Question: How does kubectl create service externalname work?

Answer: kubectl create service externalnameSynopsisCreate an ExternalName service with the specified name.ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.kubectl create service externalname NAME --external-name external.name [--dry-run=server|client|none] Examples # Create a new ExternalName service named my-ns kubectl create service externalname my-ns --external-name bar.com Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--external-name stringExternal name of service--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for externalname-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificat


Question: When would you use kubectl create service externalname?

Answer: kubectl create service externalnameSynopsisCreate an ExternalName service with the specified name.ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.kubectl create service externalname NAME --external-name external.name [--dry-run=server|client|none] Examples # Create a new ExternalName service named my-ns kubectl create service externalname my-ns --external-name bar.com Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--external-name stringExternal name of service--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for externalname-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificat


Question: What are the benefits of kubectl create service externalname?

Answer: kubectl create service externalnameSynopsisCreate an ExternalName service with the specified name.ExternalName service references to an external DNS address instead of only pods, which will allow application authors to reference services that exist off platform, on other clusters, or locally.kubectl create service externalname NAME --external-name external.name [--dry-run=server|client|none] Examples # Create a new ExternalName service named my-ns kubectl create service externalname my-ns --external-name bar.com Options--allow-missing-template-keys Default: trueIf true, ignore any errors in templates when a field or map key is missing in the template. Only applies to golang and jsonpath output formats.--dry-run string[="unchanged"] Default: "none"Must be "none", "server", or "client". If client strategy, only print the object that would be sent, without sending it. If server strategy, submit server-side request without persisting the resource.--external-name stringExternal name of service--field-manager string Default: "kubectl-create"Name of the manager used to track field ownership.-h, --helphelp for externalname-o, --output stringOutput format. One of: (json, yaml, name, go-template, go-template-file, template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).--save-configIf true, the configuration of current object will be saved in its annotation. Otherwise, the annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.--show-managed-fieldsIf true, keep the managedFields when printing objects in JSON or YAML format.--tcp stringsPort pairs can be specified as '<port>:<targetPort>'.--template stringTemplate string or path to template file to use when -o=go-template, -o=go-template-file. The template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].--validate string[="strict"] Default: "strict"Must be one of: strict (or true), warn, ignore (or false). "true" or "strict" will use a schema to validate the input and fail the request if invalid. It will perform server side validation if ServerSideFieldValidation is enabled on the api-server, but will fall back to less reliable client-side validation if not. "warn" will warn about unknown or duplicate fields without blocking the request if server-side field validation is enabled on the API server, and behave as "ignore" otherwise. "false" or "ignore" will not perform any schema validation, silently dropping any unknown or duplicate fields.Parent Options Inherited--as stringUsername to impersonate for the operation. User could be a regular user or a service account in a namespace.--as-group stringsGroup to impersonate for the operation, this flag can be repeated to specify multiple groups.--as-uid stringUID to impersonate for the operation.--cache-dir string Default: "$HOME/.kube/cache"Default cache directory--certificate-authority stringPath to a cert file for the certificate authority--client-certificat


Question: What is Synopsis?

Answer: C r e a t e   a n   E x t e r n a l N a m e   s e r v i c e   w i t h   t h e   s p e c i f i e d   n a m e .   E x t e r n a l N a m e   s e r v i c e   r e f e r e n c e s   t o   a n   e x t e r n a l   D N S   a d d r e s s   i n s t e a d   o f   o n l y   p o d s ,   w h i c h   w i l l   a l l o w   a p p l i c a t i o n   a u t h o r s   t o   r e f e r e n c e   s e r v i c e s   t h a t   e x i s t   o f f   p l a t f o r m ,   o n   o t h e r   c l u s t e r s ,   o r   l o c a l l y .   k u b e c t l   c r e a t e   s e r v i c e   e x t e r n a l n a m e   N A M E   - - e x t e r n a l - n a m e   e x t e r n a l . n a m e   [ - - d r y - r u n = s e r v e r | c l i e n t | n o n e ]


Question: What is Examples?

Answer: #   C r e a t e   a   n e w   E x t e r n a l N a m e   s e r v i c e   n a m e d   m y - n s   k u b e c t l   c r e a t e   s e r v i c e   e x t e r n a l n a m e   m y - n s   - - e x t e r n a l - n a m e   b a r . c o m


Question: What is Options?

Answer: I f   t r u e ,   i g n o r e   a n y   e r r o r s   i n   t e m p l a t e s   w h e n   a   f i e l d   o r   m a p   k e y   i s   m i s s i n g   i n   t h e   t e m p l a t e .   O n l y   a p p l i e s   t o   g o l a n g   a n d   j s o n p a t h   o u t p u t   f o r m a t s .   M u s t   b e   " n o n e " ,   " s e r v e r " ,   o r   " c l i e n t " .   I f   c l i e n t   s t r a t e g y ,   o n l y   p r i n t   t h e   o b j e c t   t h a t   w o u l d   b e   s e n t ,   w i t h o u t   s e n d i n g   i t .   I f   s e r v e r   s t r a t e g y ,   s u b m i t   s e r v e r - s i d e   r e q u e s t   w i t h o u t   p e r s i s t i n g   t h e   r e s o u r c e .   E x t e r n a l   n a m e   o f   s e r v i c e   N a m e   o f   t h e   m a n a g e r   u s e d   t o   t r a c k   f i e l d   o w n e r s h i p .   h e l p   f o r   e x t e r n a l n a m e   O u t p u t   f o r m a t .   O n e   o f :   ( j s o n ,   y a m l ,   n a m e ,   g o - t e m p l a t e ,   g o - t e m p l a t e - f i l e ,   t e m p l a t e ,   t e m p l a t e f i l e ,   j s o n p a t h ,   j s o n p a t h - a s - j s o n ,   j s o n p a t h - f i l e ) .   I f   t r u e ,   t h e   c o n f i g u r a t i o n   o f   c u r r e n t   o b j e c t   w i l l   b e   s a v e d   i n   i t s   a n n o t a t i o n .   O t h e r w i s e ,   t h e   a n n o t a t i o n   w i l l   b e   u n c h a n g e d .   T h i s   f l a g   i s   u s e f u l   w h e n   y o u   w a n t   t o   p e r f o r m   k u b e c t l   a p p l y   o n   t h i s   o b j e c t   i n   t h e   f u t u r e .   I f   t r u e ,   k e e p   t h e   m a n a g e d F i e l d s   w h e n   p r i n t i n g   o b j e c t s   i n   J S O N   o r   Y A M L   f o r m a t .   P o r t   p a i r s   c a n   b e   s p e c i f i e d   a s   ' < p o r t > : < t a r g e t P o r t > ' .   T e m p l a t e   s t r i n g   o r   p a t h   t o   t e m p l a t e   f i l e   t o   u s e   w h e n   - o = g o - t e m p l a t e ,   - o =


Question: What is Parent Options Inherited?

Answer: U s e r n a m e   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   U s e r   c o u l d   b e   a   r e g u l a r   u s e r   o r   a   s e r v i c e   a c c o u n t   i n   a   n a m e s p a c e .   G r o u p   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n ,   t h i s   f l a g   c a n   b e   r e p e a t e d   t o   s p e c i f y   m u l t i p l e   g r o u p s .   U I D   t o   i m p e r s o n a t e   f o r   t h e   o p e r a t i o n .   D e f a u l t   c a c h e   d i r e c t o r y   P a t h   t o   a   c e r t   f i l e   f o r   t h e   c e r t i f i c a t e   a u t h o r i t y   P a t h   t o   a   c l i e n t   c e r t i f i c a t e   f i l e   f o r   T L S   P a t h   t o   a   c l i e n t   k e y   f i l e   f o r   T L S   T h e   n a m e   o f   t h e   k u b e c o n f i g   c l u s t e r   t o   u s e   T h e   n a m e   o f   t h e   k u b e c o n f i g   c o n t e x t   t o   u s e   I f   t r u e ,   o p t - o u t   o f   r e s p o n s e   c o m p r e s s i o n   f o r   a l l   r e q u e s t s   t o   t h e   s e r v e r   I f   t r u e ,   t h e   s e r v e r ' s   c e r t i f i c a t e   w i l l   n o t   b e   c h e c k e d   f o r   v a l i d i t y .   T h i s   w i l l   m a k e   y o u r   H T T P S   c o n n e c t i o n s   i n s e c u r e   P a t h   t o   t h e   k u b e c o n f i g   f i l e   t o   u s e   f o r   C L I   r e q u e s t s .   P a t h   t o   t h e   k u b e r c   f i l e   t o   u s e   f o r   p r e f e r e n c e s .   T h i s   c a n   b e   d i s a b l e d   b y   e x p o r t i n g   K U B E C T L _ K U B E R C = f a l s e   f e a t u r e   g a t e   o r   t u r n i n g   o f f   t h e   f e a t u r e   K U B E R C = o f f .   R e q u i r e   s e r v e r   v e r s i o n   t o   m a t c h   c l i e n t   v e r s i o n   I f   p r e s e n t ,   t h e   n a m e s p a c e   s c o p e   f o r   t h i s   C L I   r e q u e s t   P a s s w o r d   f o r   b a s i c   a u t h e n t i c a t


Question: What is See Also?

Answer: k u b e c t l   c r e a t e   s e r v i c e   -   C r e a t e   a   s e r v i c e   u s i n g   a   s p e c i f i e d   s u b c o m m a n d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is Upgrading Windows nodes?

Answer: Upgrading Windows nodesFEATURE STATE: Kubernetes v1.18 [beta]This page explains how to upgrade a Windows node created with kubeadm.Before you beginYou need to have shell access to all the nodes, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.Your Kubernetes server must be at or later than version 1.17.To check the version, enter kubectl version.Familiarize yourself with the process for upgrading the rest of your kubeadm cluster. You will want to upgrade the control plane nodes before upgrading your Windows nodes.Upgrading worker nodesUpgrade kubeadmFrom the Windows node, upgrade kubeadm:# replace 1.34.0 with your desired version curl.exe -Lo <path-to-kubeadm.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubeadm.exe" Drain the nodeFrom a machine with access to the Kubernetes API, prepare the node for maintenance by marking it unschedulable and evicting the workloads:# replace <node-to-drain> with the name of your node you are draining kubectl drain <node-to-drain> --ignore-daemonsets You should see output similar to this:node/ip-172-31-85-18 cordoned node/ip-172-31-85-18 drained Upgrade the kubelet configurationFrom the Windows node, call the following command to sync new kubelet configuration:kubeadm upgrade node Upgrade kubelet and kube-proxyFrom the Windows node, upgrade and restart the kubelet:stop-service kubelet curl.exe -Lo <path-to-kubelet.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubelet.exe" restart-service kubelet From the Windows node, upgrade and restart the kube-proxy.stop-service kube-proxy curl.exe -Lo <path-to-kube-proxy.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kube-proxy.exe" restart-service kube-proxy Note:If you are running kube-proxy in a HostProcess container within a Pod, and not as a Windows Service, you can upgrade kube-proxy by applying a newer version of your kube-proxy manifests.Uncordon the nodeFrom a machine with access to the Kubernetes API, bring the node back online by marking it schedulable:# replace <node-to-drain> with the name of your node kubectl uncordon <node-to-drain> What's nextSee how to Upgrade Linux nodes.


Question: How does Upgrading Windows nodes work?

Answer: Upgrading Windows nodesFEATURE STATE: Kubernetes v1.18 [beta]This page explains how to upgrade a Windows node created with kubeadm.Before you beginYou need to have shell access to all the nodes, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.Your Kubernetes server must be at or later than version 1.17.To check the version, enter kubectl version.Familiarize yourself with the process for upgrading the rest of your kubeadm cluster. You will want to upgrade the control plane nodes before upgrading your Windows nodes.Upgrading worker nodesUpgrade kubeadmFrom the Windows node, upgrade kubeadm:# replace 1.34.0 with your desired version curl.exe -Lo <path-to-kubeadm.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubeadm.exe" Drain the nodeFrom a machine with access to the Kubernetes API, prepare the node for maintenance by marking it unschedulable and evicting the workloads:# replace <node-to-drain> with the name of your node you are draining kubectl drain <node-to-drain> --ignore-daemonsets You should see output similar to this:node/ip-172-31-85-18 cordoned node/ip-172-31-85-18 drained Upgrade the kubelet configurationFrom the Windows node, call the following command to sync new kubelet configuration:kubeadm upgrade node Upgrade kubelet and kube-proxyFrom the Windows node, upgrade and restart the kubelet:stop-service kubelet curl.exe -Lo <path-to-kubelet.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubelet.exe" restart-service kubelet From the Windows node, upgrade and restart the kube-proxy.stop-service kube-proxy curl.exe -Lo <path-to-kube-proxy.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kube-proxy.exe" restart-service kube-proxy Note:If you are running kube-proxy in a HostProcess container within a Pod, and not as a Windows Service, you can upgrade kube-proxy by applying a newer version of your kube-proxy manifests.Uncordon the nodeFrom a machine with access to the Kubernetes API, bring the node back online by marking it schedulable:# replace <node-to-drain> with the name of your node kubectl uncordon <node-to-drain> What's nextSee how to Upgrade Linux nodes.


Question: When would you use Upgrading Windows nodes?

Answer: Upgrading Windows nodesFEATURE STATE: Kubernetes v1.18 [beta]This page explains how to upgrade a Windows node created with kubeadm.Before you beginYou need to have shell access to all the nodes, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.Your Kubernetes server must be at or later than version 1.17.To check the version, enter kubectl version.Familiarize yourself with the process for upgrading the rest of your kubeadm cluster. You will want to upgrade the control plane nodes before upgrading your Windows nodes.Upgrading worker nodesUpgrade kubeadmFrom the Windows node, upgrade kubeadm:# replace 1.34.0 with your desired version curl.exe -Lo <path-to-kubeadm.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubeadm.exe" Drain the nodeFrom a machine with access to the Kubernetes API, prepare the node for maintenance by marking it unschedulable and evicting the workloads:# replace <node-to-drain> with the name of your node you are draining kubectl drain <node-to-drain> --ignore-daemonsets You should see output similar to this:node/ip-172-31-85-18 cordoned node/ip-172-31-85-18 drained Upgrade the kubelet configurationFrom the Windows node, call the following command to sync new kubelet configuration:kubeadm upgrade node Upgrade kubelet and kube-proxyFrom the Windows node, upgrade and restart the kubelet:stop-service kubelet curl.exe -Lo <path-to-kubelet.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubelet.exe" restart-service kubelet From the Windows node, upgrade and restart the kube-proxy.stop-service kube-proxy curl.exe -Lo <path-to-kube-proxy.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kube-proxy.exe" restart-service kube-proxy Note:If you are running kube-proxy in a HostProcess container within a Pod, and not as a Windows Service, you can upgrade kube-proxy by applying a newer version of your kube-proxy manifests.Uncordon the nodeFrom a machine with access to the Kubernetes API, bring the node back online by marking it schedulable:# replace <node-to-drain> with the name of your node kubectl uncordon <node-to-drain> What's nextSee how to Upgrade Linux nodes.


Question: What are the benefits of Upgrading Windows nodes?

Answer: Upgrading Windows nodesFEATURE STATE: Kubernetes v1.18 [beta]This page explains how to upgrade a Windows node created with kubeadm.Before you beginYou need to have shell access to all the nodes, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts.Your Kubernetes server must be at or later than version 1.17.To check the version, enter kubectl version.Familiarize yourself with the process for upgrading the rest of your kubeadm cluster. You will want to upgrade the control plane nodes before upgrading your Windows nodes.Upgrading worker nodesUpgrade kubeadmFrom the Windows node, upgrade kubeadm:# replace 1.34.0 with your desired version curl.exe -Lo <path-to-kubeadm.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubeadm.exe" Drain the nodeFrom a machine with access to the Kubernetes API, prepare the node for maintenance by marking it unschedulable and evicting the workloads:# replace <node-to-drain> with the name of your node you are draining kubectl drain <node-to-drain> --ignore-daemonsets You should see output similar to this:node/ip-172-31-85-18 cordoned node/ip-172-31-85-18 drained Upgrade the kubelet configurationFrom the Windows node, call the following command to sync new kubelet configuration:kubeadm upgrade node Upgrade kubelet and kube-proxyFrom the Windows node, upgrade and restart the kubelet:stop-service kubelet curl.exe -Lo <path-to-kubelet.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kubelet.exe" restart-service kubelet From the Windows node, upgrade and restart the kube-proxy.stop-service kube-proxy curl.exe -Lo <path-to-kube-proxy.exe> "https://dl.k8s.io/v1.34.0/bin/windows/amd64/kube-proxy.exe" restart-service kube-proxy Note:If you are running kube-proxy in a HostProcess container within a Pod, and not as a Windows Service, you can upgrade kube-proxy by applying a newer version of your kube-proxy manifests.Uncordon the nodeFrom a machine with access to the Kubernetes API, bring the node back online by marking it schedulable:# replace <node-to-drain> with the name of your node kubectl uncordon <node-to-drain> What's nextSee how to Upgrade Linux nodes.


Question: What is Upgrading Windows nodes?

Answer: T h i s   p a g e   e x p l a i n s   h o w   t o   u p g r a d e   a   W i n d o w s   n o d e   c r e a t e d   w i t h   k u b e a d m .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   s h e l l   a c c e s s   t o   a l l   t h e   n o d e s ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s . Y o u r   K u b e r n e t e s   s e r v e r   m u s t   b e   a t   o r   l a t e r   t h a n   v e r s i o n   1 . 1 7 . T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   Y o u   n e e d   t o   h a v e   s h e l l   a c c e s s   t o   a l l   t h e   n o d e s ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .   F a m i l i a r i z e   y o u r s e l f   w i t h   t h e   p r o c e s s   f o r   u p g r a d i n g   t h e   r e s t   o f   y o u r   k u b e a d m   c l u s t e r .   Y o u   w i l l   w a n t   t o   u p g r a d e   t h e   c o n t r o l   p l a n e   n o d e s   b e f o r e   u p g r a d i n g   y o u r   W i n d o w s   n o d e s .


Question: What is Upgrade kubeadm?

Answer: F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   k u b e a d m : #   r e p l a c e   1 . 3 4 . 0   w i t h   y o u r   d e s i r e d   v e r s i o n   c u r l . e x e   - L o   < p a t h - t o - k u b e a d m . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e a d m . e x e "   F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   k u b e a d m :   #   r e p l a c e   1 . 3 4 . 0   w i t h   y o u r   d e s i r e d   v e r s i o n   c u r l . e x e   - L o   < p a t h - t o - k u b e a d m . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e a d m . e x e "


Question: What is Drain the node?

Answer: F r o m   a   m a c h i n e   w i t h   a c c e s s   t o   t h e   K u b e r n e t e s   A P I ,   p r e p a r e   t h e   n o d e   f o r   m a i n t e n a n c e   b y   m a r k i n g   i t   u n s c h e d u l a b l e   a n d   e v i c t i n g   t h e   w o r k l o a d s : #   r e p l a c e   < n o d e - t o - d r a i n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   y o u   a r e   d r a i n i n g   k u b e c t l   d r a i n   < n o d e - t o - d r a i n >   - - i g n o r e - d a e m o n s e t s   Y o u   s h o u l d   s e e   o u t p u t   s i m i l a r   t o   t h i s : n o d e / i p - 1 7 2 - 3 1 - 8 5 - 1 8   c o r d o n e d   n o d e / i p - 1 7 2 - 3 1 - 8 5 - 1 8   d r a i n e d   F r o m   a   m a c h i n e   w i t h   a c c e s s   t o   t h e   K u b e r n e t e s   A P I ,   p r e p a r e   t h e   n o d e   f o r   m a i n t e n a n c e   b y   m a r k i n g   i t   u n s c h e d u l a b l e   a n d   e v i c t i n g   t h e   w o r k l o a d s :   #   r e p l a c e   < n o d e - t o - d r a i n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   y o u   a r e   d r a i n i n g   k u b e c t l   d r a i n   < n o d e - t o - d r a i n >   - - i g n o r e - d a e m o n s e t s   Y o u   s h o u l d   s e e   o u t p u t   s i m i l a r   t o   t h i s :   n o d e / i p - 1 7 2 - 3 1 - 8 5 - 1 8   c o r d o n e d   n o d e / i p - 1 7 2 - 3 1 - 8 5 - 1 8   d r a i n e d


Question: What is Upgrade the kubelet configuration?

Answer: F r o m   t h e   W i n d o w s   n o d e ,   c a l l   t h e   f o l l o w i n g   c o m m a n d   t o   s y n c   n e w   k u b e l e t   c o n f i g u r a t i o n : k u b e a d m   u p g r a d e   n o d e   F r o m   t h e   W i n d o w s   n o d e ,   c a l l   t h e   f o l l o w i n g   c o m m a n d   t o   s y n c   n e w   k u b e l e t   c o n f i g u r a t i o n :   k u b e a d m   u p g r a d e   n o d e


Question: What is Upgrade kubelet and kube-proxy?

Answer: F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   a n d   r e s t a r t   t h e   k u b e l e t : s t o p - s e r v i c e   k u b e l e t   c u r l . e x e   - L o   < p a t h - t o - k u b e l e t . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e l e t . e x e "   r e s t a r t - s e r v i c e   k u b e l e t   F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   a n d   r e s t a r t   t h e   k u b e - p r o x y . s t o p - s e r v i c e   k u b e - p r o x y   c u r l . e x e   - L o   < p a t h - t o - k u b e - p r o x y . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e - p r o x y . e x e "   r e s t a r t - s e r v i c e   k u b e - p r o x y   F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   a n d   r e s t a r t   t h e   k u b e l e t :   s t o p - s e r v i c e   k u b e l e t   c u r l . e x e   - L o   < p a t h - t o - k u b e l e t . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e l e t . e x e "   r e s t a r t - s e r v i c e   k u b e l e t   F r o m   t h e   W i n d o w s   n o d e ,   u p g r a d e   a n d   r e s t a r t   t h e   k u b e - p r o x y .   s t o p - s e r v i c e   k u b e - p r o x y   c u r l . e x e   - L o   < p a t h - t o - k u b e - p r o x y . e x e >   " h t t p s : / / d l . k 8 s . i o / v 1 . 3 4 . 0 / b i n / w i n d o w s / a m d 6 4 / k u b e - p r o x y . e x e "   r e s t a r t - s e r v i c e   k u b e - p r o x y


Question: What is Uncordon the node?

Answer: F r o m   a   m a c h i n e   w i t h   a c c e s s   t o   t h e   K u b e r n e t e s   A P I ,   b r i n g   t h e   n o d e   b a c k   o n l i n e   b y   m a r k i n g   i t   s c h e d u l a b l e : #   r e p l a c e   < n o d e - t o - d r a i n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   k u b e c t l   u n c o r d o n   < n o d e - t o - d r a i n >   F r o m   a   m a c h i n e   w i t h   a c c e s s   t o   t h e   K u b e r n e t e s   A P I ,   b r i n g   t h e   n o d e   b a c k   o n l i n e   b y   m a r k i n g   i t   s c h e d u l a b l e :   #   r e p l a c e   < n o d e - t o - d r a i n >   w i t h   t h e   n a m e   o f   y o u r   n o d e   k u b e c t l   u n c o r d o n   < n o d e - t o - d r a i n >


Question: What is What's next?

Answer: S e e   h o w   t o   U p g r a d e   L i n u x   n o d e s .


Question: What is Kubernetes Default Service CIDR Reconfiguration?

Answer: Kubernetes Default Service CIDR ReconfigurationFEATURE STATE: Kubernetes v1.33 [stable] (enabled by default: true)This document shares how to reconfigure the default Service IP range(s) assigned to a cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.33.To check the version, enter kubectl version.Kubernetes Default Service CIDR ReconfigurationThis document explains how to manage the Service IP address range within a Kubernetes cluster, which also influences the cluster's supported IP families for Services.The IP families available for Service ClusterIPs are determined by the --service-cluster-ip-range flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the Services IP address allocation tracking documentation.Since Kubernetes 1.33, the Service IP families configured for the cluster are reflected by the ServiceCIDR object named kubernetes. The kubernetes ServiceCIDR object is created by the first kube-apiserver instance that starts, based on its configured --service-cluster-ip-range flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same --service-cluster-ip-range values, which must match the default kubernetes ServiceCIDR object.Kubernetes Service CIDR Reconfiguration CategoriesWe can categorize Service CIDR reconfiguration into the following scenarios:Extending the existing Service CIDRs: This can be done dynamically by adding new ServiceCIDR objects without the need of reconfiguration of the kube-apiserver. Please refer to the dedicated documentation on Extending Service IP Ranges.Single-to-dual-stack conversion preserving the primary service CIDR: This involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or IPv4 to an IPv6-only cluster) while keeping the original IP family as primary. This requires an update to the kube-apiserver configuration and a corresponding modification of various cluster components that need to handle this additional IP family. These components include, but are not limited to, kube-proxy, the CNI or network plugin, service mesh implementations, and DNS services.Dual-to-single conversion preserving the primary service CIDR: This involves removing the secondary IP family from a dual-stack cluster, reverting to a single IP family while retaining the original primary IP family. In addition to the reconfiguration of the components to match the new IP family, you might need to address Services that were explicitly configured to use the removed IP family.Anything that


Question: How does Kubernetes Default Service CIDR Reconfiguration work?

Answer: Kubernetes Default Service CIDR ReconfigurationFEATURE STATE: Kubernetes v1.33 [stable] (enabled by default: true)This document shares how to reconfigure the default Service IP range(s) assigned to a cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.33.To check the version, enter kubectl version.Kubernetes Default Service CIDR ReconfigurationThis document explains how to manage the Service IP address range within a Kubernetes cluster, which also influences the cluster's supported IP families for Services.The IP families available for Service ClusterIPs are determined by the --service-cluster-ip-range flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the Services IP address allocation tracking documentation.Since Kubernetes 1.33, the Service IP families configured for the cluster are reflected by the ServiceCIDR object named kubernetes. The kubernetes ServiceCIDR object is created by the first kube-apiserver instance that starts, based on its configured --service-cluster-ip-range flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same --service-cluster-ip-range values, which must match the default kubernetes ServiceCIDR object.Kubernetes Service CIDR Reconfiguration CategoriesWe can categorize Service CIDR reconfiguration into the following scenarios:Extending the existing Service CIDRs: This can be done dynamically by adding new ServiceCIDR objects without the need of reconfiguration of the kube-apiserver. Please refer to the dedicated documentation on Extending Service IP Ranges.Single-to-dual-stack conversion preserving the primary service CIDR: This involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or IPv4 to an IPv6-only cluster) while keeping the original IP family as primary. This requires an update to the kube-apiserver configuration and a corresponding modification of various cluster components that need to handle this additional IP family. These components include, but are not limited to, kube-proxy, the CNI or network plugin, service mesh implementations, and DNS services.Dual-to-single conversion preserving the primary service CIDR: This involves removing the secondary IP family from a dual-stack cluster, reverting to a single IP family while retaining the original primary IP family. In addition to the reconfiguration of the components to match the new IP family, you might need to address Services that were explicitly configured to use the removed IP family.Anything that


Question: When would you use Kubernetes Default Service CIDR Reconfiguration?

Answer: Kubernetes Default Service CIDR ReconfigurationFEATURE STATE: Kubernetes v1.33 [stable] (enabled by default: true)This document shares how to reconfigure the default Service IP range(s) assigned to a cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.33.To check the version, enter kubectl version.Kubernetes Default Service CIDR ReconfigurationThis document explains how to manage the Service IP address range within a Kubernetes cluster, which also influences the cluster's supported IP families for Services.The IP families available for Service ClusterIPs are determined by the --service-cluster-ip-range flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the Services IP address allocation tracking documentation.Since Kubernetes 1.33, the Service IP families configured for the cluster are reflected by the ServiceCIDR object named kubernetes. The kubernetes ServiceCIDR object is created by the first kube-apiserver instance that starts, based on its configured --service-cluster-ip-range flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same --service-cluster-ip-range values, which must match the default kubernetes ServiceCIDR object.Kubernetes Service CIDR Reconfiguration CategoriesWe can categorize Service CIDR reconfiguration into the following scenarios:Extending the existing Service CIDRs: This can be done dynamically by adding new ServiceCIDR objects without the need of reconfiguration of the kube-apiserver. Please refer to the dedicated documentation on Extending Service IP Ranges.Single-to-dual-stack conversion preserving the primary service CIDR: This involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or IPv4 to an IPv6-only cluster) while keeping the original IP family as primary. This requires an update to the kube-apiserver configuration and a corresponding modification of various cluster components that need to handle this additional IP family. These components include, but are not limited to, kube-proxy, the CNI or network plugin, service mesh implementations, and DNS services.Dual-to-single conversion preserving the primary service CIDR: This involves removing the secondary IP family from a dual-stack cluster, reverting to a single IP family while retaining the original primary IP family. In addition to the reconfiguration of the components to match the new IP family, you might need to address Services that were explicitly configured to use the removed IP family.Anything that


Question: What are the benefits of Kubernetes Default Service CIDR Reconfiguration?

Answer: Kubernetes Default Service CIDR ReconfigurationFEATURE STATE: Kubernetes v1.33 [stable] (enabled by default: true)This document shares how to reconfigure the default Service IP range(s) assigned to a cluster.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYour Kubernetes server must be at or later than version v1.33.To check the version, enter kubectl version.Kubernetes Default Service CIDR ReconfigurationThis document explains how to manage the Service IP address range within a Kubernetes cluster, which also influences the cluster's supported IP families for Services.The IP families available for Service ClusterIPs are determined by the --service-cluster-ip-range flag to kube-apiserver. For a better understanding of Service IP address allocation, refer to the Services IP address allocation tracking documentation.Since Kubernetes 1.33, the Service IP families configured for the cluster are reflected by the ServiceCIDR object named kubernetes. The kubernetes ServiceCIDR object is created by the first kube-apiserver instance that starts, based on its configured --service-cluster-ip-range flag. To ensure consistent cluster behavior, all kube-apiserver instances must be configured with the same --service-cluster-ip-range values, which must match the default kubernetes ServiceCIDR object.Kubernetes Service CIDR Reconfiguration CategoriesWe can categorize Service CIDR reconfiguration into the following scenarios:Extending the existing Service CIDRs: This can be done dynamically by adding new ServiceCIDR objects without the need of reconfiguration of the kube-apiserver. Please refer to the dedicated documentation on Extending Service IP Ranges.Single-to-dual-stack conversion preserving the primary service CIDR: This involves introducing a secondary IP family (IPv6 to an IPv4-only cluster, or IPv4 to an IPv6-only cluster) while keeping the original IP family as primary. This requires an update to the kube-apiserver configuration and a corresponding modification of various cluster components that need to handle this additional IP family. These components include, but are not limited to, kube-proxy, the CNI or network plugin, service mesh implementations, and DNS services.Dual-to-single conversion preserving the primary service CIDR: This involves removing the secondary IP family from a dual-stack cluster, reverting to a single IP family while retaining the original primary IP family. In addition to the reconfiguration of the components to match the new IP family, you might need to address Services that were explicitly configured to use the removed IP family.Anything that


Question: What is Kubernetes Default Service CIDR Reconfiguration?

Answer: T h i s   d o c u m e n t   s h a r e s   h o w   t o   r e c o n f i g u r e   t h e   d e f a u l t   S e r v i c e   I P   r a n g e ( s )   a s s i g n e d   t o   a   c l u s t e r .


Question: What is Before you begin?

Answer: Y o u   n e e d   t o   h a v e   a   K u b e r n e t e s   c l u s t e r ,   a n d   t h e   k u b e c t l   c o m m a n d - l i n e   t o o l   m u s t   b e   c o n f i g u r e d   t o   c o m m u n i c a t e   w i t h   y o u r   c l u s t e r .   I t   i s   r e c o m m e n d e d   t o   r u n   t h i s   t u t o r i a l   o n   a   c l u s t e r   w i t h   a t   l e a s t   t w o   n o d e s   t h a t   a r e   n o t   a c t i n g   a s   c o n t r o l   p l a n e   h o s t s .   I f   y o u   d o   n o t   a l r e a d y   h a v e   a   c l u s t e r ,   y o u   c a n   c r e a t e   o n e   b y   u s i n g   m i n i k u b e   o r   y o u   c a n   u s e   o n e   o f   t h e s e   K u b e r n e t e s   p l a y g r o u n d s :   i x i m i u z   L a b s K i l l e r c o d a K o d e K l o u d P l a y   w i t h   K u b e r n e t e s   T o   c h e c k   t h e   v e r s i o n ,   e n t e r   k u b e c t l   v e r s i o n .


Question: What is Kubernetes Default Service CIDR Reconfiguration?

Answer: T h i s   d o c u m e n t   e x p l a i n s   h o w   t o   m a n a g e   t h e   S e r v i c e   I P   a d d r e s s   r a n g e   w i t h i n   a   K u b e r n e t e s   c l u s t e r ,   w h i c h   a l s o   i n f l u e n c e s   t h e   c l u s t e r ' s   s u p p o r t e d   I P   f a m i l i e s   f o r   S e r v i c e s .   T h e   I P   f a m i l i e s   a v a i l a b l e   f o r   S e r v i c e   C l u s t e r I P s   a r e   d e t e r m i n e d   b y   t h e   - - s e r v i c e - c l u s t e r - i p - r a n g e   f l a g   t o   k u b e - a p i s e r v e r .   F o r   a   b e t t e r   u n d e r s t a n d i n g   o f   S e r v i c e   I P   a d d r e s s   a l l o c a t i o n ,   r e f e r   t o   t h e   S e r v i c e s   I P   a d d r e s s   a l l o c a t i o n   t r a c k i n g   d o c u m e n t a t i o n .   S i n c e   K u b e r n e t e s   1 . 3 3 ,   t h e   S e r v i c e   I P   f a m i l i e s   c o n f i g u r e d   f o r   t h e   c l u s t e r   a r e   r e f l e c t e d   b y   t h e   S e r v i c e C I D R   o b j e c t   n a m e d   k u b e r n e t e s .   T h e   k u b e r n e t e s   S e r v i c e C I D R   o b j e c t   i s   c r e a t e d   b y   t h e   f i r s t   k u b e - a p i s e r v e r   i n s t a n c e   t h a t   s t a r t s ,   b a s e d   o n   i t s   c o n f i g u r e d   - - s e r v i c e - c l u s t e r - i p - r a n g e   f l a g .   T o   e n s u r e   c o n s i s t e n t   c l u s t e r   b e h a v i o r ,   a l l   k u b e - a p i s e r v e r   i n s t a n c e s   m u s t   b e   c o n f i g u r e d   w i t h   t h e   s a m e   - - s e r v i c e - c l u s t e r - i p - r a n g e   v a l u e s ,   w h i c h   m u s t   m a t c h   t h e   d e f a u l t   k u b e r n e t e s   S e r v i c e C I D R   o b j e c t .


Question: What is Kubernetes Service CIDR Reconfiguration Categories?

Answer: W e   c a n   c a t e g o r i z e   S e r v i c e   C I D R   r e c o n f i g u r a t i o n   i n t o   t h e   f o l l o w i n g   s c e n a r i o s :   E x t e n d i n g   t h e   e x i s t i n g   S e r v i c e   C I D R s :   T h i s   c a n   b e   d o n e   d y n a m i c a l l y   b y   a d d i n g   n e w   S e r v i c e C I D R   o b j e c t s   w i t h o u t   t h e   n e e d   o f   r e c o n f i g u r a t i o n   o f   t h e   k u b e - a p i s e r v e r .   P l e a s e   r e f e r   t o   t h e   d e d i c a t e d   d o c u m e n t a t i o n   o n   E x t e n d i n g   S e r v i c e   I P   R a n g e s . S i n g l e - t o - d u a l - s t a c k   c o n v e r s i o n   p r e s e r v i n g   t h e   p r i m a r y   s e r v i c e   C I D R :   T h i s   i n v o l v e s   i n t r o d u c i n g   a   s e c o n d a r y   I P   f a m i l y   ( I P v 6   t o   a n   I P v 4 - o n l y   c l u s t e r ,   o r   I P v 4   t o   a n   I P v 6 - o n l y   c l u s t e r )   w h i l e   k e e p i n g   t h e   o r i g i n a l   I P   f a m i l y   a s   p r i m a r y .   T h i s   r e q u i r e s   a n   u p d a t e   t o   t h e   k u b e - a p i s e r v e r   c o n f i g u r a t i o n   a n d   a   c o r r e s p o n d i n g   m o d i f i c a t i o n   o f   v a r i o u s   c l u s t e r   c o m p o n e n t s   t h a t   n e e d   t o   h a n d l e   t h i s   a d d i t i o n a l   I P   f a m i l y .   T h e s e   c o m p o n e n t s   i n c l u d e ,   b u t   a r e   n o t   l i m i t e d   t o ,   k u b e - p r o x y ,   t h e   C N I   o r   n e t w o r k   p l u g i n ,   s e r v i c e   m e s h   i m p l e m e n t a t i o n s ,   a n d   D N S   s e r v i c e s . D u a l - t o - s i n g l e   c o n v e r s i o n   p r e s e r v i n g   t h e   p r i m a r y   s e r v i c e   C I D R :   T h i s   i n v o l v e s   r e m o v i n g   t h e   s e c o n d a r y   I P   f a m i l y   f r o m   a   d u a l - s t a c k   c l u s t e r ,   r e v e r t i n g   t o   a


Question: What is Manual Operations for Replacing the Default Service CIDR?

Answer: R e c o n f i g u r i n g   t h e   d e f a u l t   S e r v i c e   C I D R   n e c e s s i t a t e s   m a n u a l   s t e p s   p e r f o r m e d   b y   t h e   c l u s t e r   o p e r a t o r ,   a d m i n i s t r a t o r ,   o r   t h e   s o f t w a r e   m a n a g i n g   t h e   c l u s t e r   l i f e c y c l e .   T h e s e   t y p i c a l l y   i n c l u d e :   U p d a t i n g   t h e   k u b e - a p i s e r v e r   c o n f i g u r a t i o n :   M o d i f y   t h e   - - s e r v i c e - c l u s t e r - i p - r a n g e   f l a g   w i t h   t h e   n e w   I P   r a n g e ( s ) . R e c o n f i g u r i n g   t h e   n e t w o r k   c o m p o n e n t s :   T h i s   i s   a   c r i t i c a l   s t e p   a n d   t h e   s p e c i f i c   p r o c e d u r e   d e p e n d s   o n   t h e   d i f f e r e n t   n e t w o r k i n g   c o m p o n e n t s   i n   u s e .   I t   m i g h t   i n v o l v e   u p d a t i n g   c o n f i g u r a t i o n   f i l e s ,   r e s t a r t i n g   a g e n t   p o d s ,   o r   u p d a t i n g   t h e   c o m p o n e n t s   t o   m a n a g e   t h e   n e w   S e r v i c e   C I D R ( s )   a n d   t h e   d e s i r e d   I P   f a m i l y   c o n f i g u r a t i o n   f o r   P o d s .   T y p i c a l   c o m p o n e n t s   c a n   b e   t h e   i m p l e m e n t a t i o n   o f   K u b e r n e t e s   S e r v i c e s ,   s u c h   a s   k u b e - p r o x y ,   a n d   t h e   c o n f i g u r e d   n e t w o r k i n g   p l u g i n ,   a n d   p o t e n t i a l l y   o t h e r   n e t w o r k i n g   c o m p o n e n t s   l i k e   s e r v i c e   m e s h   c o n t r o l l e r s   a n d   D N S   s e r v e r s ,   t o   e n s u r e   t h e y   c a n   c o r r e c t l y   h a n d l e   t r a f f i c   a n d   p e r f o r m   s e r v i c e   d i s c o v e r y   w i t h   t h e   n e w   I P   f a m i l y   c o n f i g u r a t i o n . M a n a g i n g   e x i s t i n g   S e r v i c e s :   S e r v i c e s   w i t h   I P s   f


Question: What is Illustrative Reconfiguration Steps?

Answer: T h e   f o l l o w i n g   s t e p s   d e s c r i b e   a   c o n t r o l l e d   r e c o n f i g u r a t i o n   f o c u s i n g   o n   t h e   c o m p l e t e l y   r e p l a c e m e n t   o f   t h e   d e f a u l t   S e r v i c e   C I D R   a n d   t h e   r e c r e a t i o n   o f   t h e   k u b e r n e t e s . d e f a u l t   S e r v i c e :   S t a r t   t h e   k u b e - a p i s e r v e r   w i t h   t h e   i n i t i a l   - - s e r v i c e - c l u s t e r - i p - r a n g e . C r e a t e   i n i t i a l   S e r v i c e s   t h a t   o b t a i n   I P s   f r o m   t h i s   r a n g e . I n t r o d u c e   a   n e w   S e r v i c e   C I D R   a s   a   t e m p o r a r y   t a r g e t   f o r   r e c o n f i g u r a t i o n . M a r k   t h e   k u b e r n e t e s   d e f a u l t   S e r v i c e   C I D R   f o r   d e l e t i o n   ( i t   w i l l   r e m a i n   p e n d i n g   d u e   t o   e x i s t i n g   I P s   a n d   f i n a l i z e r s ) .   T h i s   p r e v e n t s   n e w   a l l o c a t i o n s   f r o m   t h e   o l d   r a n g e . R e c r e a t e   e x i s t i n g   S e r v i c e s .   T h e y   s h o u l d   n o w   b e   a l l o c a t e d   I P s   f r o m   t h e   n e w ,   t e m p o r a r y   S e r v i c e   C I D R . R e s t a r t   t h e   k u b e - a p i s e r v e r   w i t h   t h e   n e w   S e r v i c e   C I D R ( s )   c o n f i g u r e d   a n d   s h u t   d o w n   t h e   o l d   i n s t a n c e . D e l e t e   t h e   k u b e r n e t e s . d e f a u l t   s e r v i c e .   T h e   n e w   k u b e - a p i s e r v e r   w i l l   r e c r e a t e   i t   w i t h i n   t h e   n e w   S e r v i c e   C I D R .


Question: What is What's next?

Answer: K u b e r n e t e s   N e t w o r k i n g   C o n c e p t s :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / c l u s t e r - a d m i n i s t r a t i o n / n e t w o r k i n g / K u b e r n e t e s   D u a l - S t a c k   S e r v i c e s :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / s e r v i c e s - n e t w o r k i n g / d u a l - s t a c k / E x t e n d i n g   K u b e r n e t e s   S e r v i c e   I P   R a n g e s :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / n e t w o r k / e x t e n d - s e r v i c e - i p - r a n g e s /


Question: What is ServiceAccount?

Answer: ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets.apiVersion: v1import "k8s.io/api/core/v1"ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secretsapiVersion: v1kind: ServiceAccountmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataautomountServiceAccountToken (boolean)AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.imagePullSecrets ([]LocalObjectReference)Atomic: will be replaced during a mergeImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-podsecrets ([]ObjectReference)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeSecrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". The "kubernetes.io/enforce-mountable-secrets" annotation is deprecated since v1.32. Prefer separate namespaces to isolate access to mounted secrets. This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secretServiceAccountListServiceAccountList is a list of ServiceAccount objectsapiVersion: v1kind: ServiceAccountListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]ServiceAccount), requiredList of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/Operationsget read the specified ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccounts/{name}Parametersname (in path): string, requiredname of the ServiceAccountnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ServiceAccount): OK401: Unauthorizedlist list or watch objects of kind ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccountsParametersnamespace (in path): string, re


Question: How does ServiceAccount work?

Answer: ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets.apiVersion: v1import "k8s.io/api/core/v1"ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secretsapiVersion: v1kind: ServiceAccountmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataautomountServiceAccountToken (boolean)AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.imagePullSecrets ([]LocalObjectReference)Atomic: will be replaced during a mergeImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-podsecrets ([]ObjectReference)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeSecrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". The "kubernetes.io/enforce-mountable-secrets" annotation is deprecated since v1.32. Prefer separate namespaces to isolate access to mounted secrets. This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secretServiceAccountListServiceAccountList is a list of ServiceAccount objectsapiVersion: v1kind: ServiceAccountListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]ServiceAccount), requiredList of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/Operationsget read the specified ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccounts/{name}Parametersname (in path): string, requiredname of the ServiceAccountnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ServiceAccount): OK401: Unauthorizedlist list or watch objects of kind ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccountsParametersnamespace (in path): string, re


Question: When would you use ServiceAccount?

Answer: ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets.apiVersion: v1import "k8s.io/api/core/v1"ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secretsapiVersion: v1kind: ServiceAccountmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataautomountServiceAccountToken (boolean)AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.imagePullSecrets ([]LocalObjectReference)Atomic: will be replaced during a mergeImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-podsecrets ([]ObjectReference)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeSecrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". The "kubernetes.io/enforce-mountable-secrets" annotation is deprecated since v1.32. Prefer separate namespaces to isolate access to mounted secrets. This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secretServiceAccountListServiceAccountList is a list of ServiceAccount objectsapiVersion: v1kind: ServiceAccountListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]ServiceAccount), requiredList of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/Operationsget read the specified ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccounts/{name}Parametersname (in path): string, requiredname of the ServiceAccountnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ServiceAccount): OK401: Unauthorizedlist list or watch objects of kind ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccountsParametersnamespace (in path): string, re


Question: What are the benefits of ServiceAccount?

Answer: ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secrets.apiVersion: v1import "k8s.io/api/core/v1"ServiceAccountServiceAccount binds together: * a name, understood by users, and perhaps by peripheral systems, for an identity * a principal that can be authenticated and authorized * a set of secretsapiVersion: v1kind: ServiceAccountmetadata (ObjectMeta)Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadataautomountServiceAccountToken (boolean)AutomountServiceAccountToken indicates whether pods running as this service account should have an API token automatically mounted. Can be overridden at the pod level.imagePullSecrets ([]LocalObjectReference)Atomic: will be replaced during a mergeImagePullSecrets is a list of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount. ImagePullSecrets are distinct from Secrets because Secrets can be mounted in the pod, but ImagePullSecrets are only accessed by the kubelet. More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-podsecrets ([]ObjectReference)Patch strategy: merge on key nameMap: unique values on key name will be kept during a mergeSecrets is a list of the secrets in the same namespace that pods running using this ServiceAccount are allowed to use. Pods are only limited to this list if this service account has a "kubernetes.io/enforce-mountable-secrets" annotation set to "true". The "kubernetes.io/enforce-mountable-secrets" annotation is deprecated since v1.32. Prefer separate namespaces to isolate access to mounted secrets. This field should not be used to find auto-generated service account token secrets for use outside of pods. Instead, tokens can be requested directly using the TokenRequest API, or service account token secrets can be manually created. More info: https://kubernetes.io/docs/concepts/configuration/secretServiceAccountListServiceAccountList is a list of ServiceAccount objectsapiVersion: v1kind: ServiceAccountListmetadata (ListMeta)Standard list metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kindsitems ([]ServiceAccount), requiredList of ServiceAccounts. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/Operationsget read the specified ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccounts/{name}Parametersname (in path): string, requiredname of the ServiceAccountnamespace (in path): string, requirednamespacepretty (in query): stringprettyResponse200 (ServiceAccount): OK401: Unauthorizedlist list or watch objects of kind ServiceAccountHTTP RequestGET /api/v1/namespaces/{namespace}/serviceaccountsParametersnamespace (in path): string, re


Question: What is ServiceAccount?

Answer: a p i V e r s i o n :   v 1   i m p o r t   " k 8 s . i o / a p i / c o r e / v 1 "


Question: What is ServiceAccount?

Answer: S e r v i c e A c c o u n t   b i n d s   t o g e t h e r :   *   a   n a m e ,   u n d e r s t o o d   b y   u s e r s ,   a n d   p e r h a p s   b y   p e r i p h e r a l   s y s t e m s ,   f o r   a n   i d e n t i t y   *   a   p r i n c i p a l   t h a t   c a n   b e   a u t h e n t i c a t e d   a n d   a u t h o r i z e d   *   a   s e t   o f   s e c r e t s   a p i V e r s i o n :   v 1 k i n d :   S e r v i c e A c c o u n t m e t a d a t a   ( O b j e c t M e t a ) S t a n d a r d   o b j e c t ' s   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # m e t a d a t a a u t o m o u n t S e r v i c e A c c o u n t T o k e n   ( b o o l e a n ) A u t o m o u n t S e r v i c e A c c o u n t T o k e n   i n d i c a t e s   w h e t h e r   p o d s   r u n n i n g   a s   t h i s   s e r v i c e   a c c o u n t   s h o u l d   h a v e   a n   A P I   t o k e n   a u t o m a t i c a l l y   m o u n t e d .   C a n   b e   o v e r r i d d e n   a t   t h e   p o d   l e v e l . i m a g e P u l l S e c r e t s   ( [ ] L o c a l O b j e c t R e f e r e n c e ) A t o m i c :   w i l l   b e   r e p l a c e d   d u r i n g   a   m e r g e I m a g e P u l l S e c r e t s   i s   a   l i s t   o f   r e f e r e n c e s   t o   s e c r e t s   i n   t h e   s a m e   n a m e s p a c e   t o   u s e   f o r   p u l l i n g   a n y   i m a g e s   i n   p o d s   t h a t   r e f e r e n c e   t h i s   S e r v i c e A c c o u n t .   I m a g e P u l l S e c r e t s   a r e   d i s t i n c t   f r o m   S e c r e t s   b e c a u s e   S e c r e t s   c a n   b e   m o u n t e d   i n   t h e   p o d ,   b u t   I m a g e P u l l S e c r e t s   a r e   o n l y   a c c e s s e d   b y   t h e   k u b e l e t .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / c o n c e p t s / c o n t a i


Question: What is ServiceAccountList?

Answer: S e r v i c e A c c o u n t L i s t   i s   a   l i s t   o f   S e r v i c e A c c o u n t   o b j e c t s   a p i V e r s i o n :   v 1 k i n d :   S e r v i c e A c c o u n t L i s t m e t a d a t a   ( L i s t M e t a ) S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s i t e m s   ( [ ] S e r v i c e A c c o u n t ) ,   r e q u i r e d L i s t   o f   S e r v i c e A c c o u n t s .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / c o n f i g u r e - p o d - c o n t a i n e r / c o n f i g u r e - s e r v i c e - a c c o u n t /   a p i V e r s i o n :   v 1   k i n d :   S e r v i c e A c c o u n t L i s t   m e t a d a t a   ( L i s t M e t a )   S t a n d a r d   l i s t   m e t a d a t a .   M o r e   i n f o :   h t t p s : / / g i t . k 8 s . i o / c o m m u n i t y / c o n t r i b u t o r s / d e v e l / s i g - a r c h i t e c t u r e / a p i - c o n v e n t i o n s . m d # t y p e s - k i n d s   i t e m s   ( [ ] S e r v i c e A c c o u n t ) ,   r e q u i r e d   L i s t   o f   S e r v i c e A c c o u n t s .   M o r e   i n f o :   h t t p s : / / k u b e r n e t e s . i o / d o c s / t a s k s / c o n f i g u r e - p o d - c o n t a i n e r / c o n f i g u r e - s e r v i c e - a c c o u n t /


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   S e r v i c e A c c o u n t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   S e r v i c e A c c o u n t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: G E T   / a p i / v 1 / s e r v i c e a c c o u n t s


Question: What is Parameters?

Answer: a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n a l l o w W a t c h B o o k m a r k s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s w a t c h   ( i n   q u e r y ) :   b o o l e a n w a t c h   a l l o w W a t c h B o o k m a r k s   ( i n   q u e r y ) :   b o o l e a n   a l l o w W a t c h B o o k m a r k s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   l a b e l S e l e c t o r   l i m i t   ( i n   q u e r y ) :   i n t e g e r   l i m i t   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n   r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g   r e s o u r c e V e r s i o n M a t c h   s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n   s e n d I n i t i a l E v e n t s   t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   t i m e o u t S e c o n d s   w a t c h   ( i n   q u e r y ) :   b o o l e a n   w a t c h


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t L i s t ) :   O K   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P O S T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   S e r v i c e A c c o u n t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   S e r v i c e A c c o u n t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t ) :   O K   2 0 1   ( S e r v i c e A c c o u n t ) :   C r e a t e d   2 0 2   ( S e r v i c e A c c o u n t ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P U T   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   S e r v i c e A c c o u n t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   S e r v i c e A c c o u n t ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   S e r v i c e A c c o u n t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   S e r v i c e A c c o u n t ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t ) :   O K   2 0 1   ( S e r v i c e A c c o u n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: P A T C H   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   S e r v i c e A c c o u n t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   P a t c h ,   r e q u i r e d d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g f i e l d M a n a g e r f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g f i e l d V a l i d a t i o n f o r c e   ( i n   q u e r y ) :   b o o l e a n f o r c e p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   S e r v i c e A c c o u n t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   P a t c h ,   r e q u i r e d   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d M a n a g e r   ( i n   q u e r y ) :   s t r i n g   f i e l d M a n a g e r   f i e l d V a l i d a t i o n   ( i n   q u e r y ) :   s t r i n g   f i e l d V a l i d a t i o n   f o r c e   ( i n   q u e r y ) :   b o o l e a n   f o r c e   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t ) :   O K   2 0 1   ( S e r v i c e A c c o u n t ) :   C r e a t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s / { n a m e }


Question: What is Parameters?

Answer: n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e   o f   t h e   S e r v i c e A c c o u n t n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y   n a m e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e   o f   t h e   S e r v i c e A c c o u n t   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   p r e t t y   ( i n   q u e r y ) :   s t r i n g   p r e t t y   p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g   p r o p a g a t i o n P o l i c y


Question: What is Response?

Answer: 2 0 0   ( S e r v i c e A c c o u n t ) :   O K   2 0 2   ( S e r v i c e A c c o u n t ) :   A c c e p t e d   4 0 1 :   U n a u t h o r i z e d


Question: What is HTTP Request?

Answer: D E L E T E   / a p i / v 1 / n a m e s p a c e s / { n a m e s p a c e } / s e r v i c e a c c o u n t s


Question: What is Parameters?

Answer: n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d n a m e s p a c e b o d y :   D e l e t e O p t i o n s c o n t i n u e   ( i n   q u e r y ) :   s t r i n g c o n t i n u e d r y R u n   ( i n   q u e r y ) :   s t r i n g d r y R u n f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g f i e l d S e l e c t o r g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r g r a c e P e r i o d S e c o n d s i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l   ( i n   q u e r y ) :   b o o l e a n i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g P o t e n t i a l l a b e l S e l e c t o r   ( i n   q u e r y ) :   s t r i n g l a b e l S e l e c t o r l i m i t   ( i n   q u e r y ) :   i n t e g e r l i m i t p r e t t y   ( i n   q u e r y ) :   s t r i n g p r e t t y p r o p a g a t i o n P o l i c y   ( i n   q u e r y ) :   s t r i n g p r o p a g a t i o n P o l i c y r e s o u r c e V e r s i o n   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n r e s o u r c e V e r s i o n M a t c h   ( i n   q u e r y ) :   s t r i n g r e s o u r c e V e r s i o n M a t c h s e n d I n i t i a l E v e n t s   ( i n   q u e r y ) :   b o o l e a n s e n d I n i t i a l E v e n t s t i m e o u t S e c o n d s   ( i n   q u e r y ) :   i n t e g e r t i m e o u t S e c o n d s   n a m e s p a c e   ( i n   p a t h ) :   s t r i n g ,   r e q u i r e d   n a m e s p a c e   b o d y :   D e l e t e O p t i o n s   c o n t i n u e   ( i n   q u e r y ) :   s t r i n g   c o n t i n u e   d r y R u n   ( i n   q u e r y ) :   s t r i n g   d r y R u n   f i e l d S e l e c t o r   ( i n   q u e r y ) :   s t r i n g   f i e l d S e l e c t o r   g r a c e P e r i o d S e c o n d s   ( i n   q u e r y ) :   i n t e g e r   g r a c e P e r i o d S e c o n d s   i g n o r e S t o r e R e a d E r r o r W i t h C l u s t e r B r e a k i n g


Question: What is Response?

Answer: 2 0 0   ( S t a t u s ) :   O K   4 0 1 :   U n a u t h o r i z e d   T h i s   p a g e   i s   a u t o m a t i c a l l y   g e n e r a t e d .   I f   y o u   p l a n   t o   r e p o r t   a n   i s s u e   w i t h   t h i s   p a g e ,   m e n t i o n   t h a t   t h e   p a g e   i s   a u t o - g e n e r a t e d   i n   y o u r   i s s u e   d e s c r i p t i o n .   T h e   f i x   m a y   n e e d   t o   h a p p e n   e l s e w h e r e   i n   t h e   K u b e r n e t e s   p r o j e c t .


Question: What is CertificateSigningRequest?

Answer: CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.apiVersion: certificates.k8s.io/v1import "k8s.io/api/certificates/v1"CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.Kubelets use this API to obtain:client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client-kubelet" signerName).serving certificates for TLS endpoints kube-apiserver can connect to securely (with the "kubernetes.io/kubelet-serving" signerName).This API can be used to request client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client" signerName), or to obtain certificates from custom non-Kubernetes signers.apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata (ObjectMeta)spec (CertificateSigningRequestSpec), requiredspec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.status (CertificateSigningRequestStatus)status contains information about whether the request is approved or denied, and the certificate issued by the signer, or the failure condition indicating signer failure.CertificateSigningRequestSpecCertificateSigningRequestSpec contains the certificate request.request ([]byte), requiredAtomic: will be replaced during a mergerequest contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block. When serialized as JSON or YAML, the data is additionally base64-encoded.signerName (string), requiredsignerName indicates the requested signer, and is a qualified name.List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.Well-known Kubernetes signers are:"kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver. Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver. Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely. Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.M


Question: How does CertificateSigningRequest work?

Answer: CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.apiVersion: certificates.k8s.io/v1import "k8s.io/api/certificates/v1"CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.Kubelets use this API to obtain:client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client-kubelet" signerName).serving certificates for TLS endpoints kube-apiserver can connect to securely (with the "kubernetes.io/kubelet-serving" signerName).This API can be used to request client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client" signerName), or to obtain certificates from custom non-Kubernetes signers.apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata (ObjectMeta)spec (CertificateSigningRequestSpec), requiredspec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.status (CertificateSigningRequestStatus)status contains information about whether the request is approved or denied, and the certificate issued by the signer, or the failure condition indicating signer failure.CertificateSigningRequestSpecCertificateSigningRequestSpec contains the certificate request.request ([]byte), requiredAtomic: will be replaced during a mergerequest contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block. When serialized as JSON or YAML, the data is additionally base64-encoded.signerName (string), requiredsignerName indicates the requested signer, and is a qualified name.List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.Well-known Kubernetes signers are:"kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver. Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver. Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely. Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.M


Question: When would you use CertificateSigningRequest?

Answer: CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.apiVersion: certificates.k8s.io/v1import "k8s.io/api/certificates/v1"CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.Kubelets use this API to obtain:client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client-kubelet" signerName).serving certificates for TLS endpoints kube-apiserver can connect to securely (with the "kubernetes.io/kubelet-serving" signerName).This API can be used to request client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client" signerName), or to obtain certificates from custom non-Kubernetes signers.apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata (ObjectMeta)spec (CertificateSigningRequestSpec), requiredspec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.status (CertificateSigningRequestStatus)status contains information about whether the request is approved or denied, and the certificate issued by the signer, or the failure condition indicating signer failure.CertificateSigningRequestSpecCertificateSigningRequestSpec contains the certificate request.request ([]byte), requiredAtomic: will be replaced during a mergerequest contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block. When serialized as JSON or YAML, the data is additionally base64-encoded.signerName (string), requiredsignerName indicates the requested signer, and is a qualified name.List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.Well-known Kubernetes signers are:"kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver. Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver. Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely. Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.M


Question: What are the benefits of CertificateSigningRequest?

Answer: CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.apiVersion: certificates.k8s.io/v1import "k8s.io/api/certificates/v1"CertificateSigningRequestCertificateSigningRequest objects provide a mechanism to obtain x509 certificates by submitting a certificate signing request, and having it asynchronously approved and issued.Kubelets use this API to obtain:client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client-kubelet" signerName).serving certificates for TLS endpoints kube-apiserver can connect to securely (with the "kubernetes.io/kubelet-serving" signerName).This API can be used to request client certificates to authenticate to kube-apiserver (with the "kubernetes.io/kube-apiserver-client" signerName), or to obtain certificates from custom non-Kubernetes signers.apiVersion: certificates.k8s.io/v1kind: CertificateSigningRequestmetadata (ObjectMeta)spec (CertificateSigningRequestSpec), requiredspec contains the certificate request, and is immutable after creation. Only the request, signerName, expirationSeconds, and usages fields can be set on creation. Other fields are derived by Kubernetes and cannot be modified by users.status (CertificateSigningRequestStatus)status contains information about whether the request is approved or denied, and the certificate issued by the signer, or the failure condition indicating signer failure.CertificateSigningRequestSpecCertificateSigningRequestSpec contains the certificate request.request ([]byte), requiredAtomic: will be replaced during a mergerequest contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block. When serialized as JSON or YAML, the data is additionally base64-encoded.signerName (string), requiredsignerName indicates the requested signer, and is a qualified name.List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.Well-known Kubernetes signers are:"kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver. Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver. Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager."kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely. Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.M


Question: What is CertificateSigningRequest?

Answer: a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1   i m p o r t   " k 8 s . i o / a p i / c e r t i f i c a t e s / v 1 "


Question: What is CertificateSigningRequest?

Answer: C e r t i f i c a t e S i g n i n g R e q u e s t   o b j e c t s   p r o v i d e   a   m e c h a n i s m   t o   o b t a i n   x 5 0 9   c e r t i f i c a t e s   b y   s u b m i t t i n g   a   c e r t i f i c a t e   s i g n i n g   r e q u e s t ,   a n d   h a v i n g   i t   a s y n c h r o n o u s l y   a p p r o v e d   a n d   i s s u e d .   K u b e l e t s   u s e   t h i s   A P I   t o   o b t a i n :   c l i e n t   c e r t i f i c a t e s   t o   a u t h e n t i c a t e   t o   k u b e - a p i s e r v e r   ( w i t h   t h e   " k u b e r n e t e s . i o / k u b e - a p i s e r v e r - c l i e n t - k u b e l e t "   s i g n e r N a m e ) . s e r v i n g   c e r t i f i c a t e s   f o r   T L S   e n d p o i n t s   k u b e - a p i s e r v e r   c a n   c o n n e c t   t o   s e c u r e l y   ( w i t h   t h e   " k u b e r n e t e s . i o / k u b e l e t - s e r v i n g "   s i g n e r N a m e ) .   T h i s   A P I   c a n   b e   u s e d   t o   r e q u e s t   c l i e n t   c e r t i f i c a t e s   t o   a u t h e n t i c a t e   t o   k u b e - a p i s e r v e r   ( w i t h   t h e   " k u b e r n e t e s . i o / k u b e - a p i s e r v e r - c l i e n t "   s i g n e r N a m e ) ,   o r   t o   o b t a i n   c e r t i f i c a t e s   f r o m   c u s t o m   n o n - K u b e r n e t e s   s i g n e r s .   a p i V e r s i o n :   c e r t i f i c a t e s . k 8 s . i o / v 1 k i n d :   C e r t i f i c a t e S i g n i n g R e q u e s t m e t a d a t a   ( O b j e c t M e t a ) s p e c   ( C e r t i f i c a t e S i g n i n g R e q u e s t S p e c ) ,   r e q u i r e d s p e c   c o n t a i n s   t h e   c e r t i f i c a t e   r e q u e s t ,   a n d   i s   i m m u t a b l e   a f t e r   c r e a t i o n .   O n l y   t h e   r e q u e s t ,   s i g n e r N a m e ,   e x p i r a t i o n S e c o n d s ,   a n d   u s a g e s   f i e l d s   c a n   b e   s e t   o n   c r e a t i o n .   O t h e r   f i e l d s   a r e   d e r i v e d   b y   K u b