 s . i o / v 1 / n a m e s p a c e s / { n a m e s p a c e } / r e s o u r c e c l a i m t e m p l a t e s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Projected Volumes?

Answer: Projected VolumesThis document describes projected volumes in Kubernetes. Familiarity with volumes is suggested.IntroductionA projected volume maps several existing volume sources into the same directory.Currently, the following types of volume sources can be projected:secretdownwardAPIconfigMapserviceAccountTokenclusterTrustBundlepodCertificateAll sources are required to be in the same namespace as the Pod. For more details, see the all-in-one volume design document.Example configuration with a secret, a downwardAPI, and a configMappods/storage/projected-secret-downwardapi-configmap.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - downwardAPI: items: - path: "labels" fieldRef: fieldPath: metadata.labels - path: "cpu_limit" resourceFieldRef: containerName: container-test resource: limits.cpu - configMap: name: myconfigmap items: - key: config path: my-group/my-config Example configuration: secrets with a non-default permission mode setpods/storage/projected-secrets-nondefault-permission-mode.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - secret: name: mysecret2 items: - key: password path: my-group/my-password mode: 511 Each projected volume source is listed in the spec under sources. The parameters are nearly the same with two exceptions:For secrets, the secretName field has been changed to name to be consistent with ConfigMap naming.The defaultMode can only be specified at the projected level and not for each volume source. However, as illustrated above, you can explicitly set the mode for each individual projection.serviceAccountToken projected volumesYou can inject the token for the current service account into a Pod at a specified path. For example:pods/storage/projected-service-account-token.yaml apiVersion: v1 kind: Pod metadata: name: sa-token-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: token-vol mountPath: "/service-account" readOnly: true serviceAccountName: default volumes: - name: token-vol projected: sources: - serviceAccountToken: audience: api expirationSeconds: 3600 path: token The example Pod has a projected volume containing the injected service account token. Containers in this Pod can use that token to access the Kubernetes API server, authenticating with the identity of the pod's ServiceAccount. The audience field contains the intended audience of the token. A rec


Question: How does Projected Volumes work?

Answer: Projected VolumesThis document describes projected volumes in Kubernetes. Familiarity with volumes is suggested.IntroductionA projected volume maps several existing volume sources into the same directory.Currently, the following types of volume sources can be projected:secretdownwardAPIconfigMapserviceAccountTokenclusterTrustBundlepodCertificateAll sources are required to be in the same namespace as the Pod. For more details, see the all-in-one volume design document.Example configuration with a secret, a downwardAPI, and a configMappods/storage/projected-secret-downwardapi-configmap.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - downwardAPI: items: - path: "labels" fieldRef: fieldPath: metadata.labels - path: "cpu_limit" resourceFieldRef: containerName: container-test resource: limits.cpu - configMap: name: myconfigmap items: - key: config path: my-group/my-config Example configuration: secrets with a non-default permission mode setpods/storage/projected-secrets-nondefault-permission-mode.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - secret: name: mysecret2 items: - key: password path: my-group/my-password mode: 511 Each projected volume source is listed in the spec under sources. The parameters are nearly the same with two exceptions:For secrets, the secretName field has been changed to name to be consistent with ConfigMap naming.The defaultMode can only be specified at the projected level and not for each volume source. However, as illustrated above, you can explicitly set the mode for each individual projection.serviceAccountToken projected volumesYou can inject the token for the current service account into a Pod at a specified path. For example:pods/storage/projected-service-account-token.yaml apiVersion: v1 kind: Pod metadata: name: sa-token-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: token-vol mountPath: "/service-account" readOnly: true serviceAccountName: default volumes: - name: token-vol projected: sources: - serviceAccountToken: audience: api expirationSeconds: 3600 path: token The example Pod has a projected volume containing the injected service account token. Containers in this Pod can use that token to access the Kubernetes API server, authenticating with the identity of the pod's ServiceAccount. The audience field contains the intended audience of the token. A rec


Question: When would you use Projected Volumes?

Answer: Projected VolumesThis document describes projected volumes in Kubernetes. Familiarity with volumes is suggested.IntroductionA projected volume maps several existing volume sources into the same directory.Currently, the following types of volume sources can be projected:secretdownwardAPIconfigMapserviceAccountTokenclusterTrustBundlepodCertificateAll sources are required to be in the same namespace as the Pod. For more details, see the all-in-one volume design document.Example configuration with a secret, a downwardAPI, and a configMappods/storage/projected-secret-downwardapi-configmap.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - downwardAPI: items: - path: "labels" fieldRef: fieldPath: metadata.labels - path: "cpu_limit" resourceFieldRef: containerName: container-test resource: limits.cpu - configMap: name: myconfigmap items: - key: config path: my-group/my-config Example configuration: secrets with a non-default permission mode setpods/storage/projected-secrets-nondefault-permission-mode.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - secret: name: mysecret2 items: - key: password path: my-group/my-password mode: 511 Each projected volume source is listed in the spec under sources. The parameters are nearly the same with two exceptions:For secrets, the secretName field has been changed to name to be consistent with ConfigMap naming.The defaultMode can only be specified at the projected level and not for each volume source. However, as illustrated above, you can explicitly set the mode for each individual projection.serviceAccountToken projected volumesYou can inject the token for the current service account into a Pod at a specified path. For example:pods/storage/projected-service-account-token.yaml apiVersion: v1 kind: Pod metadata: name: sa-token-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: token-vol mountPath: "/service-account" readOnly: true serviceAccountName: default volumes: - name: token-vol projected: sources: - serviceAccountToken: audience: api expirationSeconds: 3600 path: token The example Pod has a projected volume containing the injected service account token. Containers in this Pod can use that token to access the Kubernetes API server, authenticating with the identity of the pod's ServiceAccount. The audience field contains the intended audience of the token. A rec


Question: What are the benefits of Projected Volumes?

Answer: Projected VolumesThis document describes projected volumes in Kubernetes. Familiarity with volumes is suggested.IntroductionA projected volume maps several existing volume sources into the same directory.Currently, the following types of volume sources can be projected:secretdownwardAPIconfigMapserviceAccountTokenclusterTrustBundlepodCertificateAll sources are required to be in the same namespace as the Pod. For more details, see the all-in-one volume design document.Example configuration with a secret, a downwardAPI, and a configMappods/storage/projected-secret-downwardapi-configmap.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - downwardAPI: items: - path: "labels" fieldRef: fieldPath: metadata.labels - path: "cpu_limit" resourceFieldRef: containerName: container-test resource: limits.cpu - configMap: name: myconfigmap items: - key: config path: my-group/my-config Example configuration: secrets with a non-default permission mode setpods/storage/projected-secrets-nondefault-permission-mode.yaml apiVersion: v1 kind: Pod metadata: name: volume-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: all-in-one mountPath: "/projected-volume" readOnly: true volumes: - name: all-in-one projected: sources: - secret: name: mysecret items: - key: username path: my-group/my-username - secret: name: mysecret2 items: - key: password path: my-group/my-password mode: 511 Each projected volume source is listed in the spec under sources. The parameters are nearly the same with two exceptions:For secrets, the secretName field has been changed to name to be consistent with ConfigMap naming.The defaultMode can only be specified at the projected level and not for each volume source. However, as illustrated above, you can explicitly set the mode for each individual projection.serviceAccountToken projected volumesYou can inject the token for the current service account into a Pod at a specified path. For example:pods/storage/projected-service-account-token.yaml apiVersion: v1 kind: Pod metadata: name: sa-token-test spec: containers: - name: container-test image: busybox:1.28 command: ["sleep", "3600"] volumeMounts: - name: token-vol mountPath: "/service-account" readOnly: true serviceAccountName: default volumes: - name: token-vol projected: sources: - serviceAccountToken: audience: api expirationSeconds: 3600 path: token The example Pod has a projected volume containing the injected service account token. Containers in this Pod can use that token to access the Kubernetes API server, authenticating with the identity of the pod's ServiceAccount. The audience field contains the intended audience of the token. A rec


Question: What is Projected Volumes?

Answer: T h i s   d o c u m e n t   d e s c r i b e s   p r o j e c t e d   v o l u m e s   i n   K u b e r n e t e s .   F a m i l i a r i t y   w i t h   v o l u m e s   i s   s u g g e s t e d .


Question: What is Introduction?

Answer: A   p r o j e c t e d   v o l u m e   m a p s   s e v e r a l   e x i s t i n g   v o l u m e   s o u r c e s   i n t o   t h e   s a m e   d i r e c t o r y .   C u r r e n t l y ,   t h e   f o l l o w i n g   t y p e s   o f   v o l u m e   s o u r c e s   c a n   b e   p r o j e c t e d :   s e c r e t d o w n w a r d A P I c o n f i g M a p s e r v i c e A c c o u n t T o k e n c l u s t e r T r u s t B u n d l e p o d C e r t i f i c a t e   A l l   s o u r c e s   a r e   r e q u i r e d   t o   b e   i n   t h e   s a m e   n a m e s p a c e   a s   t h e   P o d .   F o r   m o r e   d e t a i l s ,   s e e   t h e   a l l - i n - o n e   v o l u m e   d e s i g n   d o c u m e n t .


Question: What is Example configuration with a secret, a downwardAPI, and a configMap?

Answer: a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   v o l u m e - t e s t   s p e c :   c o n t a i n e r s :   -   n a m e :   c o n t a i n e r - t e s t   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [ " s l e e p " ,   " 3 6 0 0 " ]   v o l u m e M o u n t s :   -   n a m e :   a l l - i n - o n e   m o u n t P a t h :   " / p r o j e c t e d - v o l u m e "   r e a d O n l y :   t r u e   v o l u m e s :   -   n a m e :   a l l - i n - o n e   p r o j e c t e d :   s o u r c e s :   -   s e c r e t :   n a m e :   m y s e c r e t   i t e m s :   -   k e y :   u s e r n a m e   p a t h :   m y - g r o u p / m y - u s e r n a m e   -   d o w n w a r d A P I :   i t e m s :   -   p a t h :   " l a b e l s "   f i e l d R e f :   f i e l d P a t h :   m e t a d a t a . l a b e l s   -   p a t h :   " c p u _ l i m i t "   r e s o u r c e F i e l d R e f :   c o n t a i n e r N a m e :   c o n t a i n e r - t e s t   r e s o u r c e :   l i m i t s . c p u   -   c o n f i g M a p :   n a m e :   m y c o n f i g m a p   i t e m s :   -   k e y :   c o n f i g   p a t h :   m y - g r o u p / m y - c o n f i g


Question: What is Example configuration: secrets with a non-default permission mode set?

Answer: a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   v o l u m e - t e s t   s p e c :   c o n t a i n e r s :   -   n a m e :   c o n t a i n e r - t e s t   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [ " s l e e p " ,   " 3 6 0 0 " ]   v o l u m e M o u n t s :   -   n a m e :   a l l - i n - o n e   m o u n t P a t h :   " / p r o j e c t e d - v o l u m e "   r e a d O n l y :   t r u e   v o l u m e s :   -   n a m e :   a l l - i n - o n e   p r o j e c t e d :   s o u r c e s :   -   s e c r e t :   n a m e :   m y s e c r e t   i t e m s :   -   k e y :   u s e r n a m e   p a t h :   m y - g r o u p / m y - u s e r n a m e   -   s e c r e t :   n a m e :   m y s e c r e t 2   i t e m s :   -   k e y :   p a s s w o r d   p a t h :   m y - g r o u p / m y - p a s s w o r d   m o d e :   5 1 1   E a c h   p r o j e c t e d   v o l u m e   s o u r c e   i s   l i s t e d   i n   t h e   s p e c   u n d e r   s o u r c e s .   T h e   p a r a m e t e r s   a r e   n e a r l y   t h e   s a m e   w i t h   t w o   e x c e p t i o n s :   F o r   s e c r e t s ,   t h e   s e c r e t N a m e   f i e l d   h a s   b e e n   c h a n g e d   t o   n a m e   t o   b e   c o n s i s t e n t   w i t h   C o n f i g M a p   n a m i n g . T h e   d e f a u l t M o d e   c a n   o n l y   b e   s p e c i f i e d   a t   t h e   p r o j e c t e d   l e v e l   a n d   n o t   f o r   e a c h   v o l u m e   s o u r c e .   H o w e v e r ,   a s   i l l u s t r a t e d   a b o v e ,   y o u   c a n   e x p l i c i t l y   s e t   t h e   m o d e   f o r   e a c h   i n d i v i d u a l   p r o j e c t i o n .


Question: What is serviceAccountToken projected volumes?

Answer: Y o u   c a n   i n j e c t   t h e   t o k e n   f o r   t h e   c u r r e n t   s e r v i c e   a c c o u n t   i n t o   a   P o d   a t   a   s p e c i f i e d   p a t h .   F o r   e x a m p l e :   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e :   s a - t o k e n - t e s t   s p e c :   c o n t a i n e r s :   -   n a m e :   c o n t a i n e r - t e s t   i m a g e :   b u s y b o x : 1 . 2 8   c o m m a n d :   [ " s l e e p " ,   " 3 6 0 0 " ]   v o l u m e M o u n t s :   -   n a m e :   t o k e n - v o l   m o u n t P a t h :   " / s e r v i c e - a c c o u n t "   r e a d O n l y :   t r u e   s e r v i c e A c c o u n t N a m e :   d e f a u l t   v o l u m e s :   -   n a m e :   t o k e n - v o l   p r o j e c t e d :   s o u r c e s :   -   s e r v i c e A c c o u n t T o k e n :   a u d i e n c e :   a p i   e x p i r a t i o n S e c o n d s :   3 6 0 0   p a t h :   t o k e n   T h e   e x a m p l e   P o d   h a s   a   p r o j e c t e d   v o l u m e   c o n t a i n i n g   t h e   i n j e c t e d   s e r v i c e   a c c o u n t   t o k e n .   C o n t a i n e r s   i n   t h i s   P o d   c a n   u s e   t h a t   t o k e n   t o   a c c e s s   t h e   K u b e r n e t e s   A P I   s e r v e r ,   a u t h e n t i c a t i n g   w i t h   t h e   i d e n t i t y   o f   t h e   p o d ' s   S e r v i c e A c c o u n t .   T h e   a u d i e n c e   f i e l d   c o n t a i n s   t h e   i n t e n d e d   a u d i e n c e   o f   t h e   t o k e n .   A   r e c i p i e n t   o f   t h e   t o k e n   m u s t   i d e n t i f y   i t s e l f   w i t h   a n   i d e n t i f i e r   s p e c i f i e d   i n   t h e   a u d i e n c e   o f   t h e   t o k e n ,   a n d   o t h e r w i s e   s h o u l d   r e j e c t   t h e   t o k e n .   T h i s   f i e l d   i s   o p t i o n a l   a n d   i t   d e f a u l t s   t o   t h e   i d e n t i f i e r   o f   t h e   A P I   s e r v e r .   T h e   e x p i r a t i o n S e c o n


Question: What is Note:?

Answer: T h e   c l u s t e r T r u s t B u n d l e   p r o j e c t e d   v o l u m e   s o u r c e   i n j e c t s   t h e   c o n t e n t s   o f   o n e   o r   m o r e   C l u s t e r T r u s t B u n d l e   o b j e c t s   a s   a n   a u t o m a t i c a l l y - u p d a t i n g   f i l e   i n   t h e   c o n t a i n e r   f i l e s y s t e m .   C l u s t e r T r u s t B u n d l e s   c a n   b e   s e l e c t e d   e i t h e r   b y   n a m e   o r   b y   s i g n e r   n a m e .   T o   s e l e c t   b y   n a m e ,   u s e   t h e   n a m e   f i e l d   t o   d e s i g n a t e   a   s i n g l e   C l u s t e r T r u s t B u n d l e   o b j e c t .   T o   s e l e c t   b y   s i g n e r   n a m e ,   u s e   t h e   s i g n e r N a m e   f i e l d   ( a n d   o p t i o n a l l y   t h e   l a b e l S e l e c t o r   f i e l d )   t o   d e s i g n a t e   a   s e t   o f   C l u s t e r T r u s t B u n d l e   o b j e c t s   t h a t   u s e   t h e   g i v e n   s i g n e r   n a m e .   I f   l a b e l S e l e c t o r   i s   n o t   p r e s e n t ,   t h e n   a l l   C l u s t e r T r u s t B u n d l e s   f o r   t h a t   s i g n e r   a r e   s e l e c t e d .   T h e   k u b e l e t   d e d u p l i c a t e s   t h e   c e r t i f i c a t e s   i n   t h e   s e l e c t e d   C l u s t e r T r u s t B u n d l e   o b j e c t s ,   n o r m a l i z e s   t h e   P E M   r e p r e s e n t a t i o n s   ( d i s c a r d i n g   c o m m e n t s   a n d   h e a d e r s ) ,   r e o r d e r s   t h e   c e r t i f i c a t e s ,   a n d   w r i t e s   t h e m   i n t o   t h e   f i l e   n a m e d   b y   p a t h .   A s   t h e   s e t   o f   s e l e c t e d   C l u s t e r T r u s t B u n d l e s   o r   t h e i r   c o n t e n t   c h a n g e s ,   k u b e l e t   k e e p s   t h e   f i l e   u p - t o - d a t e .   B y   d e f a u l t ,   t h e   k u b e l e t   w i l l   p r e v e n t   t h e   p o d   f r o m   s t a r t i n g   i f   t h e   n a m e d   C


Question: What is Note:?

Answer: T h e   p o d C e r t i f i c a t e   p r o j e c t e d   v o l u m e s   s o u r c e   s e c u r e l y   p r o v i s i o n s   a   p r i v a t e   k e y   a n d   X . 5 0 9   c e r t i f i c a t e   c h a i n   f o r   p o d   t o   u s e   a s   c l i e n t   o r   s e r v e r   c r e d e n t i a l s .   K u b e l e t   w i l l   t h e n   h a n d l e   r e f r e s h i n g   t h e   p r i v a t e   k e y   a n d   c e r t i f i c a t e   c h a i n   w h e n   t h e y   g e t   c l o s e   t o   e x p i r a t i o n .   T h e   a p p l i c a t i o n   j u s t   h a s   t o   m a k e   s u r e   t h a t   i t   r e l o a d s   t h e   f i l e   p r o m p t l y   w h e n   i t   c h a n g e s ,   w i t h   a   m e c h a n i s m   l i k e   i n o t i f y   o r   p o l l i n g .   E a c h   p o d C e r t i f i c a t e   p r o j e c t i o n   s u p p o r t s   t h e   f o l l o w i n g   c o n f i g u r a t i o n   f i e l d s :   s i g n e r N a m e :   T h e   s i g n e r   y o u   w a n t   t o   i s s u e   t h e   c e r t i f i c a t e .   N o t e   t h a t   s i g n e r s   m a y   h a v e   t h e i r   o w n   a c c e s s   r e q u i r e m e n t s ,   a n d   m a y   r e f u s e   t o   i s s u e   c e r t i f i c a t e s   t o   y o u r   p o d . k e y T y p e :   T h e   t y p e   o f   p r i v a t e   k e y   t h a t   s h o u l d   b e   g e n e r a t e d .   V a l i d   v a l u e s   a r e   E D 2 5 5 1 9 ,   E C D S A P 2 5 6 ,   E C D S A P 3 8 4 ,   E C D S A P 5 2 1 ,   R S A 3 0 7 2 ,   a n d   R S A 4 0 9 6 . m a x E x p i r a t i o n S e c o n d s :   T h e   m a x i m u m   l i f e t i m e   y o u   w i l l   a c c e p t   f o r   t h e   c e r t i f i c a t e   i s s u e d   t o   t h e   p o d .   I f   n o t   s e t ,   w i l l   b e   d e f a u l t e d   t o   8 6 4 0 0   ( 2 4   h o u r s ) .   M u s t   b e   a t   l e a s t   3 6 0 0   ( 1   h o u r ) ,   a n d   a t   m o s t   7 8 6 2 4 0 0   ( 9 1   d a y s ) .   K u b e r n e t e s   b u i


Question: What is Note:?

Answer: #   S a m p l e   P o d   s p e c   t h a t   u s e s   a   p o d C e r t i f i c a t e   p r o j e c t i o n   t o   r e q u e s t   a n   E D 2 5 5 1 9   #   p r i v a t e   k e y ,   a   c e r t i f i c a t e   f r o m   t h e   ` c o o l c e r t . e x a m p l e . c o m / f o o `   s i g n e r ,   a n d   #   w r i t e   t h e   r e s u l t s   t o   ` / v a r / r u n / m y - x 5 0 9 - c r e d e n t i a l s / c r e d e n t i a l b u n d l e . p e m ` .   a p i V e r s i o n :   v 1   k i n d :   P o d   m e t a d a t a :   n a m e s p a c e :   d e f a u l t   n a m e :   p o d c e r t i f i c a t e - p o d   s p e c :   s e r v i c e A c c o u n t N a m e :   d e f a u l t   c o n t a i n e r s :   -   i m a g e :   d e b i a n   n a m e :   m a i n   c o m m a n d :   [ " s l e e p " ,   " i n f i n i t y " ]   v o l u m e M o u n t s :   -   n a m e :   m y - x 5 0 9 - c r e d e n t i a l s   m o u n t P a t h :   / v a r / r u n / m y - x 5 0 9 - c r e d e n t i a l s   v o l u m e s :   -   n a m e :   m y - x 5 0 9 - c r e d e n t i a l s   p r o j e c t e d :   d e f a u l t M o d e :   4 2 0   s o u r c e s :   -   p o d C e r t i f i c a t e :   k e y T y p e :   E D 2 5 5 1 9   s i g n e r N a m e :   c o o l c e r t . e x a m p l e . c o m / f o o   c r e d e n t i a l B u n d l e P a t h :   c r e d e n t i a l b u n d l e . p e m


Question: What is SecurityContext interactions?

Answer: T h e   p r o p o s a l   f o r   f i l e   p e r m i s s i o n   h a n d l i n g   i n   p r o j e c t e d   s e r v i c e   a c c o u n t   v o l u m e   e n h a n c e m e n t   i n t r o d u c e d   t h e   p r o j e c t e d   f i l e s   h a v i n g   t h e   c o r r e c t   o w n e r   p e r m i s s i o n s   s e t .


Question: What is Linux?

Answer: I n   L i n u x   p o d s   t h a t   h a v e   a   p r o j e c t e d   v o l u m e   a n d   R u n A s U s e r   s e t   i n   t h e   P o d   S e c u r i t y C o n t e x t ,   t h e   p r o j e c t e d   f i l e s   h a v e   t h e   c o r r e c t   o w n e r s h i p   s e t   i n c l u d i n g   c o n t a i n e r   u s e r   o w n e r s h i p .   W h e n   a l l   c o n t a i n e r s   i n   a   p o d   h a v e   t h e   s a m e   r u n A s U s e r   s e t   i n   t h e i r   P o d S e c u r i t y C o n t e x t   o r   c o n t a i n e r   S e c u r i t y C o n t e x t ,   t h e n   t h e   k u b e l e t   e n s u r e s   t h a t   t h e   c o n t e n t s   o f   t h e   s e r v i c e A c c o u n t T o k e n   v o l u m e   a r e   o w n e d   b y   t h a t   u s e r ,   a n d   t h e   t o k e n   f i l e   h a s   i t s   p e r m i s s i o n   m o d e   s e t   t o   0 6 0 0 .


Question: What is Note:?

Answer: E p h e m e r a l   c o n t a i n e r s   a d d e d   t o   a   P o d   a f t e r   i t   i s   c r e a t e d   d o   n o t   c h a n g e   v o l u m e   p e r m i s s i o n s   t h a t   w e r e   s e t   w h e n   t h e   p o d   w a s   c r e a t e d .   I f   a   P o d ' s   s e r v i c e A c c o u n t T o k e n   v o l u m e   p e r m i s s i o n s   w e r e   s e t   t o   0 6 0 0   b e c a u s e   a l l   o t h e r   c o n t a i n e r s   i n   t h e   P o d   h a v e   t h e   s a m e   r u n A s U s e r ,   e p h e m e r a l   c o n t a i n e r s   m u s t   u s e   t h e   s a m e   r u n A s U s e r   t o   b e   a b l e   t o   r e a d   t h e   t o k e n .


Question: What is Windows?

Answer: I n   W i n d o w s   p o d s   t h a t   h a v e   a   p r o j e c t e d   v o l u m e   a n d   R u n A s U s e r n a m e   s e t   i n   t h e   P o d   S e c u r i t y C o n t e x t ,   t h e   o w n e r s h i p   i s   n o t   e n f o r c e d   d u e   t o   t h e   w a y   u s e r   a c c o u n t s   a r e   m a n a g e d   i n   W i n d o w s .   W i n d o w s   s t o r e s   a n d   m a n a g e s   l o c a l   u s e r   a n d   g r o u p   a c c o u n t s   i n   a   d a t a b a s e   f i l e   c a l l e d   S e c u r i t y   A c c o u n t   M a n a g e r   ( S A M ) .   E a c h   c o n t a i n e r   m a i n t a i n s   i t s   o w n   i n s t a n c e   o f   t h e   S A M   d a t a b a s e ,   t o   w h i c h   t h e   h o s t   h a s   n o   v i s i b i l i t y   i n t o   w h i l e   t h e   c o n t a i n e r   i s   r u n n i n g .   W i n d o w s   c o n t a i n e r s   a r e   d e s i g n e d   t o   r u n   t h e   u s e r   m o d e   p o r t i o n   o f   t h e   O S   i n   i s o l a t i o n   f r o m   t h e   h o s t ,   h e n c e   t h e   m a i n t e n a n c e   o f   a   v i r t u a l   S A M   d a t a b a s e .   A s   a   r e s u l t ,   t h e   k u b e l e t   r u n n i n g   o n   t h e   h o s t   d o e s   n o t   h a v e   t h e   a b i l i t y   t o   d y n a m i c a l l y   c o n f i g u r e   h o s t   f i l e   o w n e r s h i p   f o r   v i r t u a l i z e d   c o n t a i n e r   a c c o u n t s .   I t   i s   r e c o m m e n d e d   t h a t   i f   f i l e s   o n   t h e   h o s t   m a c h i n e   a r e   t o   b e   s h a r e d   w i t h   t h e   c o n t a i n e r   t h e n   t h e y   s h o u l d   b e   p l a c e d   i n t o   t h e i r   o w n   v o l u m e   m o u n t   o u t s i d e   o f   C : \ .   B y   d e f a u l t ,   t h e   p r o j e c t e d   f i l e s   w i l l   h a v e   t h e   f o l l o w i n g   o w n e r s h i p   a s   s h o w n   f o r   a n   e x a m p l e   p r o j e c t e d   v o l u m e   f i l e :


Question: What is Note:?

Answer: I n   g e n e r a l ,   g r a n t i n g   t h e   c o n t a i n e r   a c c e s s   t o   t h e   h o s t   i s   d i s c o u r a g e d   a s   i t   c a n   o p e n   t h e   d o o r   f o r   p o t e n t i a l   s e c u r i t y   e x p l o i t s .   C r e a t i n g   a   W i n d o w s   P o d   w i t h   R u n A s U s e r   i n   i t ' s   S e c u r i t y C o n t e x t   w i l l   r e s u l t   i n   t h e   P o d   b e i n g   s t u c k   a t   C o n t a i n e r C r e a t i n g   f o r e v e r .   S o   i t   i s   a d v i s e d   t o   n o t   u s e   t h e   L i n u x   o n l y   R u n A s U s e r   o p t i o n   w i t h   W i n d o w s   P o d s .


Question: What is Assign Pods to Nodes using Node Affinity?

Answer: Assign Pods to Nodes using Node AffinityThis page shows how to assign a Kubernetes Pod to a particular node using Node Affinity in a Kubernetes cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.10.To check the version, enter kubectl version.Add a label to a nodeList the nodes in your cluster, along with their labels:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 Choose one of your nodes, and add a label to it:kubectl label nodes <your-node-name> disktype=ssd where <your-node-name> is the name of your chosen node.Verify that your chosen node has a disktype=ssd label:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,disktype=ssd,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 In the preceding output, you can see that the worker0 node has a disktype=ssd label.Schedule a Pod using required node affinityThis manifest describes a Pod that has a requiredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will get scheduled only on a node that has a disktype=ssd label.pods/pod-nginx-required-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: disktype operator: In values: - ssd containers: - name: nginx image: nginx imagePullPolicy: IfNotPresent Apply the manifest to create a Pod that is scheduled onto your chosen node:kubectl apply -f https://k8s.io/examples/pods/pod-nginx-required-affinity.yaml Verify that the pod is running on your chosen node:kubectl get pods --output=wide The output is similar to this:NAME READY STATUS RESTARTS AGE IP NODE nginx 1/1 Running 0 13s 10.200.0.4 worker0 Schedule a Pod using preferred node affinityThis manifest describes a Pod that has a preferredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will prefer a node that has a disktype=ssd label.pods/pod-nginx-preferred-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1


Question: How does Assign Pods to Nodes using Node Affinity work?

Answer: Assign Pods to Nodes using Node AffinityThis page shows how to assign a Kubernetes Pod to a particular node using Node Affinity in a Kubernetes cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.10.To check the version, enter kubectl version.Add a label to a nodeList the nodes in your cluster, along with their labels:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 Choose one of your nodes, and add a label to it:kubectl label nodes <your-node-name> disktype=ssd where <your-node-name> is the name of your chosen node.Verify that your chosen node has a disktype=ssd label:kubectl get nodes --show-labels The output is similar to this:NAME STATUS ROLES AGE VERSION LABELS worker0 Ready <none> 1d v1.13.0 ...,disktype=ssd,kubernetes.io/hostname=worker0 worker1 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker1 worker2 Ready <none> 1d v1.13.0 ...,kubernetes.io/hostname=worker2 In the preceding output, you can see that the worker0 node has a disktype=ssd label.Schedule a Pod using required node affinityThis manifest describes a Pod that has a requiredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will get scheduled only on a node that has a disktype=ssd label.pods/pod-nginx-required-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: requiredDuringSchedulingIgnoredDuringExecution: nodeSelectorTerms: - matchExpressions: - key: disktype operator: In values: - ssd containers: - name: nginx image: nginx imagePullPolicy: IfNotPresent Apply the manifest to create a Pod that is scheduled onto your chosen node:kubectl apply -f https://k8s.io/examples/pods/pod-nginx-required-affinity.yaml Verify that the pod is running on your chosen node:kubectl get pods --output=wide The output is similar to this:NAME READY STATUS RESTARTS AGE IP NODE nginx 1/1 Running 0 13s 10.200.0.4 worker0 Schedule a Pod using preferred node affinityThis manifest describes a Pod that has a preferredDuringSchedulingIgnoredDuringExecution node affinity,disktype: ssd. This means that the pod will prefer a node that has a disktype=ssd label.pods/pod-nginx-preferred-affinity.yaml apiVersion: v1 kind: Pod metadata: name: nginx spec: affinity: nodeAffinity: preferredDuringSchedulingIgnoredDuringExecution: - weight: 1