Question: What is Synopsis?

Answer: E x p o s e   a   r e s o u r c e   a s   a   n e w   K u b e r n e t e s   s e r v i c e .   L o o k s   u p   a   d e p l o y m e n t ,   s e r v i c e ,   r e p l i c a   s e t ,   r e p l i c a t i o n   c o n t r o l l e r   o r   p o d   b y   n a m e   a n d   u s e s   t h e   s e l e c t o r   f o r   t h a t   r e s o u r c e   a s   t h e   s e l e c t o r   f o r   a   n e w   s e r v i c e   o n   t h e   s p e c i f i e d   p o r t .   A   d e p l o y m e n t   o r   r e p l i c a   s e t   w i l l   b e   e x p o s e d   a s   a   s e r v i c e   o n l y   i f   i t s   s e l e c t o r   i s   c o n v e r t i b l e   t o   a   s e l e c t o r   t h a t   s e r v i c e   s u p p o r t s ,   i . e .   w h e n   t h e   s e l e c t o r   c o n t a i n s   o n l y   t h e   m a t c h L a b e l s   c o m p o n e n t .   N o t e   t h a t   i f   n o   p o r t   i s   s p e c i f i e d   v i a   - - p o r t   a n d   t h e   e x p o s e d   r e s o u r c e   h a s   m u l t i p l e   p o r t s ,   a l l   w i l l   b e   r e - u s e d   b y   t h e   n e w   s e r v i c e .   A l s o   i f   n o   l a b e l s   a r e   s p e c i f i e d ,   t h e   n e w   s e r v i c e   w i l l   r e - u s e   t h e   l a b e l s   f r o m   t h e   r e s o u r c e   i t   e x p o s e s .   P o s s i b l e   r e s o u r c e s   i n c l u d e   ( c a s e   i n s e n s i t i v e ) :   p o d   ( p o ) ,   s e r v i c e   ( s v c ) ,   r e p l i c a t i o n c o n t r o l l e r   ( r c ) ,   d e p l o y m e n t   ( d e p l o y ) ,   r e p l i c a s e t   ( r s )   k u b e c t l   e x p o s e   ( - f   F I L E N A M E   |   T Y P E   N A M E )   [ - - p o r t = p o r t ]   [ - - p r o t o c o l = T C P | U D P | S C T P ]   [ - - t a r g e t - p o r t = n u m b e r - o r - n a m e ]   [ - - n a m e = n a m e ]   [ - - e x t e r n a l - i p = e x t e r n a l - i p - o f - s e r v i c e ]   [ - - t y p e = t y p e ]


Question: What is Examples?

Answer: #   C r e a t e   a   s e r v i c e   f o r   a   r e p l i c a t e d   n g i n x ,   w h i c h   s e r v e s   o n   p o r t   8 0   a n d   c o n n e c t s   t o   t h e   c o n t a i n e r s   o n   p o r t   8 0 0 0   k u b e c t l   e x p o s e   r c   n g i n x   - - p o r t = 8 0   - - t a r g e t - p o r t = 8 0 0 0   #   C r e a t e   a   s e r v i c e   f o r   a   r e p l i c a t i o n   c o n t r o l l e r   i d e n t i f i e d   b y   t y p e   a n d   n a m e   s p e c i f i e d   i n   " n g i n x - c o n t r o l l e r . y a m l " ,   w h i c h   s e r v e s   o n   p o r t   8 0   a n d   c o n n e c t s   t o   t h e   c o n t a i n e r s   o n   p o r t   8 0 0 0   k u b e c t l   e x p o s e   - f   n g i n x - c o n t r o l l e r . y a m l   - - p o r t = 8 0   - - t a r g e t - p o r t = 8 0 0 0   #   C r e a t e   a   s e r v i c e   f o r   a   p o d   v a l i d - p o d ,   w h i c h   s e r v e s   o n   p o r t   4 4 4   w i t h   t h e   n a m e   " f r o n t e n d "   k u b e c t l   e x p o s e   p o d   v a l i d - p o d   - - p o r t = 4 4 4   - - n a m e = f r o n t e n d   #   C r e a t e   a   s e c o n d   s e r v i c e   b a s e d   o n   t h e   a b o v e   s e r v i c e ,   e x p o s i n g   t h e   c o n t a i n e r   p o r t   8 4 4 3   a s   p o r t   4 4 3   w i t h   t h e   n a m e   " n g i n x - h t t p s "   k u b e c t l   e x p o s e   s e r v i c e   n g i n x   - - p o r t = 4 4 3   - - t a r g e t - p o r t = 8 4 4 3   - - n a m e = n g i n x - h t t p s   #   C r e a t e   a   s e r v i c e   f o r   a   r e p l i c a t e d   s t r e a m i n g   a p p l i c a t i o n   o n   p o r t   4 1 0 0   b a l a n c i n g   U D P   t r a f f i c   a n d   n a m e d   ' v i d e o - s t r e a m ' .   k u b e c t l   e x p o s e   r c   s t r e a m e r   - - p o r t = 4 1 0 0   - - p r o t o c o l = U D P   - - n a m e = v i d e o - s t r e a m   #   C r e a t e   a   s e r v i c e   f o r   a   r e p l i c a t e d   n g i n x


Question: What is Options?

Answer: I f   t r u e ,   i g n o r e   a n y   e r r o r s   i n   t e m p l a t e s   w h e n   a   f i e l d   o r   m a p   k e y   i s   m i s s i n g   i n   t h e   t e m p l a t e .   O n l y   a p p l i e s   t o   g o l a n g   a n d   j s o n p a t h   o u t p u t   f o r m a t s .   C l u s t e r I P   t o   b e   a s s i g n e d   t o   t h e   s e r v i c e .   L e a v e   e m p t y   t o   a u t o - a l l o c a t e ,   o r   s e t   t o   ' N o n e '   t o   c r e a t e   a   h e a d l e s s   s e r v i c e .   M u s t   b e   " n o n e " ,   " s e r v e r " ,   o r   " c l i e n t " .   I f   c l i e n t   s t r a t e g y ,   o n l y   p r i n t   t h e   o b j e c t   t h a t   w o u l d   b e   s e n t ,   w i t h o u t   s e n d i n g   i t .   I f   s e r v e r   s t r a t e g y ,   s u b m i t   s e r v e r - s i d e   r e q u e s t   w i t h o u t   p e r s i s t i n g   t h e   r e s o u r c e .   A d d i t i o n a l   e x t e r n a l   I P   a d d r e s s   ( n o t   m a n a g e d   b y   K u b e r n e t e s )   t o   a c c e p t   f o r   t h e   s e r v i c e .   I f   t h i s   I P   i s   r o u t e d   t o   a   n o d e ,   t h e   s e r v i c e   c a n   b e   a c c e s s e d   b y   t h i s   I P   i n   a d d i t i o n   t o   i t s   g e n e r a t e d   s e r v i c e   I P .   N a m e   o f   t h e   m a n a g e r   u s e d   t o   t r a c k   f i e l d   o w n e r s h i p .   F i l e n a m e ,   d i r e c t o r y ,   o r   U R L   t o   f i l e s   i d e n t i f y i n g   t h e   r e s o u r c e   t o   e x p o s e   a   s e r v i c e   h e l p   f o r   e x p o s e   P r o c e s s   t h e   k u s t o m i z a t i o n   d i r e c t o r y .   T h i s   f l a g   c a n ' t   b e   u s e d   t o g e t h e r   w i t h   - f   o r   - R .   L a b e l s   t o   a p p l y   t o   t h e   s e r v i c e   c r e a t e d   b y   t h i s   c a l l .   I P   t o   a s s i g n   t o   t h e   L o a d B a l a n c e r .   I f   e m p t y ,   a n   e p h e m


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   -   k u b e c t l   c o n t r o l s   t h e   K u b e r n e t e s   c l u s t e r   m a n a g e r   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Gateway API?

Answer: Gateway APIGateway API is a family of API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Make network services available by using an extensible, role-oriented, protocol-aware configuration mechanism. Gateway API is an add-on containing API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Design principlesThe following principles shaped the design and architecture of Gateway API:Role-oriented: Gateway API kinds are modeled after organizational roles that are responsible for managing Kubernetes service networking:Infrastructure Provider: Manages infrastructure that allows multiple isolated clusters to serve multiple tenants, e.g. a cloud provider.Cluster Operator: Manages clusters and is typically concerned with policies, network access, application permissions, etc.Application Developer: Manages an application running in a cluster and is typically concerned with application-level configuration and Service composition.Portable: Gateway API specifications are defined as custom resources and are supported by many implementations.Expressive: Gateway API kinds support functionality for common traffic routing use cases such as header-based matching, traffic weighting, and others that were only possible in Ingress by using custom annotations.Extensible: Gateway allows for custom resources to be linked at various layers of the API. This makes granular customization possible at the appropriate places within the API structure.Resource modelGateway API has four stable API kinds:GatewayClass: Defines a set of gateways with common configuration and managed by a controller that implements the class.Gateway: Defines an instance of traffic handling infrastructure, such as cloud load balancer.HTTPRoute: Defines HTTP-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.GRPCRoute: Defines gRPC-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.Gateway API is organized into different API kinds that have interdependent relationships to support the role-oriented nature of organizations. A Gateway object is associated with exactly one GatewayClass; the GatewayClass describes the gateway controller responsible for managing Gateways of this class. One or more route kinds such as HTTPRoute, are then associated to Gateways. A Gateway can filter the routes that may be attached to its listeners, forming a bidirectional trust model with routes.The following figure illustrates the relationships of the three stable Gateway API kinds:GatewayClassGateways can be implemented by different controllers, often with different configurations. A Gateway must reference a GatewayClass that contains the name of the controller that implements the class.A minimal GatewayClass example:apiVersion: gateway.network


Question: How does Gateway API work?

Answer: Gateway APIGateway API is a family of API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Make network services available by using an extensible, role-oriented, protocol-aware configuration mechanism. Gateway API is an add-on containing API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Design principlesThe following principles shaped the design and architecture of Gateway API:Role-oriented: Gateway API kinds are modeled after organizational roles that are responsible for managing Kubernetes service networking:Infrastructure Provider: Manages infrastructure that allows multiple isolated clusters to serve multiple tenants, e.g. a cloud provider.Cluster Operator: Manages clusters and is typically concerned with policies, network access, application permissions, etc.Application Developer: Manages an application running in a cluster and is typically concerned with application-level configuration and Service composition.Portable: Gateway API specifications are defined as custom resources and are supported by many implementations.Expressive: Gateway API kinds support functionality for common traffic routing use cases such as header-based matching, traffic weighting, and others that were only possible in Ingress by using custom annotations.Extensible: Gateway allows for custom resources to be linked at various layers of the API. This makes granular customization possible at the appropriate places within the API structure.Resource modelGateway API has four stable API kinds:GatewayClass: Defines a set of gateways with common configuration and managed by a controller that implements the class.Gateway: Defines an instance of traffic handling infrastructure, such as cloud load balancer.HTTPRoute: Defines HTTP-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.GRPCRoute: Defines gRPC-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.Gateway API is organized into different API kinds that have interdependent relationships to support the role-oriented nature of organizations. A Gateway object is associated with exactly one GatewayClass; the GatewayClass describes the gateway controller responsible for managing Gateways of this class. One or more route kinds such as HTTPRoute, are then associated to Gateways. A Gateway can filter the routes that may be attached to its listeners, forming a bidirectional trust model with routes.The following figure illustrates the relationships of the three stable Gateway API kinds:GatewayClassGateways can be implemented by different controllers, often with different configurations. A Gateway must reference a GatewayClass that contains the name of the controller that implements the class.A minimal GatewayClass example:apiVersion: gateway.network


Question: When would you use Gateway API?

Answer: Gateway APIGateway API is a family of API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Make network services available by using an extensible, role-oriented, protocol-aware configuration mechanism. Gateway API is an add-on containing API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Design principlesThe following principles shaped the design and architecture of Gateway API:Role-oriented: Gateway API kinds are modeled after organizational roles that are responsible for managing Kubernetes service networking:Infrastructure Provider: Manages infrastructure that allows multiple isolated clusters to serve multiple tenants, e.g. a cloud provider.Cluster Operator: Manages clusters and is typically concerned with policies, network access, application permissions, etc.Application Developer: Manages an application running in a cluster and is typically concerned with application-level configuration and Service composition.Portable: Gateway API specifications are defined as custom resources and are supported by many implementations.Expressive: Gateway API kinds support functionality for common traffic routing use cases such as header-based matching, traffic weighting, and others that were only possible in Ingress by using custom annotations.Extensible: Gateway allows for custom resources to be linked at various layers of the API. This makes granular customization possible at the appropriate places within the API structure.Resource modelGateway API has four stable API kinds:GatewayClass: Defines a set of gateways with common configuration and managed by a controller that implements the class.Gateway: Defines an instance of traffic handling infrastructure, such as cloud load balancer.HTTPRoute: Defines HTTP-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.GRPCRoute: Defines gRPC-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.Gateway API is organized into different API kinds that have interdependent relationships to support the role-oriented nature of organizations. A Gateway object is associated with exactly one GatewayClass; the GatewayClass describes the gateway controller responsible for managing Gateways of this class. One or more route kinds such as HTTPRoute, are then associated to Gateways. A Gateway can filter the routes that may be attached to its listeners, forming a bidirectional trust model with routes.The following figure illustrates the relationships of the three stable Gateway API kinds:GatewayClassGateways can be implemented by different controllers, often with different configurations. A Gateway must reference a GatewayClass that contains the name of the controller that implements the class.A minimal GatewayClass example:apiVersion: gateway.network


Question: What are the benefits of Gateway API?

Answer: Gateway APIGateway API is a family of API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Make network services available by using an extensible, role-oriented, protocol-aware configuration mechanism. Gateway API is an add-on containing API kinds that provide dynamic infrastructure provisioning and advanced traffic routing.Design principlesThe following principles shaped the design and architecture of Gateway API:Role-oriented: Gateway API kinds are modeled after organizational roles that are responsible for managing Kubernetes service networking:Infrastructure Provider: Manages infrastructure that allows multiple isolated clusters to serve multiple tenants, e.g. a cloud provider.Cluster Operator: Manages clusters and is typically concerned with policies, network access, application permissions, etc.Application Developer: Manages an application running in a cluster and is typically concerned with application-level configuration and Service composition.Portable: Gateway API specifications are defined as custom resources and are supported by many implementations.Expressive: Gateway API kinds support functionality for common traffic routing use cases such as header-based matching, traffic weighting, and others that were only possible in Ingress by using custom annotations.Extensible: Gateway allows for custom resources to be linked at various layers of the API. This makes granular customization possible at the appropriate places within the API structure.Resource modelGateway API has four stable API kinds:GatewayClass: Defines a set of gateways with common configuration and managed by a controller that implements the class.Gateway: Defines an instance of traffic handling infrastructure, such as cloud load balancer.HTTPRoute: Defines HTTP-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.GRPCRoute: Defines gRPC-specific rules for mapping traffic from a Gateway listener to a representation of backend network endpoints. These endpoints are often represented as a Service.Gateway API is organized into different API kinds that have interdependent relationships to support the role-oriented nature of organizations. A Gateway object is associated with exactly one GatewayClass; the GatewayClass describes the gateway controller responsible for managing Gateways of this class. One or more route kinds such as HTTPRoute, are then associated to Gateways. A Gateway can filter the routes that may be attached to its listeners, forming a bidirectional trust model with routes.The following figure illustrates the relationships of the three stable Gateway API kinds:GatewayClassGateways can be implemented by different controllers, often with different configurations. A Gateway must reference a GatewayClass that contains the name of the controller that implements the class.A minimal GatewayClass example:apiVersion: gateway.network


Question: What is Gateway API?

Answer: M a k e   n e t w o r k   s e r v i c e s   a v a i l a b l e   b y   u s i n g   a n   e x t e n s i b l e ,   r o l e - o r i e n t e d ,   p r o t o c o l - a w a r e   c o n f i g u r a t i o n   m e c h a n i s m .   G a t e w a y   A P I   i s   a n   a d d - o n   c o n t a i n i n g   A P I   k i n d s   t h a t   p r o v i d e   d y n a m i c   i n f r a s t r u c t u r e   p r o v i s i o n i n g   a n d   a d v a n c e d   t r a f f i c   r o u t i n g .


Question: What is Design principles?

Answer: T h e   f o l l o w i n g   p r i n c i p l e s   s h a p e d   t h e   d e s i g n   a n d   a r c h i t e c t u r e   o f   G a t e w a y   A P I :   R o l e - o r i e n t e d :   G a t e w a y   A P I   k i n d s   a r e   m o d e l e d   a f t e r   o r g a n i z a t i o n a l   r o l e s   t h a t   a r e   r e s p o n s i b l e   f o r   m a n a g i n g   K u b e r n e t e s   s e r v i c e   n e t w o r k i n g : I n f r a s t r u c t u r e   P r o v i d e r :   M a n a g e s   i n f r a s t r u c t u r e   t h a t   a l l o w s   m u l t i p l e   i s o l a t e d   c l u s t e r s   t o   s e r v e   m u l t i p l e   t e n a n t s ,   e . g .   a   c l o u d   p r o v i d e r . C l u s t e r   O p e r a t o r :   M a n a g e s   c l u s t e r s   a n d   i s   t y p i c a l l y   c o n c e r n e d   w i t h   p o l i c i e s ,   n e t w o r k   a c c e s s ,   a p p l i c a t i o n   p e r m i s s i o n s ,   e t c . A p p l i c a t i o n   D e v e l o p e r :   M a n a g e s   a n   a p p l i c a t i o n   r u n n i n g   i n   a   c l u s t e r   a n d   i s   t y p i c a l l y   c o n c e r n e d   w i t h   a p p l i c a t i o n - l e v e l   c o n f i g u r a t i o n   a n d   S e r v i c e   c o m p o s i t i o n . P o r t a b l e :   G a t e w a y   A P I   s p e c i f i c a t i o n s   a r e   d e f i n e d   a s   c u s t o m   r e s o u r c e s   a n d   a r e   s u p p o r t e d   b y   m a n y   i m p l e m e n t a t i o n s . E x p r e s s i v e :   G a t e w a y   A P I   k i n d s   s u p p o r t   f u n c t i o n a l i t y   f o r   c o m m o n   t r a f f i c   r o u t i n g   u s e   c a s e s   s u c h   a s   h e a d e r - b a s e d   m a t c h i n g ,   t r a f f i c   w e i g h t i n g ,   a n d   o t h e r s   t h a t   w e r e   o n l y   p o s s i b l e   i n   I n g r e s s   b y   u s i n g   c u s t o m   a n n o t a t i o n s . E x t e n s i b l e :   G a t e w a y   a l l o w s   f o r   c u s t o m   r e s o u r c e s   t o


Question: What is Resource model?

Answer: G a t e w a y   A P I   h a s   f o u r   s t a b l e   A P I   k i n d s :   G a t e w a y C l a s s :   D e f i n e s   a   s e t   o f   g a t e w a y s   w i t h   c o m m o n   c o n f i g u r a t i o n   a n d   m a n a g e d   b y   a   c o n t r o l l e r   t h a t   i m p l e m e n t s   t h e   c l a s s . G a t e w a y :   D e f i n e s   a n   i n s t a n c e   o f   t r a f f i c   h a n d l i n g   i n f r a s t r u c t u r e ,   s u c h   a s   c l o u d   l o a d   b a l a n c e r . H T T P R o u t e :   D e f i n e s   H T T P - s p e c i f i c   r u l e s   f o r   m a p p i n g   t r a f f i c   f r o m   a   G a t e w a y   l i s t e n e r   t o   a   r e p r e s e n t a t i o n   o f   b a c k e n d   n e t w o r k   e n d p o i n t s .   T h e s e   e n d p o i n t s   a r e   o f t e n   r e p r e s e n t e d   a s   a   S e r v i c e . G R P C R o u t e :   D e f i n e s   g R P C - s p e c i f i c   r u l e s   f o r   m a p p i n g   t r a f f i c   f r o m   a   G a t e w a y   l i s t e n e r   t o   a   r e p r e s e n t a t i o n   o f   b a c k e n d   n e t w o r k   e n d p o i n t s .   T h e s e   e n d p o i n t s   a r e   o f t e n   r e p r e s e n t e d   a s   a   S e r v i c e .   G a t e w a y C l a s s :   D e f i n e s   a   s e t   o f   g a t e w a y s   w i t h   c o m m o n   c o n f i g u r a t i o n   a n d   m a n a g e d   b y   a   c o n t r o l l e r   t h a t   i m p l e m e n t s   t h e   c l a s s .   G a t e w a y :   D e f i n e s   a n   i n s t a n c e   o f   t r a f f i c   h a n d l i n g   i n f r a s t r u c t u r e ,   s u c h   a s   c l o u d   l o a d   b a l a n c e r .   H T T P R o u t e :   D e f i n e s   H T T P - s p e c i f i c   r u l e s   f o r   m a p p i n g   t r a f f i c   f r o m   a   G a t e w a y   l i s t e n e r   t o   a   r e p r e s e n t a t i o n   o f   b a c k e n d   n e t w o r k   e n d p o i n t s .   T h e s e   e n d p o i n t s   a r e   o f t e n   r e p r e


Question: What is GatewayClass?

Answer: G a t e w a y s   c a n   b e   i m p l e m e n t e d   b y   d i f f e r e n t   c o n t r o l l e r s ,   o f t e n   w i t h   d i f f e r e n t   c o n f i g u r a t i o n s .   A   G a t e w a y   m u s t   r e f e r e n c e   a   G a t e w a y C l a s s   t h a t   c o n t a i n s   t h e   n a m e   o f   t h e   c o n t r o l l e r   t h a t   i m p l e m e n t s   t h e   c l a s s .   A   m i n i m a l   G a t e w a y C l a s s   e x a m p l e :   a p i V e r s i o n :   g a t e w a y . n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   G a t e w a y C l a s s   m e t a d a t a :   n a m e :   e x a m p l e - c l a s s   s p e c :   c o n t r o l l e r N a m e :   e x a m p l e . c o m / g a t e w a y - c o n t r o l l e r   I n   t h i s   e x a m p l e ,   a   c o n t r o l l e r   t h a t   h a s   i m p l e m e n t e d   G a t e w a y   A P I   i s   c o n f i g u r e d   t o   m a n a g e   G a t e w a y C l a s s e s   w i t h   t h e   c o n t r o l l e r   n a m e   e x a m p l e . c o m / g a t e w a y - c o n t r o l l e r .   G a t e w a y s   o f   t h i s   c l a s s   w i l l   b e   m a n a g e d   b y   t h e   i m p l e m e n t a t i o n ' s   c o n t r o l l e r .   S e e   t h e   G a t e w a y C l a s s   r e f e r e n c e   f o r   a   f u l l   d e f i n i t i o n   o f   t h i s   A P I   k i n d .


Question: What is Gateway?

Answer: A   G a t e w a y   d e s c r i b e s   a n   i n s t a n c e   o f   t r a f f i c   h a n d l i n g   i n f r a s t r u c t u r e .   I t   d e f i n e s   a   n e t w o r k   e n d p o i n t   t h a t   c a n   b e   u s e d   f o r   p r o c e s s i n g   t r a f f i c ,   i . e .   f i l t e r i n g ,   b a l a n c i n g ,   s p l i t t i n g ,   e t c .   f o r   b a c k e n d s   s u c h   a s   a   S e r v i c e .   F o r   e x a m p l e ,   a   G a t e w a y   m a y   r e p r e s e n t   a   c l o u d   l o a d   b a l a n c e r   o r   a n   i n - c l u s t e r   p r o x y   s e r v e r   t h a t   i s   c o n f i g u r e d   t o   a c c e p t   H T T P   t r a f f i c .   A   m i n i m a l   G a t e w a y   r e s o u r c e   e x a m p l e :   a p i V e r s i o n :   g a t e w a y . n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   G a t e w a y   m e t a d a t a :   n a m e :   e x a m p l e - g a t e w a y   s p e c :   g a t e w a y C l a s s N a m e :   e x a m p l e - c l a s s   l i s t e n e r s :   -   n a m e :   h t t p   p r o t o c o l :   H T T P   p o r t :   8 0   I n   t h i s   e x a m p l e ,   a n   i n s t a n c e   o f   t r a f f i c   h a n d l i n g   i n f r a s t r u c t u r e   i s   p r o g r a m m e d   t o   l i s t e n   f o r   H T T P   t r a f f i c   o n   p o r t   8 0 .   S i n c e   t h e   a d d r e s s e s   f i e l d   i s   u n s p e c i f i e d ,   a n   a d d r e s s   o r   h o s t n a m e   i s   a s s i g n e d   t o   t h e   G a t e w a y   b y   t h e   i m p l e m e n t a t i o n ' s   c o n t r o l l e r .   T h i s   a d d r e s s   i s   u s e d   a s   a   n e t w o r k   e n d p o i n t   f o r   p r o c e s s i n g   t r a f f i c   o f   b a c k e n d   n e t w o r k   e n d p o i n t s   d e f i n e d   i n   r o u t e s .   S e e   t h e   G a t e w a y   r e f e r e n c e   f o r   a   f u l l   d e f i n i t i o n   o f   t h i s   A P I   k i n d .


Question: What is HTTPRoute?

Answer: T h e   H T T P R o u t e   k i n d   s p e c i f i e s   r o u t i n g   b e h a v i o r   o f   H T T P   r e q u e s t s   f r o m   a   G a t e w a y   l i s t e n e r   t o   b a c k e n d   n e t w o r k   e n d p o i n t s .   F o r   a   S e r v i c e   b a c k e n d ,   a n   i m p l e m e n t a t i o n   m a y   r e p r e s e n t   t h e   b a c k e n d   n e t w o r k   e n d p o i n t   a s   a   S e r v i c e   I P   o r   t h e   b a c k i n g   E n d p o i n t S l i c e s   o f   t h e   S e r v i c e .   A n   H T T P R o u t e   r e p r e s e n t s   c o n f i g u r a t i o n   t h a t   i s   a p p l i e d   t o   t h e   u n d e r l y i n g   G a t e w a y   i m p l e m e n t a t i o n .   F o r   e x a m p l e ,   d e f i n i n g   a   n e w   H T T P R o u t e   m a y   r e s u l t   i n   c o n f i g u r i n g   a d d i t i o n a l   t r a f f i c   r o u t e s   i n   a   c l o u d   l o a d   b a l a n c e r   o r   i n - c l u s t e r   p r o x y   s e r v e r .   A   m i n i m a l   H T T P R o u t e   e x a m p l e :   a p i V e r s i o n :   g a t e w a y . n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   H T T P R o u t e   m e t a d a t a :   n a m e :   e x a m p l e - h t t p r o u t e   s p e c :   p a r e n t R e f s :   -   n a m e :   e x a m p l e - g a t e w a y   h o s t n a m e s :   -   " w w w . e x a m p l e . c o m "   r u l e s :   -   m a t c h e s :   -   p a t h :   t y p e :   P a t h P r e f i x   v a l u e :   / l o g i n   b a c k e n d R e f s :   -   n a m e :   e x a m p l e - s v c   p o r t :   8 0 8 0   I n   t h i s   e x a m p l e ,   H T T P   t r a f f i c   f r o m   G a t e w a y   e x a m p l e - g a t e w a y   w i t h   t h e   H o s t :   h e a d e r   s e t   t o   w w w . e x a m p l e . c o m   a n d   t h e   r e q u e s t   p a t h   s p e c i f i e d   a s   / l o g i n   w i l l   b e   r o u t e d   t o   S e r v i c e   e x a m p l e - s v c   o n   p o r t   8 0 8 0 .   S e e   t h e


Question: What is GRPCRoute?

Answer: T h e   G R P C R o u t e   k i n d   s p e c i f i e s   r o u t i n g   b e h a v i o r   o f   g R P C   r e q u e s t s   f r o m   a   G a t e w a y   l i s t e n e r   t o   b a c k e n d   n e t w o r k   e n d p o i n t s .   F o r   a   S e r v i c e   b a c k e n d ,   a n   i m p l e m e n t a t i o n   m a y   r e p r e s e n t   t h e   b a c k e n d   n e t w o r k   e n d p o i n t   a s   a   S e r v i c e   I P   o r   t h e   b a c k i n g   E n d p o i n t S l i c e s   o f   t h e   S e r v i c e .   A   G R P C R o u t e   r e p r e s e n t s   c o n f i g u r a t i o n   t h a t   i s   a p p l i e d   t o   t h e   u n d e r l y i n g   G a t e w a y   i m p l e m e n t a t i o n .   F o r   e x a m p l e ,   d e f i n i n g   a   n e w   G R P C R o u t e   m a y   r e s u l t   i n   c o n f i g u r i n g   a d d i t i o n a l   t r a f f i c   r o u t e s   i n   a   c l o u d   l o a d   b a l a n c e r   o r   i n - c l u s t e r   p r o x y   s e r v e r .   G a t e w a y s   s u p p o r t i n g   G R P C R o u t e   a r e   r e q u i r e d   t o   s u p p o r t   H T T P / 2   w i t h o u t   a n   i n i t i a l   u p g r a d e   f r o m   H T T P / 1 ,   s o   g R P C   t r a f f i c   i s   g u a r a n t e e d   t o   f l o w   p r o p e r l y .   A   m i n i m a l   G R P C R o u t e   e x a m p l e :   a p i V e r s i o n :   g a t e w a y . n e t w o r k i n g . k 8 s . i o / v 1   k i n d :   G R P C R o u t e   m e t a d a t a :   n a m e :   e x a m p l e - g r p c r o u t e   s p e c :   p a r e n t R e f s :   -   n a m e :   e x a m p l e - g a t e w a y   h o s t n a m e s :   -   " s v c . e x a m p l e . c o m "   r u l e s :   -   b a c k e n d R e f s :   -   n a m e :   e x a m p l e - s v c   p o r t :   5 0 0 5 1   I n   t h i s   e x a m p l e ,   g R P C   t r a f f i c   f r o m   G a t e w a y   e x a m p l e - g a t e w a y   w i t h   t h e   h o s t   s e t   t o   s v c . e x a m p l e . c o m   w i l l   b e


Question: What is Request flow?

Answer: H e r e   i s   a   s i m p l e   e x a m p l e   o f   H T T P   t r a f f i c   b e i n g   r o u t e d   t o   a   S e r v i c e   b y   u s i n g   a   G a t e w a y   a n d   a n   H T T P R o u t e :   I n   t h i s   e x a m p l e ,   t h e   r e q u e s t   f l o w   f o r   a   G a t e w a y   i m p l e m e n t e d   a s   a   r e v e r s e   p r o x y   i s :   T h e   c l i e n t   s t a r t s   t o   p r e p a r e   a n   H T T P   r e q u e s t   f o r   t h e   U R L   h t t p : / / w w w . e x a m p l e . c o m T h e   c l i e n t ' s   D N S   r e s o l v e r   q u e r i e s   f o r   t h e   d e s t i n a t i o n   n a m e   a n d   l e a r n s   a   m a p p i n g   t o   o n e   o r   m o r e   I P   a d d r e s s e s   a s s o c i a t e d   w i t h   t h e   G a t e w a y . T h e   c l i e n t   s e n d s   a   r e q u e s t   t o   t h e   G a t e w a y   I P   a d d r e s s ;   t h e   r e v e r s e   p r o x y   r e c e i v e s   t h e   H T T P   r e q u e s t   a n d   u s e s   t h e   H o s t :   h e a d e r   t o   m a t c h   a   c o n f i g u r a t i o n   t h a t   w a s   d e r i v e d   f r o m   t h e   G a t e w a y   a n d   a t t a c h e d   H T T P R o u t e . O p t i o n a l l y ,   t h e   r e v e r s e   p r o x y   c a n   p e r f o r m   r e q u e s t   h e a d e r   a n d / o r   p a t h   m a t c h i n g   b a s e d   o n   m a t c h   r u l e s   o f   t h e   H T T P R o u t e . O p t i o n a l l y ,   t h e   r e v e r s e   p r o x y   c a n   m o d i f y   t h e   r e q u e s t ;   f o r   e x a m p l e ,   t o   a d d   o r   r e m o v e   h e a d e r s ,   b a s e d   o n   f i l t e r   r u l e s   o f   t h e   H T T P R o u t e . L a s t l y ,   t h e   r e v e r s e   p r o x y   f o r w a r d s   t h e   r e q u e s t   t o   o n e   o r   m o r e   b a c k e n d s .


Question: What is Conformance?

Answer: G a t e w a y   A P I   c o v e r s   a   b r o a d   s e t   o f   f e a t u r e s   a n d   i s   w i d e l y   i m p l e m e n t e d .   T h i s   c o m b i n a t i o n   r e q u i r e s   c l e a r   c o n f o r m a n c e   d e f i n i t i o n s   a n d   t e s t s   t o   e n s u r e   t h a t   t h e   A P I   p r o v i d e s   a   c o n s i s t e n t   e x p e r i e n c e   w h e r e v e r   i t   i s   u s e d .   S e e   t h e   c o n f o r m a n c e   d o c u m e n t a t i o n   t o   u n d e r s t a n d   d e t a i l s   s u c h   a s   r e l e a s e   c h a n n e l s ,   s u p p o r t   l e v e l s ,   a n d   r u n n i n g   c o n f o r m a n c e   t e s t s .


Question: What is Migrating from Ingress?

Answer: G a t e w a y   A P I   i s   t h e   s u c c e s s o r   t o   t h e   I n g r e s s   A P I .   H o w e v e r ,   i t   d o e s   n o t   i n c l u d e   t h e   I n g r e s s   k i n d .   A s   a   r e s u l t ,   a   o n e - t i m e   c o n v e r s i o n   f r o m   y o u r   e x i s t i n g   I n g r e s s   r e s o u r c e s   t o   G a t e w a y   A P I   r e s o u r c e s   i s   n e c e s s a r y .   R e f e r   t o   t h e   i n g r e s s   m i g r a t i o n   g u i d e   f o r   d e t a i l s   o n   m i g r a t i n g   I n g r e s s   r e s o u r c e s   t o   G a t e w a y   A P I   r e s o u r c e s .


Question: What is What's next?

Answer: I n s t e a d   o f   G a t e w a y   A P I   r e s o u r c e s   b e i n g   n a t i v e l y   i m p l e m e n t e d   b y   K u b e r n e t e s ,   t h e   s p e c i f i c a t i o n s   a r e   d e f i n e d   a s   C u s t o m   R e s o u r c e s   s u p p o r t e d   b y   a   w i d e   r a n g e   o f   i m p l e m e n t a t i o n s .   I n s t a l l   t h e   G a t e w a y   A P I   C R D s   o r   f o l l o w   t h e   i n s t a l l a t i o n   i n s t r u c t i o n s   o f   y o u r   s e l e c t e d   i m p l e m e n t a t i o n .   A f t e r   i n s t a l l i n g   a n   i m p l e m e n t a t i o n ,   u s e   t h e   G e t t i n g   S t a r t e d   g u i d e   t o   h e l p   y o u   q u i c k l y   s t a r t   w o r k i n g   w i t h   G a t e w a y   A P I .


Question: What is Note:?

Answer: R e f e r   t o   t h e   A P I   s p e c i f i c a t i o n   f o r   a d d i t i o n a l   d e t a i l s   o f   a l l   G a t e w a y   A P I   k i n d s .


Question: What is Kubernetes API Server Bypass Risks?

Answer: Kubernetes API Server Bypass RisksSecurity architecture information relating to the API server and other componentsThe Kubernetes API server is the main point of entry to a cluster for external parties (users and services) interacting with it.As part of this role, the API server has several key built-in security controls, such as audit logging and admission controllers. However, there are ways to modify the configuration or content of the cluster that bypass these controls.This page describes the ways in which the security controls built into the Kubernetes API server can be bypassed, so that cluster operators and security architects can ensure that these bypasses are appropriately restricted.Static PodsThe kubelet on each node loads and directly manages any manifests that are stored in a named directory or fetched from a specific URL as static Pods in your cluster. The API server doesn't manage these static Pods. An attacker with write access to this location could modify the configuration of static pods loaded from that source, or could introduce new static Pods.Static Pods are restricted from accessing other objects in the Kubernetes API. For example, you can't configure a static Pod to mount a Secret from the cluster. However, these Pods can take other security sensitive actions, such as using hostPath mounts from the underlying node.By default, the kubelet creates a mirror pod so that the static Pods are visible in the Kubernetes API. However, if the attacker uses an invalid namespace name when creating the Pod, it will not be visible in the Kubernetes API and can only be discovered by tooling that has access to the affected host(s).If a static Pod fails admission control, the kubelet won't register the Pod with the API server. However, the Pod still runs on the node. For more information, refer to kubeadm issue #1541.MitigationsOnly enable the kubelet static Pod manifest functionality if required by the node.If a node uses the static Pod functionality, restrict filesystem access to the static Pod manifest directory or URL to users who need the access.Restrict access to kubelet configuration parameters and files to prevent an attacker setting a static Pod path or URL.Regularly audit and centrally report all access to directories or web storage locations that host static Pod manifests and kubelet configuration files.The kubelet APIThe kubelet provides an HTTP API that is typically exposed on TCP port 10250 on cluster worker nodes. The API might also be exposed on control plane nodes depending on the Kubernetes distribution in use. Direct access to the API allows for disclosure of information about the pods running on a node, the logs from those pods, and execution of commands in every container running on the node.When Kubernetes cluster users have RBAC access to Node object sub-resources, that access serves as authorization to interact with the kubelet API. The exact access depends on which sub-resource access has been granted, as detailed i


Question: How does Kubernetes API Server Bypass Risks work?

Answer: Kubernetes API Server Bypass RisksSecurity architecture information relating to the API server and other componentsThe Kubernetes API server is the main point of entry to a cluster for external parties (users and services) interacting with it.As part of this role, the API server has several key built-in security controls, such as audit logging and admission controllers. However, there are ways to modify the configuration or content of the cluster that bypass these controls.This page describes the ways in which the security controls built into the Kubernetes API server can be bypassed, so that cluster operators and security architects can ensure that these bypasses are appropriately restricted.Static PodsThe kubelet on each node loads and directly manages any manifests that are stored in a named directory or fetched from a specific URL as static Pods in your cluster. The API server doesn't manage these static Pods. An attacker with write access to this location could modify the configuration of static pods loaded from that source, or could introduce new static Pods.Static Pods are restricted from accessing other objects in the Kubernetes API. For example, you can't configure a static Pod to mount a Secret from the cluster. However, these Pods can take other security sensitive actions, such as using hostPath mounts from the underlying node.By default, the kubelet creates a mirror pod so that the static Pods are visible in the Kubernetes API. However, if the attacker uses an invalid namespace name when creating the Pod, it will not be visible in the Kubernetes API and can only be discovered by tooling that has access to the affected host(s).If a static Pod fails admission control, the kubelet won't register the Pod with the API server. However, the Pod still runs on the node. For more information, refer to kubeadm issue #1541.MitigationsOnly enable the kubelet static Pod manifest functionality if required by the node.If a node uses the static Pod functionality, restrict filesystem access to the static Pod manifest directory or URL to users who need the access.Restrict access to kubelet configuration parameters and files to prevent an attacker setting a static Pod path or URL.Regularly audit and centrally report all access to directories or web storage locations that host static Pod manifests and kubelet configuration files.The kubelet APIThe kubelet provides an HTTP API that is typically exposed on TCP port 10250 on cluster worker nodes. The API might also be exposed on control plane nodes depending on the Kubernetes distribution in use. Direct access to the API allows for disclosure of information about the pods running on a node, the logs from those pods, and execution of commands in every container running on the node.When Kubernetes cluster users have RBAC access to Node object sub-resources, that access serves as authorization to interact with the kubelet API. The exact access depends on which sub-resource access has been granted, as detailed i


Question: When would you use Kubernetes API Server Bypass Risks?

Answer: Kubernetes API Server Bypass RisksSecurity architecture information relating to the API server and other componentsThe Kubernetes API server is the main point of entry to a cluster for external parties (users and services) interacting with it.As part of this role, the API server has several key built-in security controls, such as audit logging and admission controllers. However, there are ways to modify the configuration or content of the cluster that bypass these controls.This page describes the ways in which the security controls built into the Kubernetes API server can be bypassed, so that cluster operators and security architects can ensure that these bypasses are appropriately restricted.Static PodsThe kubelet on each node loads and directly manages any manifests that are stored in a named directory or fetched from a specific URL as static Pods in your cluster. The API server doesn't manage these static Pods. An attacker with write access to this location could modify the configuration of static pods loaded from that source, or could introduce new static Pods.Static Pods are restricted from accessing other objects in the Kubernetes API. For example, you can't configure a static Pod to mount a Secret from the cluster. However, these Pods can take other security sensitive actions, such as using hostPath mounts from the underlying node.By default, the kubelet creates a mirror pod so that the static Pods are visible in the Kubernetes API. However, if the attacker uses an invalid namespace name when creating the Pod, it will not be visible in the Kubernetes API and can only be discovered by tooling that has access to the affected host(s).If a static Pod fails admission control, the kubelet won't register the Pod with the API server. However, the Pod still runs on the node. For more information, refer to kubeadm issue #1541.MitigationsOnly enable the kubelet static Pod manifest functionality if required by the node.If a node uses the static Pod functionality, restrict filesystem access to the static Pod manifest directory or URL to users who need the access.Restrict access to kubelet configuration parameters and files to prevent an attacker setting a static Pod path or URL.Regularly audit and centrally report all access to directories or web storage locations that host static Pod manifests and kubelet configuration files.The kubelet APIThe kubelet provides an HTTP API that is typically exposed on TCP port 10250 on cluster worker nodes. The API might also be exposed on control plane nodes depending on the Kubernetes distribution in use. Direct access to the API allows for disclosure of information about the pods running on a node, the logs from those pods, and execution of commands in every container running on the node.When Kubernetes cluster users have RBAC access to Node object sub-resources, that access serves as authorization to interact with the kubelet API. The exact access depends on which sub-resource access has been granted, as detailed i


Question: What are the benefits of Kubernetes API Server Bypass Risks?

Answer: Kubernetes API Server Bypass RisksSecurity architecture information relating to the API server and other componentsThe Kubernetes API server is the main point of entry to a cluster for external parties (users and services) interacting with it.As part of this role, the API server has several key built-in security controls, such as audit logging and admission controllers. However, there are ways to modify the configuration or content of the cluster that bypass these controls.This page describes the ways in which the security controls built into the Kubernetes API server can be bypassed, so that cluster operators and security architects can ensure that these bypasses are appropriately restricted.Static PodsThe kubelet on each node loads and directly manages any manifests that are stored in a named directory or fetched from a specific URL as static Pods in your cluster. The API server doesn't manage these static Pods. An attacker with write access to this location could modify the configuration of static pods loaded from that source, or could introduce new static Pods.Static Pods are restricted from accessing other objects in the Kubernetes API. For example, you can't configure a static Pod to mount a Secret from the cluster. However, these Pods can take other security sensitive actions, such as using hostPath mounts from the underlying node.By default, the kubelet creates a mirror pod so that the static Pods are visible in the Kubernetes API. However, if the attacker uses an invalid namespace name when creating the Pod, it will not be visible in the Kubernetes API and can only be discovered by tooling that has access to the affected host(s).If a static Pod fails admission control, the kubelet won't register the Pod with the API server. However, the Pod still runs on the node. For more information, refer to kubeadm issue #1541.MitigationsOnly enable the kubelet static Pod manifest functionality if required by the node.If a node uses the static Pod functionality, restrict filesystem access to the static Pod manifest directory or URL to users who need the access.Restrict access to kubelet configuration parameters and files to prevent an attacker setting a static Pod path or URL.Regularly audit and centrally report all access to directories or web storage locations that host static Pod manifests and kubelet configuration files.The kubelet APIThe kubelet provides an HTTP API that is typically exposed on TCP port 10250 on cluster worker nodes. The API might also be exposed on control plane nodes depending on the Kubernetes distribution in use. Direct access to the API allows for disclosure of information about the pods running on a node, the logs from those pods, and execution of commands in every container running on the node.When Kubernetes cluster users have RBAC access to Node object sub-resources, that access serves as authorization to interact with the kubelet API. The exact access depends on which sub-resource access has been granted, as detailed i


Question: What is Kubernetes API Server Bypass Risks?

Answer: T h e   K u b e r n e t e s   A P I   s e r v e r   i s   t h e   m a i n   p o i n t   o f   e n t r y   t o   a   c l u s t e r   f o r   e x t e r n a l   p a r t i e s   ( u s e r s   a n d   s e r v i c e s )   i n t e r a c t i n g   w i t h   i t .   A s   p a r t   o f   t h i s   r o l e ,   t h e   A P I   s e r v e r   h a s   s e v e r a l   k e y   b u i l t - i n   s e c u r i t y   c o n t r o l s ,   s u c h   a s   a u d i t   l o g g i n g   a n d   a d m i s s i o n   c o n t r o l l e r s .   H o w e v e r ,   t h e r e   a r e   w a y s   t o   m o d i f y   t h e   c o n f i g u r a t i o n   o r   c o n t e n t   o f   t h e   c l u s t e r   t h a t   b y p a s s   t h e s e   c o n t r o l s .   T h i s   p a g e   d e s c r i b e s   t h e   w a y s   i n   w h i c h   t h e   s e c u r i t y   c o n t r o l s   b u i l t   i n t o   t h e   K u b e r n e t e s   A P I   s e r v e r   c a n   b e   b y p a s s e d ,   s o   t h a t   c l u s t e r   o p e r a t o r s   a n d   s e c u r i t y   a r c h i t e c t s   c a n   e n s u r e   t h a t   t h e s e   b y p a s s e s   a r e   a p p r o p r i a t e l y   r e s t r i c t e d .


Question: What is Static Pods?

Answer: T h e   k u b e l e t   o n   e a c h   n o d e   l o a d s   a n d   d i r e c t l y   m a n a g e s   a n y   m a n i f e s t s   t h a t   a r e   s t o r e d   i n   a   n a m e d   d i r e c t o r y   o r   f e t c h e d   f r o m   a   s p e c i f i c   U R L   a s   s t a t i c   P o d s   i n   y o u r   c l u s t e r .   T h e   A P I   s e r v e r   d o e s n ' t   m a n a g e   t h e s e   s t a t i c   P o d s .   A n   a t t a c k e r   w i t h   w r i t e   a c c e s s   t o   t h i s   l o c a t i o n   c o u l d   m o d i f y   t h e   c o n f i g u r a t i o n   o f   s t a t i c   p o d s   l o a d e d   f r o m   t h a t   s o u r c e ,   o r   c o u l d   i n t r o d u c e   n e w   s t a t i c   P o d s .   S t a t i c   P o d s   a r e   r e s t r i c t e d   f r o m   a c c e s s i n g   o t h e r   o b j e c t s   i n   t h e   K u b e r n e t e s   A P I .   F o r   e x a m p l e ,   y o u   c a n ' t   c o n f i g u r e   a   s t a t i c   P o d   t o   m o u n t   a   S e c r e t   f r o m   t h e   c l u s t e r .   H o w e v e r ,   t h e s e   P o d s   c a n   t a k e   o t h e r   s e c u r i t y   s e n s i t i v e   a c t i o n s ,   s u c h   a s   u s i n g   h o s t P a t h   m o u n t s   f r o m   t h e   u n d e r l y i n g   n o d e .   B y   d e f a u l t ,   t h e   k u b e l e t   c r e a t e s   a   m i r r o r   p o d   s o   t h a t   t h e   s t a t i c   P o d s   a r e   v i s i b l e   i n   t h e   K u b e r n e t e s   A P I .   H o w e v e r ,   i f   t h e   a t t a c k e r   u s e s   a n   i n v a l i d   n a m e s p a c e   n a m e   w h e n   c r e a t i n g   t h e   P o d ,   i t   w i l l   n o t   b e   v i s i b l e   i n   t h e   K u b e r n e t e s   A P I   a n d   c a n   o n l y   b e   d i s c o v e r e d   b y   t o o l i n g   t h a t   h a s   a c c e s s   t o   t h e   a f f e c t e d   h o s t ( s ) .   I f   a   s t a t i c   P o d   f a i l s   a d m i s s i o n   c o n t r o l ,   t h e


Question: What is Mitigations?

Answer: O n l y   e n a b l e   t h e   k u b e l e t   s t a t i c   P o d   m a n i f e s t   f u n c t i o n a l i t y   i f   r e q u i r e d   b y   t h e   n o d e . I f   a   n o d e   u s e s   t h e   s t a t i c   P o d   f u n c t i o n a l i t y ,   r e s t r i c t   f i l e s y s t e m   a c c e s s   t o   t h e   s t a t i c   P o d   m a n i f e s t   d i r e c t o r y   o r   U R L   t o   u s e r s   w h o   n e e d   t h e   a c c e s s . R e s t r i c t   a c c e s s   t o   k u b e l e t   c o n f i g u r a t i o n   p a r a m e t e r s   a n d   f i l e s   t o   p r e v e n t   a n   a t t a c k e r   s e t t i n g   a   s t a t i c   P o d   p a t h   o r   U R L . R e g u l a r l y   a u d i t   a n d   c e n t r a l l y   r e p o r t   a l l   a c c e s s   t o   d i r e c t o r i e s   o r   w e b   s t o r a g e   l o c a t i o n s   t h a t   h o s t   s t a t i c   P o d   m a n i f e s t s   a n d   k u b e l e t   c o n f i g u r a t i o n   f i l e s .


Question: What is The kubelet API?

Answer: T h e   k u b e l e t   p r o v i d e s   a n   H T T P   A P I   t h a t   i s   t y p i c a l l y   e x p o s e d   o n   T C P   p o r t   1 0 2 5 0   o n   c l u s t e r   w o r k e r   n o d e s .   T h e   A P I   m i g h t   a l s o   b e   e x p o s e d   o n   c o n t r o l   p l a n e   n o d e s   d e p e n d i n g   o n   t h e   K u b e r n e t e s   d i s t r i b u t i o n   i n   u s e .   D i r e c t   a c c e s s   t o   t h e   A P I   a l l o w s   f o r   d i s c l o s u r e   o f   i n f o r m a t i o n   a b o u t   t h e   p o d s   r u n n i n g   o n   a   n o d e ,   t h e   l o g s   f r o m   t h o s e   p o d s ,   a n d   e x e c u t i o n   o f   c o m m a n d s   i n   e v e r y   c o n t a i n e r   r u n n i n g   o n   t h e   n o d e .   W h e n   K u b e r n e t e s   c l u s t e r   u s e r s   h a v e   R B A C   a c c e s s   t o   N o d e   o b j e c t   s u b - r e s o u r c e s ,   t h a t   a c c e s s   s e r v e s   a s   a u t h o r i z a t i o n   t o   i n t e r a c t   w i t h   t h e   k u b e l e t   A P I .   T h e   e x a c t   a c c e s s   d e p e n d s   o n   w h i c h   s u b - r e s o u r c e   a c c e s s   h a s   b e e n   g r a n t e d ,   a s   d e t a i l e d   i n   k u b e l e t   a u t h o r i z a t i o n .   D i r e c t   a c c e s s   t o   t h e   k u b e l e t   A P I   i s   n o t   s u b j e c t   t o   a d m i s s i o n   c o n t r o l   a n d   i s   n o t   l o g g e d   b y   K u b e r n e t e s   a u d i t   l o g g i n g .   A n   a t t a c k e r   w i t h   d i r e c t   a c c e s s   t o   t h i s   A P I   m a y   b e   a b l e   t o   b y p a s s   c o n t r o l s   t h a t   d e t e c t   o r   p r e v e n t   c e r t a i n   a c t i o n s .   T h e   k u b e l e t   A P I   c a n   b e   c o n f i g u r e d   t o   a u t h e n t i c a t e   r e q u e s t s   i n   a   n u m b e r   o f   w a y s .   B y   d e f a u l t ,   t h e   k u b e l e t   c o n f i g u r a t i o n   a l l


Question: What is Mitigations?

Answer: R e s t r i c t   a c c e s s   t o   s u b - r e s o u r c e s   o f   t h e   n o d e s   A P I   o b j e c t   u s i n g   m e c h a n i s m s   s u c h   a s   R B A C .   O n l y   g r a n t   t h i s   a c c e s s   w h e n   r e q u i r e d ,   s u c h   a s   b y   m o n i t o r i n g   s e r v i c e s . R e s t r i c t   a c c e s s   t o   t h e   k u b e l e t   p o r t .   O n l y   a l l o w   s p e c i f i e d   a n d   t r u s t e d   I P   a d d r e s s   r a n g e s   t o   a c c e s s   t h e   p o r t . E n s u r e   t h a t   k u b e l e t   a u t h e n t i c a t i o n .   i s   s e t   t o   w e b h o o k   o r   c e r t i f i c a t e   m o d e . E n s u r e   t h a t   t h e   u n a u t h e n t i c a t e d   " r e a d - o n l y "   K u b e l e t   p o r t   i s   n o t   e n a b l e d   o n   t h e   c l u s t e r .


Question: What is The etcd API?

Answer: K u b e r n e t e s   c l u s t e r s   u s e   e t c d   a s   a   d a t a s t o r e .   T h e   e t c d   s e r v i c e   l i s t e n s   o n   T C P   p o r t   2 3 7 9 .   T h e   o n l y   c l i e n t s   t h a t   n e e d   a c c e s s   a r e   t h e   K u b e r n e t e s   A P I   s e r v e r   a n d   a n y   b a c k u p   t o o l i n g   t h a t   y o u   u s e .   D i r e c t   a c c e s s   t o   t h i s   A P I   a l l o w s   f o r   d i s c l o s u r e   o r   m o d i f i c a t i o n   o f   a n y   d a t a   h e l d   i n   t h e   c l u s t e r .   A c c e s s   t o   t h e   e t c d   A P I   i s   t y p i c a l l y   m a n a g e d   b y   c l i e n t   c e r t i f i c a t e   a u t h e n t i c a t i o n .   A n y   c e r t i f i c a t e   i s s u e d   b y   a   c e r t i f i c a t e   a u t h o r i t y   t h a t   e t c d   t r u s t s   a l l o w s   f u l l   a c c e s s   t o   t h e   d a t a   s t o r e d   i n s i d e   e t c d .   D i r e c t   a c c e s s   t o   e t c d   i s   n o t   s u b j e c t   t o   K u b e r n e t e s   a d m i s s i o n   c o n t r o l   a n d   i s   n o t   l o g g e d   b y   K u b e r n e t e s   a u d i t   l o g g i n g .   A n   a t t a c k e r   w h o   h a s   r e a d   a c c e s s   t o   t h e   A P I   s e r v e r ' s   e t c d   c l i e n t   c e r t i f i c a t e   p r i v a t e   k e y   ( o r   c a n   c r e a t e   a   n e w   t r u s t e d   c l i e n t   c e r t i f i c a t e )   c a n   g a i n   c l u s t e r   a d m i n   r i g h t s   b y   a c c e s s i n g   c l u s t e r   s e c r e t s   o r   m o d i f y i n g   a c c e s s   r u l e s .   E v e n   w i t h o u t   e l e v a t i n g   t h e i r   K u b e r n e t e s   R B A C   p r i v i l e g e s ,   a n   a t t a c k e r   w h o   c a n   m o d i f y   e t c d   c a n   r e t r i e v e   a n y   A P I   o b j e c t   o r   c r e a t e   n e w   w o r k l o a d s   i n s i d e   t h e   c l u s t e r .   M a n y   K u b e r n e t e


Question: What is Mitigations?

Answer: E n s u r e   t h a t   t h e   c e r t i f i c a t e   a u t h o r i t y   t r u s t e d   b y   e t c d   i s   u s e d   o n l y   f o r   t h e   p u r p o s e s   o f   a u t h e n t i c a t i o n   t o   t h a t   s e r v i c e . C o n t r o l   a c c e s s   t o   t h e   p r i v a t e   k e y   f o r   t h e   e t c d   s e r v e r   c e r t i f i c a t e ,   a n d   t o   t h e   A P I   s e r v e r ' s   c l i e n t   c e r t i f i c a t e   a n d   k e y . C o n s i d e r   r e s t r i c t i n g   a c c e s s   t o   t h e   e t c d   p o r t   a t   a   n e t w o r k   l e v e l ,   t o   o n l y   a l l o w   a c c e s s   f r o m   s p e c i f i e d   a n d   t r u s t e d   I P   a d d r e s s   r a n g e s .


Question: What is Container runtime socket?

Answer: O n   e a c h   n o d e   i n   a   K u b e r n e t e s   c l u s t e r ,   a c c e s s   t o   i n t e r a c t   w i t h   c o n t a i n e r s   i s   c o n t r o l l e d   b y   t h e   c o n t a i n e r   r u n t i m e   ( o r   r u n t i m e s ,   i f   y o u   h a v e   c o n f i g u r e d   m o r e   t h a n   o n e ) .   T y p i c a l l y ,   t h e   c o n t a i n e r   r u n t i m e   e x p o s e s   a   U n i x   s o c k e t   t h a t   t h e   k u b e l e t   c a n   a c c e s s .   A n   a t t a c k e r   w i t h   a c c e s s   t o   t h i s   s o c k e t   c a n   l a u n c h   n e w   c o n t a i n e r s   o r   i n t e r a c t   w i t h   r u n n i n g   c o n t a i n e r s .   A t   t h e   c l u s t e r   l e v e l ,   t h e   i m p a c t   o f   t h i s   a c c e s s   d e p e n d s   o n   w h e t h e r   t h e   c o n t a i n e r s   t h a t   r u n   o n   t h e   c o m p r o m i s e d   n o d e   h a v e   a c c e s s   t o   S e c r e t s   o r   o t h e r   c o n f i d e n t i a l   d a t a   t h a t   a n   a t t a c k e r   c o u l d   u s e   t o   e s c a l a t e   p r i v i l e g e s   t o   o t h e r   w o r k e r   n o d e s   o r   t o   c o n t r o l   p l a n e   c o m p o n e n t s .


Question: What is Mitigations?

Answer: E n s u r e   t h a t   y o u   t i g h t l y   c o n t r o l   f i l e s y s t e m   a c c e s s   t o   c o n t a i n e r   r u n t i m e   s o c k e t s .   W h e n   p o s s i b l e ,   r e s t r i c t   t h i s   a c c e s s   t o   t h e   r o o t   u s e r . I s o l a t e   t h e   k u b e l e t   f r o m   o t h e r   c o m p o n e n t s   r u n n i n g   o n   t h e   n o d e ,   u s i n g   m e c h a n i s m s   s u c h   a s   L i n u x   k e r n e l   n a m e s p a c e s . E n s u r e   t h a t   y o u   r e s t r i c t   o r   f o r b i d   t h e   u s e   o f   h o s t P a t h   m o u n t s   t h a t   i n c l u d e   t h e   c o n t a i n e r   r u n t i m e   s o c k e t ,   e i t h e r   d i r e c t l y   o r   b y   m o u n t i n g   a   p a r e n t   d i r e c t o r y .   A l s o   h o s t P a t h   m o u n t s   m u s t   b e   s e t   a s   r e a d - o n l y   t o   m i t i g a t e   r i s k s   o f   a t t a c k e r s   b y p a s s i n g   d i r e c t o r y   r e s t r i c t i o n s . R e s t r i c t   u s e r   a c c e s s   t o   n o d e s ,   a n d   e s p e c i a l l y   r e s t r i c t   s u p e r u s e r   a c c e s s   t o   n o d e s .


Question: What is Access Applications in a Cluster?

Answer: Access Applications in a ClusterConfigure load balancing, port forwarding, or setup firewall or DNS configurations to access applications in a cluster.Deploy and Access the Kubernetes DashboardDeploy the web UI (Kubernetes Dashboard) and access it.Accessing ClustersConfigure Access to Multiple ClustersUse Port Forwarding to Access Applications in a ClusterUse a Service to Access an Application in a ClusterConnect a Frontend to a Backend Using ServicesCreate an External Load BalancerList All Container Images Running in a ClusterSet up Ingress on Minikube with the NGINX Ingress ControllerCommunicate Between Containers in the Same Pod Using a Shared VolumeConfigure DNS for a ClusterAccess Services Running on Clusters


Question: How does Access Applications in a Cluster work?

Answer: Access Applications in a ClusterConfigure load balancing, port forwarding, or setup firewall or DNS configurations to access applications in a cluster.Deploy and Access the Kubernetes DashboardDeploy the web UI (Kubernetes Dashboard) and access it.Accessing ClustersConfigure Access to Multiple ClustersUse Port Forwarding to Access Applications in a ClusterUse a Service to Access an Application in a ClusterConnect a Frontend to a Backend Using ServicesCreate an External Load BalancerList All Container Images Running in a ClusterSet up Ingress on Minikube with the NGINX Ingress ControllerCommunicate Between Containers in the Same Pod Using a Shared VolumeConfigure DNS for a ClusterAccess Services Running on Clusters


Question: When would you use Access Applications in a Cluster?

Answer: Access Applications in a ClusterConfigure load balancing, port forwarding, or setup firewall or DNS configurations to access applications in a cluster.Deploy and Access the Kubernetes DashboardDeploy the web UI (Kubernetes Dashboard) and access it.Accessing ClustersConfigure Access to Multiple ClustersUse Port Forwarding to Access Applications in a ClusterUse a Service to Access an Application in a ClusterConnect a Frontend to a Backend Using ServicesCreate an External Load BalancerList All Container Images Running in a ClusterSet up Ingress on Minikube with the NGINX Ingress ControllerCommunicate Between Containers in the Same Pod Using a Shared VolumeConfigure DNS for a ClusterAccess Services Running on Clusters


Question: What are the benefits of Access Applications in a Cluster?

Answer: Access Applications in a ClusterConfigure load balancing, port forwarding, or setup firewall or DNS configurations to access applications in a cluster.Deploy and Access the Kubernetes DashboardDeploy the web UI (Kubernetes Dashboard) and access it.Accessing ClustersConfigure Access to Multiple ClustersUse Port Forwarding to Access Applications in a ClusterUse a Service to Access an Application in a ClusterConnect a Frontend to a Backend Using ServicesCreate an External Load BalancerList All Container Images Running in a ClusterSet up Ingress on Minikube with the NGINX Ingress ControllerCommunicate Between Containers in the Same Pod Using a Shared VolumeConfigure DNS for a ClusterAccess Services Running on Clusters


Question: What is Deploy and Access the Kubernetes Dashboard?

Answer: D e p l o y   t h e   w e b   U I   ( K u b e r n e t e s   D a s h b o a r d )   a n d   a c c e s s   i t .


Question: What is Using a Service to Expose Your App?

Answer: Using a Service to Expose Your AppObjectivesLearn about a Service in Kubernetes.Understand how labels and selectors relate to a Service.Expose an application outside a Kubernetes cluster.Overview of Kubernetes ServicesKubernetes Pods are mortal. Pods have a lifecycle. When a worker node dies, the Pods running on the Node are also lost. A Replicaset might then dynamically drive the cluster back to the desired state via the creation of new Pods to keep your application running. As another example, consider an image-processing backend with 3 replicas. Those replicas are exchangeable; the front-end system should not care about backend replicas or even if a Pod is lost and recreated. That said, each Pod in a Kubernetes cluster has a unique IP address, even Pods on the same Node, so there needs to be a way of automatically reconciling changes among Pods so that your applications continue to function.A Kubernetes Service is an abstraction layer which defines a logical set of Pods and enables external traffic exposure, load balancing and service discovery for those Pods.A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. Services enable a loose coupling between dependent Pods. A Service is defined using YAML or JSON, like all Kubernetes object manifests. The set of Pods targeted by a Service is usually determined by a label selector (see below for why you might want a Service without including a selector in the spec).Although each Pod has a unique IP address, those IPs are not exposed outside the cluster without a Service. Services allow your applications to receive traffic. Services can be exposed in different ways by specifying a type in the spec of the Service:ClusterIP (default) - Exposes the Service on an internal IP in the cluster. This type makes the Service only reachable from within the cluster.NodePort - Exposes the Service on the same port of each selected Node in the cluster using NAT. Makes a Service accessible from outside the cluster using NodeIP:NodePort. Superset of ClusterIP.LoadBalancer - Creates an external load balancer in the current cloud (if supported) and assigns a fixed, external IP to the Service. Superset of NodePort.ExternalName - Maps the Service to the contents of the externalName field (e.g. foo.bar.example.com), by returning a CNAME record with its value. No proxying of any kind is set up. This type requires v1.7 or higher of kube-dns, or CoreDNS version 0.0.8 or higher.More information about the different types of Services can be found in the Using Source IP tutorial. Also see Connecting Applications with Services.Additionally, note that there are some use cases with Services that involve not defining a selector in the spec. A Service created without selector will also not create the corresponding Endpoints object. This allows users to manually map a Service to specific endpoints. Another possibility why there may be no selector is you are strictly using typ


Question: How does Using a Service to Expose Your App work?

Answer: Using a Service to Expose Your AppObjectivesLearn about a Service in Kubernetes.Understand how labels and selectors relate to a Service.Expose an application outside a Kubernetes cluster.Overview of Kubernetes ServicesKubernetes Pods are mortal. Pods have a lifecycle. When a worker node dies, the Pods running on the Node are also lost. A Replicaset might then dynamically drive the cluster back to the desired state via the creation of new Pods to keep your application running. As another example, consider an image-processing backend with 3 replicas. Those replicas are exchangeable; the front-end system should not care about backend replicas or even if a Pod is lost and recreated. That said, each Pod in a Kubernetes cluster has a unique IP address, even Pods on the same Node, so there needs to be a way of automatically reconciling changes among Pods so that your applications continue to function.A Kubernetes Service is an abstraction layer which defines a logical set of Pods and enables external traffic exposure, load balancing and service discovery for those Pods.A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. Services enable a loose coupling between dependent Pods. A Service is defined using YAML or JSON, like all Kubernetes object manifests. The set of Pods targeted by a Service is usually determined by a label selector (see below for why you might want a Service without including a selector in the spec).Although each Pod has a unique IP address, those IPs are not exposed outside the cluster without a Service. Services allow your applications to receive traffic. Services can be exposed in different ways by specifying a type in the spec of the Service:ClusterIP (default) - Exposes the Service on an internal IP in the cluster. This type makes the Service only reachable from within the cluster.NodePort - Exposes the Service on the same port of each selected Node in the cluster using NAT. Makes a Service accessible from outside the cluster using NodeIP:NodePort. Superset of ClusterIP.LoadBalancer - Creates an external load balancer in the current cloud (if supported) and assigns a fixed, external IP to the Service. Superset of NodePort.ExternalName - Maps the Service to the contents of the externalName field (e.g. foo.bar.example.com), by returning a CNAME record with its value. No proxying of any kind is set up. This type requires v1.7 or higher of kube-dns, or CoreDNS version 0.0.8 or higher.More information about the different types of Services can be found in the Using Source IP tutorial. Also see Connecting Applications with Services.Additionally, note that there are some use cases with Services that involve not defining a selector in the spec. A Service created without selector will also not create the corresponding Endpoints object. This allows users to manually map a Service to specific endpoints. Another possibility why there may be no selector is you are strictly using typ


Question: When would you use Using a Service to Expose Your App?

Answer: Using a Service to Expose Your AppObjectivesLearn about a Service in Kubernetes.Understand how labels and selectors relate to a Service.Expose an application outside a Kubernetes cluster.Overview of Kubernetes ServicesKubernetes Pods are mortal. Pods have a lifecycle. When a worker node dies, the Pods running on the Node are also lost. A Replicaset might then dynamically drive the cluster back to the desired state via the creation of new Pods to keep your application running. As another example, consider an image-processing backend with 3 replicas. Those replicas are exchangeable; the front-end system should not care about backend replicas or even if a Pod is lost and recreated. That said, each Pod in a Kubernetes cluster has a unique IP address, even Pods on the same Node, so there needs to be a way of automatically reconciling changes among Pods so that your applications continue to function.A Kubernetes Service is an abstraction layer which defines a logical set of Pods and enables external traffic exposure, load balancing and service discovery for those Pods.A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. Services enable a loose coupling between dependent Pods. A Service is defined using YAML or JSON, like all Kubernetes object manifests. The set of Pods targeted by a Service is usually determined by a label selector (see below for why you might want a Service without including a selector in the spec).Although each Pod has a unique IP address, those IPs are not exposed outside the cluster without a Service. Services allow your applications to receive traffic. Services can be exposed in different ways by specifying a type in the spec of the Service:ClusterIP (default) - Exposes the Service on an internal IP in the cluster. This type makes the Service only reachable from within the cluster.NodePort - Exposes the Service on the same port of each selected Node in the cluster using NAT. Makes a Service accessible from outside the cluster using NodeIP:NodePort. Superset of ClusterIP.LoadBalancer - Creates an external load balancer in the current cloud (if supported) and assigns a fixed, external IP to the Service. Superset of NodePort.ExternalName - Maps the Service to the contents of the externalName field (e.g. foo.bar.example.com), by returning a CNAME record with its value. No proxying of any kind is set up. This type requires v1.7 or higher of kube-dns, or CoreDNS version 0.0.8 or higher.More information about the different types of Services can be found in the Using Source IP tutorial. Also see Connecting Applications with Services.Additionally, note that there are some use cases with Services that involve not defining a selector in the spec. A Service created without selector will also not create the corresponding Endpoints object. This allows users to manually map a Service to specific endpoints. Another possibility why there may be no selector is you are strictly using typ


Question: What are the benefits of Using a Service to Expose Your App?

Answer: Using a Service to Expose Your AppObjectivesLearn about a Service in Kubernetes.Understand how labels and selectors relate to a Service.Expose an application outside a Kubernetes cluster.Overview of Kubernetes ServicesKubernetes Pods are mortal. Pods have a lifecycle. When a worker node dies, the Pods running on the Node are also lost. A Replicaset might then dynamically drive the cluster back to the desired state via the creation of new Pods to keep your application running. As another example, consider an image-processing backend with 3 replicas. Those replicas are exchangeable; the front-end system should not care about backend replicas or even if a Pod is lost and recreated. That said, each Pod in a Kubernetes cluster has a unique IP address, even Pods on the same Node, so there needs to be a way of automatically reconciling changes among Pods so that your applications continue to function.A Kubernetes Service is an abstraction layer which defines a logical set of Pods and enables external traffic exposure, load balancing and service discovery for those Pods.A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. Services enable a loose coupling between dependent Pods. A Service is defined using YAML or JSON, like all Kubernetes object manifests. The set of Pods targeted by a Service is usually determined by a label selector (see below for why you might want a Service without including a selector in the spec).Although each Pod has a unique IP address, those IPs are not exposed outside the cluster without a Service. Services allow your applications to receive traffic. Services can be exposed in different ways by specifying a type in the spec of the Service:ClusterIP (default) - Exposes the Service on an internal IP in the cluster. This type makes the Service only reachable from within the cluster.NodePort - Exposes the Service on the same port of each selected Node in the cluster using NAT. Makes a Service accessible from outside the cluster using NodeIP:NodePort. Superset of ClusterIP.LoadBalancer - Creates an external load balancer in the current cloud (if supported) and assigns a fixed, external IP to the Service. Superset of NodePort.ExternalName - Maps the Service to the contents of the externalName field (e.g. foo.bar.example.com), by returning a CNAME record with its value. No proxying of any kind is set up. This type requires v1.7 or higher of kube-dns, or CoreDNS version 0.0.8 or higher.More information about the different types of Services can be found in the Using Source IP tutorial. Also see Connecting Applications with Services.Additionally, note that there are some use cases with Services that involve not defining a selector in the spec. A Service created without selector will also not create the corresponding Endpoints object. This allows users to manually map a Service to specific endpoints. Another possibility why there may be no selector is you are strictly using typ


Question: What is Objectives?

Answer: L e a r n   a b o u t   a   S e r v i c e   i n   K u b e r n e t e s . U n d e r s t a n d   h o w   l a b e l s   a n d   s e l e c t o r s   r e l a t e   t o   a   S e r v i c e . E x p o s e   a n   a p p l i c a t i o n   o u t s i d e   a   K u b e r n e t e s   c l u s t e r .


Question: What is Overview of Kubernetes Services?

Answer: K u b e r n e t e s   P o d s   a r e   m o r t a l .   P o d s   h a v e   a   l i f e c y c l e .   W h e n   a   w o r k e r   n o d e   d i e s ,   t h e   P o d s   r u n n i n g   o n   t h e   N o d e   a r e   a l s o   l o s t .   A   R e p l i c a s e t   m i g h t   t h e n   d y n a m i c a l l y   d r i v e   t h e   c l u s t e r   b a c k   t o   t h e   d e s i r e d   s t a t e   v i a   t h e   c r e a t i o n   o f   n e w   P o d s   t o   k e e p   y o u r   a p p l i c a t i o n   r u n n i n g .   A s   a n o t h e r   e x a m p l e ,   c o n s i d e r   a n   i m a g e - p r o c e s s i n g   b a c k e n d   w i t h   3   r e p l i c a s .   T h o s e   r e p l i c a s   a r e   e x c h a n g e a b l e ;   t h e   f r o n t - e n d   s y s t e m   s h o u l d   n o t   c a r e   a b o u t   b a c k e n d   r e p l i c a s   o r   e v e n   i f   a   P o d   i s   l o s t   a n d   r e c r e a t e d .   T h a t   s a i d ,   e a c h   P o d   i n   a   K u b e r n e t e s   c l u s t e r   h a s   a   u n i q u e   I P   a d d r e s s ,   e v e n   P o d s   o n   t h e   s a m e   N o d e ,   s o   t h e r e   n e e d s   t o   b e   a   w a y   o f   a u t o m a t i c a l l y   r e c o n c i l i n g   c h a n g e s   a m o n g   P o d s   s o   t h a t   y o u r   a p p l i c a t i o n s   c o n t i n u e   t o   f u n c t i o n .   A   S e r v i c e   i n   K u b e r n e t e s   i s   a n   a b s t r a c t i o n   w h i c h   d e f i n e s   a   l o g i c a l   s e t   o f   P o d s   a n d   a   p o l i c y   b y   w h i c h   t o   a c c e s s   t h e m .   S e r v i c e s   e n a b l e   a   l o o s e   c o u p l i n g   b e t w e e n   d e p e n d e n t   P o d s .   A   S e r v i c e   i s   d e f i n e d   u s i n g   Y A M L   o r   J S O N ,   l i k e   a l l   K u b e r n e t e s   o b j e c t   m a n i f e s t s .   T h e   s e t   o f   P o d s   t a r g e t e d   b y   a   S e r v i c e   i s   u s u a l l y   d e t e r m i n e


Question: What is Services and Labels?

Answer: A   S e r v i c e   r o u t e s   t r a f f i c   a c r o s s   a   s e t   o f   P o d s .   S e r v i c e s   a r e   t h e   a b s t r a c t i o n   t h a t   a l l o w s   p o d s   t o   d i e   a n d   r e p l i c a t e   i n   K u b e r n e t e s   w i t h o u t   i m p a c t i n g   y o u r   a p p l i c a t i o n .   D i s c o v e r y   a n d   r o u t i n g   a m o n g   d e p e n d e n t   P o d s   ( s u c h   a s   t h e   f r o n t e n d   a n d   b a c k e n d   c o m p o n e n t s   i n   a n   a p p l i c a t i o n )   a r e   h a n d l e d   b y   K u b e r n e t e s   S e r v i c e s .   S e r v i c e s   m a t c h   a   s e t   o f   P o d s   u s i n g   l a b e l s   a n d   s e l e c t o r s ,   a   g r o u p i n g   p r i m i t i v e   t h a t   a l l o w s   l o g i c a l   o p e r a t i o n   o n   o b j e c t s   i n   K u b e r n e t e s .   L a b e l s   a r e   k e y / v a l u e   p a i r s   a t t a c h e d   t o   o b j e c t s   a n d   c a n   b e   u s e d   i n   a n y   n u m b e r   o f   w a y s :   D e s i g n a t e   o b j e c t s   f o r   d e v e l o p m e n t ,   t e s t ,   a n d   p r o d u c t i o n E m b e d   v e r s i o n   t a g s C l a s s i f y   a n   o b j e c t   u s i n g   t a g s   L a b e l s   c a n   b e   a t t a c h e d   t o   o b j e c t s   a t   c r e a t i o n   t i m e   o r   l a t e r   o n .   T h e y   c a n   b e   m o d i f i e d   a t   a n y   t i m e .   L e t ' s   e x p o s e   o u r   a p p l i c a t i o n   n o w   u s i n g   a   S e r v i c e   a n d   a p p l y   s o m e   l a b e l s .


Question: What is Step 1: Creating a new Service?

Answer: L e t ’ s   v e r i f y   t h a t   o u r   a p p l i c a t i o n   i s   r u n n i n g .   W e ’ l l   u s e   t h e   k u b e c t l   g e t   c o m m a n d   a n d   l o o k   f o r   e x i s t i n g   P o d s :   k u b e c t l   g e t   p o d s   I f   n o   P o d s   a r e   r u n n i n g   t h e n   i t   m e a n s   t h e   o b j e c t s   f r o m   t h e   p r e v i o u s   t u t o r i a l s   w e r e   c l e a n e d   u p .   I n   t h i s   c a s e ,   g o   b a c k   a n d   r e c r e a t e   t h e   d e p l o y m e n t   f r o m   t h e   U s i n g   k u b e c t l   t o   c r e a t e   a   D e p l o y m e n t   t u t o r i a l .   P l e a s e   w a i t   a   c o u p l e   o f   s e c o n d s   a n d   l i s t   t h e   P o d s   a g a i n .   Y o u   c a n   c o n t i n u e   o n c e   y o u   s e e   t h e   o n e   P o d   r u n n i n g .   N e x t ,   l e t ’ s   l i s t   t h e   c u r r e n t   S e r v i c e s   f r o m   o u r   c l u s t e r :   k u b e c t l   g e t   s e r v i c e s   T o   e x p o s e   t h e   d e p l o y m e n t   t o   e x t e r n a l   t r a f f i c ,   w e ' l l   u s e   t h e   k u b e c t l   e x p o s e   c o m m a n d   w i t h   t h e   - - t y p e = N o d e P o r t   o p t i o n :   k u b e c t l   e x p o s e   d e p l o y m e n t / k u b e r n e t e s - b o o t c a m p   - - t y p e = " N o d e P o r t "   - - p o r t   8 0 8 0   W e   h a v e   n o w   a   r u n n i n g   S e r v i c e   c a l l e d   k u b e r n e t e s - b o o t c a m p .   H e r e   w e   s e e   t h a t   t h e   S e r v i c e   r e c e i v e d   a   u n i q u e   c l u s t e r - I P ,   a n   i n t e r n a l   p o r t   a n d   a n   e x t e r n a l - I P   ( t h e   I P   o f   t h e   N o d e ) .   T o   f i n d   o u t   w h a t   p o r t   w a s   o p e n e d   e x t e r n a l l y   ( f o r   t h e   t y p e :   N o d e P o r t   S e r v i c e )   w e ’ l l   r u n   t h e   d e s c r i b e   s e r v i c e   s u b c o m m a n d :   k u b


Question: What is Note:?

Answer: I f   y o u ' r e   r u n n i n g   m i n i k u b e   w i t h   D o c k e r   D e s k t o p   a s   t h e   c o n t a i n e r   d r i v e r ,   a   m i n i k u b e   t u n n e l   i s   n e e d e d .   T h i s   i s   b e c a u s e   c o n t a i n e r s   i n s i d e   D o c k e r   D e s k t o p   a r e   i s o l a t e d   f r o m   y o u r   h o s t   c o m p u t e r .   I n   a   s e p a r a t e   t e r m i n a l   w i n d o w ,   e x e c u t e :   m i n i k u b e   s e r v i c e   k u b e r n e t e s - b o o t c a m p   - - u r l   T h e   o u t p u t   l o o k s   l i k e   t h i s :   h t t p : / / 1 2 7 . 0 . 0 . 1 : 5 1 0 8 2   !   B e c a u s e   y o u   a r e   u s i n g   a   D o c k e r   d r i v e r   o n   d a r w i n ,   t h e   t e r m i n a l   n e e d s   t o   b e   o p e n   t o   r u n   i t .   T h e n   u s e   t h e   g i v e n   U R L   t o   a c c e s s   t h e   a p p :   c u r l   1 2 7 . 0 . 0 . 1 : 5 1 0 8 2   A n d   w e   g e t   a   r e s p o n s e   f r o m   t h e   s e r v e r .   T h e   S e r v i c e   i s   e x p o s e d .


Question: What is Step 2: Using labels?

Answer: T h e   D e p l o y m e n t   c r e a t e d   a u t o m a t i c a l l y   a   l a b e l   f o r   o u r   P o d .   W i t h   t h e   d e s c r i b e   d e p l o y m e n t   s u b c o m m a n d   y o u   c a n   s e e   t h e   n a m e   ( t h e   k e y )   o f   t h a t   l a b e l :   k u b e c t l   d e s c r i b e   d e p l o y m e n t   L e t ’ s   u s e   t h i s   l a b e l   t o   q u e r y   o u r   l i s t   o f   P o d s .   W e ’ l l   u s e   t h e   k u b e c t l   g e t   p o d s   c o m m a n d   w i t h   - l   a s   a   p a r a m e t e r ,   f o l l o w e d   b y   t h e   l a b e l   v a l u e s :   k u b e c t l   g e t   p o d s   - l   a p p = k u b e r n e t e s - b o o t c a m p   Y o u   c a n   d o   t h e   s a m e   t o   l i s t   t h e   e x i s t i n g   S e r v i c e s :   k u b e c t l   g e t   s e r v i c e s   - l   a p p = k u b e r n e t e s - b o o t c a m p   G e t   t h e   n a m e   o f   t h e   P o d   a n d   s t o r e   i t   i n   t h e   P O D _ N A M E   e n v i r o n m e n t   v a r i a b l e :   e x p o r t   P O D _ N A M E = " $ ( k u b e c t l   g e t   p o d s   - o   g o - t e m p l a t e   - - t e m p l a t e   ' { { r a n g e   . i t e m s } } { { . m e t a d a t a . n a m e } } { { " \ n " } } { { e n d } } ' ) "   e c h o   " N a m e   o f   t h e   P o d :   $ P O D _ N A M E "   T o   a p p l y   a   n e w   l a b e l   w e   u s e   t h e   l a b e l   s u b c o m m a n d   f o l l o w e d   b y   t h e   o b j e c t   t y p e ,   o b j e c t   n a m e   a n d   t h e   n e w   l a b e l :   k u b e c t l   l a b e l   p o d s   " $ P O D _ N A M E "   v e r s i o n = v 1   T h i s   w i l l   a p p l y   a   n e w   l a b e l   t o   o u r   P o d   ( w e   p i n n e d   t h e   a p p l i c a t i o n   v e r s i o n   t o   t h e   P o d ) ,   a n d   w e   c a n   c h e c k   i t   w i t h   t h e   d e s c r i b e   p o d   c o m m a n d :   k u b e c t l   d e s c r i b e   p o d s   " $ P O D _ N A


Question: What is Step 3: Deleting a service?

Answer: T o   d e l e t e   S e r v i c e s   y o u   c a n   u s e   t h e   d e l e t e   s e r v i c e   s u b c o m m a n d .   L a b e l s   c a n   b e   u s e d   a l s o   h e r e :   k u b e c t l   d e l e t e   s e r v i c e   - l   a p p = k u b e r n e t e s - b o o t c a m p   C o n f i r m   t h a t   t h e   S e r v i c e   i s   g o n e :   k u b e c t l   g e t   s e r v i c e s   T h i s   c o n f i r m s   t h a t   o u r   S e r v i c e   w a s   r e m o v e d .   T o   c o n f i r m   t h a t   r o u t e   i s   n o t   e x p o s e d   a n y m o r e   y o u   c a n   c u r l   t h e   p r e v i o u s l y   e x p o s e d   I P   a n d   p o r t :   c u r l   h t t p : / / " $ ( m i n i k u b e   i p ) : $ N O D E _ P O R T "   T h i s   p r o v e s   t h a t   t h e   a p p l i c a t i o n   i s   n o t   r e a c h a b l e   a n y m o r e   f r o m   o u t s i d e   o f   t h e   c l u s t e r .   Y o u   c a n   c o n f i r m   t h a t   t h e   a p p   i s   s t i l l   r u n n i n g   w i t h   a   c u r l   f r o m   i n s i d e   t h e   p o d :   k u b e c t l   e x e c   - t i   $ P O D _ N A M E   - -   c u r l   h t t p : / / l o c a l h o s t : 8 0 8 0   W e   s e e   h e r e   t h a t   t h e   a p p l i c a t i o n   i s   u p .   T h i s   i s   b e c a u s e   t h e   D e p l o y m e n t   i s   m a n a g i n g   t h e   a p p l i c a t i o n .   T o   s h u t   d o w n   t h e   a p p l i c a t i o n ,   y o u   w o u l d   n e e d   t o   d e l e t e   t h e   D e p l o y m e n t   a s   w e l l .


Question: What is What's next?

Answer: T u t o r i a l   R u n n i n g   M u l t i p l e   I n s t a n c e s   o f   Y o u r   A p p . L e a r n   m o r e   a b o u t   S e r v i c e .


Question: What is Assign Pod-level CPU and memory resources?

Answer: Assign Pod-level CPU and memory resourcesFEATURE STATE: Kubernetes v1.34 [beta] (enabled by default: true)This page shows how to specify CPU and memory resources for a Pod at pod-level in addition to container-level resource specifications. A Kubernetes node allocates resources to a pod based on the pod's resource requests. These requests can be defined at the pod level or individually for containers within the pod. When both are present, the pod-level requests take precedence.Similarly, a pod's resource usage is restricted by limits, which can also be set at the pod-level or individually for containers within the pod. Again, pod-level limits are prioritized when both are present. This allows for flexible resource management, enabling you to control resource allocation at both the pod and container levels.In order to specify the resources at pod-level, it is required to enable PodLevelResources feature gate.For Pod Level Resources:Priority: When both pod-level and container-level resources are specified, pod-level resources take precedence.QoS: Pod-level resources take precedence in influencing the QoS class of the pod.OOM Score: The OOM score adjustment calculation considers both pod-level and container-level resources.Compatibility: Pod-level resources are designed to be compatible with existing features.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version 1.34.To check the version, enter kubectl version.The PodLevelResources feature gate must be enabled for your control plane and for all nodes in your cluster.LimitationsFor Kubernetes 1.34, resizing pod-level resources has the following limitations:Resource Types: Only CPU, memory and hugepages resources can be specified at pod-level.Operating System: Pod-level resources are not supported for Windows pods.Resource Managers: The Topology Manager, Memory Manager and CPU Manager do not align pods and containers based on pod-level resources as these resource managers don't currently support pod-level resources.In-Place Resize: In-place resize of pod-level resources is not supported. Modifying the pod-level resource limits or requests on a pod result in a field.Forbidden error. The error message explicitly states, "pods with pod-level resources cannot be resized."Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace pod-resources-example Create a pod with memory requests and limits at pod-levelTo specify memory requests for a Pod at pod-level, include the resources.


Question: How does Assign Pod-level CPU and memory resources work?

Answer: Assign Pod-level CPU and memory resourcesFEATURE STATE: Kubernetes v1.34 [beta] (enabled by default: true)This page shows how to specify CPU and memory resources for a Pod at pod-level in addition to container-level resource specifications. A Kubernetes node allocates resources to a pod based on the pod's resource requests. These requests can be defined at the pod level or individually for containers within the pod. When both are present, the pod-level requests take precedence.Similarly, a pod's resource usage is restricted by limits, which can also be set at the pod-level or individually for containers within the pod. Again, pod-level limits are prioritized when both are present. This allows for flexible resource management, enabling you to control resource allocation at both the pod and container levels.In order to specify the resources at pod-level, it is required to enable PodLevelResources feature gate.For Pod Level Resources:Priority: When both pod-level and container-level resources are specified, pod-level resources take precedence.QoS: Pod-level resources take precedence in influencing the QoS class of the pod.OOM Score: The OOM score adjustment calculation considers both pod-level and container-level resources.Compatibility: Pod-level resources are designed to be compatible with existing features.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version 1.34.To check the version, enter kubectl version.The PodLevelResources feature gate must be enabled for your control plane and for all nodes in your cluster.LimitationsFor Kubernetes 1.34, resizing pod-level resources has the following limitations:Resource Types: Only CPU, memory and hugepages resources can be specified at pod-level.Operating System: Pod-level resources are not supported for Windows pods.Resource Managers: The Topology Manager, Memory Manager and CPU Manager do not align pods and containers based on pod-level resources as these resource managers don't currently support pod-level resources.In-Place Resize: In-place resize of pod-level resources is not supported. Modifying the pod-level resource limits or requests on a pod result in a field.Forbidden error. The error message explicitly states, "pods with pod-level resources cannot be resized."Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace pod-resources-example Create a pod with memory requests and limits at pod-levelTo specify memory requests for a Pod at pod-level, include the resources.


Question: When would you use Assign Pod-level CPU and memory resources?

Answer: Assign Pod-level CPU and memory resourcesFEATURE STATE: Kubernetes v1.34 [beta] (enabled by default: true)This page shows how to specify CPU and memory resources for a Pod at pod-level in addition to container-level resource specifications. A Kubernetes node allocates resources to a pod based on the pod's resource requests. These requests can be defined at the pod level or individually for containers within the pod. When both are present, the pod-level requests take precedence.Similarly, a pod's resource usage is restricted by limits, which can also be set at the pod-level or individually for containers within the pod. Again, pod-level limits are prioritized when both are present. This allows for flexible resource management, enabling you to control resource allocation at both the pod and container levels.In order to specify the resources at pod-level, it is required to enable PodLevelResources feature gate.For Pod Level Resources:Priority: When both pod-level and container-level resources are specified, pod-level resources take precedence.QoS: Pod-level resources take precedence in influencing the QoS class of the pod.OOM Score: The OOM score adjustment calculation considers both pod-level and container-level resources.Compatibility: Pod-level resources are designed to be compatible with existing features.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version 1.34.To check the version, enter kubectl version.The PodLevelResources feature gate must be enabled for your control plane and for all nodes in your cluster.LimitationsFor Kubernetes 1.34, resizing pod-level resources has the following limitations:Resource Types: Only CPU, memory and hugepages resources can be specified at pod-level.Operating System: Pod-level resources are not supported for Windows pods.Resource Managers: The Topology Manager, Memory Manager and CPU Manager do not align pods and containers based on pod-level resources as these resource managers don't currently support pod-level resources.In-Place Resize: In-place resize of pod-level resources is not supported. Modifying the pod-level resource limits or requests on a pod result in a field.Forbidden error. The error message explicitly states, "pods with pod-level resources cannot be resized."Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace pod-resources-example Create a pod with memory requests and limits at pod-levelTo specify memory requests for a Pod at pod-level, include the resources.